Cyber Virus
Virus Name: Cyber
Aliases: Intrep-1092
V Status: Rare
Discovery: September, 1992
Symptoms: .COM & .EXE growth
Origin: Unknown
Eff Length: 1,092 - 1,106 Bytes
Type Code: PNAK - Parasitic Non-Resident .COM & .EXE Infector
Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, AVTK/N, LProt, NProt, NAV/N, IBMAV/N,
Innoc
Removal Instructions: Delete infected files
General Comments:
The Cyber virus was received in September, 1992. It appears to be
from North America. Cyber is a non-resident, direct action infector
of .COM and .EXE programs, including COMMAND.COM.
When a program infected with the Cyber virus is executed, the
Cyber virus will search the current directory to locate an uninfected
.COM program. If one is found, the virus infects it, and then the
program the user was attempting to execute runs. If an uninfected
.COM file was not found, the virus will search the current directory
for an uninfected .EXE program to infect, and then infect it.
.COM programs infected with the Cyber virus will have a file length
increase of 1,092 bytes. .EXE programs infected with the virus will
have a file length increase of 1,092 to 1,106 bytes. In both cases,
the virus will be located at the end of the file. The program's
date and time in the DOS disk directory listing will not be altered.
The following text strings can be found in the Cyber viral code in
all infected programs:
"*.com *.exe"
"A trip into the realm of intelligent replication..."
The Cyber virus doesn't do anything besides replicate.
Known variant(s) of Cyber are:
Cyber-946: A 946 byte variant of the Cyber virus described above,
this variant infects one .COM program in the current
directory each time an infected program is executed.
Infected programs will have a file length increase of 946
bytes with the virus being located at the end of the
file. The program's date and time in the DOS disk
directory listing will not be altered. The following
text string can be found within the viral code in all
Cyber-946 infected programs:
"*.com *.exe"
Origin: Unknown December, 1992.