Ugur Virus

 Virus Name:  Ugur 
 Aliases:     Mumcu 
 V Status:    New 
 Discovered:  July, 1993 
 Symptoms:    .COM & .EXE growth; 
              decrease in total system & available free memory 
 Origin:      Turkey 
 Eff Length:  1,297 - 1,313 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  F-Prot, AVTK, Sweep, ViruScan, IBMAV, NAVDX, 
                    NAV, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N, 
 Removal Instructions:  Delete infected Files 
 General Comments: 
       The Ugur virus was isolated in Turkey in July, 1993.  Ugur is a 
       memory resident infector of .COM and .EXE programs, including 
       COMMAND.COM.  It "commemorates" turkish journalist Ugur Mumcu whom 
       passed away in early 1993. 
       When they first Ugur infected program is executed, the Ugur virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, hooking interrupt 21.  Total system 
       and available free memory, as indicated by the DOS CHKDSK program, 
       will not be altered.  Interrupt 12's return will not be moved. 
       Once the Ugur virus is memory resident, it will infect .COM and 
       .EXE programs, including COMMAND.COM, when they are executed or 
       opened for any reason.  .COM programs infected with the Ugur virus 
       will have a file length increase of 1,297 bytes.  .EXE programs will 
       increase in size by 1,301 to 1,313 bytes.  In both cases, the virus 
       will be located at the end of the file.  The program's date and time 
       in the DOS disk directory listing will not be altered.  The following 
       text string is visible within the viral code in all Ugur infected 
               "UGUR MUMCU ”LMEDi.." 
       This turkish phrase translates roughly to: 
               "Ugur Mumcu has not died" 

Show viruses from discovered during that infect .

Main Page