China Virus

 Virus Name:  China 
 V Status:    Rare 
 Discovery:   March, 1993 
 Symptoms:    .COM & .EXE growth; TSR 
 Origin:      China 
 Eff Length:  1,824 - 1,838 Bytes 
 Type Code:   PRsA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  Sweep, AVTK, F-Prot, ViruScan, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, LProt, NShld, AVTK/N, NAV/N, Innoc, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The China virus was submitted in March, 1993, and is probably from 
       China.  The China virus is a memory resident infector of .COM and 
       .EXE programs, and does not infect COMMAND.COM.  It is based on the 
       Jerusalem virus. 
       When the first China infected program is executed, the China virus 
       will install itself memory resident as a low system memory TSR of 
       2,128 bytes.  Interrupts 21 and 24 will be hooked by the China 
       virus in memory. 
       Once memory resident, the China virus will infect .COM and .EXE 
       programs, but not COMMAND.COM, when they are executed.  Infected .COM 
       programs will will have a file length increase of 1,831 bytes with 
       the virus being located at the beginning of the file.  Infected .EXE 
       programs will have a file length increase of 1,824 to 1,838 bytes 
       with the virus being located at the end of the file.  The program's 
       date and time in the DOS disk directory listing will not be altered. 
       Unlike many variants of the Jerusalem virus, China does not reinfect 
       previously infected programs.  No text strings are visible within the 
       viral code in China infected programs. 
       It is unknown what China may do besides replicate. 
       See:   Jerusalem 

Show viruses from discovered during that infect .

Main Page