Butterflies Virus


 Virus Name:  Butterflies 
 Aliases:     Butterflies-302, Goddamn Butterflies 
 V Status:    Common 
 Discovery:   June, 1993 
 Isolated:    Illinois, United States 
 Symptoms:    .COM file growth; system hangs may occur 
 Origin:      Unknown 
 Eff Length:  302 Bytes 
 Type Code:   PNC - Parasitic Non-Resident .COM Infector 
 Detection Method:  AVTK, NAV, F-Prot, IBMAV, ViruScan, Sweep, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NProt, AVTK/N, Sweep/N, NShld, NAV/N, IBMAV/N, Innoc, 
                    LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Butterflies, Butterflies-302 or Goddamn Butterflies, virus was 
       received in June, 1993 from a VSUM user in the state of Illinois in 
       the United States.  Butterflies is a non-resident, direct action 
       infector of .COM programs, but not COMMAND.COM.  It has been given 
       a status of Common as many reports of this virus were received in 
       mid to late June 1993 due to its distribution on a shareware 
       communications package.  These reports were from the United States, 
       Canada, Europe, and Israel.  As such, its origin is unknown. 
 
       When a program infected with the Butterflies virus is executed, this 
       virus will infect all of the .COM files located in the current 
       directory which meet its selection criteria.  Infected programs will 
       have a file length increase of 302 bytes with the virus being located 
       at the end of the file.  The program's date and time in the DOS disk 
       directory listing will not be altered.  The following text strings 
       are visible within the viral code in all Butterflies infected 
       programs: 
 
               "Goddamn Butterflies" 
               "*.COM" 
 
       Butterflies doesn't appear to do much besides replicate, though 
       system hangs may unexpectantly occur when infected programs 
       are executed. 
 
       Known variant(s) of Butterflies are: 
       Crusades: Based on the Butterflies virus described above, this 
                 variant will infect three or four .EXE files in the 
                 current directory when an infected program is executed. 
                 Infected programs increase in size by 302 bytes with the 
                 virus being located at the end of the file.  The program's 
                 date and time in the DOS disk directory listing will not 
                 be altered.  The following text strings are visible within 
                 the viral code in all Crusades infected programs: 
                 "Hurray The Crusades" 
                 "*.EXE" 
                 System hangs frequently occur when infected programs are 
                 executed. 
                 Origin:  Unknown  July, 1993. 
       Crusades COM: Similar to the Crusades variant, this variant will 
                 infect four .COM files in the current current directory when 
                 an infected program is executed.  Infected programs increase 
                 in size by 302 bytes with the virus being located at the end 
                 of the file.  The program's date and time in the DOS disk 
                 directory listing will not be altered.  The following text 
                 strings are visible within the viral code in all Crusades COM 
                 infected programs: 
                 "Hurray The Crusades" 
                 "*.COM" 
                 Origin:  Unknown  January, 1994. 

Show viruses from discovered during that infect .

Main Page