Virus Name: Australian
V Status: Rare
Discovery: June, 1991
Symptoms: .COM & .EXE growth; TSR
Eff Length: 1,413 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, NAV, F-Prot, Sweep, AVTK, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Australian virus was received in June, 1991. It is originally
from Australia. Australian is a memory resident infector of .COM
and .EXE programs. It does not infect COMMAND.COM. It is based
on the 1720 virus.
When the first Australian infected program is executed, the virus
will install itself memory resident as a low system memory TSR of
1,392 bytes. Interrupt 21 will be hooked by the virus in memory.
After Australian is memory resident, it will occasionally infect
.COM and .EXE programs when they are executed. Infected .COM
programs will increase in length by 1,413 bytes with the virus
being located at the beginning of the infected file. Infected
.EXE programs will increase in length by 1,413 to 1,425 bytes
with the virus being located at the end of the infected file.
In both cases, there will be no change to the file date and time
in the disk directory.
Programs infected with Australian will contain one text string which
is within the viral code:
It is unknown if Australian does anything besides replicate.