Virus Name: Beaches
V Status: Rare
Discovery: June, 1993
Symptoms: .EXE file growth;
Decrease in total system & available free memory
Origin: The Netherlands
Eff Length: 1,392 - 1,406 Bytes
Type Code: PRtE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, Sweep, F-Prot, IBMAV, AVTK, NAV,
NAVDX, VAlert, ChAV,
NShld, Sweep/N, Innoc, IBMAV/N, AVTK/N, NAV/N
Removal Instructions: Delete infected files
The Beaches virus was submitted in June, 1993, and is from The
Netherlands. Beaches is a memory resident infector of .EXE
programs. The virus contains a poem, which is how it derives its
When the first Beaches infected program is executed, the Beaches
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary, moving interrupt 12's return.
Total system and available free memory, as indicated by the DOS
CHKDSK program, will have decreased by 4,912 bytes. No interrupts
are directly mapped to the viral code in memory.
The Beaches virus infects up to five .EXE programs in the current
directory whenever an infected program is executed. Infected
programs will have a file length increase of 1,392 to 1,406 bytes
with the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will not be altered.
The following text strings are encrypted within the Beaches viral
"bridges sinking into the sea"
"you're a fading memory"
"*.EXE \* \"
It is unknown what Beaches does besides replicate.