Worm-17690 Virus

Virus Name: Worm-17690 Aliases: 17690 V Status: Rare Discovered: May, 1992 Symptoms: .EXE files become 17,690 bytes in length & .SYS, .PRG, .FIL, and .DAT files created Origin: Unknown Eff Length: 17,690 Bytes Type Code: SNE - Spawning Non-Resident .EXE Infector Detection Method: NAV, F-Prot, Sweep, AVTK, NAVDX, ChAV, ViruScan, VAlert, PCScan, Sweep/N, Innoc, AVTK/N, LProt, NAV/N, NProt, NShld Removal Instructions: Delete infected files and rename original files General Comments: The Worm-17690 virus was isolated in May, 1992. Its origin is unknown. This virus is a non-resident infector of .EXE programs, and can be difficult to disinfect. When a program infected with the Worm-17690 virus is executed, this virus will infect one .EXE program located on the A:, B:, or C: drive. The program the virus decides to infect will be renamed to some other base file name and then have an extension of either .SYS, .PRG, .FIL, or .DAT. The virus will then write a copy of itself to disk with the original program's file name. The new copy of virus will be 17,690 bytes in length and have a file date and time of the current system date and time when infection occurred. The host program will then continue execution. Worm-17690 is difficult to disinfect since once the .EXE programs containing the viral code are found and deleted, the original program must be located and renamed back to the correct name.