Demon Viper Virus
Virus Name: Demon Viper
V Status: Rare
Discovered: March, 1993
Symptoms: .COM file growth; file date/time changes; programs fail to
function properly; jumbled characters may appear on display
Eff Length: 817 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, F-Prot, AVTK, Sweep, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, NProt, Sweep/N, NAV/N, AVTK/N, IBMAV/N, Innoc,
Removal Instructions: Delete infected programs
The Demon Viper virus was submitted in March, 1993. Its origin or
point of isolation is unknown. Demon Viper is a non-resident, direct
action infector of .COM programs, including COMMAND.COM.
When a program infected with the Demon Viper virus is executed, the
Demon Viper virus will infect one .COM program located in the current
or next higher level directory. Infected programs will have a file
length increase of 817 bytes with the virus being located at the
end of the file. The program's date and time in the DOS disk
directory listing will have been updated to the current system date
and time when infection occurred. The following text strings are
encrypted within the Demon Viper viral code in all infected programs:
"May SATAN prevail on this system!"
"I summon you!"
Systems infected with the Demon Viper virus may experience unexpected
results when infected .COM programs are executed, including garbled
characters from memory being displayed on the system monitor and
program execution failure.