Virus Name: Vampire
V Status: Viron
Discovered: July, 1994
Symptoms: .COM file corruption; message; file date/time changes
Eff Length: 417 Bytes Overwriting
Type Code: ONCK - Overwriting Non-Resident .COM Infector
Detection Method: ViruScan, NAV, NAVDX, AVTK 7.68+,
NShld, NAV/N, AVTK/N 7.68+
Removal Instructions: Delete infected files
The Vampire virus was received in July, 1994. Its origin or point of
isolation is unknown. Vampire is a non-resident, direct action
overwriting virus which infects .COM files, including COMMAND.COM.
When a program infected with the Vampire virus is executed, this virus
will infect one .COM file located in the current directory. Infected
programs will have the first 417 bytes overwritten by the viral code.
The program's date and time in the DOS disk directory listing will
have been updated to the current system date and time when infection
occurred. The following text strings are visible within the viral
code in all infected files:
"[Vampire] [DS] [OEC-G001] NJ Memory stack overflow."
"Program too big to fit into memory."
Execution of infected programs will also usually result in the
third message above being displayed, and the user returned to the