Virus Name: Viking
V Status: New
Discovered: February, 1995
Symptoms: .COM & .EXE growth; TSR; system hangs
Eff Length: 1,350 - 1,566 Bytes (Approx)
Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, ViruScan, AVTK, IBMAV, Sweep, NAV, NAVDX,
VAlert, PCScan, ChAV,
NShld, Innoc, NProt, IBMAV/N, AVTK/N, Sweep/N, NAV/N,
Removal Instructions: Delete infected files
The Viking or Viking.Dec3 virus was received in February, 1995. Its
origin or point of isolation is unknown. Viking is a memory
resident infector of .COM and .EXE files, including COMMAND.COM.
When the first Viking infected program is executed, the Viking
virus will install itself memory resident as a low system memory
TSR of 5,136 bytes. Interrupt 21 will be hooked by the virus in
memory. The boot copy of COMMAND.COM will become infected by the
virus if it was not previously infected. A system hang may occur at
this time if the virus is attempting to become memory resident from
other than the boot copy of COMMAND.COM.
Once the Viking virus is memory resident, it will infect .COM and
.EXE files when they are executed, opened, or a DOS Dir command is
issued. Infected files will have a file length increase of 1,350
to 1,566 bytes with the virus being located at the end of the file.
The program's date and time in the DOS disk directory listing will
not be altered. The following text string is encrypted within the
"*.COM *.EXE Dec 3 92 is my 20th birthday (V6)"
It is unknown what the Viking virus does besides replicate.