Wild Thing 2 Virus


 Virus Name:  Wild Thing 2 
 Aliases:     IVP.Wild_Thing 
 V Status:    Rare 
 Discovered:  December, 1992 
 Symptoms:    .COM file growth; display switched to 40 column mode & 
              message displayed 
 Origin:      North America 
 Eff Length:  567 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, AVTK, IBMAV, NAV, NAVDX, 
                    Sweep, VAlert, ChAV, 
                    NShld, NProt, AVTK/N, Sweep/N, IBMAV/N, NAV/N, Innoc 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Wild Thing 2 virus was submitted in December, 1992 and is from 
       North America.  It is a non-resident, direct action infector of 
       .COM programs, including COMMAND.COM. 
 
       When a program infected with the Wild Thing 2 virus is executed, 
       this virus will infect all of the .COM programs located in the 
       current directory.  Infected programs will have a file length 
       increase of 567 bytes with the virus being located at the end of 
       the file.  The program's date and time in the DOS disk directory 
       listing will not be altered.  The following text strings are 
       encrypted within the viral code: 
 
               "Wild Thing ][" 
               "It's Friday... Enjoy the weekend with" 
               "your computer! [YAM '92]" 
               "By: Admiral Bailey [YAM]*.com \command.com" 
 
       The Wild Thing 2 virus activates on Fridays, at which time execution 
       of an infected program will result in the system monitor being 
       switched to 40 column mode and the following message being displayed: 
  
               "It's Friday... Enjoy the weekend with 
                your computer! [YAM '92]" 
 
       Known variant(s) of Wild Thing 2 are: 
       Wild Thing: An earlier version of the Wild Thing 2 virus, 
                   Wild Thing was received in October 1992.  The sample 
                   submitted does not replicate, and is not used for 
                   certification purposes.  It contains the following 
                   text: 
                   "This is a Wild Thing" 
                   "LEGALIZE MARIJUANA!" 
                   "ACiD RULEZ!!! hahaha" 
                   "Programed by Magic" 
                   "*.com" 
                   Origin:  North America, October, 1992. 
       Wild Thing-289: A later version of the non-functional Wild Thing 
                   variant, Wild Thing-289 infects three .COM programs in 
                   the current directory each time an infected program is 
                   executed.  Infected programs will have a file length 
                   increase of 289 bytes with the virus being located at 
                   the end of the file.  The program's date and time in the 
                   DOS disk directory listing will have been updated to the 
                   current system date and time.  It contains the following 
                   text: 
                   "This is a Wild Thing" 
                   "Programmed By Admiral Bailey [YAM]" 
                   "(C) 1992 YAM Inc." 
                   "*.com" 
                   The first three text strings above will be displayed as 
                   a message when an infected program is executed. 
                   Origin:  North America, February, 1993. 
       Wild Thing.555: Received in May, 1995, Wild Thing.555 is a 
                   555 byte variant of the Wild Thing 2 virus described 
                   above.  It infects all of the .COM files in the current 
                   directory whenever an infected program is executed. 
                   Infected programs will have a file length increase of 555 
                   bytes with the virus being located at the end of the file. 
                   The program's date and time in the DOS disk directory 
                   listing will not be altered.  The following text strings 
                   are encrypted within the viral code: 
                   "Wild Thing ][" 
                   "It's Friday... Enjoy the weekend with" 
                   "your computer! [YAM '92]" 
                   "By: Admiral Bailey [YAM] *.com \command.com" 
                   Origin:  Unknown  May, 1995. 
       Wild Thing.557: Received in May, 1995, Wild Thing.557 is a 
                   557 byte variant of the Wild Thing 2 virus described 
                   above.  It infects all of the .COM files in the current 
                   directory whenever an infected program is executed. 
                   Infected programs will have a file length increase of 557 
                   bytes with the virus being located at the end of the file. 
                   The program's date and time in the DOS disk directory 
                   listing will not be altered.  The following text strings 
                   are encrypted within the viral code: 
                   "Wild Thing ][" 
                   "It's Friday... Enjoy the weekend with" 
                   "your computer! [YAM '92]" 
                   "By: Admiral Bailey [YAM] *.com \command.com" 
                   Origin:  Unknown  May, 1995. 
 
       See:   IVP 
 
      

Show viruses from discovered during that infect .

Main Page