Virus Name: Wonderful
V Status: Rare
Discovered: January, 1992
Symptoms: .COM file growth; unexpected access to C: drive
Eff Length: 1,338 - 2,602 Bytes
Type Code: PNC - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, IBMAV, NAV,
F-Prot, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Wonderful virus was received in January, 1992. Its origin or
point of original isolation is unknown. Wonderful is a non-
resident, direct action infect of .COM files other than COMMAND.COM.
It is a member of the Burger family of viruses, and is based
specifically on the VirDem virus.
When a program infected with Wonderful is executed, the virus will
search the C: drive directory structure to locate the first
uninfected .COM file which is not named COMMAND.COM. Once this
file is found, the virus will infect it.
Wonderful infected programs will normally have a file length
increase of 1,336 bytes. However, if the .COM file's original
length was less than 1,280 bytes, the infected file's length will
become 2,616 bytes. Therefore, file length increases can be
anywhere from 1,336 bytes to 2,614 bytes. In any case, the virus
will be located at the beginning of the infected file. There will
be no change to the file's date and time in the DOS disk directory
The following text strings can be found within the viral code in
Wonderful infected files:
"\V 4V2 A"
"HAS HAPPENED !!!"
It is unknown if Wonderful does anything besides replicate.
See: Burger VirDem VirDem-1542