Crocodiles Virus

Virus Name: Crocodiles Aliases: Crocodiles.1592 V Status: New Discovery: January, 1996 Symptoms: .COM & .EXE growth; frequent system hangs; unexpected system reboots Origin: Unknown Eff Length: 1,592 - 1,606 Bytes Type Code: PRAK - Parasitic Resident .COM & .EXE Infector Detection Method: NAV, NAVDX, AVTK, ViruScan, F-Prot, IBMAV, ChAV, NAV/N, AVTK/N, IBMAV/N, NShld, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Crocodiles virus was received in January, 1996. Its origin or point of isolation is unknown. Crocodiles is a memory resident infector of .COM and .EXE files, including COMMAND.COM. When the first Crocodiles infected program is executed, this virus will become memory resident and infect the copy of COMMAND.COM indicated by the COMSPEC environmental variable. A system hang will then occur. Rebooting the system will be successful, and the virus will become memory resident. When the user executes any program, another system hang will occur. If this program was previously not infected by the virus, it will become infected by the virus. If it was previously infected, the virus will not reinfect it. Programs infected with the Crocodiles virus will have a file length increase of 1,592 to 1,606 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code: "SCAN.EXE" "CROCODILES" SCAN.EXE will not be infected by the virus when it is executed, though a system hang will still occur when the virus is memory resident.