Black Wizard Virus

Virus Name: Black Wizard Aliases: V Status: Rare Discovery: November, 1991 Symptoms: .EXE file growth; music Origin: Unknown Eff Length: 2,051 Bytes Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: ViruScan, Sweep, NAV, AVTK, F-Prot, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Black Wizard virus was received in November, 1991. Its origin is unknown. Black Wizard is a non-resident, direct action infector of .EXE programs. It is based on the Enigma and Yankee 2 viruses. When a program infected with Black Wizard is executed, the virus will search the current directory for an uninfected .EXE program to infect. If one is found, it will become infected with the virus. Black Wizard infected programs will have a file length increase of 2,051 bytes with the virus being located at the end of the infected file. There will be no change in the file's date and time in a DOS directory listing. Two text strings can be found within the viral code in infected programs: "*.exe *.*" "Black Wizard" Execution of infected programs may result in the virus playing the tune "Turkey In The Straw" on the system speaker, followed by the program executing. Black Wizard may be a research virus, and not in the public domain, as the original sample is not a natural occurrence of the virus. See: Enigma Yankee 2