Vicious Virus

 Virus Name:  Vicious 
 Aliases:     Vicious.918 
 V Status:    New 
 Discovered:  October, 1994 
 Symptoms:    .COM & .EXE growth; file date/time seconds = "40"; 
              decrease in total system & available free memory 
 Origin:      Sweden 
 Eff Length:  918 or 943 Bytes 
 Type Code:   PRAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, ViruScan, Sweep, NAV, 
                    NAVDX, VAlert, PCScan, 
                    AVTK/N, Sweep/N, IBMAV/N, NShld, NAV/N, LProt 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Vicious or Vicious.918 virus was received in October, 1994 and 
       appears to be from Sweden.  Vicious is a memory resident fast 
       infector of .COM and .EXE programs, including COMMAND.COM. 
       When the first Vicious infected program is executed, this virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary, not moving interrupt 12's return.  Total system 
       and available free memory, as indicated by the DOS CHKDSK program, 
       will have decreased by 2,016 bytes.  Interrupt 21 will be hooked by 
       the virus in memory. 
       Once the Vicious virus is memory resident, it will infect .COM and 
       .EXE programs when they are executed, opened, copied, or when a DOS 
       DIR command is issued.  Infected .COM programs will have a file length 
       increase of 918 bytes while infected .EXE programs will increase in 
       size by 943 bytes.  In both cases the virus will be located at the 
       end of the file.  The program's date and time in the DOS disk 
       directory listing will not appear to be altered, though the seconds 
       field will have been set to "40".  The following text strings are 
       encrypted within the viral code: 
               "*.COM *.EXE" 
               "[Vicious!] MnemoniX" 

Show viruses from discovered during that infect .

Main Page