WWT Virus

Virus Name: WWT Aliases: WWT 01, WWT 02, WWT 02B V Status: Viron Discovered: May, 1991 Symptoms: .COM program corruption Origin: Europe Eff Length: 67 or 125 bytes Type Code: ONCK - Overwriting Non-Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The WWT viruses were received from Europe in May, 1991. As of May, 1991, there are two viruses in this family. One virus, WWT 01, is a 67 byte virus. The other virus, WWT 02, is a 125 byte virus. Both viruses are non-resident overwriting viruses which infect .COM programs including COMMAND.COM. When a program infected with a WWT virus is executed, the virus will infect all .COM programs in the current directory. If COMMAND.COM resides in the current directory, it will be infected. Infected programs will have the beginning portion of their code overwritten with the viral code. The number of bytes overwritten depends on which of the WWT viruses are present. The program's date and time in the disk directory may also be updated to the current system date and time. Programs infected with a WWT virus will not execute properly since they have been permanently corrupted due to the beginning of their code having been overwritten. WWT does not do anything besides replicate. Known variant(s) of WWT are: WWT 01: The WWT 01 variant is 67 bytes in length. Programs infected by this variant will have the first 67 bytes overwritten by the virus. If the program's original length was less than 67 bytes, the infected program's length will become 67 bytes. Programs which are 67 bytes or greater before infection will have no file length increase. WWT 01 infections will also result in the .COM program's date and time in the disk directory having been altered to the system date and time of infection. WWT 02: The WWT 02 variant is 125 bytes in length. Programs infected by this variant will have the first 125 bytes overwritten by the virus. If the program's original length was less than 125 bytes, the infected program's length will become 125 bytes. Programs which are 125 bytes or greater before infection will have no file length increase. WWT 02 infections will not result in a change to the file's date and time in the disk directory. WWT 02B: WWT 02B is very similar to the WWT 02 variant. Its only difference is that this variant has one byte which has been altered at offset 2C. Origin: Unknown January, 1992.