Virus Name: Chad
V Status: Rare
Discovery: September, 1992
Symptoms: .COM file growth; file date/time changed to 00-00-80 00:00;
Eff Length: 751 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, Sweep, ViruScan, IBMAV, AVTK,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, LProt, Innoc, NProt, IBMAV/N,
Removal Instructions: Delete infected files
The Chad virus was submitted in September, 1992. It is originally
from England. Chad is a non-resident, direct action infector of
.COM programs, including COMMAND.COM.
When a program infected with the Chad virus is executed, this
virus will search the current directory to locate a previouly
uninfected .COM program to infect. If one is found, it will
be infected by the virus. Programs infected with the Chad virus
will have a file length increase of 751 bytes with the virus
being located at the end of the file. The program's date and
time in the DOS disk directory listing will appear to be blank
or missing, though it has actually been set to 00-00-80 00:00.
The following text strings can be found within the Chad viral
code in all infected programs:
"WOT!! No Anti - Virus"
"CHAD Against Damaging Viruses ... Save Our Software. 1992."
The Chad virus contains code to display the message above once the
10th generation of the virus has occurred.