Virus Name: Cocaine
V Status: Rare
Discovery: July, 1994
Symptoms: .EXE file growth; file date/time changes
Eff Length: 535 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: F-Prot, AVTK, ViruScan, Sweep, IBMAV, NAV,
NAVDX, VAlert, PCScan,
AVTK/N, Sweep/N, IBMAV/N, NShld, NProt, NAV/N, LProt
Removal Instructions: Delete infected files
The Cocaine virus was received in July, 1994. Its origin or point
of isolation is unknown. Cocaine is a non-resident, direct action
infector of .EXE files.
When a program infected with the Cocaine virus is executed, this
virus will infect all of the .EXE files located in the current
directory. Infected programs will have a file length increase of
535 bytes with the virus being located at the end of the file. The
program's date and time in the DOS disk directory listing will have
been updated to the current system date and time when infection
occurred. The following text strings can be found within the viral
code in all infected files:
"Cocaine [CoKe](c) Metal Militia/Immortal Riot"
"Love to LISA :)"
"Cocaine's running thrue your vains"
"It seems you have become an addict"