Copyright Virus
Virus Name: Copyright
Aliases: V1193
V Status: Rare
Discovery: November, 1991
Symptoms: .COM file growth; file date/time changes; decrease in total
system and available free memory
Origin: USSR
Eff Length: 1,193 - 1,208 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, Sweep, AVTK, F-Prot, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
NAV/N, IBMAV/N
Removal Instructions: Delete infected files
General Comments:
The Copyright virus was received in November, 1991. It is from
the USSR. Copyright is a memory resident infector of .COM programs,
including COMMAND.COM.
The first time a program infected with the Copyright virus is
executed, the virus will install itself memory resident at the
top of system memory but below the 640K DOS boundary. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 1,200 bytes. Interrupt 21 will
be hooked by the Copyright virus. Interrupt 12's return will not
have been moved.
After the Copyright virus has become memory resident, it will
infect .COM programs, including COMMAND.COM, when they are
executed. Infected programs will have a file length increase of
1,193 to 1,208 bytes with the virus being located at the end of
the infected files. Copyright infected programs will also have
their date and time in the DOS disk directory updated to the
system date and time when infection occurred.
The following text strings can be found within the viral code in
Copyright infected programs:
"(C) 1987 American Megatrends Inc.286-BIOS"
"(C) 1989 American Megatrends Inc"
"(c) COPYRIGHT 1984,1987 Award Software Inc."
"ALL RIGHTS RESERVED"
The virus was named due to the above fake copyright messages which
appear within infected programs. American Megatrends and Award
Software had nothing to do with this virus' creation.
It is unknown if Copyright does anything besides replicate.
Known variant(s) of Copyright are:
Copyright-1205: Received in December, 1992, Copyright-1205 is
a 1,205 byte variant of the Copyright virus described above.
Its size in memory is 1,216 bytes, moving interrupt 12's
return. Like the original virus, it hooks interrupt 21.
Once it is memory resident, Copyright-1205 infects .COM
programs when they are executed, adding 1,205 to 1,220 bytes
to the file length. The virus will be located at the end of
the file. The program's date and time in the DOS disk
directory listing will have been updated to the current
system date and time when infection occurred. The following
text strings can be found within the Copyright-1205 viral
code in all infected programs:
"COM"
"(C)1991 Software Developed by Maxi"
"Lena All Rights Reserved"
"(c) COPYRIGHT 1984,1987 Award Software Inc."
"ALL RIGHTS RESERVED"
Origin: USSR December, 1992.
Ungame: Received in October, 1992, Ungame is a 766 byte variant
of the Copyright virus described above. Its size in memory
is 768 bytes, and it hooks interrupts 08 and 21. Once
resident, it infects .COM and .EXE programs when they are
executed. Infected programs will have a file length increase
of 766 bytes with the virus being located at the end of the
file. Infected .EXE files will have the structure of .COM
files after infection. The program's date and time in the
DOS disk directory will have been updated to the current
system date and time when infection occurred. The following
text strings can be found within the viral code in all
Ungame infected programs:
"Come On, no. 51, You Time is up."
"Ungame(C)Dr"
Origin: Unknown October, 1992.