Vivaldi Virus

Virus Name: Vivaldi Aliases: Hs V Status: Rare Discovered: February, 1992 Symptoms: .EXE file growth; TSR Origin: Unknown Eff Length: 4,102 - 4,112 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: Sweep, ViruScan, F-Prot, AVTK, IBMAV, ChAV, NAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Vivaldi virus was submitted in February, 1992. Its origin, or point of original isolation, are unknown. Vivaldi is a memory resident infector of .EXE programs. The first time a program infected with the Vivaldi virus is executed, the Vivaldi virus will install itself memory resident as a low system memory TSR of 4,160 bytes. Interrupts 21 and CC will be hooked by Vivaldi in memory. Once the Vivaldi virus is memory resident, it will infect .EXE programs when they are executed. Infected programs will have a file length increase of 4,102 to 4,112 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. One text string can be found in the viral code in Vivaldi infected programs: "VIVALDI" It is unknown what Vivaldi does besides replicate.