Virus Name: Urfydus
V Status: Rare
Discovered: May, 1992
Symptoms: .COM & .EXE growth; TSR
Eff Length: 2,638 - 2,653 Bytes
Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, IBMAV, ChAV,
AVTK, NAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, AVTK/N, NAV/N, IBMAV/N, Innoc, LProt
Removal Instructions: Delete infected Files
The Urfydus virus was isolated in Italy in May, 1992. This virus
is a memory resident infector of .COM and .EXE programs, including
COMMAND.COM, but not very small .COM and .EXE programs. Its name
is italian, and translates to "Nasty" in english.
The first time a program infected with Urfydus is executed, this
virus will install itself memory resident as a low system memory
TSR of 3,152 bytes, hooking interrupts 21, CC, and F8.
Once Urfydus is memory resident, it will infect .COM and .EXE
programs when they are executed. If the user attempts to execute
a program from a write protected diskette, the virus will attempt
to infect the program, resulting in the system hanging while it
attempts to write to the write protected diskette.
Programs infected with Urfydus will have a file length increase
of 2,638 to 2,653 bytes. The virus will be located at the end
of the infected file. The program's date and time in the DOS
disk directory listing will not have been altered. The following
text string can be found within the viral code in all infected
It is unknown what Urfydus does besides replicate.