Virus Name: Unsnared
V Status: In the wild
Discovered: July, 1996
Symptoms: .EXE file growth; file date/time minutes = "13"; system hangs;
decrease in total system & available free memory
Eff Length: 814 Bytes
Type Code: PRtE - Parasitic Resident .EXE Infector
Detection Method: F-Prot, AVTK, IBMAV, ViruScan, PCScan, NAV, NAVDX,
Innoc, AVTK/N, IBMAV/N, NShld, NAV/N
Removal Instructions: Delete infected Files
The Unsnared virus was received in July, 1996 and has been reported
to be "in the wild". Its origin or point of isolation is unknown.
Unsnared is a memory resident infector of .EXE files.
When the first Unsnared infected program is executed, this virus
will install itself memory resident at the top of system memory
but below the 640K DOS boundary, moving interrupt 12's return.
Total system and available free memory, as indicated by the DOS
CHKDSK program from DOS 5.0, will have decreased by 1,024 bytes.
Interrupt 21 will be hooked by the virus in memory.
Once the Unsnared virus is memory resident, it will infect .EXE
files when they are executed. Infected files will have a file
length increase of 814 bytes with the virus being located at the
end of the file. The program's date in the DOS disk directory
listing will not be altered, but the minutes field in the time
will have been set to "13". No text strings are visible within
the viral code.
System hangs frequently occur on infected systems when .EXE files