DOS7 Virus

Virus Name: DOS7 Aliases: V Status: Rare Discovered: April, 1993 Symptoms: .COM file growth; file date/time changes Origin: Unknown Eff Length: 342 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, ViruScan, NAV, ChAV, AVTK, Sweep, IBMAV, NAVDX, VAlert, PCScan, NShld, NProt, Sweep/N, AVTK/N, NAV/N, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The DOS7 virus was submitted in April, 1993. Its origin or point of isolation is unknown. The DOS7 virus is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the DOS7 virus is executed, the DOS7 virus will infect one .COM program located in the current directory. Infected programs will have a file length increase of 342 bytes with the virus being located at the beginning of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time. The following text strings can be found within the DOS7 viral code: "W.C?M is infected!oy,re you ever dumb!" "MSDOS 7 (C)1993 ANARKICK SYSTEMS" "DOS 6 Antivirus sucks. It missed this one!" It is unknown what DOS7 does besides replicate. Known variant(s) of DOS7 are: DOS7-B: Based on the DOS7 virus described above, DOS7-B is a 376 byte variant which infects one .COM file in the current directory whenever an infected program is executed. Infected programs will have a file length increase of 376 bytes with the virus being located at the beginning of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time. The following text strings are visible within the viral code in all DOS7-B infected programs: "W.C?M is infected!oy, are you ever dumb!" "MSDOS 7 (C) 1993 ANARKICK SYSTEMS" "DOS 6 Antivirus sucks. It missed this one!" Origin: Unknown June, 1993. DOS7-C: Based on the DOS7 virus described above, DOS7-C is a 419 byte variant which infects one .COM file in the current directory whenever an infected program is executed. Infected programs will have a file length increase of 419 bytes with the virus being located at the beginning of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time. The following text strings are visible within the viral code in all DOS7-C infected programs: "W.C?M is infected!oy, are you ever dumb!" "MSDOS 7 (C) 1993 ANARKICK SYSTEMS" "DOS 6 Antivirus sucks. It missed this one!" Origin: Unknown June, 1993.