Cerburus Virus

Virus Name: Cerburus Aliases: V Status: Rare Discovery: September, 1992 Symptoms: .COM file growth; dog's head graphic; message; interfers with .BAT file execution Origin: Unknown Eff Length: 1,353 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, IBMAV, Sweep, NAV, ChAV, NAVDX, VAlert, NShld, AVTK/N, Sweep/N, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Cerburus virus was submitted in September, 1992. Its origin or place of isolation is unknown. Cerburus is a memory resident infector of .COM programs over approximately 2K in size, including COMMAND.COM. The first time a program infected with the Cerburus virus is executed, the Cerburus virus will install itself memory resident in free available system memory, hooking interrupts 21, 28, and 60. There will be no change to total system or available free memory as indicated by the DOS CHKDSK program. Once Cerburus is memory resident, it will infect .COM programs located in the current directory when a DOS DIR command is issued. Infected programs will have a file length increase of 1,353 bytes with the virus being located at the beginning of the file. The program's date and time in the DOS disk directory listing will not be altered. Systems infected with the Cerburus virus may notice a graphic dog's head appear on the upper half of the system display. The head will move from left to right, wiping out the contents of the display as it passes. At the same time, the text below will be displayed at the top of the screen. "***CERBURUS***" The above text string is not visible in infected programs, though the following text strings can be found within the viral code in all infected programs: "????????COM" "*.COM" Execution of .BAT files may be interfered with when Cerburus is memory resident which may produce odd results. It is particularly noticeable in batch file execution of the DOS DIR command.