Cossiga Virus

 Virus Name:  Cossiga 
 V Status:    Rare 
 Discovery:   February, 1992 
 Symptoms:    .EXE file growth; video mode change to 40 columns; message 
              displayed; .EXE programs don't execute properly 
 Origin:      Italy 
 Eff Length:  875 - 899 Bytes 
 Type Code:   PNE - Parasitic Non-Resident .EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, NAV, PCScan, 
                    IBMAV, NAVDX, VAlert, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Cossiga virus was received in February, 1992.  It is originally 
       from Italy.  Cossiga is a non-resident, direct action infector of 
       .EXE programs. 
       When a program infected with the Cossiga virus is executed, the 
       Cossiga virus will search the current directory for the first 
       uninfected .EXE program.  If an uninfected .EXE program is found, 
       it will then infect it.  Once it has completed infecting the 
       program, the virus will then switch the system video mode to a 
       40 column display, and the following message will be displayed in 
       block letters: 
               "COSSIGA ?!  NO GRAZIE! 
                By Amissi dee Panoce (c) 1991 PADOVA" 
       The host program the user was attempting to execute will not 
       function, instead the user will be returned to the DOS prompt. 
       Programs infected with the Cossiga virus will have a file length 
       increase of 875 - 899 bytes.  The virus will be located at the 
       end of the infected program.  The file's date and time in the 
       DOS disk directory listing will not be altered.  The following 
       text strings can be found within the viral code in Cossiga infected 
               "AXI TY" 
       Known variant(s) of Cossiga are: 
       Cossiga-B: Based on the Cossiga virus described above, this 
                  variant adds 895 to 899 bytes to the .EXE programs it 
                  infects.  The virus will be located at the end of the 
                  file.  The following text strings are encrypted within 
                  the Cossiga-B viral code: 
                  "COSSIGA ?!  NO GRAZIE!" 
                  "By Amissi dee Panoce (c) 1991 PADOVA" 
                  "AEGE/B V1.2" 
                  "*.* *.exe" 
                  The first three text strings will be displayed as a 
                  message in 40 column mode, with a blank line between each 
                  string, whenever an infected program is executed. 
                  Origin:  Spain  May, 1993. 
       See:   Friends 

Show viruses from discovered during that infect .

Main Page