Black Wizard Virus

 Virus Name:  Black Wizard 
 V Status:    Rare 
 Discovery:   November, 1991 
 Symptoms:    .EXE file growth; music 
 Origin:      Unknown 
 Eff Length:  2,051 Bytes 
 Type Code:   PNE - Parasitic Non-Resident .EXE Infector 
 Detection Method:  ViruScan, Sweep, NAV, AVTK, F-Prot, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Black Wizard virus was received in November, 1991.  Its origin 
       is unknown.  Black Wizard is a non-resident, direct action infector 
       of .EXE programs.  It is based on the Enigma and Yankee 2 viruses. 
       When a program infected with Black Wizard is executed, the virus 
       will search the current directory for an uninfected .EXE program to 
       infect.  If one is found, it will become infected with the virus. 
       Black Wizard infected programs will have a file length increase of 
       2,051 bytes with the virus being located at the end of the 
       infected file.  There will be no change in the file's date and time 
       in a DOS directory listing.  Two text strings can be found within 
       the viral code in infected programs: 
               "*.exe *.*" 
               "Black Wizard" 
       Execution of infected programs may result in the virus playing the 
       tune "Turkey In The Straw" on the system speaker, followed by the 
       program executing. 
       Black Wizard may be a research virus, and not in the public domain, 
       as the original sample is not a natural occurrence of the virus. 
       See:   Enigma   Yankee 2 

Show viruses from discovered during that infect .

Main Page