Virus Name: Violetta
V Status: Common - Germany
Discovered: January, 1992
Symptoms: .COM file growth; TSR
Eff Length: 3,840 - 7,678 Bytes
Type Code: PRsC - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, ChAV,
IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Violetta virus was discovered in Germany in January, 1992. It
was reported to be widespread in Germany at the time of its
isolation. Violetta is a memory resident infector of .COM files,
but does not infect COMMAND.COM.
The first time a program infected with Violetta is executed, the
Violetta virus will install itself memory resident as a low system
memory TSR of 8,256 Bytes. Interrupts 21, CC, CE, F1, F7, and F8
will be hooked.
Once the Violetta virus is memory resident, it will infect .COM
programs when they are executed. Programs infected with the
Violetta virus will normally have a file length increase of
3,840 bytes. However, if the program's pre-infection file length
was less than 3,840 bytes, the program's infected file length will
be 7,680 bytes. In either case the virus will be located at the
beginning of the infected program. There will be no change to the
file's date and time in the DOS disk directory listing.
The following text strings will appear within the viral code in
Violetta infected programs:
It is unknown if Violetta does anything besides replicate.
Known variant(s) of Violetta are:
Violetta-1024: Violetta-1024 is a smaller version of the
Violetta virus. Its memory resident TSR is 4,432
bytes in length, and hooks interrupt 21. Violetta-
1024 infects .COM programs when they are executed.
Infected .COM programs will have a file length
increase of 1,024 bytes with the virus being located
at the beginning of the file. .COM programs which
were originally smaller than 1,024 bytes in length
will become 2,048 bytes in length when infected by
Violetta-1024. The program's date and time in the
DOS disk directory listing will have been updated to
the current system date and time when infection
occurred. The following text strings can be found
within the viral code in Violetta-1024 infected
"Greetings to Cracker Jack..."
"Loving thoughts to Shirley..."
"Marty McFly lives somewhere in time."
"Kill Eddie. Kill Diana. Kill Fredo."
Origin: Unknown June, 1992