Virus Name: Weak
V Status: Rare
Discovered: December, 1992
Symptoms: .COM file growth; system hangs
Eff Length: 1,253 Bytes
Type Code: PRfCK - Parasitic Resident .COM Infector
Detection Method: Sweep, AVTK, F-Prot, ViruScan, NAV, NAVDX,
IBMAV, VAlert, ChAV,
Sweep/N, NShld, AVTK/N, NAV/N, IBMAV/N, Innoc
Removal Instructions: Delete infected files
The Weak, or Vulner, virus was submitted in December, 1992. Its
origin or point of isolation is unknown. Weak is a memory resident
infector of .COM programs, including COMMAND.COM.
When the first Weak infected program is executed, the Weak virus
will become memory resident in available free memory, hooking
interrupt 21. Total system and available free memory, as indicated
by the DOS CHKDSK program, will not be altered.
Once the Weak virus is memory resident, it will infect .COM
programs, including COMMAND.COM, when they are copied or opened,
providing the program is located in a subdirectory. Programs located
in the root directory will not become infected. Programs infected
with the Weak virus will have a file length increase of 1,253 bytes
with the virus being located at the beginning of the file. The
program's date and time in the DOS disk directory listing will not
be altered. The following text string is encrypted within the viral
"Et tu vulneratus es sicut et nos,
nostri similis effectus es..."
System hangs frequently occur on infected systems.