Dark Lord Virus

Virus Name: Dark Lord Aliases: Dark Lord-B, ManOWar, Terror V Status: Rare Discovery: May, 1991 Symptoms: .COM & .EXE growth; decrease in total system & available memory; system hangs Origin: Bulgaria Eff Length: 923 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Dark Lord virus was received in May, 1991. It is from Bulgaria. Dark Lord is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. The first time a program infected with Dark Lord is executed, the virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as measured by the DOS CHKDSK program, will decrease by 1,616 bytes. Interrupts 21 and 24 will be hooked by Dark Lord. Once Dark Lord is memory resident, it will infect .COM and .EXE programs when they are opened or executed. Infected programs will increase in size by 923 to 936 bytes with the virus being located at the end of the file. COMMAND.COM is an exception, though, as it will not have a file length increase, the virus will overwrite the stack space on the end of COMMAND.COM. Programs infected with Dark Lord will contain the following text strings: "COMMAND.COM" "Dark Lord, I summon thee! MANOWAR" The second string will occur near the end of infected files. Dark Lord does not replicate on 386-class systems. On those systems, execution of an infected program will result in a system hang. It is unknown if Dark Lord does anything besides replicate. Known variant(s) of Dark Lord are: Dark Lord-B: Very similar to Dark Lord, this variant isolated in September, 1991 from the NCSA virus collection differs in 1 byte internally from the original Dark Lord virus. COMMAND.COM will become infected when the virus goes memory resident, if it was not already infected. With the exception of COMMAND.COM, infected files will increase in size by 921 - 935 bytes. See: Terror