Vor Virus

Virus Name: Vor Aliases: Vor.1536.A V Status: New Discovered: July, 1995 Symptoms: .COM & .EXE growth; decrease in total available memory Origin: Unknown Eff Length: 1,536 Bytes Type Code: PRhA - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, AVTK, VAlert, Sweep, ViruScan, IBMAV, NAV, NAVDX, ChAV, Sweep/N, NShld, IBMAV/N, AVTK/N, NAV/N, LProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Vor or Vor.1536.A virus was received in July, 1995. Its origin or point of isolation is unknown. Vor is a memory resident fast infector of .COM and .EXE files, including COMMAND.COM. It does not infect very small .COM files. When the first Vor infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Total available memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 5,248 bytes. Interrupts 17 and 21 will be hooked by the virus in memory. Once the Vor virus is memory resident, it will infect .COM and .EXE files, including COMMAND.COM, when they are executed or opened. Programs infected with the Vor virus will have a file length increase of 1,536 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code. It is unknown what the Vor virus may do besides replicate. Known variant(s) of Vor are: Vor.1536.B: Also received in July, 1995, this is a minor variant of the Vor virus described above. It hooks interrupt 13, as well as 17 and 21 when it becomes memory resident. Origin: Unknown July, 1995. Vor.1536.C: Also received in July, 1995, this is a very minor variant of Vor.1536.B. Origin: Unknown July, 1995. Vor.1584: Also received in July, 1995, this is a 1,584 byte variant of the Vor virus described above. Its size in memory is 5,296 bytes, hooking interrupts 13 and 21. It adds 1,584 bytes to the files it infects on execution and open, but not upon copying. The virus will be located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. Origin: Unknown July, 1995.