Twin-351 Virus

Virus Name: Twin-351 Aliases: COM 351, Twin V Status: Rare Discovered: July, 1991 Symptoms: .COM files created with system & hidden attributes; TSR Origin: Europe Eff Length: 351 Bytes Type Code: SRsA - Spawning Resident .COM/.EXE Infector Detection Method: ViruScan, Sweep, AVTK, NAV, F-Prot, IBMAV, NAVDX, VAlert, PCScan, ChAV, LProt, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete hidden infected files General Comments: The Twin-351 virus was isolated in Europe in July, 1991. Twin-351 is a memory resident spawning virus. It infects .EXE files by creating a corresponding .COM file which DOS will execute in place of the .EXE program. The first time a program infected with Twin-351 is executed, Twin-351 will install itself memory resident as a low system memory TSR of 656 bytes. Interrupt 21 will be hooked by the virus. Once memory resident, Twin-351 will infect .EXE files when they are executed. Instead of altering the .EXE file, Twin-351 creates a 351 byte .COM file with a file name which corresponds to the file name of the .EXE file. For example, if the user was attempting to execute ABC.EXE, Twin-351 will create ABC.COM which contains its viral code. The 351 byte .COM files created by the virus will have the hidden and system attributes set so that the files are not visible in the disk directory listing. As a result of the hidden .COM files, when the user attempts to execute a .EXE file, the Twin-351 .COM file will be executed first. If Twin-351 is already memory resident, it will then execute the corresponding .EXE file. If Twin-351 wasn't already resident, it will become resident. Twin-351 will hide the hidden files if the user attempts to execute an anti-viral program with Twin-351 in memory.