Dad Virus

 Virus Name:  Dad 
 V Status:    Rare 
 Discovery:   April, 1992 
 Symptoms:    .COM file growth; TSR; message 
 Origin:      Argentina 
 Eff Length:  897 Bytes 
 Type Code:   PRsC - Parasitic Resident .COM Infector 
 Detection Method:  AVTK, F-Prot, NAV, ViruScan, Sweep, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Dad virus was discovered in Argentina in May, 1992.  It is a 
       memory resident infector of .COM programs, but not COMMAND.COM. 
       When the first Dad infected program is executed, the Dad virus 
       will install itself memory resident as a low system memory TSR of 
       1,232 bytes.  It will hook interrupts 21 and F8. 
       After becoming memory resident, this virus will infect any .COM 
       program which is executed, and then display the following 
       message on the system display: 
               "DAD WAS HERE" 
       Programs infected with the Dad virus will have a file length 
       increase of 897 bytes.  The virus will be located at the beginning 
       of the file.  There will be no change to the file's date and time 
       in the DOS disk directory listing.  This virus is unable to 
       determine when it has previously infected a file, so it will 
       reinfect files, adding an additional 897 bytes for each reinfection. 
       The following text strings can be found in the viral code in all 
       Dad infected programs: 
               "Que dia es hoy?" 
               "PRIMERO DE ABRIL!!!" 
               "(C) DAD  DAD WAS HERE" 

Show viruses from discovered during that infect .

Main Page