Virus Name: Emmie
V Status: Rare
Discovered: May, 1992
Symptoms: .COM file growth; decrease in total system & available free
memory; characters typed on the keyboard may be repeated,
file allocation errors
Eff Length: 2,702 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV,
IBMAV, NAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N,
Removal Instructions: Delete infected files
The Emmie virus was discovered in Israel in May, 1992. It is a
memory resident virus which infects .COM programs, including
COMMAND.COM, employing stealth techniques to avoid detection.
The first time a program infected with the Emmie virus is executed,
the Emmie virus will install itself memory resident at the top of
system memory but below the 640K DOS boundary. Interrupt 12's
return will not have been moved. Total system and available free
memory, as indicated by the DOS CHKDSK program, will have decreased
by 2,752 bytes. Interrupts 01, 09, 10, 17, and 21 will be hooked
by Emmie in memory. COMMAND.COM will also be infected at this
time, if not previously infected by the virus.
Once the Emmie virus is memory resident, it may infect .COM
programs when they are opened. It does not infect programs when
they are executed. Programs infected with the Emmie virus will
have a file length increase of 2,702 bytes with the virus being
located at the end of the file. The file length increase will not
be visible if Emmie is memory resident. The program's date and time
in the DOS disk directory listing will not be altered.
The following text strings can be found within the viral code in
Emmie infected programs:
"My name is Emmie, I am Eddie's sister."
"It'll tire you too much."
Systems infected with the Emmie virus will notice that CHKDSK will
return file allocation errors on infected files when the virus is
memory resident. The virus will also occassionally repeat a
character entered on the system keyboard two times.
Known variant(s) of Emmie are:
Emmie.2823: Received in February, 1995, Emmie 2823 is a 2,823
byte variant of the Emmie virus described above. Its size in
memory is 5,520 bytes, hooking interrupts 01, 08, 09, 10, 17,
and 21. It infects all of the .COM files in the current
directory larger than the virus itself when the virus becomes
memory resident, as well as infecting .COM files when they are
executed. Infected .COM files will have a file length increase
of 2,823 bytes, though this increase will be hidden when the
virus is memory resident. The following text strings are
encrypted within the viral code:
"It'll tire you too much."
"My name is Emmie, I am Eddie's sister. 03/24/92"
Emmie.2823 will cause some characters typed on the system
keyboard to be repeated when the virus is memory resident.
Origin: Unknown February, 1995.