Ed Virus


 Virus Name:  Ed 
 Aliases:    
 V Status:    Rare 
 Discovered:  November, 1992 
 Symptoms:    .COM & .EXE file growth; decrease in total system and 
              available free memory 
 Origin:      Finland 
 Eff Length:  779 - 794 Bytes 
 Type Code:   PRtAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, Sweep, IBMAV, VAlert, PCScan, 
                    NAV, NAVDX, ChAV, 
                    NShld, Sweep/N, Innoc, AVTK/N, LProt, IBMAV/N, NAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Ed virus was submitted in November, 1992.  It is originally 
       from Finland.  Ed is a memory resident infector of .COM and .EXE 
       programs, including COMMAND.COM.  It spreads quickly on infected 
       systems. 
 
       When the first Ed infected program is executed, the Ed virus will 
       install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, moving interrupt 12's return.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will have decreased by 1,584 bytes.  Interrupts 12, 21, 
       and 24 will be hooked by Ed in memory. 
 
       Once the Ed virus is memory resident, it will infect .COM and .EXE 
       programs when they are executed or opened for any reason.  Infected 
       .COM programs will have a file length increase of 779 bytes with 
       the virus being located at the beginning of the file.  Infected 
       .EXE programs will increase in size by 779 to 794 bytes with the 
       virus being located at the end of the file.  The program's date and 
       time in the DOS disk directory listing will not be altered.  No 
       text strings are visible within the viral code in infected programs. 
 
       It is unknown what Ed does besides replicate. 

Show viruses from discovered during that infect .

Main Page