Beast-N-Black Virus

Virus Name: Beast-N-Black Aliases: Beast V Status: Rare Discovery: February, 1992 Symptoms: .COM file growth; .COM programs in \DOS directory may be deleted Origin: United States Eff Length: 429 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Beast-N-Black virus was isolated in the United States in February, 1992. This virus is a non-resident, direct action infector of .COM programs including COMMAND.COM. When a program infected with the Beast-N-Black virus is executed, this virus will search the current directory for all previously uninfected .COM programs, and then infect them. Once it completes with the current directory, it will attempt to infect all .COM programs in the root directory of the current drive. Programs infected with the Beast-N-Black virus will have a file length increase of 429 bytes. The virus will be located at the end of the program. The file's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code of all infected programs: "*.COM \*.COM \DOS\*.COM" "Beware the Beast-N-Black" "(C) 1992, Night Crawler - SKISM/PHALCON" The Beast-N-Black virus is malicious. It will occassionally delete all .COM programs located in the DOS directory on the current drive. Known variant(s) of Beast-N-Black are: Beast-N-Black B: Functionally equivalent to the original virus, this variant has three bytes which differ. Origin: Canada May, 1992. Public Enemy: Based on the Beast-N-Black virus, this variant infects all .COM files in the current directory and the current drive root directory when an infected program is executed. It adds 429 bytes to the programs it infects, including COMMAND.COM. The virus will be located at the end of the file. The following text strings can be found within all Public Enemy infected programs: "*.COM \*.COM \DOS\*.COM" "????????COM" "Public enemy number one" Origin: Unknown November, 1992.