Viking Virus

 Virus Name:  Viking 
 Aliases:     Viking.Dec3 
 V Status:    New 
 Discovered:  February, 1995 
 Symptoms:    .COM & .EXE growth; TSR; system hangs 
 Origin:      Unknown 
 Eff Length:  1,350 - 1,566 Bytes (Approx) 
 Type Code:   PRsAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  F-Prot, ViruScan, AVTK, IBMAV, Sweep, NAV, NAVDX, 
                    VAlert, PCScan, ChAV, 
                    NShld, Innoc, NProt, IBMAV/N, AVTK/N, Sweep/N, NAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Viking or Viking.Dec3 virus was received in February, 1995.  Its 
       origin or point of isolation is unknown.  Viking is a memory 
       resident infector of .COM and .EXE files, including COMMAND.COM. 
       When the first Viking infected program is executed, the Viking 
       virus will install itself memory resident as a low system memory 
       TSR of 5,136 bytes.  Interrupt 21 will be hooked by the virus in 
       memory.  The boot copy of COMMAND.COM will become infected by the 
       virus if it was not previously infected.  A system hang may occur at 
       this time if the virus is attempting to become memory resident from 
       other than the boot copy of COMMAND.COM. 
       Once the Viking virus is memory resident, it will infect .COM and 
       .EXE files when they are executed, opened, or a DOS Dir command is 
       issued.  Infected files will have a file length increase of 1,350 
       to 1,566 bytes with the virus being located at the end of the file. 
       The program's date and time in the DOS disk directory listing will 
       not be altered.  The following text string is encrypted within the 
       viral code: 
               "*.COM *.EXE Dec 3 92 is my 20th birthday (V6)" 
       It is unknown what the Viking virus does besides replicate. 

Show viruses from discovered during that infect .

Main Page