Virus Name: Ugur
V Status: New
Discovered: July, 1993
Symptoms: .COM & .EXE growth;
decrease in total system & available free memory
Eff Length: 1,297 - 1,313 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, AVTK, Sweep, ViruScan, IBMAV, NAVDX,
NAV, VAlert, PCScan, ChAV,
NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N,
Removal Instructions: Delete infected Files
The Ugur virus was isolated in Turkey in July, 1993. Ugur is a
memory resident infector of .COM and .EXE programs, including
COMMAND.COM. It "commemorates" turkish journalist Ugur Mumcu whom
passed away in early 1993.
When they first Ugur infected program is executed, the Ugur virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, hooking interrupt 21. Total system
and available free memory, as indicated by the DOS CHKDSK program,
will not be altered. Interrupt 12's return will not be moved.
Once the Ugur virus is memory resident, it will infect .COM and
.EXE programs, including COMMAND.COM, when they are executed or
opened for any reason. .COM programs infected with the Ugur virus
will have a file length increase of 1,297 bytes. .EXE programs will
increase in size by 1,301 to 1,313 bytes. In both cases, the virus
will be located at the end of the file. The program's date and time
in the DOS disk directory listing will not be altered. The following
text string is visible within the viral code in all Ugur infected
"UGUR MUMCU ”LMEDi.."
This turkish phrase translates roughly to:
"Ugur Mumcu has not died"