Enola Virus

Virus Name: Enola Aliases: V Status: Rare Discovered: June, 1992 Symptoms: .COM & .EXE growth; system reboots; system hangs; decrease in total system & available free memory Origin: USSR Eff Length: 1,864 - 1,878 Bytes Type Code: PRtA - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, AVTK, Sweep, IBMAV, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Enola virus was received in June, 1992. It is originally from Russia. Enola is a memory resident infector of .COM and .EXE programs which will infect files on file open, execution, or copy. When the first program infected with the Enola virus is executed, the Enola virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,048 bytes. Interrupts 08 and 62 will be hooked by Enola in memory. Once the Enola virus is memory resident, it will infect or alter .COM and .EXE programs when they are opened, executed, or copied. In the case of copying files, both the source and target files will become infected or altered. Enola does not always infect files, it will sometimes alter the program adding less than 15 bytes. These altered programs will not function properly, and may cause system reboots or system hangs to occur. Programs infected with the Enola virus will have a file length increase of 1,864 to 1,878 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code within all Enola infected programs: "comexe" "Enola Gay is now flying to SoftPanorama !" "command" It is unknown what Enola may do besides replicate.