Bit Addict Virus
Virus Name: Bit Addict
V Status: Rare
Discovery: November, 1992
Symptoms: .COM file growth
Origin: The Netherlands
Eff Length: 477 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, Sweep, AVTK, ViruScan, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
Sweep/N, LProt, NShld, NProt, AVTK/N, NAV/N, IBMAV/N,
Removal Instructions: Delete infected files
The Bit Addict virus was received from the Netherlands in November,
1992. Bit Addict is a memory resident infector of .COM programs,
The first time a program infected with the Bit Addict virus is
executed, the Bit Addict virus will install itself memory resident
in Video Card Memory, with a hook to this memory resident in low
available memory. Interrupt 21 will be hooked by the virus in
memory. The DOS CHKDSK program will not indicate any decrease in
total system and available free memory.
Once the Bit Addict virus is memory resident, it will infect .COM
programs, including COMMAND.COM, when they are executed. Infected
programs will have a file length increase of 477 bytes with the
virus being located at the end of the file. The file's date and
time in the DOS disk directory listing will not be altered. The
following text strings can be found within the viral code in all
Bit Addict infected programs:
"The Bit Addict says"
"You have a good taste for hard disks, it was delicious !!!"
It is unknown what this virus may do besides replicate.
Known variant(s) of Bit Addict are:
Bit Addict-496: Received in July, 1993, Bit Addict-496 appears
to be an earlier version of the virus described
above. It installs a 2,576 byte TSR when the first
infected program is executed, hooking interrupt 21.
Once memory resident, this virus infects .COM
programs, including COMMAND.COM, when they are
executed. Infected programs will have a file length
increase of 496 bytes with the virus being located
at the end of the file. The program's date and time
in the DOS disk directory listing will have been
updated to the current system date and time. No
text strings are visible within the viral code.
Origin: Unknown July, 1993.