Chris Virus


 Virus Name:  Chris 
 Aliases:    
 V Status:    Rare 
 Discovery:   November, 1993 
 Symptoms:    .COM file growth; file date/time changes; system hangs; 
              beeping and display of message; programs fail to function 
 Origin:      Italy 
 Eff Length:  463 Bytes 
 Type Code:   PRaCK - Parasitic Resident .COM Infector 
 Detection Method:  F-Prot, ViruScan, AVTK, Sweep, IBMAV, NAV, 
                    NAVDX, VAlert, ChAV, 
                    NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Chris virus was received in November, 1993.  It appears to be 
       from Italy.  Chris is a memory resident infector of .COM programs, 
       including COMMAND.COM. 
 
       When the first Chris infected program is executed, the Chris virus 
       will install itself memory resident in available system memory, 
       hooking interrupt 21.  Total system and available free memory, as 
       indicated by the DOS CHKDSK, will not be altered. 
 
       Once memory resident, the Chris virus will infect .COM programs when 
       they are executed.  Infected programs will have a file length increase 
       of 463 bytes with the virus being located at the end of the file. 
       The program's date and time in the DOS disk directory listing will 
       have been updated to the current system date and time when infection 
       occurred.  One text string is visible within the viral code in 
       infected programs: 
 
               "" 
 
       The following text string is encrypted within the viral code: 
  
               "Mary,.... ti AMO!" 
 
       This second text string is occassionally displayed by the virus 
       as a message on the system monitor, accompanied by beeping.  When 
       the message is displayed, a system hang may also occur.  Infected 
       programs may not function properly as a result. 

Show viruses from discovered during that infect .

Main Page