Best Wishes Virus


 Virus Name:  Best Wishes 
 Aliases:     Best Wish, Wishes 
 V Status:    Rare 
 Discovery:   December, 1990 
 Symptoms:    .COM file growth; decrease in system and available free 
              memory; system hangs; file date/time changes; file not found 
              errors; boot sector modification 
 Origin:      USSR 
 Eff Length:  970 Bytes 
 Type Code:   PRtCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, NAV, Sweep, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Best Wishes virus was submitted in December, 1990 and is 
       believed to be from the USSR.  Best Wishes is a memory resident 
       infector of .COM files, including COMMAND.COM.  There is a variant 
       of this virus, Best Wishes B, which is 1,024 bytes in length. 
 
       The first time a program infected with the Best Wishes virus is 
       executed, the virus will install itself memory resident in system 
       high memory, but below the 640K DOS boundary.  The interrupt 12 
       return will be moved.  Total system memory will decrease by 61,440 
       bytes, available free memory will decrease by 61,360 bytes. 
       COMMAND.COM will become infected at this time, and the disk's boot 
       sector will also be modified.  Disks with the boot sector 
       modification and infected COMMAND.COM will still boot properly. 
 
       After Best Wishes is resident, the virus will infect .COM files as 
       they are executed with a probability of 50%.  Infected .COM files 
       will increase in length by 970 bytes with the virus being located at 
       the end of the infected file.  Infected programs will also have the 
       following text string located near the end of the file: 
 
               "This programm ... With Best Wishes!" 
 
       Best Wishes does not restore the original file date and time in the 
       directory when it infects programs, so all infected programs will 
       have their date/time stamps set to the system date and time when 
       infection occurred. 
 
       Two additional symptoms of a Best Wishes infection are that the user 
       may experience "File not found" errors when the file is actually on 
       disk, as well as system hangs on every fourth program execution. 
 
       Known variant(s) of Best Wishes are: 
       Best Wishes B: An earlier version of Best Wishes, this variant is 
                      1,024 bytes in length.  The major differences are 
                      that infected disks will not boot if COMMAND.COM has 
                      been modified.  Execution of a .COM program once the 
                      virus is memory resident will result in the program 
                      most likely being infected, but the system will also 
                      hang. 
       Best Wishes C: Another variant of Best Wishes, this variant does 
                      not hang the system when .COM programs are infected 
                      by the virus.  Execution of .EXE programs, however, 
                      will usually result in a system hang. 

Show viruses from discovered during that infect .

Main Page