Virus Name: DisDev
V Status: Viron
Discovered: November, 1992
Symptoms: .EXE files corrupted; .EXE files truncated and/or disappear;
file date/time changes; messages
Eff Length: 6,144 Bytes
Type Code: ONE - Overwriting Non-Resident .EXE Infector
Detection Method: F-Prot, Sweep, NAV, IBMAV, AVTK, ViruScan,
NAVDX, VAlert, PCScan, ChAV,
LProt, NShld, NAV/N, AVTK/N, NProt, Sweep/N, IBMAV/N,
Removal Instructions: Delete infected files
The DisDev virus was submitted in November, 1992. Its origin or
point of isolation is unknown. DisDev is a non-resident, direct
action overwriting virus which infects .EXE programs.
When a program infected with the DisDev virus is executed, the
DisDev virus will infect all of the .EXE programs in the current
directory. Infected programs will have a file length of 6,144
bytes, having been replaced with a pure copy of the DisDev viral
code. Their date and time in the DOS disk directory listing will
have been updated to the current system date and time. The following
text strings can be found within the DisDev viral code:
"<*>-==> DisDev -Copyright (c) 1066 ScumSoft- <==-<*"
"Portions Copyright (c) 1066 ScumSoft!!"
Once DisDev has infected all of the .EXE files in the current
directory, executing an infected program will result in the file
being executed "disappearing" from the DOS disk directory listing.
The virus will have set the hidden attribute, resulting in this
effect. Attempts to replace the file by copying a clean copy of
the program to disk will fail with a file creation error.
The DisDev virus may also display one of the following two messages
when an infected program is executed:
"Fucking error 202 at 0000:00F1"