Como Virus

Virus Name: Como Aliases: Como-Lake V Status: Rare Discovery: December, 1992 Symptoms: .EXE file growth Origin: Italy Eff Length: 2,022 - 2,035 Bytes Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: AVTK, IBMAV, NAV, Sweep, F-Prot, ViruScan, VAlert, NAVDX, ChAV, Sweep/N, NShld, Innoc, NProt, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Como, or Como-Lake, virus was submitted in December, 1992, and is originally from Italy. Como is a non-resident, direct action infector of .EXE programs. When a program infected with the Como virus is executed, this virus may infect a .EXE program in the current directory, though it does this only with about a 1 in 7 probability. Infected programs will have a file length increase of 2,022 to 2,035 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text is encrypted within the viral code in Como infected programs: "This is the" "COMO-LAKE" "virus" "(rel. 1.1)" "I'm a non-destructive virus developed to study the worldwide" "diffusion rate. I was released in September 1990 by a software" "group resident near Como lake (north Italy)." "Don't worry about your data on disk. My activity is limited only" "to auto-transferring into other program files. Perhaps you've got" "many files infected. It's your task to find and delete them." "Best wishes." "Pres a key to execute the program" "*.EXE" Known variant(s) of Como are: Como.1786: Received in May, 1995, Como.1786 is a 1,786 byte variant of the Como virus described above. It adds 1,786 to 1,802 bytes to the .EXE files it infects. The following text strings are encrypted within the viral code: "This is the" "COMO-LAKE" "virus 1.13" "I'm a non-destructive virus developed to study the worldwide" "diffusion rate. I was released in September 1990 by a software" "group resident near Como lake (north Italy)." "Don't worry about your data on disk. My activity is limited only" "to auto-transferring into other program files. Perhaps you've got" "many files infected. It's your task to find and delete them." "Best wishes." "Press a key to execute the program" "*.EXE" Origin: Unknown May, 1995.