V-1n Virus

Virus Name: V-1n Aliases: V-10, V-11 V Status: Viron Discovered: May, 1992 Symptoms: .COM files overwritten; program corruption; file date/time changes Origin: Unknown Eff Length: 113 or 624 Bytes (Overwriting) Type Code: ONCK - Overwriting Non-Resident .COM Infector Detection Method: ViruScan, NAV, NAVDX, AVTK 7.68+, NShld, NAV/N, AVTK/N 7.68+ Removal Instructions: Delete infected files General Comments: The V-1n group of viruses was received in May, 1992. This group's origin is unknown. The viruses in this entry are earlier versions of the viruses described in the V-3n entry. Unlike the viruses described in the V-3n entry, the viruses described here are overwriting viruses. The earliest of the viruses, V-10, is described in this entry, with the other member of the group described below. Both of the viruses in this entry infect .COM files, including COMMAND.COM. When a program infected with the V-10 virus is executed, this virus will infect the third .COM file located in the current directory, overwriting the first 624 bytes of the program. The user will then be returned to the DOS prompt. Besides having the first 624 bytes of the host program overwritten with the viral code of the V-10 virus, infected programs will also have their date and time in the DOS disk directory listing updated to the system date and time when infection occurred. If the host program was originally smaller than 628 bytes, it will become 628 bytes in length. Programs larger than 628 bytes in length will have no file length increase. The following text strings can be found within V-10 infected programs: "*.COM" "????????COM" "V - Version 1.0" V-10 doesn't do anything besides replicate, destroying the host programs it infects. Other Member(s) of the V-1n group of viruses are: V-11: A later version of the V-10 virus described above, this virus overwrites the first 113 bytes of the .COM programs it infects. The text strings within the virus have been changed to: "*.COM "V - Version 1.1". Origin: Unknown May, 1992. See: V-3n