10 Past 3 Virus
Virus Name: 10 Past 3
V Status: Rare
Symptoms: .COM file growth; keyboard keypresses altered; system reboots;
hardware devices disabled or interference
Eff Length: 748 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: AVTK, F-Prot, IBMAV, ViruScan, Sweep, NAV,
NAVDX, VAlert, PCScan, ChAV,
LProt, NShld, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The 10 Past 3, or 748, virus was submitted in November, 1992. This
virus was actually isolated much earlier, in early 1991. 10 Past 3
is a memory resident infector of .COM programs, including
The first time a program infected with the 10 Past 3 virus is
executed, this virus will install itself memory resident in low
available system memory, hooking interrupts 21 and 6B. Total
system and available free memory, as measured by the DOS CHKDSK
program, will not be altered.
Once the 10 Past 3 virus is memory resident, it will infect .COM
programs, including COMMAND.COM, when they are executed. Infected
programs will have a file length increase of 748 bytes with the
virus being located at the end of the file. The program's date and
time in the DOS disk directory listing will not be altered. No
text strings are visible within the viral code.
The 10 Past 3 virus activates between 15:10 and 15:13 (3:00PM and
3:15PM) every day, at which time it will cause the "Ctrl" or "Shift"
keys to be invokes occassionally when the system user enters a
character on the system keyboard. As a result, the character input
may not be the same as what the user intended. Additionally, it
either disables or interfers with the functioning of the following
devices on the days of any month indicated below:
1st day of any month - keyboard
10th day of any month - system hard disk
16th day of any month - system monitor/display
29th day of any month - disk drives
On the 22nd day of any month, unexpected system reboots may occur.
Known variant(s) of 10 Past 3 are:
10 Past 3-B: A 789 byte variant of the 10 Past 3 virus, this
variant adds 789 bytes to the .COM programs it infects,
including COMMAND.COM. It will occassionally display
the following text on the system monitor:
The text is visible within the viral code in all
10 Past 3-B infected programs.
Origin: Republic Of South Africa January, 1993.