10 Past 3 Virus

 Virus Name:  10 Past 3 
 Aliases:     748 
 V Status:    Rare 
 Discovery:   1991 
 Symptoms:    .COM file growth; keyboard keypresses altered; system reboots; 
              hardware devices disabled or interference 
 Origin:      Unknown 
 Eff Length:  748 Bytes 
 Type Code:   PRaCK - Parasitic Resident .COM Infector 
 Detection Method:  AVTK, F-Prot, IBMAV, ViruScan, Sweep, NAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    LProt, NShld, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The 10 Past 3, or 748, virus was submitted in November, 1992.  This 
       virus was actually isolated much earlier, in early 1991.  10 Past 3 
       is a memory resident infector of .COM programs, including 
       The first time a program infected with the 10 Past 3 virus is 
       executed, this virus will install itself memory resident in low 
       available system memory, hooking interrupts 21 and 6B.  Total 
       system and available free memory, as measured by the DOS CHKDSK 
       program, will not be altered. 
       Once the 10 Past 3 virus is memory resident, it will infect .COM 
       programs, including COMMAND.COM, when they are executed.  Infected 
       programs will have a file length increase of 748 bytes with the 
       virus being located at the end of the file.  The program's date and 
       time in the DOS disk directory listing will not be altered.  No 
       text strings are visible within the viral code. 
       The 10 Past 3 virus activates between 15:10 and 15:13 (3:00PM and 
       3:15PM) every day, at which time it will cause the "Ctrl" or "Shift" 
       keys to be invokes occassionally when the system user enters a 
       character on the system keyboard.  As a result, the character input 
       may not be the same as what the user intended.  Additionally, it 
       either disables or interfers with the functioning of the following 
       devices on the days of any month indicated below: 
                1st day of any month - keyboard 
               10th day of any month - system hard disk 
               16th day of any month - system monitor/display 
               29th day of any month - disk drives 
       On the 22nd day of any month, unexpected system reboots may occur. 
       Known variant(s) of 10 Past 3 are: 
       10 Past 3-B: A 789 byte variant of the 10 Past 3 virus, this 
                    variant adds 789 bytes to the .COM programs it infects, 
                    including COMMAND.COM.  It will occassionally display 
                    the following text on the system monitor: 
                    The text is visible within the viral code in all 
                    10 Past 3-B infected programs. 
                    Origin:  Republic Of South Africa  January, 1993. 

Show viruses from discovered during that infect .

Main Page