Violetta Virus


 Virus Name:  Violetta 
 Aliases:    
 V Status:    Common - Germany 
 Discovered:  January, 1992 
 Symptoms:    .COM file growth; TSR 
 Origin:      Germany 
 Eff Length:  3,840 - 7,678 Bytes 
 Type Code:   PRsC - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, NAV, ChAV, 
                    IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Violetta virus was discovered in Germany in January, 1992.  It 
       was reported to be widespread in Germany at the time of its 
       isolation.  Violetta is a memory resident infector of .COM files, 
       but does not infect COMMAND.COM. 
 
       The first time a program infected with Violetta is executed, the 
       Violetta virus will install itself memory resident as a low system 
       memory TSR of 8,256 Bytes.  Interrupts 21, CC, CE, F1, F7, and F8 
       will be hooked. 
 
       Once the Violetta virus is memory resident, it will infect .COM 
       programs when they are executed.  Programs infected with the 
       Violetta virus will normally have a file length increase of 
       3,840 bytes.  However, if the program's pre-infection file length 
       was less than 3,840 bytes, the program's infected file length will 
       be 7,680 bytes.  In either case the virus will be located at the 
       beginning of the infected program.  There will be no change to the 
       file's date and time in the DOS disk directory listing. 
 
       The following text strings will appear within the viral code in 
       Violetta infected programs: 
 
               "VIOLETTA" 
               "Version 4.00" 
 
       It is unknown if Violetta does anything besides replicate.  
 
       Known variant(s) of Violetta are: 
       Violetta-1024: Violetta-1024 is a smaller version of the 
                      Violetta virus.  Its memory resident TSR is 4,432 
                      bytes in length, and hooks interrupt 21.  Violetta- 
                      1024 infects .COM programs when they are executed. 
                      Infected .COM programs will have a file length 
                      increase of 1,024 bytes with the virus being located 
                      at the beginning of the file.  .COM programs which 
                      were originally smaller than 1,024 bytes in length 
                      will become 2,048 bytes in length when infected by 
                      Violetta-1024.  The program's date and time in the 
                      DOS disk directory listing will have been updated to 
                      the current system date and time when infection 
                      occurred.  The following text strings can be found 
                      within the viral code in Violetta-1024 infected 
                      programs: 
                      "Greetings to Cracker Jack..." 
                      "Loving thoughts to Shirley..." 
                      "Marty McFly lives somewhere in time." 
                      "Kill Eddie. Kill Diana. Kill Fredo." 
                      Origin:  Unknown  June, 1992 

Show viruses from discovered during that infect .

Main Page