Beeper Virus

Virus Name: Beeper Aliases: Russian Mirror V Status: Rare Discovery: 1991 Symptoms: .COM file growth; file date/time changes; beeps on system speaker; hard disk corruption Origin: USSR Eff Length: 482 Bytes Type Code: PRCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, IBMAV, NAV, F-Prot, NAVDX, VAlert, PCScan, ChAV, LProt, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Beeper, or Russian Mirror, virus was first isolated in the USSR sometime in 1991. It was not added to VSUM until November, 1992 due to previous samples not replicating. Beeper is a memory resident infector of .COM programs, including COMMAND.COM. It can also corrupt the system hard disk on infected systems. The first time a program infected with the Beeper virus is executed, the Beeper virus will install itself memory resident in low available free memory, hooking interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will not be altered. Once the Beeper virus is memory resident, it will infect .COM programs when they are executed twice in a row. Infected programs will have a file length increase of 482 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been altered to the current system date and time when infection occurred. No text strings are visible within the viral code in infected programs. Systems infected with the Beeper virus may experience the hard disk becoming corrupted, resulting in an "Invalid drive specification" message when the user attempts to access it. This corruption occurs when the virus will occassionally overwrite the system hard disk's master boot sector. Users of infected systems may also notice that a "beep" will be emitted from the system speaker when infected programs are executed.