Virus Name: Egg-1000
V Status: Rare
Discovered: January, 1993
Symptoms: COMMAND.COM & .EXE growth; decrease in total system &
available free memory
Eff Length: 1,000 - 1,014 Bytes
Type Code: PRhEK - Parasitic Resident COMMAND.COM & .EXE Infector
Detection Method: AVTK, F-Prot, IBMAV, Sweep, ViruScan, NAV, PCScan,
NAVDX, VAlert, ChAV,
AVTK/N, Sweep/N, NAV/N, NShld, IBMAV/N, Innoc, LProt
Removal Instructions: Delete infected files
The Egg-1000, or Egg, virus was submitted in January, 1993. Its
origin or point of isolation is unknown. Egg-1000 is a memory
resident infector of .EXE files and COMMAND.COM.
When the first Egg-1000 infected program is executed, the Egg-1000
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary, hooking interrupts 21 and
6C. Total system and available free memory, as indicated by the
DOS CHKDSK program, will have decreased by 1,280 bytes. Interrupt
12's return will not be moved. Also at this time, the virus will
infect COMMAND.COM if it was not previously infected.
Once the Egg-1000 virus is memory resident, it will infect .EXE
programs when they are executed or opened for any reason. Infected
programs will have a file length increase of 1,000 to 1,014 bytes
with the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will not be altered.
The following text strings are visible within the viral code in all
Egg-1000 infected programs:
"eat cry sleep pizza cash getbackjack"
"chickens are good"
It is unknown what Egg-1000 does besides replicate.