Virus Name: China
V Status: Rare
Discovery: March, 1993
Symptoms: .COM & .EXE growth; TSR
Eff Length: 1,824 - 1,838 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: Sweep, AVTK, F-Prot, ViruScan, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
Sweep/N, LProt, NShld, AVTK/N, NAV/N, Innoc, IBMAV/N
Removal Instructions: Delete infected files
The China virus was submitted in March, 1993, and is probably from
China. The China virus is a memory resident infector of .COM and
.EXE programs, and does not infect COMMAND.COM. It is based on the
When the first China infected program is executed, the China virus
will install itself memory resident as a low system memory TSR of
2,128 bytes. Interrupts 21 and 24 will be hooked by the China
virus in memory.
Once memory resident, the China virus will infect .COM and .EXE
programs, but not COMMAND.COM, when they are executed. Infected .COM
programs will will have a file length increase of 1,831 bytes with
the virus being located at the beginning of the file. Infected .EXE
programs will have a file length increase of 1,824 to 1,838 bytes
with the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will not be altered.
Unlike many variants of the Jerusalem virus, China does not reinfect
previously infected programs. No text strings are visible within the
viral code in China infected programs.
It is unknown what China may do besides replicate.