Cossiga Virus
Virus Name: Cossiga
Aliases:
V Status: Rare
Discovery: February, 1992
Symptoms: .EXE file growth; video mode change to 40 columns; message
displayed; .EXE programs don't execute properly
Origin: Italy
Eff Length: 875 - 899 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, PCScan,
IBMAV, NAVDX, VAlert, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
NAV/N, IBMAV/N
Removal Instructions: Delete infected files
General Comments:
The Cossiga virus was received in February, 1992. It is originally
from Italy. Cossiga is a non-resident, direct action infector of
.EXE programs.
When a program infected with the Cossiga virus is executed, the
Cossiga virus will search the current directory for the first
uninfected .EXE program. If an uninfected .EXE program is found,
it will then infect it. Once it has completed infecting the
program, the virus will then switch the system video mode to a
40 column display, and the following message will be displayed in
block letters:
"COSSIGA ?! NO GRAZIE!
By Amissi dee Panoce (c) 1991 PADOVA"
The host program the user was attempting to execute will not
function, instead the user will be returned to the DOS prompt.
Programs infected with the Cossiga virus will have a file length
increase of 875 - 899 bytes. The virus will be located at the
end of the infected program. The file's date and time in the
DOS disk directory listing will not be altered. The following
text strings can be found within the viral code in Cossiga infected
programs:
"????????EXE"
"*.*"
"*.exe"
"AXI TY"
Known variant(s) of Cossiga are:
Cossiga-B: Based on the Cossiga virus described above, this
variant adds 895 to 899 bytes to the .EXE programs it
infects. The virus will be located at the end of the
file. The following text strings are encrypted within
the Cossiga-B viral code:
"COSSIGA ?! NO GRAZIE!"
"By Amissi dee Panoce (c) 1991 PADOVA"
"AEGE/B V1.2"
"*.* *.exe"
The first three text strings will be displayed as a
message in 40 column mode, with a blank line between each
string, whenever an infected program is executed.
Origin: Spain May, 1993.
See: Friends