Banana Virus

Virus Name: Banana Aliases: Trivial-Banana V Status: Viron Discovery: June, 1992 Symptoms: .COM files overwritten; program corruption; boot failures Origin: Sweden Eff Length: 139 Bytes Type Code: ONCK - Overwriting Non-Resident .COM Infector Detection Method: AVTK, Sweep, ViruScan, F-Prot, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, NProt, AVTK/N, LProt, NAV/N, Innoc, IBMAV/N Removal Instructions: Delete infected files General Comments: The Banana virus was submitted in June, 1992. It is originally from Sweden. Banana is a non-resident direct action infector of .COM programs. It corrupts the programs it infects. When a program infected with the Banana virus is executed, the Banana virus will infect all of the .COM programs located in the current directory. Banana overwrites the first 139 bytes of the programs it infects, so programs which were originally larger than 139 bytes will have no file length increase. Programs which were originally smaller than 139 bytes in length will become 139 bytes in length. The file's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code in all Banana infected programs: "BANANA, coded by Morbid Angel -92 in Stockholm/Sweden" "*.com" Programs infected with Banana will no longer function properly. Since the beginning of the host program was overwritten, it is not possible to disinfect programs. Infected programs should be replaced with clean, uninfected copies. See: Mini-45