Zero Bug Virus

 Virus Name:  Zero Bug 
 Aliases:     Palette, 1536, Zero 
 V Status:    Endangered 
 Discovered:  September, 1989 
 Symptoms:    .COM growth (see text); TSR; graphics display 
 Origin:      Netherlands 
 Eff Length:  1,536 bytes 
 Type Code:   PRsC - Parasitic Resident .COM Infector 
 Detection Method:  Viruscan, F-Prot, AVTK, NAV, Sweep, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  F-Prot, or delete infected files 
 General Comments: 
       The Zero Bug virus was first isolated in the Netherlands by Jan 
       Terpstra in September, 1989.  This virus is a memory resident .COM 
       file infector.  Infected .COM files will increase in size by 1,536 
       bytes, however the increase in file length will not show up when 
       the disk directory is displayed. 
       The virus's main objective is to infect the copy of COMMAND.COM 
       indicated by the environment variable COMSPEC.  If COMSPEC doesn't 
       point to anything, the Zero Bug virus will install itself memory 
       resident using INT 21h. 
       After the virus has either infected COMMAND.COM or become memory 
       resident, it will infect all .COM files that are accessed, 
       including those accessed by actions such as COPY or XCOPY.  Any 
       .COM file created on an infected system will also be infected. 
       If the currently loaded COMMAND.COM is infected, the virus will 
       hook into the timer interrupt 1Ch, and after a certain amount of 
       time has past, a smiley face character () will appear and 
       eat all the zeros it can find on the screen. The virus does not 
       delete files or format disks in its present form. 
       Known variant(s) of Zero Bug are: 
       Zero Bug B: Similar to Zero Bug, this variant will not infect 
                   the copy of COMMAND.COM pointed to by the COMSPEC 
                   environment variable when the first infected file is 
                   executed.  Zero Bug B will only infect .COM files 
                   when they are copied.  The Zero Bug B virus' TSR is 
                   1,840 bytes in size and hooks interrupts 21 and 60. 

Show viruses from discovered during that infect .

Main Page