Virus Name: Criminal
V Status: Rare
Discovery: January, 1992
Symptoms: .COM file growth; TSR; file allocation error on COMMAND.COM
Eff Length: 2,615 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, NAV, NAVDX,
IBMAV, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N,
Removal Instructions: Delete infected files
The Criminal virus was submitted in January, 1992. Its origin or
point of isolation is unknown. Criminal is a memory resident
infector of .COM files, including COMMAND.COM.
The first time a program infected with the Criminal virus is
executed, the Criminal virus will install itself memory resident as
a low system memory TSR of 480 bytes. This TSR will have hooked
interrupts 21, D0, and EA. An additional TSR of 3,712 bytes will
also be installed, though it will not have hooked any interrupts.
At this time, the Criminal virus will infect the first three .COM
files in the current directory.
With the original sample of Criminal received by the author of
VSUM, it does not infect programs other than when it becomes
memory resident. Further, it is only infectious from the original
sample, not from replicated samples.
Programs infected with the Criminal virus will increase in size
by 2,615 bytes. The virus will be located at the end of the
infected program. The file's date and time in the DOS disk
directory listing will not have been altered.
Systems infected with Criminal may notice that the DOS CHKDSK
program will indicate COMMAND.COM has a file allocation error.
This error only appears if the system has been booted from an
infected COMMAND.COM file.
It is unknown if Criminal does anything besides replicate.
Known variant(s) of Criminal are:
Criminal-B: Similar to the original virus, this variant infects
one .COM program each time an infected program is
executed, though it does not infect more than the first
three .COM programs in a directory. Its size in memory
is 470 bytes. Nineteen bytes differ from the original
Origin: Unknown October, 1992.