Virus Name: Blood
V Status: Rare
Discovery: August, 1990
Symptoms: .COM file length increase; system reboots and/or hangs;
cascading screen effect
Origin: Natal, Republic of South Africa
Eff Length: 418 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, NAV, AVTK, F-Prot, Sweep,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Blood virus was submitted by Fridrik Skulason in August, 1990.
It was originally isolated in Natal, Republic of South Africa.
There are two variants of this virus, Blood and Blood2. This virus
is a non-resident infector of .COM files, including COMMAND.COM.
When a program infected with the Blood virus is executed, it will
infect one .COM file located in the C: drive root directory. The
newly infected file will have increased in length by 418 bytes. If
the program just infected is COMMAND.COM, a system reboot will
occur. Following the system reboot, executing an infected program
will result in a cascading effect of the cursor down the screen.
The next .COM file executed will then result in the hard disk being
accessed followed by the system hanging. Spurious characters from
memory may also appear on the screen on the line below the command
After August 15, execution of an infected program will result in a
Known variant(s) of Blood are:
Blood2: Similar to Blood, with the major difference being that
system reboots, system hangs, and the cascading cursor
effect no longer occur. This variant also does not hang
the system after August 15th.