Dutch Tiny Virus

Virus Name: Dutch Tiny Aliases: D-Tiny V Status: Rare Discovered: October, 1991 Symptoms: .COM file growth; file date/time changes; write protect errors; program error messages; system hangs Origin: Netherlands Eff Length: 124 - 126 Bytes Type Code: PRAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, IBMAV, AVTK, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The three viruses which comprise the Dutch Tiny group were received from The Netherlands in October, 1991. All three are memory resident viruses which use memory resident techniques similar to the viruses in the Tiny Family of Bulgarian viruses. There are also two non-resident viruses which are included under Mini-97 which are related to the Dutch Tiny viruses. The virus described here is the 126 byte version of this virus, Dutch Tiny-126. The other two variants, both of 124 bytes, are described below in the known variants. The first time a program infected with Dutch Tiny is executed, the virus was install itself memory resident within a DOS buffer located at memory address 0000:063A. Interrupt 21 will be hooked by the virus in memory. There will be no change in total system and available free memory. Once the Dutch Tiny virus is memory resident, it will infect .COM programs when they are executed. If COMMAND.COM is executed, it will become infected. Infected .COM programs will increase in size by 126 bytes with the virus being located at the end of the infected file. The file's date and time in the DOS disk directory will have been updated to the system date and time when infection occurred. Execution of some programs which expect command line input will result in error messages, as though the user did not provide the input. Also, attempts to execute programs from write-protected diskettes will result in a "write protect error" from DOS. This virus does not do anything besides replicate. Known variant(s) of Dutch Tiny are: Dutch Tiny.111: Received in July, 1994, Dutch Tiny.111 is a 111 byte variant. It will infect all .COM files in the current directory when an infected program is executed. Infected programs will have a file length increase of 111 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. One text string can be found within the viral code in infected programs: "*.COM" Origin: Unknown July, 1994. Dutch Tiny-115: Received in July, 1992, Dutch Tiny-115 is a 115 byte variant. It will infect all .COM files in the current directory when an infected program is executed. Infected programs will have a file length increase of 115 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. Frequent system hangs will occur on infected systems when infected programs are executed. Origin: Bulgaria July, 1992. Dutch Tiny-117: Received in December, 1992, Dutch Tiny-117 is a 117 byte variant. It will infect one .COM file in the current directory when an infected program is executed. Infected programs will have a file length increase of 117 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. One text string can be found within the viral code: "*.COM" Origin: The Netherlands December, 1992. Dutch Tiny-124: A later version of the virus described above, Dutch Tiny-124 is a 124 byte variant. With this variant, frequent system hangs will occur once the virus is memory resident and a .EXE file, or an already infected .COM file, is executed. Additionally, execution of any program from the A: drive will result in a system hang has the virus is expecting program execution to occur from the C: drive. Dutch Tiny-124 is a poor replicator, and will not infect most .COM files. Dutch Tiny-124B: Dutch Tiny-124B is a later version of Dutch Tiny-124. Unlike other members of this family, it will infect both .COM and .EXE programs, though .COM file infections do not occur very often. Infected .EXE programs will be damaged, and later execution of them will result in a system hang in all cases. See: Mini-97 Tiny Family