Virus Name: Commonwealth
V Status: Rare
Discovery: December, 1993
Symptoms: .COM & .ESE growth; file date/time seconds set to "58"; TSR
Eff Length: 800 - 815 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, ViruScan, AVTK, Sweep, IBMAV, NAVDX,
VAlert, NAV, ChAV, PCScan,
Sweep/N, NShld, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N
Removal Instructions: Delete infected files
The Commonwealth virus was received in December, 1993. Its origin or
point of isolation is unknown. Commonwealth is a memory resident
infector of .COM and .EXE programs, but not COMMAND.COM.
When the first Commonwealth infected program is executed, this virus
will install itself memory resident as a low system memory TSR of
2,048 bytes. Interrupt 21 will be hooked by the virus in memory.
Once the Commonwealth virus is memory resident, it will infect .COM
and .EXE programs when they are executed. Infected programs will have
a file length increase of 800 to 815 bytes with the virus being
located at the end of the file. The program's date and time in the
DOS disk directory listing will not appear to be altered, but it will
have the seconds field set to "58". The following text string is
encrypted within the Commonwealth viral code:
"Commonwealth of Independent States"
It is unknown what Commonwealth does besides replicate.