Virus Name: Fellowship
Aliases: 1022, Better World, Fellow
V Status: Rare
Discovered: July, 1990
Symptoms: TSR; .EXE file growth
Eff Length: 1,019 - 1,027 Bytes
Type Code: PRsE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, F-Prot, NAV, AVTK, Sweep,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: F-Prot, NAV, or delete infected files
The Fellowship or 1022 virus was isolated in Australia in July 1990.
Fellowship is a memory resident generic infector of .EXE files. It
does not infect .COM or overlay files.
The first time a program infected with the Fellowship virus is
executed, the virus will install itself memory resident as a 2,048
byte TSR in low system memory. Available free memory will be
decreased by a corresponding 2,048 bytes. Interrupt 21 will also
now be controlled by the virus.
After the virus is memory resident, the virus will infect .EXE files
when they are executed. Infected .EXE files will increase in size
by between 1,019 and 1,027 bytes. The virus's code will be located
at the end of infected files.
Infected files will contain the following text strings very close to
the end of the file:
"This message is dedicated to
all fellow PC users on Earth
Toward A Better Tomorrow
And A Better Place To Live In"
"03/03/90 KV KL MAL"
This virus is believed to have originated in Kuala Lumpur, Malaysia.
Known variant(s) of Fellowship are:
Fellowship-B: Based on the Fellowship virus described above,
this variant adds 1,019 to 1,034 bytes to the .EXE files
it infects. The virus will be located at the end of the
program, and the file's date and time in the DOS disk
directory listing will have been updated to the current
system date and time when infection occurred. The text
strings found in the original virus also occur in this
Origin: Malaysia December, 1992.