Blood Virus

Virus Name: Blood Aliases: Blood2 V Status: Rare Discovery: August, 1990 Symptoms: .COM file length increase; system reboots and/or hangs; cascading screen effect Origin: Natal, Republic of South Africa Eff Length: 418 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, NAV, AVTK, F-Prot, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Blood virus was submitted by Fridrik Skulason in August, 1990. It was originally isolated in Natal, Republic of South Africa. There are two variants of this virus, Blood and Blood2. This virus is a non-resident infector of .COM files, including COMMAND.COM. When a program infected with the Blood virus is executed, it will infect one .COM file located in the C: drive root directory. The newly infected file will have increased in length by 418 bytes. If the program just infected is COMMAND.COM, a system reboot will occur. Following the system reboot, executing an infected program will result in a cascading effect of the cursor down the screen. The next .COM file executed will then result in the hard disk being accessed followed by the system hanging. Spurious characters from memory may also appear on the screen on the line below the command line. After August 15, execution of an infected program will result in a system hang. Known variant(s) of Blood are: Blood2: Similar to Blood, with the major difference being that system reboots, system hangs, and the cascading cursor effect no longer occur. This variant also does not hang the system after August 15th.