Bobo Virus


 Virus Name:  Bobo 
 Aliases:     Bobo.530 
 V Status:    New 
 Discovery:   October, 1994 
 Symptoms:    .COM file growth; 
              decrease in total system & available free memory 
 Origin:      Unknown 
 Eff Length:  530 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  AVTK, ViruScan, IBMAV, Sweep, F-Prot, NAV, 
                    NAVDX, VAlert, PCScan, 
                    AVTK/N, Sweep/N, NShld, IBMAV/N, NProt, NAV/N, LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Bobo virus was received in October, 1994.  Its origin or 
       point of isolation is unknown.  Bobo is a memory resident infector 
       of .COM files, including COMMAND.COM. 
 
       When the first Bobo infected program is executed, the Bobo virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, not moving interrupt 12's return.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will have decreased by 1,024 bytes.  Interrupts 1C and 21 
       will be hooked by the virus in memory. 
 
       Once the Bobo virus is memory resident, it will infect .COM programs, 
       including COMMAND.COM, when they are executed.  Infected programs 
       will have a file length increase of 530 bytes with the virus being 
       located at the end of the file.  The program's date and time in the 
       DOS disk directory listing will not be altered.  The following text 
       strings are visible within the viral code in all Bobo infected 
       programs: 
 
               "Happy Birthday, Bobo!" 
               "BOBO" 

Show viruses from discovered during that infect .

Main Page