Dark Lord Virus

 Virus Name:  Dark Lord 
 Aliases:     Dark Lord-B, ManOWar, Terror 
 V Status:    Rare 
 Discovery:   May, 1991 
 Symptoms:    .COM & .EXE growth; decrease in total system & available 
              memory; system hangs 
 Origin:      Bulgaria 
 Eff Length:  923 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, Sweep, ChAV, 
                    NAV, IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Dark Lord virus was received in May, 1991.  It is from 
       Bulgaria.  Dark Lord is a memory resident infector of .COM and 
       .EXE programs, including COMMAND.COM. 
       The first time a program infected with Dark Lord is executed, the 
       virus will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary.  Total system and available 
       free memory, as measured by the DOS CHKDSK program, will decrease 
       by 1,616 bytes.  Interrupts 21 and 24 will be hooked by Dark Lord. 
       Once Dark Lord is memory resident, it will infect .COM and .EXE 
       programs when they are opened or executed.  Infected programs will 
       increase in size by 923 to 936 bytes with the virus being located 
       at the end of the file.  COMMAND.COM is an exception, though, as 
       it will not have a file length increase, the virus will overwrite 
       the stack space on the end of COMMAND.COM. 
       Programs infected with Dark Lord will contain the following text 
               "Dark Lord, I summon thee! MANOWAR" 
       The second string will occur near the end of infected files. 
       Dark Lord does not replicate on 386-class systems.  On those systems, 
       execution of an infected program will result in a system hang. 
       It is unknown if Dark Lord does anything besides replicate. 
       Known variant(s) of Dark Lord are: 
       Dark Lord-B: Very similar to Dark Lord, this variant isolated 
                    in September, 1991 from the NCSA virus collection 
                    differs in 1 byte internally from the original Dark 
                    Lord virus.  COMMAND.COM will become infected when 
                    the virus goes memory resident, if it was not already 
                    infected.  With the exception of COMMAND.COM, infected 
                    files will increase in size by 921 - 935 bytes. 
       See:   Terror 

Show viruses from discovered during that infect .

Main Page