Virus Name: Entity
V Status: New
Discovered: January, 1996
Symptoms: .COM & .EXE growth; decrease in available free memory;
file date/time seconds = "62"
Eff Length: 1,986 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ChAV, F-Prot, AVTK, IBMAV, ViruScan, PCScan,
Innoc, AVTK/N, IBMAV/N, NShld, NAV/N
Removal Instructions: Delete infected files
The Entity or Entity.1986 virus was received in January, 1996. Its
origin or point of isolation is unknown. Entity is a memory
resident stealth virus which infects .COM and .EXE files,
When the first Entity infected program is executed, this virus
will install itself memory resident at the top of system memory
but below the 640K DOS boundary, not moving interrupt 12's return.
Available free memory, as indicated by the DOS CHKDSK program
from DOS 5.0, will have decreased by 4,032 bytes. Interrupts 11
and 21 will be hooked by the virus in memory.
Once the virus is memory resident, it will infect .COM and .EXE
files, including COMMAND.COM, when they are executed or opened,
but not when copied. Infected files will have a file length
increase of 1,986 bytes, though this file length increase will
be hidden by the virus when it is memory resident. The virus will
be located at the end of the file. The program's date and time
in the DOS disk directory listing will not appear to be altered,
though the seconds field will have been set to "62". The
following text strings are encrypted within the viral code:
"Hello user. I am a computer virus. My name is Entity."
"First: The keyboard is locked. Don't worry, it will be"
"unlocked at the end of this message."
"I am here because of your illegal software copying and"
"I am carrying a message for you from my programmer:"
"Buy only ORIGINAL SOFTWARE. Today the risk of infection"
"by a virus is very high (as you can see) and, next time,"
"you could be visited by an harmful virus which can perform"
"serious damage to your hard disk, floppies and backups..."
"So, pay attention while getting pirated software from CDs"
"and/or criminal BBSs. Pirating software is a federal crime."
"[This warning comes from Entity virus (c) 1995 by The Nuker]"