Virus Name: Damage
V Status: Rare
Discovery: May, 1991
Symptoms: .COM & .EXE growth; decrease in total system and available
memory; screen effects; "Sector not found" errors
Eff Length: 1,063 bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Damage virus was received from Europe in May, 1991. Damage is
based on the Diamond variant of V1024. It is a memory resident
infector of .COM and .EXE programs, including COMMAND.COM.
When the first Damage infected program is executed on a system,
Damage will install itself memory resident at the top of system
memory but below the 640K DOS boundary. Total system and available
free memory, as measured by the DOS CHKDSK program, will decrease
by 1,120 bytes. Interrupts 08 and 21 will be hooked by the virus.
Once Damage is memory resident, it will infect .COM and .EXE
programs over approximately 1K in size when they are executed.
If COMMAND.COM is executed, it will become infected. Infected
programs will increase in size by 1,063 bytes with the virus being
located at the end of the infected file. The file length increase,
however, will be hidden if Damage is memory resident. If the
infected program's file time in the disk directory was originally
12:00a, its time will be blank when displayed if Damage is memory
The DOS CHKDSK program will not find file allocation errors as it
will with some stealth type viruses when Damage is memory resident.
Damage activates when the system time is 14:59:53. At that time,
it will have a large, multi-color diamond appear in the center of
the system display. The diamond will then break up into smaller
diamonds which shoot around the screen cleaning off characters on
Occasionally, the Damage virus will format a section of the current
disk drive. This formatting will result in "Sector not found"
errors when the user attempts to read a file may have been
damaged, or if the user attempts to write to one of these areas.
Programs infected with Damage will have the following text string
located near the end of the infected file:
Known variant(s) of Damage are:
Damage-B: Damage-B is a 1,110 byte variant of Damage, this
variant will not infect COMMAND.COM. The decrease in
total system and available memory will be 1,152 bytes.
Two text strings can be found in infected programs:
"Jump for joy!!!"
Damage-B may be detected as Lucifer by some anti-viral
programs as it is very similar.
See: Alfa Lucifer V1024