Dad Virus

Virus Name: Dad Aliases: V Status: Rare Discovery: April, 1992 Symptoms: .COM file growth; TSR; message Origin: Argentina Eff Length: 897 Bytes Type Code: PRsC - Parasitic Resident .COM Infector Detection Method: AVTK, F-Prot, NAV, ViruScan, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Dad virus was discovered in Argentina in May, 1992. It is a memory resident infector of .COM programs, but not COMMAND.COM. When the first Dad infected program is executed, the Dad virus will install itself memory resident as a low system memory TSR of 1,232 bytes. It will hook interrupts 21 and F8. After becoming memory resident, this virus will infect any .COM program which is executed, and then display the following message on the system display: "DAD WAS HERE" Programs infected with the Dad virus will have a file length increase of 897 bytes. The virus will be located at the beginning of the file. There will be no change to the file's date and time in the DOS disk directory listing. This virus is unable to determine when it has previously infected a file, so it will reinfect files, adding an additional 897 bytes for each reinfection. The following text strings can be found in the viral code in all Dad infected programs: "Argentina!" "COMMANDCOMA:TMP$$TMP.COM" "Que dia es hoy?" "PRIMERO DE ABRIL!!!" "(C) DAD DAD WAS HERE"