Dir Virus Virus

 Virus Name:  Dir Virus 
 Aliases:     691 
 V Status:    Rare 
 Discovered:  January, 1991 
 Symptoms:    .COM growth; TSR; sluggishness of DIR commands; 
              File allocation errors 
 Origin:      USSR 
 Eff Length:  691 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM  Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, NAV, Sweep, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Dir Virus was submitted in January, 1991.  It originated in the 
       USSR.  The Dir Virus is a memory resident infector of .COM programs, 
       including COMMAND.COM. 
       The first time a program infected with the Dir Virus is executed, 
       the virus will install itself memory resident as a low system memory 
       TSR of 1,008 bytes.  Interrupt 21 will be hooked by the virus.  If 
       COMMAND.COM is not already infected, it will become infected at this 
       After the Dir Virus is memory resident, it will only infect .COM 
       programs when a DOS DIR command is performed.  It does not infect 
       programs on execution, or when .COM files are opened.  When a DIR 
       command is performed, the first uninfected .COM program that is 
       found in the directory will become infected.  When the virus infects 
       a .COM file, there will be a pause in the output of the DIR command 
       while the program is being infected, then the output will continue. 
       Infected programs will increase in size by 691 bytes, though the 
       file length increase cannot be seen when a directory command is 
       performed if the virus is memory resident.  The virus will be 
       located at the end of infected programs.  Infected programs will not 
       have their date and time altered by the virus. 
       Systems infected with the Dir Virus will receive file allocation 
       errors when the DOS CHKDSK program is executed on a drive containing 
       infected programs.  If the virus is not memory resident, these 
       errors will not be found.  Execution of the DOS CHKDSK program with 
       the /F option when the virus is memory resident will result in 
       corruption of the infected programs. 
       This virus does not appear to contain any activation mechanism. 

Show viruses from discovered during that infect .

Main Page