ETC Virus

Virus Name: ETC Aliases: E.T.C. V Status: Rare Discovered: May, 1991 Symptoms: .COM file growth Origin: Bulgaria Eff Length: 700 Bytes Type Code: PRfCK - Parasitic Resident .COM Infector Detection Method: AVTK, F-Prot, ViruScan, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The ETC virus was received from Bulgaria in May, 1991. ETC is a memory resident direct action infector of .COM programs, including COMMAND.COM. When the first program infected with ETC is executed, the virus will install itself memory resident in low available system memory, hooking interrupt 00. There will be no change in available system memory or total system memory indicated with the DOS CHKDSK program. ETC will then infect the first uninfected .COM program it finds in the current directory. If that program is COMMAND.COM, it will become infected. Programs infected with ETC increase in size by 700 bytes with the virus being located at the end of infected files. The program's date and time in the disk directory will be updated to the system date and time when infection occurred. ETC will infect one .COM program in the current directory each time an infected program is executed. Programs infected with ETC will contain the following text strings: "*.COM" "Virus, (c) ETC" "E.T.C. VIRUS, Version 3.0, Copyright (c) 1989 by E.T.C. Co" The last text string will be found near the end of all infected programs. ETC does not do anything besides replicate.