Virus Name: Behaviour
V Status: New
Discovery: May, 1996
Symptoms: .COM file growth;
characters from memory displayed on system monitor
Eff Length: 304 Bytes
Type Code: PNC - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, AVTK, IBMAV, ViruScan, NAV, NAVDX, PCScan,
NProt, AVTK/N, IBMAV/N, LProt, NShld, NAV/N
Removal Instructions: Delete infected files
The Behaviour virus was received in May, 1996. Its origin or point
of isolation is unknown. Behaviour is a non-resident, direct action
infector of .COM files, but not COMMAND.COM.
When a program infected with the Behaviour virus is executed, this
virus will infect up to ten .COM files located in the current
directory. Infected .COM files will have a file length increase of
304 bytes with the virus being located at the end of the file. The
program's date and time in the DOS disk directory listing will not
be altered. The following text strings are visible within the
"The Herb VirusCriminal Behaviour"
The text string "BC" can be found starting in the fourth byte of
all infected files.
This virus will sometimes display characters from memory on the
system monitor when an infected program is executed.