Twin-351 Virus

 Virus Name:  Twin-351 
 Aliases:     COM 351, Twin 
 V Status:    Rare 
 Discovered:  July, 1991 
 Symptoms:    .COM files created with system & hidden attributes; TSR 
 Origin:      Europe 
 Eff Length:  351 Bytes 
 Type Code:   SRsA - Spawning Resident .COM/.EXE Infector 
 Detection Method:  ViruScan, Sweep, AVTK, NAV, F-Prot, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    LProt, NShld, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete hidden infected files 
 General Comments: 
       The Twin-351 virus was isolated in Europe in July, 1991.  Twin-351 
       is a memory resident spawning virus.  It infects .EXE files by 
       creating a corresponding .COM file which DOS will execute in place 
       of the .EXE program. 
       The first time a program infected with Twin-351 is executed, Twin-351 
       will install itself memory resident as a low system memory TSR of 
       656 bytes.  Interrupt 21 will be hooked by the virus. 
       Once memory resident, Twin-351 will infect .EXE files when they are 
       executed.  Instead of altering the .EXE file, Twin-351 creates a 
       351 byte .COM file with a file name which corresponds to the file 
       name of the .EXE file.  For example, if the user was attempting to 
       execute ABC.EXE, Twin-351 will create ABC.COM which contains its 
       viral code.  The 351 byte .COM files created by the virus will have 
       the hidden and system attributes set so that the files are not 
       visible in the disk directory listing. 
       As a result of the hidden .COM files, when the user attempts to 
       execute a .EXE file, the Twin-351 .COM file will be executed first. 
       If Twin-351 is already memory resident, it will then execute the 
       corresponding .EXE file.  If Twin-351 wasn't already resident, it 
       will become resident. 
       Twin-351 will hide the hidden files if the user attempts to execute 
       an anti-viral program with Twin-351 in memory. 

Show viruses from discovered during that infect .

Main Page