Zaragosa Virus
Virus Name: Zaragosa
Aliases: Caz-1159
V Status: Rare
Discovered: January, 1992
Symptoms: .COM & .EXE growth; decrease in total system & available free
memory; disk allocation errors; system hang
Origin: Unknown
Eff Length: 1,159 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: Viruscan, AVTK, F-Prot, Sweep, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
NAV/N, IBMAV/N
Removal Instructions: Delete infected files
General Comments:
The Zaragosa virus was submitted in January, 1992. Its origin
or point of isolation is unknown. Zaragosa is a memory resident
infector of .COM and .EXE programs, including COMMAND.COM. It
employs some stealth techniques.
The first time a program infected with the Zaragosa virus is
executed on a system, the Zaragosa virus will infect the copy of
COMMAND.COM located in the C: drive root directory. A system
hang will then occur. When the user reboots the system from the
system hard disk, or a diskette with an infected copy of COMMAND.COM,
the Zaragosa virus will become memory resident at the top of system
memory but below the 640K DOS boundary. Interrupt 12's return
will not have been moved. Total system and available free memory,
as indicated by the DOS CHKDSK program, will have decreased by
2,048 bytes. Interrupts 21 and 2F will be hooked.
Once the Zaragosa virus is memory resident, it will infect .COM
and .EXE programs when they are opened or executed. Infected
programs will have a file length increase of 1,159 bytes, though
the file length increase will not be visible if the Zaragosa virus
is memory resident. The Zaragosa virus will be located at the end
of the infected program. The file's date and time in the DOS disk
directory listing will not have been altered.
The following text strings can be found within the viral code in
Zaragosa infected programs:
"EXECOMC:\COMMAND.COM"
"CLEAN."
Execution of the DOS CHKDSK program with Zaragosa memory resident
will result in the utility indicating that all Zaragosa infected
programs have a file allocation error.
It is unknown if Zaragosa does anything besides replicate.
Known variant(s) of Zaragosa are:
Caz-1159: Functionally equivalent to the Zaragosa virus
described above, this variant has three bytes which
differ.
Origin: Unknown April, 1992.
See: Caz