Whale Virus

 Virus Name:  Whale 
 Aliases:     Mother Fish, Stealth Virus, Z The Whale 
 V Status:    Research 
 Discovered:  August, 1990 
 Symptoms:    .COM & .EXE growth; decrease in available memory; system 
              slowdown; video flicker; slow screen writes; file allocation 
              errors; simulated system reboot 
 Origin:      Hamburg, West Germany 
 Eff Length:  9,216 Bytes 
 Type Code:   PRhA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  AVTK, F-Prot, Sweep, IBMAV, NAV, ViruScan, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, Innoc, AVTK/N, NAV/N, IBMAV/N, LProt, NShld 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Whale virus was submitted in early September, 1990.  This virus 
       had been rumored to exist since the isolation of the Fish 6 virus 
       in June, 1990.  It has been referred to by several names besides 
       Whale, including Mother Fish and Z The Whale.  The origin of this 
       virus is subject to some speculation, though it is probably from 
       Hamburg, West Germany due to a reference within the viral code once 
       it is decrypted. 
       The first time a program infected with the Whale virus is executed, 
       the Whale will install itself memory resident in high system memory 
       but below the 640K DOS boundary.  On the author's XT clone, the 
       virus always starts at address 9D90.  Available free memory will be 
       decreased by 9,984 bytes.  Most utilities which display memory 
       usage will also indicate a value for total system memory which is 
       9,984 bytes less than what is actually installed. 
       The following text string can be found in memory on systems 
       infected with the Whale virus: 
              "Z THE WHALE". 
       Immediately upon becoming memory resident, the system user will 
       experience the system slowing down.  Noticeable effects of the 
       system slowdown include video flicker to extremely slow screen 
       writes.  Some programs may appear to "hang", though they will 
       eventually execute properly in most cases since the "hang" is due 
       to the slowing of the system. 
       When a program is executed with the Whale memory resident, the 
       virus will infect the program.  Infected programs increase in 
       length, the actual change in length is usually 9,216 bytes.  Note 
       the "usually": this virus does occasionally infect a program with a 
       "mutant" which will be a different length.  If the file length 
       increase is exactly 9,216 bytes, the Whale will hide the change in 
       file length when a disk directory command is executed.  If the file 
       length of the viral code added to the program is other than 9,216 
       bytes, the file length displayed with the directory command will 
       either the actual infected file length, or the actual infected file 
       length minus 9,216 bytes. 
       Executing the DOS CHKDSK program on infected systems will result in 
       file allocation errors being reported.  If CHKDSK /F is executed, 
       file damage will result. 
       The Whale also alters the program's date/time in the directory when 
       the file is executed, though it is not set to the system date/time 
       of infection.  Occasionally, Whale will alter the directory entry 
       for the program it is infecting improperly, resulting in the 
       directory entry becoming invalid.  These programs with invalid 
       directory entries will appear when the directory is listed, but 
       some disk utilities will not allow access to the program.  In these 
       cases, the directory entry can be fixed with Norton Utilities FD 
       command to reset the file date. 
       The Whale occasionally will change its behavior while it is memory 
       resident.  While most of the time it only infects files when 
       executed, there are periods of time when it will infect any file 
       opened for any reason.  It will also, at times, disinfect files 
       when they are copied with the DOS COPY command, at other times it 
       will not "disinfect on the fly". 
       Occasionally, the Whale virus will simulate what appears to be a 
       system reboot.  While this doesn't always occur, when it does occur 
       the Break key is disabled so that the user cannot exit unexpectedly 
       from the execution of the system's autoexec.bat file.  If the 
       autoexec.bat file contained any software which does file opens of 
       other executable programs, those opened executable programs will be 
       infected at that time if they were not previously infected. 
       Typically, files infected in this manner will increase by 9,216 
       bytes though it will not be shown in a directory listing. 
       A hidden file may be found in the root directory of drive C: on 
       infected files.  This file is not always present, the virus will 
       sometimes remove it, only to recreate it again at a later time. The 
       name of this hidden file is FISH-#9.TBL, it contains an image of 
       the hard disk's master boot sector (partition table), along with 
       the following message: 
               "Fish Virus #9 
                A Whale is no Fish! 
                Mind her Mutant Fish 
                and the hidden Fish Eggs 
                for they are damaging. 
                The sixth Fish mutates 
                only if the Whale is in 
                her Cave." 
       After the discovery of this hidden file, the author of this 
       document made several attempt to have the Fish 6 virus mutate by 
       introducing it and Whale into a system.  Under no circumstances did 
       a mutation of either virus result, the resultant files were 
       infected with both an identifiable Fish 6 infection and a Whale 
       Whale is hostile to debuggers and contains many traps to prevent 
       successful decryption of the virus.  One of its "traps" is to lock 
       out the keyboard if it determines a debugger is in use. 

Show viruses from discovered during that infect .

Main Page