Wonder Virus

 Virus Name:  Wonder 
 V Status:    Viron 
 Discovered:  January, 1992 
 Symptoms:    .EXE programs overwritten; programs fail to execute; 
              system hangs; message 
 Origin:      Unknown 
 Eff Length:  7,424 Bytes 
 Type Code:   ONE - Overwriting Non-Resident .EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, LProt, Innoc, AVTK/N, IBMAV/N, 
                    NAV/N, NProt 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Wonder virus was received in January, 1992.  Its origin or point 
       of original isolation is unknown.  Wonder is a non-resident, over- 
       writing virus which infects .EXE programs. 
       When a program infected with Wonder is executed, the Wonder virus 
       will infect all .EXE programs located in the current directory.  The 
       infected .EXE programs will have their first 7,424 bytes overwritten 
       with the Wonder virus.  Unless the file's pre-infection length was 
       less than 7,424 bytes, there will be no change in the file's length. 
       Programs whose pre-infection length was smaller than 7,424 bytes 
       will become 7,424 bytes in length.  The file's date and time in the 
       DOS disk directory listing will have been updated to the current 
       system date and time when infection occurred. 
       Programs infected with Wonder will frequently hang the system when 
       they are executed.  If the program is larger than 64K in size, it 
       may instead result in an "Error in EXE file" message and the user 
       being returned to the DOS prompt. 
       Known variant(s) of Wonder are: 
       Wonder-2: The Wonder-2 variant is a minor variant of the  
                 Wonder virus described above.  It has been altered so that 
                 it doesn't infect .EXE files over 64K in size.  As a 
                 result, the "Error in EXE file" message no longer occurs. 

Show viruses from discovered during that infect .

Main Page