Wasp Virus


 Virus Name:  Wasp 
 Aliases:     SSI 1.0, Wasp.629 
 V Status:    New 
 Discovered:  July, 1994 
 Symptoms:    .COM file growth; 
              decrease in total system & available free memory 
 Origin:      Unknown 
 Eff Length:  629 - 637 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, ViruScan, Sweep, NAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    AVTK/N, Sweep/N, IBMAV/N, NShld, Innoc, NAV/N, NProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Wasp, Wasp.629 or SSI 1.0, virus was received in July, 1994.  Its 
       origin or point of isolation is unknown.  Wasp is a memory resident 
       infector of .COM programs, including COMMAND.COM. 
 
       When the first Wasp infected program is executed, this virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary, not moving interrupt 12's return.  Total system 
       and available free memory, as indicated by the DOS CHKDSK program, 
       will have decreased by 592 bytes.  Interrupt 21 will be hooked by the 
       virus in memory. 
 
       Once memory resident, the Wasp virus will infect .COM programs when 
       they are executed.  Infected programs will have a file length increase 
       of 629 to 637 bytes with the virus being located at the end of the 
       file.  The program's date and time in the DOS disk directory listing 
       will not be altered.  The following text string is visible within the 
       viral code in all Wasp infected programs: 
 
               "SSI v. 1.00" 
 
       It is unknown what Wasp may do besides replicate. 
 
       Known variant(s) of Wasp are: 
       Wasp.909: Also known as SSI 2.01, Wasp 909 is a later version of 
           the Wasp virus described above.  Its size in memory is 928 bytes, 
           hooking interrupt 21.  It infects .COM and .EXE files, including 
           COMMAND.COM, when they are executed.  Infected .COM programs 
           increase in size by 946 to 958 bytes, while .EXE programs 
           increase in size by 909 to 919 bytes.  In both cases, the virus 
           will be located at the end of the file.  The following text string 
           can be found within the viral code in all infected programs: 
           "SSI v. 2.01" 
           Origin:  Unknown  July, 1994. 

Show viruses from discovered during that infect .

Main Page