Virus Name: Atas
V Status: Rare
Discovery: August, 1992
Symptoms: .COM file growth; file date/time changes
Eff Length: 384 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, Sweep, AVTK, IBMAV, ViruScan, NAV,
NAVDX, VAlert, PCScan, ChAV,
Sweep/N, NShld, Innoc, AVTK/N, NAV/N, IBMAV/N, LProt
Removal Instructions: Delete infected files
The Atas virus was received in August, 1992. It is originally from
Poland. Atas is a non-resident, direct action infector of .COM
programs, including COMMAND.COM.
When a program infected with the Atas virus is executed, the Atas
virus will infect one previously uninfected .COM program located in
the current directory. The newly infected program will have a file
length increase of 384 bytes with the virus being located at the
end of the infected program. The file's date and time in the DOS
disk directory listing will have been updated to the current system
date and time when infection occurred.
The following text strings are contained in the Atas viral code,
though they are not visible in infected programs as they are
"ATAS V0.1 Cr.24.01.92"
Systems with advanced infections of Atas may notice that "Ok" will
occassionally be displayed when .COM programs are executed. The
display of "Ok" usually occurs when the virus infects a .COM
Known variant(s) of the Atas virus are:
Atas-400: Also received in August, 1992, Atas-400 is a 400 byte
variant of the Atas virus described above. It adds 400
bytes to the end of the .COM programs it infects. The
program's date and time in the DOS disk directory listing
will have been updated to the current system date and time
when infection occurred. The following text strings are
encrypted within the viral code:
"*.COM I like to travel..."
"ATAS(Kiev) V3.03 Cr.91.10.11"
Origin: Poland August, 1992.
See: Atas II