Ugur Virus

Virus Name: Ugur Aliases: Mumcu V Status: New Discovered: July, 1993 Symptoms: .COM & .EXE growth; decrease in total system & available free memory Origin: Turkey Eff Length: 1,297 - 1,313 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, AVTK, Sweep, ViruScan, IBMAV, NAVDX, NAV, VAlert, PCScan, ChAV, NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N, LProt Removal Instructions: Delete infected Files General Comments: The Ugur virus was isolated in Turkey in July, 1993. Ugur is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. It "commemorates" turkish journalist Ugur Mumcu whom passed away in early 1993. When they first Ugur infected program is executed, the Ugur virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will not be altered. Interrupt 12's return will not be moved. Once the Ugur virus is memory resident, it will infect .COM and .EXE programs, including COMMAND.COM, when they are executed or opened for any reason. .COM programs infected with the Ugur virus will have a file length increase of 1,297 bytes. .EXE programs will increase in size by 1,301 to 1,313 bytes. In both cases, the virus will be located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code in all Ugur infected programs: "UGUR MUMCU ”LMEDi.." This turkish phrase translates roughly to: "Ugur Mumcu has not died"