Chemnitz Virus

 Virus Name:  Chemnitz 
 V Status:    Rare 
 Discovery:   March, 1993 
 Symptoms:    .EXE file growth; system hangs; 
              decrease in total system & available free memory 
 Origin:      Unknown 
 Eff Length:  767 - 781 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  AVTK, F-Prot, Sweep, ViruScan, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, NShld, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Chemnitz virus was submitted in March, 1993.  Its origin or point 
       of isolation is unknown.  Chemnitz is a memory resident infector of 
       .EXE programs, and does not infect very small .EXE files. 
       When the first Chemnitz infected program is executed, the Chemnitz 
       virus will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary, hooking interrupt 21.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will have decreased by 848 bytes.  Interrupt 12's return 
       will not be moved. 
       Once memory resident, the Chemnitz virus will infect .EXE programs, 
       other than very small .EXE programs, when they are executed. 
       Infected programs will have a file length increase of 767 to 781 
       bytes with the virus being located at the end of the file.  The 
       program's date and time in the DOS disk directory listing will not 
       be altered.  The following text strings are visible within the viral 
       code in all Chemnitz infected programs: 
               "MsDos    COMMAND" 
       Systems infected with the Chemnitz virus may experience system hangs 
       when .EXE programs are executed. 

Show viruses from discovered during that infect .

Main Page