Atas Virus

Virus Name: Atas Aliases: Atas-384 V Status: Rare Discovery: August, 1992 Symptoms: .COM file growth; file date/time changes Origin: Poland Eff Length: 384 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, Sweep, AVTK, IBMAV, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, Innoc, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Atas virus was received in August, 1992. It is originally from Poland. Atas is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Atas virus is executed, the Atas virus will infect one previously uninfected .COM program located in the current directory. The newly infected program will have a file length increase of 384 bytes with the virus being located at the end of the infected program. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings are contained in the Atas viral code, though they are not visible in infected programs as they are encrypted: "*.COM Ok." "ATAS V0.1 Cr.24.01.92" Systems with advanced infections of Atas may notice that "Ok" will occassionally be displayed when .COM programs are executed. The display of "Ok" usually occurs when the virus infects a .COM program. Known variant(s) of the Atas virus are: Atas-400: Also received in August, 1992, Atas-400 is a 400 byte variant of the Atas virus described above. It adds 400 bytes to the end of the .COM programs it infects. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings are encrypted within the viral code: "*.COM I like to travel..." "ATAS(Kiev) V3.03 Cr.91.10.11" Origin: Poland August, 1992. See: Atas II