Virus Name: Voronezh-370
V Status: Rare
Discovered: November, 1991
Symptoms: .COM file growth; TSR; file date/time change
Eff Length: 370 Bytes
Type Code: PRsCK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, Sweep, AVTK, F-Prot, NAVDX,
NAV, IBMAV, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The Voronezh-370 virus was received in November, 1991 from Europe.
Its origin is unknown. Voronezh-370 is a memory resident infector
of .COM programs. It does not infect COMMAND.COM.
The first time a program infected with Voronezh-370 is executed,
this virus will install itself memory resident as a low system
memory TSR of 1,712 bytes. It will have hooked interrupt 21.
Once Voronezh-370 is memory resident, it will infect .COM programs
other than COMMAND.COM when they are executed. Infected programs
will have a file size increase of 370 bytes with the virus being
located at the beginning of the file. The program's date and time
in the DOS disk directory will have been updated to the current
system date and time when infection occurred.
It is unknown if Voronezh-370 does anything besides replicate.
See: Voronezh Voronezh-Chemist