Worm-16850 Virus

Virus Name: Worm-16850 Aliases: V Status: Rare Discovered: April, 1992 Symptoms: Hidden Read-Only .COM programs created Origin: Unknown Eff Length: 16,850 Bytes Type Code: SNA - Spawning Non-Resident .EXE Infector Detection Method: AVTK, F-Prot, ViruScan, Sweep, IBMAV, NAVDX, ChAV, NAV, VAlert, PCScan, NShld, Sweep/N, Innoc, AVTK/N, LProt, NProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Worm-16850 virus was received in April, 1992. Its origin is unknown. This virus is a non-resident spawning or companion virus which infects .EXE programs by creating corresponding hidden .COM programs. When a program infected with the Worm-16850 virus is executed, this virus will search the current directory for an .EXE program which does not have a matching .COM program. Once such a program is found, the virus infects it by creating a 16,850 byte .COM program with the same base file name. This newly created .COM program will not be visible to the system user as the file attributes are set to hidden and read-only. The host .EXE program is not altered in any way. The following text strings can be found within the hidden, read-only .COM programs which contain the viral code: "Turbo-C - Copyright (c) 1988 Borland Intl..Divide error" "Abnormal program termination" "*.EXE.COM.wb....rb.PATH." Systems infected with Worm-16850 can be easily disinfected by deleting all of the hidden, read-only .COM programs of 16,850 bytes which correspond to .EXE programs in the directory.