Wally Virus

Virus Name: Wally Aliases: V Status: New Discovered: January, 1995 Symptoms: .COM file growth; file date/time changes Origin: Unknown Eff Length: 1,029 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, AVTK, IBMAV, Sweep, NAV, NAVDX, VAlert, ViruScan, PCScan, ChAV, AVTK/N, IBMAV/N, Sweep/N, NShld, NAV/N, NProt, Innoc Removal Instructions: Delete infected files General Comments: The Wally virus was received in January, 1995. Its origin or point of isolation is unknown. Wally is a non-resident, direct action infector of .COM files, including COMMAND.COM. When a program infected with the Wally virus is executed, this virus will infect one .COM file located in the current directory, plus the copy of COMMAND.COM located in the C: drive root directory if it was not previously infected by the virus. Programs infected with the Wally virus will have a file length increase of 1,029 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings are encrypted within the Wally viral code, and are thus not visible within infected programs: "Virus Wally versao programa.Tente me encontrar." It is unknown what the Wally virus does besides replicate. Known variant(s) of Wally are: Wally.981: Received in May, 1995, Wally.981 is a 981 byte variant of the Wally virus described above. It infects one .COM file each time an infected program is executed. Infected files will have a file length increase of 981 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text string is encrypted within the viral code: "Virus Wally versao programa.Tente me encontrar." Origin: Unknown May, 1995.