Vivat Virus

Virus Name: Vivat Aliases: V Status: New Discovered: January, 1995 Symptoms: .COM & .EXE file growth; decrease in available free memory; message Origin: USSR Eff Length: 9,382 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: AVTK, IBMAV, Sweep, F-Prot, ViruScan, NAV, ChAV, NAVDX, VAlert, PCScan, NProt, AVTK/N, Sweep/N, IBMAV/N, NShld, NAV/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Vivat virus was received in January, 1995. Information received with the virus indicated that it is from the USSR. Vivat is a memory resident fast infector of primarily .COM files, including COMMAND.COM, though it will also occassionally infect .EXE files. When the first Vivat infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupts 9, 21, and 28. Available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 82,912 bytes while total system memory will not be altered. Once the Vivat virus is memory resident, it will infect .COM files, and occassionally .EXE files, when they are executed or opened. It does not infect programs when they are copied. Infected programs will have a file length increase of 9,382 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected files: "VIVAT EGOR LETOV !!! -989" "NEVOR FREE," "NEVOR ME." "SO I DUB THEE" "UNFORGIVON" The first text string occurs near the beginning of all infected .COM files, but not within infected .EXE files. The remaining four lines of text may be displayed by the virus as a message. Other text strings also occur within the viral code, but they may also occur within some disk utilities and are not repeated here.