Emo-899 Virus

Virus Name: Emo-899 Aliases: Emo V Status: Rare Discovered: April, 1993 Symptoms: .COM file growth; system hangs on Tuesdays Origin: Israel Eff Length: 899 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: AVTK, ViruScan, IBMAV, F-Prot, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, NProt, AVTK/N, Sweep/N, NAV/N, Innoc, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Emo-899 virus was submitted in April, 1993, and is from Israel. Emo-899 is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Emo-899 virus is executed, this virus will infect all of the .COM programs located in the current directory. Infected programs will have a file length increase of 899 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the Emo-899 viral code: "Virus" "EMO" "\*.com" "*.*" "RB91" "????????COM" The Emo-899 virus contains some destructive code intended to format the C: drive, but due to a bug in the code, it doesn't work. Instead, execution of an infected program on a Tuesday will result in a system hang.