Worm-16850 Virus

 Virus Name:  Worm-16850 
 V Status:    Rare 
 Discovered:  April, 1992 
 Symptoms:    Hidden Read-Only .COM programs created 
 Origin:      Unknown 
 Eff Length:  16,850 Bytes 
 Type Code:   SNA - Spawning Non-Resident .EXE Infector 
 Detection Method:  AVTK, F-Prot, ViruScan, Sweep, IBMAV, NAVDX, ChAV, 
                    NAV, VAlert, PCScan, 
                    NShld, Sweep/N, Innoc, AVTK/N, LProt, NProt, IBMAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Worm-16850 virus was received in April, 1992.  Its origin is 
       unknown.  This virus is a non-resident spawning or companion 
       virus which infects .EXE programs by creating corresponding 
       hidden .COM programs. 
       When a program infected with the Worm-16850 virus is executed, this 
       virus will search the current directory for an .EXE program which 
       does not have a matching .COM program.  Once such a program is 
       found, the virus infects it by creating a 16,850 byte .COM program 
       with the same base file name.  This newly created .COM program will 
       not be visible to the system user as the file attributes are set 
       to hidden and read-only.  The host .EXE program is not altered in 
       any way. 
       The following text strings can be found within the hidden, read-only 
       .COM programs which contain the viral code: 
               "Turbo-C - Copyright (c) 1988 Borland Intl..Divide error" 
               "Abnormal program termination" 
       Systems infected with Worm-16850 can be easily disinfected by 
       deleting all of the hidden, read-only .COM programs of 16,850 
       bytes which correspond to .EXE programs in the directory. 

Show viruses from discovered during that infect .

Main Page