V651 Virus


 Virus Name:  V651 
 Aliases:     Eddie 3, Stealth Virus, Dark Avenger 2 
 V Status:    Rare 
 Discovered:  April, 1990 
 Symptoms:    .COM & .EXE growth; decrease in system and free memory; file 
              allocation errors 
 Origin:      Sofia, Bulgaria 
 Eff Length:  651 Bytes 
 Type Code:   PRtA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, NAV, AVTK, F-Prot, Sweep, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The V651, or Eddie 3, virus was isolated in Sofia, Bulgaria in 
       April 1990 by Vesselin Bontchev.  V651 is believed to have been 
       written by the same author as Dark Avenger, V1024, and V2000. This 
       virus is a generic infector for .COM and .EXE files. 
 
       The first time a program infected with V651 is executed, the virus 
       will install itself memory resident.  Using the DOS CHKDSK program, 
       total system memory, as well as available free memory, will be 
       decreased by 688 bytes. 
 
       Later, as programs with a length of 651 bytes or greater are 
       executed, they will be infected by the virus.  Infected files 
       increase in length by 651 bytes, though the increase in file length 
       will not be seen by performing a directory command with the virus 
       present in memory. The total available disk space will also be 
       adjusted by the virus so that the decrease in available disk space 
       due to the virus's activities cannot be seen.  Powering off the 
       system and booting from a known clean boot diskette, followed by 
       issuing a directory command will result in the correct infected 
       file lengths being displayed as well as the actual available space 
       on the disk. 
 
       Infected files can be easily identified as the text string "Eddie 
       Lives." appears near the end of the infected file.  These files 
       will also be 651 bytes longer than expected when the virus is not 
       present in memory. 
 
       A side effect of the V651 virus is that lost clusters may occur on 
       infected systems if the CHKDSK /F command is used.  While this does 
       not occur for all infected files, the number of errors reported by 
       CHKDSK will be much higher statistically when V651 is present. 
 
       Unlike Dark Avenger and V2000, this virus does not infect files on 
       any file open.  It only infects when programs are executed. 
 
       See:   Alfa   Dark Avenger   V1024   V2000 

Show viruses from discovered during that infect .

Main Page