DNR Virus

 Virus Name:  DNR 
 Aliases:     Drive Not Ready 
 V Status:    Rare 
 Discovered:  November, 1993 
 Symptoms:    .COM file growth; File date/time changes; Message; TSR; 
              Programs which open a lot of files may not function properly 
 Origin:      Unknown 
 Eff Length:  331 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, ChAV, 
                    AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, 
                    NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The DNR, or Drive Not Ready, virus was submitted in November, 1993. 
       Its origin or point of isolation is unknown.  DNR is a memory 
       resident infector of .COM programs, including COMMAND.COM.  It may 
       be related to the  Cybercide  virus. 
       When the first DNR infected program is executed, the DNR virus will 
       install itself memory resident as a low system memory TSR of 2,048 
       bytes, hooking interrupt 21.  At this time, the virus will also 
       display the following message on the system monitor: 
               "Drive Not Ready." 
       Once the DNR virus is memory resident, it will infect .COM programs 
       when they are executed.  Infected .COM programs will have a file 
       length increase of 331 bytes with the virus being located at the end 
       of the file.  The program's date and time in the DOS disk directory 
       listing will have been updated to the current system date and time 
       when infection occurred.  The following text string is visible within 
       the viral code in all DNR infected programs: 
               "Drive Not Ready" 
       The DNR virus uses one file handle each time an infected program 
       is executed.  As the number of available file handles slowly 
       decreases, the system user may find that programs which concurrently 
       open a large number of files may fail to function properly. 
       Known variant(s) of DNR are: 
       DNR-ROM Bios: Received in November, 1993, DNR-ROM Bios is a 397 
                byte variant of the DNR virus described above.  Its size and 
                usage of memory is the similar.  It displays the following 
                message when it becomes memory resident: 
                "ROM BIOS not compatible" 
                Programs infected with DNR-ROM Bios will have a file length 
                increase of 397 bytes with the virus being located at the 
                end of the file.  The above message text string, as well as 
                the following text string, is visible within the viral code: 
                Origin:  Unknown  November, 1993. 
       See:   Cybercide 

Show viruses from discovered during that infect .

Main Page