Virus Name: Enola
V Status: Rare
Discovered: June, 1992
Symptoms: .COM & .EXE growth; system reboots; system hangs; decrease
in total system & available free memory
Eff Length: 1,864 - 1,878 Bytes
Type Code: PRtA - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, AVTK, Sweep, IBMAV, ViruScan,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N,
Removal Instructions: Delete infected files
The Enola virus was received in June, 1992. It is originally from
Russia. Enola is a memory resident infector of .COM and .EXE
programs which will infect files on file open, execution, or copy.
When the first program infected with the Enola virus is executed,
the Enola virus will install itself memory resident at the top of
system memory but below the 640K DOS boundary, moving interrupt 12's
return. Total system and available free memory, as indicated by the
DOS CHKDSK program, will have decreased by 2,048 bytes. Interrupts
08 and 62 will be hooked by Enola in memory.
Once the Enola virus is memory resident, it will infect or alter
.COM and .EXE programs when they are opened, executed, or copied.
In the case of copying files, both the source and target files will
become infected or altered. Enola does not always infect files, it
will sometimes alter the program adding less than 15 bytes. These
altered programs will not function properly, and may cause system
reboots or system hangs to occur.
Programs infected with the Enola virus will have a file length
increase of 1,864 to 1,878 bytes with the virus being located at
the end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text strings
can be found within the viral code within all Enola infected
"Enola Gay is now flying to SoftPanorama !"
It is unknown what Enola may do besides replicate.