Virus Name: Emo-899
V Status: Rare
Discovered: April, 1993
Symptoms: .COM file growth; system hangs on Tuesdays
Eff Length: 899 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: AVTK, ViruScan, IBMAV, F-Prot, Sweep,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, NProt, AVTK/N, Sweep/N, NAV/N, Innoc, IBMAV/N,
Removal Instructions: Delete infected files
The Emo-899 virus was submitted in April, 1993, and is from
Israel. Emo-899 is a non-resident, direct action infector of
.COM programs, including COMMAND.COM.
When a program infected with the Emo-899 virus is executed, this
virus will infect all of the .COM programs located in the current
directory. Infected programs will have a file length increase of
899 bytes with the virus being located at the end of the file.
The program's date and time in the DOS disk directory listing will
not be altered. The following text strings are encrypted within
the Emo-899 viral code:
The Emo-899 virus contains some destructive code intended to format
the C: drive, but due to a bug in the code, it doesn't work.
Instead, execution of an infected program on a Tuesday will result
in a system hang.