Virus Name: Banana
V Status: Viron
Discovery: June, 1992
Symptoms: .COM files overwritten; program corruption; boot failures
Eff Length: 139 Bytes
Type Code: ONCK - Overwriting Non-Resident .COM Infector
Detection Method: AVTK, Sweep, ViruScan, F-Prot, NAV, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, NProt, AVTK/N, LProt, NAV/N, Innoc,
Removal Instructions: Delete infected files
The Banana virus was submitted in June, 1992. It is originally
from Sweden. Banana is a non-resident direct action infector
of .COM programs. It corrupts the programs it infects.
When a program infected with the Banana virus is executed, the
Banana virus will infect all of the .COM programs located in the
current directory. Banana overwrites the first 139 bytes of the
programs it infects, so programs which were originally larger than
139 bytes will have no file length increase. Programs which were
originally smaller than 139 bytes in length will become 139 bytes
in length. The file's date and time in the DOS disk directory
listing will not be altered.
The following text strings can be found within the viral code in
all Banana infected programs:
"BANANA, coded by Morbid Angel -92 in Stockholm/Sweden"
Programs infected with Banana will no longer function properly.
Since the beginning of the host program was overwritten, it is
not possible to disinfect programs. Infected programs should be
replaced with clean, uninfected copies.