Voice-1495 Virus

Virus Name: Voice-1495 Aliases: V Status: New Discovered: October, 1993 Symptoms: .COM & .EXE growth; TSR; file date/time changes; system hangs Origin: Unknown Eff Length: 1,495 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, AVTK, NAV, Sweep, ViruScan, IBMAV, NAVDX, VAlert, PCScan, ChAV, AVTK/N, Sweep/N, NAV/N, NShld, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The Voice-1495 virus was submitted in October, 1993. Its origin or point of isolation is unknown. Voice-1495 is a memory resident infector of .COM and .EXE programs, but not COMMAND.COM. When the first Voice-1495 infected program is executed, this virus will install itself memory resident as a low system memory TSR. Interrupt 21 will be hooked by the virus in memory. The system hard disk will also be accessed at this time, and the system user may notice a scraping sound coming from the system. Once the Voice-1495 virus is memory resident, it will infect .COM and .EXE programs located in the C: drive root directory when they are executed. Infected programs will have a file length increase of 1,495 bytes with the virus being located at the end of the file. This virus is unable to determine when it has previously infected a file, so it will reinfect previously infected programs. Each reinfection adds an additional 1,495 bytes to the file. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time when the last infection of the file occurred. The following text string can be found within the viral code in all Voice-1495 infected programs: "VOICE V1.01" The following text string is encrypted within the viral code, and is thus not visible within infected files: "C:\*.COM C:\*.EXE" System hangs frequently occur when programs are executed on infected systems.