Virus Name: ETC
V Status: Rare
Discovered: May, 1991
Symptoms: .COM file growth
Eff Length: 700 Bytes
Type Code: PRfCK - Parasitic Resident .COM Infector
Detection Method: AVTK, F-Prot, ViruScan, Sweep, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The ETC virus was received from Bulgaria in May, 1991. ETC is a
memory resident direct action infector of .COM programs, including
When the first program infected with ETC is executed, the virus will
install itself memory resident in low available system memory,
hooking interrupt 00. There will be no change in available system
memory or total system memory indicated with the DOS CHKDSK program.
ETC will then infect the first uninfected .COM program it finds in
the current directory. If that program is COMMAND.COM, it will
Programs infected with ETC increase in size by 700 bytes with the
virus being located at the end of infected files. The program's
date and time in the disk directory will be updated to the system
date and time when infection occurred.
ETC will infect one .COM program in the current directory each time
an infected program is executed.
Programs infected with ETC will contain the following text strings:
"Virus, (c) ETC"
"E.T.C. VIRUS, Version 3.0, Copyright (c) 1989 by E.T.C. Co"
The last text string will be found near the end of all infected
ETC does not do anything besides replicate.