Virus Name: Attention!
Aliases: USSR 394, USSR-394, 394
V Status: Rare
Discovery: December, 1990
Symptoms: .COM file growth; decrease in system and available memory;
clicking emitted from system speaker on keypress; file
Eff Length: 394 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Attention! virus was submitted in December, 1990 and was
originally isolated in the USSR. This virus is a memory resident
infector of .COM files, including COMMAND.COM.
The first time a program infected with the Attention! virus is
executed, the virus will reserve 416 bytes at the top of system
memory, but below the 640K DOS boundary. The virus becomes memory
resident in this area, and hooks interrupt 21. Total system memory
and available free memory returned by the DOS CHKDSK command will
decrease by 416 bytes. The interrupt 12 return is not moved.
After the virus is memory resident, a clicking sound will be emitted
by the system speaker each time a key is pressed on the keyboard.
Some programs, such as the EDLIN program supplied with MS-DOS, will
receive an "Invalid drive or file name" message when they are
attempted to be executed.
Attention! will infect .COM files, including COMMAND.COM, when they
are executed. The exception is that very small .COM files will not
become infected. Infected files will increase in length by 394
bytes with the virus being located at the end of the file. Infected
programs will also contain the text string: "ATTENTION !" near the
beginning of the program.