Walker Virus

Virus Name: Walker Aliases: V Status: Rare Discovered: September, 1992 Symptoms: .COM & .EXE growth; decrease in total system & available free memory; man walks across screen intermittenly Origin: Turkey Eff Length: 3,846 - 3,861 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: Sweep, ViruScan, AVTK, F-Prot, IBMAV, NAVDX, NAV, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Walker virus was submitted in September, 1992. It is originally from Turkey. Walker is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. When the first Walker infected program is executed, the Walker virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 12,304 bytes. Interrupts 16 and 21 will be hooked by the virus. Once the virus is memory resident, it will infect .COM and .EXE programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 3,846 to 3,861 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the Walker viral code in infected programs: "WALKER V1.00 - This absolutely harmless and self destructive program is written by UJHPTTLZ in the city of Istanbul, 1992" The Walker virus activates after it has been memory resident for a few minutes, at which time a colorful ASCII block graphic man approximately 20 lines tall will walk from right to left across the system display. The graphic man walks across the display every few seconds. When the graphic man walks across the screen, keyboard input will be suspended until he goes off the screen.