Virus Name: Cinderella
V Status: Rare
Discovery: July, 1991
Symptoms: .COM file growth; TSR
Eff Length: 390 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Cinderella virus was isolated in Finland in July, 1991.
Cinderella is a memory resident infector of .COM files, including
The first time a program infected with Cinderella is executed, the
virus will install itself memory resident as a low system memory
TSR of 560 bytes. Interrupt 2E will be hooked by the virus.
After Cinderella is memory resident, it will infect .COM programs,
including COMMAND.COM, when they are executed or opened for any
reason. Infected .COM files will increase in size by 390 bytes.
The virus will be located at the end of the infected file. The
following text string can be found within infected files:
Cinderella doesn't do anything besides replicate.
Known variant(s) of Cinderella are:
Cinderella-B: Functionally equivalent to the original virus,
this variant has two bytes which differ.
Origin: Finland November, 1991
Cinderella.C: Similar to the original virus, this variant adds
its viral code to the beginning of all infected
programs. It contains the following text string:
Origin: Unknown May, 1994.