Davis Virus

Virus Name: Davis Aliases: V Status: Rare Discovered: May, 1992 Symptoms: .EXE file growth; beeping & message display; decrease in total system & available free memory Origin: Malaysia Eff Length: 1,776 - 1,965 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N Removal Instructions: Delete infected files General Comments: The Davis virus was received from Malaysia in May, 1992. Davis is a memory resident infector of .EXE programs which will display a message after it has been memory resident for 15 to 30 minutes. The first time a program infected with the Davis virus is executed, the Davis virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. It does not move interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,776 bytes. Interrupts 08 and 21 will be hooked by the Davis virus in memory. Once Davis is memory resident, it will infect .EXE programs when they are executed. Infected programs will have a file length increase of 1,776 to 1,965 bytes with the virus being located at the end of the infected file. The program's date and time in the DOS disk directory listing will not be altered. Approximately 15 to 30 minutes after the Davis virus has become memory resident, it will start displaying the following message accompanied by 3 beeps every few minutes: "ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ DAVIS V1.01 ³ ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´ ³ Author : Davis ³ ³ Date : mm/dd/yy ³ ³ VIRUS STATION COPY ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Hi ! How are you today ? Don't worry about ! DAVIS VIRUS will follow you forever and ever ! Don't care me! I really do not damage your disk or data. But..........................make Funny to you sometime." Davis does not do anything malicious other than displaying its disruptive message.