Virus Name: Violite
V Status: New
Discovered: January, 1993
Symptoms: .COM file growth; file date/time seconds = 56; message
Origin: North America
Eff Length: 988 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: IBMAV, AVTK, F-Prot, ViruScan, ChAV,
Sweep, NAV, NAVDX, VAlert, PCScan,
LProt, NShld, NProt, AVTK/N, NAV/N, Sweep/N,
Removal Instructions: Delete infected files
The Violite virus was submitted in January, 1993, and is from North
America, probably the United States. Violite is based on the
Violator virus, and like Violator, is a non-resident, direct action
infector of .COM programs, including COMMAND.COM.
When a program infected with the Violite virus is executed, the
Violite virus will infect one .COM program located in the current
directory, though it will not infect very small .COM programs. If
a suitable uninfected .COM program cannot be found in the current
directory, the virus will then search the system path for a suitable
candidate .COM program to infect.
Programs infected with the Violite virus will have a file length
increase of 988 bytes with the virus being located at the end of the
file. The program's date and time in the DOS disk directory listing
will appear not to be altered, though the seconds field of the file
time will have been set to "56". The following text strings can be
found within the viral code in all Violite infected programs:
"Vio-Lite, TAA, Virulent Graffiti, (k) 1992"
The Violite virus maintains a counter within its viral code which
is intended to be the generation number of the particular infection
of the virus. Once this counter reaches a value of 10, the virus
may display the first text message above as a message.