Virus Name: UFA-1201
V Status: Rare
Discovered: December, 1992
Symptoms: .COM file growth
Eff Length: 1,201 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: AVTK, IBMAV, Sweep, F-Prot, ViruScan,
NAV, NAVDX, VAlert, PCScan, ChAV,
Sweep/N, NShld, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N,
Removal Instructions: Delete infected Files
The UFA-1201 virus was submitted in December, 1992, and is originally
from the USSR. UFA-1201 is a non-resident, direct action infector of
.COM programs, including COMMAND.COM.
When a program infected with the UFA-1201 virus is executed, the
UFA-1201 virus will infect two .COM programs located in the current
directory. Infected programs will have a file length increase of
1,201 bytes with the virus being located at the end of the file.
The program's date and time in the DOS disk directory listing will
not be altered. The following text string is encrypted within the
UFA-1201 viral code:
It is unknown what UFA-1201 may do besides replicate.