Virus Name: Dad
V Status: Rare
Discovery: April, 1992
Symptoms: .COM file growth; TSR; message
Eff Length: 897 Bytes
Type Code: PRsC - Parasitic Resident .COM Infector
Detection Method: AVTK, F-Prot, NAV, ViruScan, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The Dad virus was discovered in Argentina in May, 1992. It is a
memory resident infector of .COM programs, but not COMMAND.COM.
When the first Dad infected program is executed, the Dad virus
will install itself memory resident as a low system memory TSR of
1,232 bytes. It will hook interrupts 21 and F8.
After becoming memory resident, this virus will infect any .COM
program which is executed, and then display the following
message on the system display:
"DAD WAS HERE"
Programs infected with the Dad virus will have a file length
increase of 897 bytes. The virus will be located at the beginning
of the file. There will be no change to the file's date and time
in the DOS disk directory listing. This virus is unable to
determine when it has previously infected a file, so it will
reinfect files, adding an additional 897 bytes for each reinfection.
The following text strings can be found in the viral code in all
Dad infected programs:
"Que dia es hoy?"
"PRIMERO DE ABRIL!!!"
"(C) DAD DAD WAS HERE"