Darkray Virus

Virus Name: Darkray Aliases: V Status: New Discovery: October, 1993 Symptoms: .EXE file growth; decrease in total system & available memory Origin: The Netherlands Eff Length: 1,525 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, IBMAV, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, AVTK/N, NProt, Sweep/N, IBMAV/N, NAV/N, LProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Darkray virus was submitted in October, 1993, and is originally from The Netherlands. It is a memory resident infector of .EXE programs written by the Trident virus writing group. When the first Darkray infected program is executed, the Darkray virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,888 bytes. Interrupts 13 and 21 will be hooked by the virus in memory. Once the Darkray virus is memory resident, it will infect .EXE programs when they are executed. Infected programs will have a file length increase of 1,525 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all Darkray infected programs: "(C)1993" "[DàRkRàY]" "TridenT" It is unknown what Darkray does besides replicate. See: Flue Trident