Vivat Virus

 Virus Name:  Vivat  
 V Status:    New 
 Discovered:  January, 1995 
 Symptoms:    .COM & .EXE file growth; decrease in available free memory; 
 Origin:      USSR 
 Eff Length:  9,382 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  AVTK, IBMAV, Sweep, F-Prot, ViruScan, NAV, ChAV, 
                    NAVDX, VAlert, PCScan, 
                    NProt, AVTK/N, Sweep/N, IBMAV/N, NShld, NAV/N, Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Vivat virus was received in January, 1995.  Information received 
       with the virus indicated that it is from the USSR.  Vivat is a 
       memory resident fast infector of primarily .COM files, including 
       COMMAND.COM, though it will also occassionally infect .EXE files. 
       When the first Vivat infected program is executed, this virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary, hooking interrupts 9, 21, and 28.  Available 
       free memory, as indicated by the DOS CHKDSK program from DOS 5.0, 
       will have decreased by 82,912 bytes while total system memory will 
       not be altered. 
       Once the Vivat virus is memory resident, it will infect .COM files, 
       and occassionally .EXE files, when they are executed or opened.  It 
       does not infect programs when they are copied.  Infected programs 
       will have a file length increase of 9,382 bytes with the virus 
       being located at the end of the file.  The program's date and time 
       in the DOS disk directory listing will not be altered.  The following 
       text strings are visible within the viral code in all infected files: 
               "VIVAT EGOR LETOV !!! -989" 
               "NEVOR FREE," 
               "NEVOR ME." 
               "SO I DUB THEE" 
       The first text string occurs near the beginning of all infected .COM 
       files, but not within infected .EXE files.  The remaining four lines 
       of text may be displayed by the virus as a message. 
       Other text strings also occur within the viral code, but they may 
       also occur within some disk utilities and are not repeated here. 

Show viruses from discovered during that infect .

Main Page