Bebe Virus


 Virus Name:  Bebe 
 Aliases:    
 V Status:    Rare 
 Discovery:   December, 1990 
 Symptoms:    .COM file growth; long disk access on .COM program execution; 
              clicking on system speaker and system hang 
 Origin:      USSR 
 Eff Length:  1,000 - 1,019 Bytes 
 Type Code:   PRCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, ChAV, 
                    NAV, IBMAV, NAVDX, VAlert, PCScan, 
                    LProt, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N, NAV/N, 
                    NShld 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Bebe virus was received from the USSR in December, 1990.  Bebe 
       is a memory resident virus, though it replicates as a direct action 
       .COM program infector. 
 
       When a program infected with Bebe is executed, Bebe will search and 
       infect all previously uninfected .COM programs on the current drive 
       and directory.  If COMMAND.COM resides in the current directory, it 
       will become infected.  Programs infected with Bebe increase in size 
       by 1,000 to 1,019 bytes with the virus being located at the end of 
       the infected file.  The infected programs will also have had their 
       date and time in the DOS disk directory updated to the current 
       system date and time when infection occurred. 
 
       Since Bebe searchs the current directory, and infects all .COM 
       programs not previously infected, execution of an infected .COM 
       program will result in a long, slow program load with much disk 
       access while the virus replicates. 
 
       Bebe is a memory resident virus, though it doesn't behave like one. 
       When the first infected program is executed, it will install a 
       portion of itself memory resident in available free system memory. 
       After being resident for awhile, the virus will activate.  At 
       activation, it will emit a "click" on the system speaker, and the 
       system will then be hung. 
 
       Bebe does not replicate on 386 class systems, on those systems 
       execution of a Bebe-infected program will result in a system hang. 

Show viruses from discovered during that infect .

Main Page