DNR Virus
Virus Name: DNR
Aliases: Drive Not Ready
V Status: Rare
Discovered: November, 1993
Symptoms: .COM file growth; File date/time changes; Message; TSR;
Programs which open a lot of files may not function properly
Origin: Unknown
Eff Length: 331 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, ChAV,
AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc,
LProt
Removal Instructions: Delete infected files
General Comments:
The DNR, or Drive Not Ready, virus was submitted in November, 1993.
Its origin or point of isolation is unknown. DNR is a memory
resident infector of .COM programs, including COMMAND.COM. It may
be related to the Cybercide virus.
When the first DNR infected program is executed, the DNR virus will
install itself memory resident as a low system memory TSR of 2,048
bytes, hooking interrupt 21. At this time, the virus will also
display the following message on the system monitor:
"Drive Not Ready."
Once the DNR virus is memory resident, it will infect .COM programs
when they are executed. Infected .COM programs will have a file
length increase of 331 bytes with the virus being located at the end
of the file. The program's date and time in the DOS disk directory
listing will have been updated to the current system date and time
when infection occurred. The following text string is visible within
the viral code in all DNR infected programs:
"Drive Not Ready"
The DNR virus uses one file handle each time an infected program
is executed. As the number of available file handles slowly
decreases, the system user may find that programs which concurrently
open a large number of files may fail to function properly.
Known variant(s) of DNR are:
DNR-ROM Bios: Received in November, 1993, DNR-ROM Bios is a 397
byte variant of the DNR virus described above. Its size and
usage of memory is the similar. It displays the following
message when it becomes memory resident:
"ROM BIOS not compatible"
Programs infected with DNR-ROM Bios will have a file length
increase of 397 bytes with the virus being located at the
end of the file. The above message text string, as well as
the following text string, is visible within the viral code:
"WHY_ME"
Origin: Unknown November, 1993.
See: Cybercide