Violite Virus

Virus Name: Violite Aliases: V Status: New Discovered: January, 1993 Symptoms: .COM file growth; file date/time seconds = 56; message Origin: North America Eff Length: 988 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: IBMAV, AVTK, F-Prot, ViruScan, ChAV, Sweep, NAV, NAVDX, VAlert, PCScan, LProt, NShld, NProt, AVTK/N, NAV/N, Sweep/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Violite virus was submitted in January, 1993, and is from North America, probably the United States. Violite is based on the Violator virus, and like Violator, is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Violite virus is executed, the Violite virus will infect one .COM program located in the current directory, though it will not infect very small .COM programs. If a suitable uninfected .COM program cannot be found in the current directory, the virus will then search the system path for a suitable candidate .COM program to infect. Programs infected with the Violite virus will have a file length increase of 988 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will appear not to be altered, though the seconds field of the file time will have been set to "56". The following text strings can be found within the viral code in all Violite infected programs: "Vio-Lite, TAA, Virulent Graffiti, (k) 1992" "PATH=*.COM" "????????COM" The Violite virus maintains a counter within its viral code which is intended to be the generation number of the particular infection of the virus. Once this counter reaches a value of 10, the virus may display the first text message above as a message. See: Violator