Cinderella Virus

Virus Name: Cinderella Aliases: V Status: Rare Discovery: July, 1991 Symptoms: .COM file growth; TSR Origin: Finland Eff Length: 390 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Cinderella virus was isolated in Finland in July, 1991. Cinderella is a memory resident infector of .COM files, including COMMAND.COM. The first time a program infected with Cinderella is executed, the virus will install itself memory resident as a low system memory TSR of 560 bytes. Interrupt 2E will be hooked by the virus. After Cinderella is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed or opened for any reason. Infected .COM files will increase in size by 390 bytes. The virus will be located at the end of the infected file. The following text string can be found within infected files: "cInDeReL.la" Cinderella doesn't do anything besides replicate. Known variant(s) of Cinderella are: Cinderella-B: Functionally equivalent to the original virus, this variant has two bytes which differ. Origin: Finland November, 1991 Cinderella.C: Similar to the original virus, this variant adds its viral code to the beginning of all infected programs. It contains the following text string: "CindyRul.ez 2" Origin: Unknown May, 1994.