DOS3 Virus

Virus Name: DOS3 Aliases: V Status: Rare Discovered: February, 1993 Symptoms: .COM & .EXE growth; message displayed on some systems Origin: Unknown Eff Length: 661 Bytes Type Code: PNA - Parasitic Non-Resident .COM & .EXE Infector Detection Method: AVTK, F-Prot, ViruScan, Sweep, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, NProt, AVTK/N, NAV/N, Sweep/N, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The DOS3 virus was submitted in February, 1993. Its origin or point of isolation is unknown. The DOS3 virus is a non-resident, direct action infector of .COM and .EXE programs, but not COMMAND.COM. When a program infected with the DOS3 virus is executed, the DOS3 virus will infect all of the .COM and .EXE programs located in the current directory, with the exception of COMMAND.COM. Infected programs will have a file length increase of 661 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the DOS3 virus' code in all infected programs: "Still using DOS 3?" "You need to upgrade, you loser!" "*.EXE *.COM .." The first two text strings may be displayed as a message on the system monitor when an infected program is executed on computer which uses Ms-Dos 3.0 to Ms-Dos 3.3.