Destructor V4.00 Virus

Virus Name: Destructor V4.00 Aliases: Destructor V Status: Rare Discovered: December, 1990 Symptoms: .COM & .EXE growth; decrease in system and available free memory Origin: Bulgaria Eff Length: 1,150 - 1162 Bytes Type Code: PRtAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Destructor V4.00 virus was received in December, 1990. This virus is from Bulgaria, and is a memory resident infector of .COM and .EXE files, including COMMAND.COM. When the first program infected with the Destructor V4.00 virus is executed, the virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Interrupt 12's return is moved. Total system memory and available free memory will be 1,216 bytes less than what is expected on the infected system. At this time, the virus will also infect COMMAND.COM if it is not already infected. Once Destructor V4.00 is memory resident, it will infect programs as they are opened or executed. Infected .COM programs will have increased in size by 1,150 bytes. .EXE programs will have increased in size by 1,154 to 1,162 bytes. In both cases, the virus will be located at the end of the infected file. This virus does not alter the file's date/time in the disk directory, and it also makes no attempt to hide the file length increase on infected programs. The following text string can be found in files infected with this virus: "DESTRUCTOR V4.00 (c) 1990 by ATA It is unknown what Destructor V4.00 does, if anything, besides replicate.