Virus Name: Cerburus
V Status: Rare
Discovery: September, 1992
Symptoms: .COM file growth; dog's head graphic; message; interfers with
.BAT file execution
Eff Length: 1,353 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, IBMAV, Sweep, NAV, ChAV,
NShld, AVTK/N, Sweep/N, NAV/N, IBMAV/N, Innoc
Removal Instructions: Delete infected files
The Cerburus virus was submitted in September, 1992. Its origin or
place of isolation is unknown. Cerburus is a memory resident
infector of .COM programs over approximately 2K in size, including
The first time a program infected with the Cerburus virus is
executed, the Cerburus virus will install itself memory resident
in free available system memory, hooking interrupts 21, 28, and 60.
There will be no change to total system or available free memory
as indicated by the DOS CHKDSK program.
Once Cerburus is memory resident, it will infect .COM programs
located in the current directory when a DOS DIR command is
issued. Infected programs will have a file length increase of
1,353 bytes with the virus being located at the beginning of the
file. The program's date and time in the DOS disk directory
listing will not be altered.
Systems infected with the Cerburus virus may notice a graphic
dog's head appear on the upper half of the system display. The
head will move from left to right, wiping out the contents of
the display as it passes. At the same time, the text below
will be displayed at the top of the screen.
The above text string is not visible in infected programs, though
the following text strings can be found within the viral code in
all infected programs:
Execution of .BAT files may be interfered with when Cerburus is
memory resident which may produce odd results. It is particularly
noticeable in batch file execution of the DOS DIR command.