Virus Name: Avalanche
V Status: New
Discovery: July, 1995
Symptoms: .COM & .EXE growth; DOS CHKDSK file allocation errors;
decrease in available free memory;
may delete some anti-viral programs when executed;
file date/time years altered
Eff Length: 2,818 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: NAV, NAVDX, ViruScan, IBMAV, VAlert, AVTK, F-Prot,
AVTK/N, NAV/N, IBMAV/N, NShld, Innoc
Removal Instructions: Delete infected files
The Avalanche or Avalanche.2818 virus was received in July, 1995,
and appears to be from Germany. Avalanche is a memory resident
stealth virus which infects .COM and .EXE files, including
When the first Avalanche infected program is executed, this virus
will install itself memory resident at the top of system memory
but below the 640K DOS boundary, not moving interrupt 12's return.
Available free memory, as indicated by the DOS CHKDSK program from
DOS 5.0, will have decreased by 3,456 bytes. Interrupts 13 and 21
will be hooked by the virus in memory.
Once the Avalanche virus is memory resident, it will infect .COM and
.EXE files, including COMMAND.COM, when they are executed. Infected
files will have a file length increase of 2,818 bytes, though this
file length increase will be hidden by the virus when it is memory
resident. The virus will be located at the end of the file. The
program's date and time in the DOS disk directory listing will not
appear to be altered, though the year field will have been altered
by 100 years. The following text strings are encrypted within the
"AVALANCHE/Germany '94...Metal Junkie greets Neurobasher"
"F-PR TBAV SCAN MSAV CPAV TBME TBFI TBSC VIRS TBDR"
With this virus memory resident, if the system user attempts to
execute any program starting with one of the four character strings
indicated in the last text string above, the virus will delete the
program from disk. Attempts to view infected files with the virus
memory resident will result in an uninfected copy of the program
being displayed. The DOS CHKDSK program will indicate file
allocation errors on all infected files.
Known variant(s) of Avalanche are:
Avalanche.2831: Also received in July, 1995, this is a 2,831
byte variant of the Avalanche virus described above. Its size
in memory is 3,472 bytes, hooking interrupts 13 and 21. It
adds 2,831 bytes to the .COM and .EXE files it infects,
including COMMAND.COM. Like the original virus, it is a full
stealth virus. The same text strings are encrypted within the
viral code as in the original virus. This variant also deletes
some anti-viral programs when the user attempts to execute
them with the virus memory resident.
Origin: Germany July, 1995.