Virus Name: 923
Aliases: Hey You
V Status: Rare
Discovery: June, 1991
Symptoms: .COM & .EXE file growth; message; programs may fail to
execute; decrease in total system and available memory
Eff Length: 923 Bytes
Type Code: PRhAK - Parasitic Resident COM & .EXE Infector
Detection Method: ViruScan, Sweep, AVTK, NAV, ChAV,
F-Prot, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The 923 virus was received in June, 1991. Its origin is unknown.
923 is a memory resident generic infector of .COM and .EXE programs,
it will infect COMMAND.COM.
The first time a program infected with 923 is executed, 923 will
install itself memory resident at the top of system memory but
below the 640K DOS boundary. Total system and available memory,
as indicated by the DOS CHKDSK program, will decrease by 944 bytes.
Interrupt 21 will be hooked by the virus in memory.
Once 923 is memory resident, it will infect .COM and .EXE programs
when they are executed. If COMMAND.COM is executed, it will become
infected. Programs infected with 923 will increase in size by
923 to 942 bytes with the virus being located at the end of the
infected file. This virus does not alter infected files' date and
time in the disk directory.
Programs infected with 923 will contain the following message which
is part of the viral code:
"Hey, YOU !!!
Something's happening to you !
Guess what it is ?!
HA HA HA HA"
This message may be displayed when the user attempts to execute a
program. When the message is displayed, the program the user was
attempting to execute will be terminated and the user returned to
a DOS prompt.