Wonderful Virus

 Virus Name:  Wonderful 
 V Status:    Rare 
 Discovered:  January, 1992 
 Symptoms:    .COM file growth; unexpected access to C: drive 
 Origin:      Unknown 
 Eff Length:  1,338 - 2,602 Bytes 
 Type Code:   PNC - Parasitic Non-Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, Sweep, IBMAV, NAV, 
                    F-Prot, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Wonderful virus was received in January, 1992.  Its origin or 
       point of original isolation is unknown.  Wonderful is a non- 
       resident, direct action infect of .COM files other than COMMAND.COM. 
       It is a member of the Burger family of viruses, and is based 
       specifically on the VirDem virus. 
       When a program infected with Wonderful is executed, the virus will 
       search the C: drive directory structure to locate the first 
       uninfected .COM file which is not named COMMAND.COM.  Once this 
       file is found, the virus will infect it. 
       Wonderful infected programs will normally have a file length 
       increase of 1,336 bytes.  However, if the .COM file's original 
       length was less than 1,280 bytes, the infected file's length will 
       become 2,616 bytes.  Therefore, file length increases can be 
       anywhere from 1,336 bytes to 2,614 bytes.  In any case, the virus 
       will be located at the beginning of the infected file.  There will 
       be no change to the file's date and time in the DOS disk directory 
       The following text strings can be found within the viral code in 
       Wonderful infected files: 
               "*.com *" 
               "? ????????exe" 
               "\V 4V2 A" 
               "SOMETHING WONDERFUL" 
               "HAS HAPPENED !!!" 
       It is unknown if Wonderful does anything besides replicate. 
       See:   Burger    VirDem    VirDem-1542 

Show viruses from discovered during that infect .

Main Page