Virus Name: Estonia
V Status: New
Discovered: July, 1995
Symptoms: .COM file growth
Eff Length: 400 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: VAlert, AVTK, NAV, NAVDX, ViruScan, IBMAV, F-Prot,
AVTK/N, NAV/N, IBMAV/N, NShld, Innoc
Removal Instructions: Delete infected files
The Estonia virus was received in July, 1995. Its origin or point
of isolation in unknown. Estonia is a non-resident, direct action
infector of .COM files, including COMMAND.COM.
When a program infected with the Estonia virus is executed, this
virus will infect all of the .COM files located in the current
directory. Infected files will have a file length increase of 400
bytes with the virus being located at the end of the file. The
program's date and time in the DOS disk directory listing will not
be altered. The following text strings are encrypted within the
"Your drives were on the Estonia... They DIDN'T survive!!!"
The text string "ES" can also be found starting in the fourth byte
of all infected files.