CSF Virus

Virus Name: CSF Aliases: CSF.240 V Status: New Discovery: July, 1995 Symptoms: .COM file growth Origin: Unknown Eff Length: 240 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: F-Prot, AVTK, VAlert, Sweep, IBMAV, NAV, NAVDX, ViruScan, ChAV, Sweep/N, AVTK/N, NAV/N, NShld, IBMAV/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The CSF or CSF.240 virus was received in July, 1995. Its origin or point of isolation is unknown. CSF is a memory resident infector of .COM files, including COMMAND.COM. When the first CSF infected program is executed, this virus will install itself memory resident in allocated system memory at 0010. It hooks interrupt 21. Once memory resident, it will infect .COM files when they are executed. Infected .COM files will have a file length increase of 240 bytes with the virus being located at the beginning of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code in all infected files: "csf"