Zoid Virus

Virus Name: Zoid Aliases: V Status: Rare Discovered: November, 1992 Symptoms: .EXE file growth; decrease in total system & available free memory Origin: Unknown Eff Length: 1,751 - 1,773 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: AVTK, F-Prot, ViruScan, Sweep, IBMAV, NAVDX, NAV, VAlert, PCScan, ChAV, NShld, Sweep/N, AVTK/N, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Zoid virus was submitted in November, 1992. Zoid is a memory resident infector of .EXE programs. When the first Zoid infected program is executed, the Zoid virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,048 bytes. No interrupts will be mapped to the Zoid virus in memory. Once the Zoid virus is memory resident, it will infect .EXE programs when they are executed twice in a row. Infected programs will have a file length increase of 1,751 to 1,773 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code in all Zoid infected programs: "ZOID.EXE" It is unknown what Zoid does besides replicate.