Virus Name: V800
Aliases: Live after Death Virus
V Status: Rare
Discovered: May, 1990
Symptoms: .COM growth; decrease in total system and available memory
Eff Length: 800 Bytes
Type Code: PRC - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, NAV, AVTK, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N,
Removal Instructions: F-Prot, or delete infected files
The V800, or Live after Death, virus was isolated in Bulgaria by
Vesselin Bontchev in May, 1990. The V800 is a self-encrypting
memory resident .COM infector, and it does not infect COMMAND.COM.
This virus is thought to have been written by the same person as
the Dark Avenger virus since many of the same techniques are used.
The virus has received an alias of the Live after Death virus as
the virus contains the "Live after Death" string, though it cannot
be seen in infected files as the virus is encrypted.
The first time an infected program is run on a system, the V800
virus will install itself memory resident. In the process of
installing itself resident, it will decrease available system
memory by 16K, using 8,192 bytes for itself in the top of available
free memory. It will also hook interrupt 2A.
Once in memory, every time a .COM file is attempted to be executed,
the virus will check to see if it is a candidate for infection.
Whether the file will be infected depends on the size of the .COM
file when it is attempted to be executed. In no event is a .COM
file smaller than 1024 bytes infected, but not all .COM files over
1024 bytes are infected either.
The V800 virus will reinfect .COM files, with the file's size
increasing by 800 bytes with each infection. It does not, however,
infect .COM files more than eight times.
Known variant(s) of V800 are:
V800M: Very similar to V800, the major difference is that V800M
will infect files on both file open and file execute,
putting this variant into the "Stealth" virus category. When
the virus becomes memory resident, total system and free
memory will decrease by only 8,192 bytes. This variant does
not have the "Live after Death" string in it.