Dark Lord Virus
Virus Name: Dark Lord
Aliases: Dark Lord-B, ManOWar, Terror
V Status: Rare
Discovery: May, 1991
Symptoms: .COM & .EXE growth; decrease in total system & available
memory; system hangs
Eff Length: 923 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Dark Lord virus was received in May, 1991. It is from
Bulgaria. Dark Lord is a memory resident infector of .COM and
.EXE programs, including COMMAND.COM.
The first time a program infected with Dark Lord is executed, the
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. Total system and available
free memory, as measured by the DOS CHKDSK program, will decrease
by 1,616 bytes. Interrupts 21 and 24 will be hooked by Dark Lord.
Once Dark Lord is memory resident, it will infect .COM and .EXE
programs when they are opened or executed. Infected programs will
increase in size by 923 to 936 bytes with the virus being located
at the end of the file. COMMAND.COM is an exception, though, as
it will not have a file length increase, the virus will overwrite
the stack space on the end of COMMAND.COM.
Programs infected with Dark Lord will contain the following text
"Dark Lord, I summon thee! MANOWAR"
The second string will occur near the end of infected files.
Dark Lord does not replicate on 386-class systems. On those systems,
execution of an infected program will result in a system hang.
It is unknown if Dark Lord does anything besides replicate.
Known variant(s) of Dark Lord are:
Dark Lord-B: Very similar to Dark Lord, this variant isolated
in September, 1991 from the NCSA virus collection
differs in 1 byte internally from the original Dark
Lord virus. COMMAND.COM will become infected when
the virus goes memory resident, if it was not already
infected. With the exception of COMMAND.COM, infected
files will increase in size by 921 - 935 bytes.