Virus Name: Emf
V Status: Rare
Discovered: March, 1992
Symptoms: .COM file growth
Origin: North America
Eff Length: 404 Bytes Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, IBMAV/N,
Removal Instructions: Delete infected files
The Emf virus was submitted in March, 1992. It is from North
America. Emf is a non-resident, direct action infector of .COM
programs, including COMMAND.COM. It is possibly related to the
Scream family of viruses.
When a program infected with the Emf virus is executed, Emf will
search the current directory to locate an uninfected .COM
program to infect. If one is found, it will be infected by Emf.
If COMMAND.COM is located in the current directory, Emf may
Programs infected with the Emf virus will have a file length
increase of 404 bytes with the virus being located at the end of
the infected file. The program's date and time in the DOS disk
directory listing will not have been altered. The following text
string is encrypted within the Emf viral code:
"*.COM Screaming Fist (c)1"
Emf doesn't appear to do anything besides replicate.
Known variant(s) of Emf are:
Emf-625: A 625 byte variant of the Emf virus described above,
this variant infects one .COM program in the current
directory each time an infected program is executed.
Infected programs will have a file length increase of 625
bytes with the virus being located at the end of the file.
The program's date and time in the DOS disk directory
listing will not be altered. The following text string
is encrypted within the viral code in Emf-625 infected
"*.COM Screaming Fist (c)10/91"
Origin: North America December, 1992.