923 Virus

Virus Name: 923 Aliases: Hey You V Status: Rare Discovery: June, 1991 Symptoms: .COM & .EXE file growth; message; programs may fail to execute; decrease in total system and available memory Origin: Unknown Eff Length: 923 Bytes Type Code: PRhAK - Parasitic Resident COM & .EXE Infector Detection Method: ViruScan, Sweep, AVTK, NAV, ChAV, F-Prot, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The 923 virus was received in June, 1991. Its origin is unknown. 923 is a memory resident generic infector of .COM and .EXE programs, it will infect COMMAND.COM. The first time a program infected with 923 is executed, 923 will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available memory, as indicated by the DOS CHKDSK program, will decrease by 944 bytes. Interrupt 21 will be hooked by the virus in memory. Once 923 is memory resident, it will infect .COM and .EXE programs when they are executed. If COMMAND.COM is executed, it will become infected. Programs infected with 923 will increase in size by 923 to 942 bytes with the virus being located at the end of the infected file. This virus does not alter infected files' date and time in the disk directory. Programs infected with 923 will contain the following message which is part of the viral code: "Hey, YOU !!! Something's happening to you ! Guess what it is ?! HA HA HA HA" This message may be displayed when the user attempts to execute a program. When the message is displayed, the program the user was attempting to execute will be terminated and the user returned to a DOS prompt.