Cyber Virus


 Virus Name:  Cyber 
 Aliases:     Intrep-1092 
 V Status:    Rare 
 Discovery:   September, 1992 
 Symptoms:    .COM & .EXE growth 
 Origin:      Unknown 
 Eff Length:  1,092 - 1,106 Bytes 
 Type Code:   PNAK - Parasitic Non-Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, Sweep, AVTK, F-Prot, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, AVTK/N, LProt, NProt, NAV/N, IBMAV/N, 
                    Innoc 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Cyber virus was received in September, 1992.  It appears to be 
       from North America.  Cyber is a non-resident, direct action infector 
       of .COM and .EXE programs, including COMMAND.COM. 
 
       When a program infected with the Cyber virus is executed, the 
       Cyber virus will search the current directory to locate an uninfected 
       .COM program.  If one is found, the virus infects it, and then the 
       program the user was attempting to execute runs.  If an uninfected 
       .COM file was not found, the virus will search the current directory 
       for an uninfected .EXE program to infect, and then infect it. 
 
       .COM programs infected with the Cyber virus will have a file length 
       increase of 1,092 bytes.  .EXE programs infected with the virus will 
       have a file length increase of 1,092 to 1,106 bytes.  In both cases, 
       the virus will be located at the end of the file.  The program's 
       date and time in the DOS disk directory listing will not be altered. 
       The following text strings can be found in the Cyber viral code in 
       all infected programs: 
 
               "*.com *.exe" 
               "A trip into the realm of intelligent replication..." 
 
       The Cyber virus doesn't do anything besides replicate. 
 
       Known variant(s) of Cyber are: 
       Cyber-946: A 946 byte variant of the Cyber virus described above, 
                  this variant infects one .COM program in the current 
                  directory each time an infected program is executed. 
                  Infected programs will have a file length increase of 946 
                  bytes with the virus being located at the end of the 
                  file.  The program's date and time in the DOS disk 
                  directory listing will not be altered.  The following 
                  text string can be found within the viral code in all 
                  Cyber-946 infected programs: 
                  "*.com *.exe" 
                  Origin:  Unknown  December, 1992. 

Show viruses from discovered during that infect .

Main Page