Virus Name: Bebe
V Status: Rare
Discovery: December, 1990
Symptoms: .COM file growth; long disk access on .COM program execution;
clicking on system speaker and system hang
Eff Length: 1,000 - 1,019 Bytes
Type Code: PRCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
LProt, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N, NAV/N,
Removal Instructions: Delete infected files
The Bebe virus was received from the USSR in December, 1990. Bebe
is a memory resident virus, though it replicates as a direct action
.COM program infector.
When a program infected with Bebe is executed, Bebe will search and
infect all previously uninfected .COM programs on the current drive
and directory. If COMMAND.COM resides in the current directory, it
will become infected. Programs infected with Bebe increase in size
by 1,000 to 1,019 bytes with the virus being located at the end of
the infected file. The infected programs will also have had their
date and time in the DOS disk directory updated to the current
system date and time when infection occurred.
Since Bebe searchs the current directory, and infects all .COM
programs not previously infected, execution of an infected .COM
program will result in a long, slow program load with much disk
access while the virus replicates.
Bebe is a memory resident virus, though it doesn't behave like one.
When the first infected program is executed, it will install a
portion of itself memory resident in available free system memory.
After being resident for awhile, the virus will activate. At
activation, it will emit a "click" on the system speaker, and the
system will then be hung.
Bebe does not replicate on 386 class systems, on those systems
execution of a Bebe-infected program will result in a system hang.