Bit Addict Virus


 Virus Name:  Bit Addict 
 Aliases:    
 V Status:    Rare 
 Discovery:   November, 1992 
 Symptoms:    .COM file growth 
 Origin:      The Netherlands 
 Eff Length:  477 Bytes 
 Type Code:   PRaCK - Parasitic Resident .COM Infector 
 Detection Method:  F-Prot, Sweep, AVTK, ViruScan, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, LProt, NShld, NProt, AVTK/N, NAV/N, IBMAV/N, 
                    Innoc 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Bit Addict virus was received from the Netherlands in November, 
       1992.  Bit Addict is a memory resident infector of .COM programs, 
       including COMMAND.COM. 
 
       The first time a program infected with the Bit Addict virus is 
       executed, the Bit Addict virus will install itself memory resident 
       in Video Card Memory, with a hook to this memory resident in low 
       available memory.  Interrupt 21 will be hooked by the virus in 
       memory.  The DOS CHKDSK program will not indicate any decrease in 
       total system and available free memory. 
 
       Once the Bit Addict virus is memory resident, it will infect .COM 
       programs, including COMMAND.COM, when they are executed.  Infected 
       programs will have a file length increase of 477 bytes with the 
       virus being located at the end of the file.  The file's date and 
       time in the DOS disk directory listing will not be altered.  The 
       following text strings can be found within the viral code in all 
       Bit Addict infected programs: 
 
               "BIT ADDICT" 
               "The Bit Addict says" 
               "You have a good taste for hard disks, it was delicious !!!" 
 
       It is unknown what this virus may do besides replicate. 
 
       Known variant(s) of Bit Addict are: 
       Bit Addict-496: Received in July, 1993, Bit Addict-496 appears 
                       to be an earlier version of the virus described 
                       above.  It installs a 2,576 byte TSR when the first 
                       infected program is executed, hooking interrupt 21. 
                       Once memory resident, this virus infects .COM 
                       programs, including COMMAND.COM, when they are 
                       executed.  Infected programs will have a file length 
                       increase of 496 bytes with the virus being located 
                       at the end of the file.  The program's date and time 
                       in the DOS disk directory listing will have been 
                       updated to the current system date and time.  No 
                       text strings are visible within the viral code. 
                       Origin:  Unknown  July, 1993. 

Show viruses from discovered during that infect .

Main Page