Virus Name: CSF
V Status: New
Discovery: July, 1995
Symptoms: .COM file growth
Eff Length: 240 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, AVTK, VAlert, Sweep, IBMAV, NAV,
NAVDX, ViruScan, ChAV,
Sweep/N, AVTK/N, NAV/N, NShld, IBMAV/N, Innoc 4.0+
Removal Instructions: Delete infected files
The CSF or CSF.240 virus was received in July, 1995. Its origin
or point of isolation is unknown. CSF is a memory resident infector
of .COM files, including COMMAND.COM.
When the first CSF infected program is executed, this virus will
install itself memory resident in allocated system memory at 0010.
It hooks interrupt 21.
Once memory resident, it will infect .COM files when they are
executed. Infected .COM files will have a file length increase of
240 bytes with the virus being located at the beginning of the file.
The program's date and time in the DOS disk directory listing will
not be altered. The following text string is visible within the
viral code in all infected files: