Best Wishes Virus
Virus Name: Best Wishes
Aliases: Best Wish, Wishes
V Status: Rare
Discovery: December, 1990
Symptoms: .COM file growth; decrease in system and available free
memory; system hangs; file date/time changes; file not found
errors; boot sector modification
Eff Length: 970 Bytes
Type Code: PRtCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Best Wishes virus was submitted in December, 1990 and is
believed to be from the USSR. Best Wishes is a memory resident
infector of .COM files, including COMMAND.COM. There is a variant
of this virus, Best Wishes B, which is 1,024 bytes in length.
The first time a program infected with the Best Wishes virus is
executed, the virus will install itself memory resident in system
high memory, but below the 640K DOS boundary. The interrupt 12
return will be moved. Total system memory will decrease by 61,440
bytes, available free memory will decrease by 61,360 bytes.
COMMAND.COM will become infected at this time, and the disk's boot
sector will also be modified. Disks with the boot sector
modification and infected COMMAND.COM will still boot properly.
After Best Wishes is resident, the virus will infect .COM files as
they are executed with a probability of 50%. Infected .COM files
will increase in length by 970 bytes with the virus being located at
the end of the infected file. Infected programs will also have the
following text string located near the end of the file:
"This programm ... With Best Wishes!"
Best Wishes does not restore the original file date and time in the
directory when it infects programs, so all infected programs will
have their date/time stamps set to the system date and time when
Two additional symptoms of a Best Wishes infection are that the user
may experience "File not found" errors when the file is actually on
disk, as well as system hangs on every fourth program execution.
Known variant(s) of Best Wishes are:
Best Wishes B: An earlier version of Best Wishes, this variant is
1,024 bytes in length. The major differences are
that infected disks will not boot if COMMAND.COM has
been modified. Execution of a .COM program once the
virus is memory resident will result in the program
most likely being infected, but the system will also
Best Wishes C: Another variant of Best Wishes, this variant does
not hang the system when .COM programs are infected
by the virus. Execution of .EXE programs, however,
will usually result in a system hang.