Walker Virus

 Virus Name:  Walker 
 V Status:    Rare 
 Discovered:  September, 1992 
 Symptoms:    .COM & .EXE growth; decrease in total system & available free 
              memory; man walks across screen intermittenly 
 Origin:      Turkey 
 Eff Length:  3,846 - 3,861 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  Sweep, ViruScan, AVTK, F-Prot, IBMAV, NAVDX, 
                    NAV, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, NAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Walker virus was submitted in September, 1992.  It is originally 
       from Turkey.  Walker is a memory resident infector of .COM and .EXE 
       programs, including COMMAND.COM. 
       When the first Walker infected program is executed, the Walker virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary.  Total system and available free 
       memory, as indicated by the DOS CHKDSK program, will have decreased 
       by 12,304 bytes.  Interrupts 16 and 21 will be hooked by the virus. 
       Once the virus is memory resident, it will infect .COM and .EXE 
       programs, including COMMAND.COM, when they are executed.  Infected 
       programs will have a file length increase of 3,846 to 3,861 bytes 
       with the virus being located at the end of the file.  The program's 
       date and time in the DOS disk directory listing will not be 
       altered.  The following text strings are visible within the Walker 
       viral code in infected programs: 
               "WALKER V1.00 - This absolutely harmless and self 
                destructive program is written by UJHPTTLZ in the 
                city of Istanbul, 1992" 
       The Walker virus activates after it has been memory resident for 
       a few minutes, at which time a colorful ASCII block graphic man 
       approximately 20 lines tall will walk from right to left across 
       the system display.  The graphic man walks across the display 
       every few seconds.  When the graphic man walks across the screen, 
       keyboard input will be suspended until he goes off the screen. 

Show viruses from discovered during that infect .

Main Page