DisDev Virus

Virus Name: DisDev Aliases: V Status: Viron Discovered: November, 1992 Symptoms: .EXE files corrupted; .EXE files truncated and/or disappear; file date/time changes; messages Origin: Unknown Eff Length: 6,144 Bytes Type Code: ONE - Overwriting Non-Resident .EXE Infector Detection Method: F-Prot, Sweep, NAV, IBMAV, AVTK, ViruScan, NAVDX, VAlert, PCScan, ChAV, LProt, NShld, NAV/N, AVTK/N, NProt, Sweep/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The DisDev virus was submitted in November, 1992. Its origin or point of isolation is unknown. DisDev is a non-resident, direct action overwriting virus which infects .EXE programs. When a program infected with the DisDev virus is executed, the DisDev virus will infect all of the .EXE programs in the current directory. Infected programs will have a file length of 6,144 bytes, having been replaced with a pure copy of the DisDev viral code. Their date and time in the DOS disk directory listing will have been updated to the current system date and time. The following text strings can be found within the DisDev viral code: "<*>-==> DisDev -Copyright (c) 1066 ScumSoft- <==-<*" "disdev" "DisDev" "Fucking error" "Portions Copyright (c) 1066 ScumSoft!!" Once DisDev has infected all of the .EXE files in the current directory, executing an infected program will result in the file being executed "disappearing" from the DOS disk directory listing. The virus will have set the hidden attribute, resulting in this effect. Attempts to replace the file by copying a clean copy of the program to disk will fail with a file creation error. The DisDev virus may also display one of the following two messages when an infected program is executed: "DisDev" "Fucking error 202 at 0000:00F1"