Write Virus

Virus Name: Write Aliases: Write.474 V Status: New Discovered: January, 1996 Symptoms: .EXE file growth; file date/time changes; system hangs Origin: Unknown Eff Length: 474 - 488 Bytes Type Code: PRaE - Parasitic Resident .EXE Infector Detection Method: IBMAV, ViruScan, NAV, NAVDX, AVTK, ChAV, IBMAV/N, NShld, NAV/N, AVTK/N, Innoc Removal Instructions: Delete infected files General Comments: The Write or Write.474 virus was received in January, 1996. Its origin or point of isolation is unknown. Write is a memory resident infector of .EXE files. System hangs frequently occur on infected systems. When the first Write infected program is executed, this virus will install itself memory resident in allocated system memory, hooking interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will not be altered. Once the Write virus is memory resident, it will infect .EXE files when they are executed. Infected programs will have a file length increase of 474 to 488 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. No significate text strings are visible within the viral code.