Enola Virus

 Virus Name:  Enola 
 V Status:    Rare 
 Discovered:  June, 1992 
 Symptoms:    .COM & .EXE growth; system reboots; system hangs; decrease 
              in total system & available free memory 
 Origin:      USSR 
 Eff Length:  1,864 - 1,878 Bytes 
 Type Code:   PRtA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  F-Prot, AVTK, Sweep, IBMAV, ViruScan, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Enola virus was received in June, 1992.  It is originally from 
       Russia.  Enola is a memory resident infector of .COM and .EXE 
       programs which will infect files on file open, execution, or copy. 
       When the first program infected with the Enola virus is executed, 
       the Enola virus will install itself memory resident at the top of 
       system memory but below the 640K DOS boundary, moving interrupt 12's 
       return.  Total system and available free memory, as indicated by the 
       DOS CHKDSK program, will have decreased by 2,048 bytes.  Interrupts 
       08 and 62 will be hooked by Enola in memory. 
       Once the Enola virus is memory resident, it will infect or alter 
       .COM and .EXE programs when they are opened, executed, or copied. 
       In the case of copying files, both the source and target files will 
       become infected or altered.  Enola does not always infect files, it 
       will sometimes alter the program adding less than 15 bytes.  These 
       altered programs will not function properly, and may cause system 
       reboots or system hangs to occur. 
       Programs infected with the Enola virus will have a file length 
       increase of 1,864 to 1,878 bytes with the virus being located at 
       the end of the file.  The program's date and time in the DOS disk 
       directory listing will not be altered.  The following text strings 
       can be found within the viral code within all Enola infected 
               "Enola Gay is now flying to SoftPanorama !" 
       It is unknown what Enola may do besides replicate. 

Show viruses from discovered during that infect .

Main Page