Virus Name: Voice-1495
V Status: New
Discovered: October, 1993
Symptoms: .COM & .EXE growth; TSR; file date/time changes;
Eff Length: 1,495 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, AVTK, NAV, Sweep, ViruScan, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
AVTK/N, Sweep/N, NAV/N, NShld, IBMAV/N, Innoc, LProt
Removal Instructions: Delete infected files
The Voice-1495 virus was submitted in October, 1993. Its origin or
point of isolation is unknown. Voice-1495 is a memory resident
infector of .COM and .EXE programs, but not COMMAND.COM.
When the first Voice-1495 infected program is executed, this virus
will install itself memory resident as a low system memory TSR.
Interrupt 21 will be hooked by the virus in memory. The system
hard disk will also be accessed at this time, and the system user
may notice a scraping sound coming from the system.
Once the Voice-1495 virus is memory resident, it will infect .COM
and .EXE programs located in the C: drive root directory when they are
executed. Infected programs will have a file length increase of
1,495 bytes with the virus being located at the end of the file.
This virus is unable to determine when it has previously infected
a file, so it will reinfect previously infected programs.
Each reinfection adds an additional 1,495 bytes to the file. The
file's date and time in the DOS disk directory listing will have
been updated to the current system date and time when the last
infection of the file occurred. The following text string can be
found within the viral code in all Voice-1495 infected programs:
The following text string is encrypted within the viral code, and
is thus not visible within infected files:
System hangs frequently occur when programs are executed on infected