Unk Virus

Virus Name: Unk Aliases: V Status: Rare Discovered: March, 1992 Symptoms: .COM & .EXE growth; decrease in total system and available free memory; file date/times corrupted Origin: Unknown Eff Length: 1,015 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, Sweep, IBMAV, ChAV, NAV, F-Prot, NAVDX, VAlert, PCScan, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected Files General Comments: The Unk virus was received in April, 1992. Its origin and point of isolation are unknown. Unk is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. When the first Unk infected program is executed, the Unk virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 3,008 bytes. Interrupt 21 will be hooked. Once the Unk virus is memory resident, it will infect .COM and .EXE programs when they are executed or opened for any reason. The virus hides the file length increase on infected files, so it is not noticeable to the system user. Programs infected with the Unk virus will have a file length increase of 1,015 bytes with the virus being located at the end of the infected file. This virus will occassionally reinfect previously infected programs, adding an additional 1,015 bytes. The file's date and time in the DOS disk directory may appear to be corrupted. One text string can be found within the viral code in Unk infected programs: "(c) 1991 Szegedi & Farmosi Kiss." It is unknown what Unk does besides replicate.