Cacophony Virus
Virus Name: Cacophony
Aliases: Cacophony 1
V Status: Rare
Discovery: February, 1994
Symptoms: .EXE file growth; file date/time changed to 4:08a
tune played on system speaker
Origin: Unknown
Eff Length: 950 - 960 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan, F-Prot, AVTK, IBMAV, Sweep, NAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, IBMAV/N, AVTK/N, NProt, NAV/N
Removal Instructions: Delete infected files
General Comments:
The Cacophony, or Cacophony 1, virus was received in February, 1994.
Its origin or point of isolation is unknown. Cacophony is a non-
resident, direct action infector of .EXE programs. A later version
of this virus, Cacophony 2, is memory resident adds encryption to the
virus, as well as no longer altering the file date and time.
When a Cacophony infected program is executed, this virus will infect
one .EXE file located in the current directory. Infected programs
will have a file length increase of 950 to 960 bytes with the virus
being located at the end of the file. The program's date and time
in the DOS disk directory listing will have been altered so that the
time field is set to 4:08a. The following text strings are visible
within the viral code in all Cacophony infected programs:
"cacophony"
"*.e?*"
"\ .. smartc*.cps"
Cacophony may interfer with the functionality of the Central Point
Anti-Virus program. The virus also installs a small portion of code
at the top of system memory but below the 640K DOS boundary, hooking
interrupt 08. This code is not a complete copy of the virus, but a
routine to play a tune on the system speaker sometime after the first
infected program is executed.
Known variant(s) of Cacophony are:
Cacophony 2: A later version of the Cacophony virus, this variant
also infects one .EXE file in the current directory
when an infected program is executed. Infected programs
will have a file length increase of 1,056 to 1,066 bytes
with the virus being located at the end of the file. The
program's date and time in the DOS disk directory listing
will not be altered. The following text strings are
encrypted within the Cacophony viral code:
"CACOPHONY * EpidemicWare 93 G.I.P.Po."
"Cacofonia"
"*.EXE \ *.* smartchk.cp?"
Like the original virus, this variant will play a tune
on the system speaker after being present on the system
for some time. It may also interfer with the functioning
of Central Point Anti-Virus.
Origin: Unknown February, 1994.