1067 Virus


 Virus Name:  1067 
 Aliases: 
 V Status:    Rare 
 Discovery:   January, 1991 
 Symptoms:    .COM file growth; decrease in total system & available free 
              memory; TSR; error messages 
 Origin:      Europe 
 Eff Length:  1,067 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, NAV, AVTK, Sweep, ChAV, 
                    F-Prot, IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
                  
 General Comments: 
       The 1067 virus was originally received in January, 1991.  1067 is 
       a memory resident infector of .COM programs, including COMMAND.COM. 
       It is originally from Europe. 
 
       The first time a 1067 infected program is executed, the 1067 virus 
       will install itself memory resident as a low system memory TSR of 
       1,808 or 1,856 bytes.  Interrupt 21 will be hooked by the virus in 
       memory.  Unlike most viruses which are TSRs, the infection of the 
       virus in memory will also result in a decrease in total system and 
       available free memory in increments of 64K.  The additional decrease 
       in total system and available free memory may be mapped by some 
       utilities as an increase in the size of the in memory command 
       interpretor. 
 
       Once the 1067 virus is memory resident, it will infect one .COM 
       program over approximately 3K in size located in the current 
       directory each time any program is executed.  If COMMAND.COM is 
       located in this directory, it may become infected. 
 
       1067 virus infected programs will have a file length increase of 
       1,067 bytes.  The virus will be located at the end of the infected 
       program.  The file's date and time in the DOS disk directory 
       listing will not have been altered.  There are no text strings 
       visible within the viral code in infected programs. 
 
       A symptom of a 1067 infection is that attempts to execute large 
       .EXE programs may fail due to the virus' allocation of large 
       amounts of memory.  These large .EXE programs may receive the 
       following error message when the user attempts to execute them: 
 
               "Program too big to fit in memory" 
 
       1067 doesn't appear to do anything besides replicate. 

Show viruses from discovered during that infect .

Main Page