Fellowship Virus

 Virus Name:  Fellowship 
 Aliases:     1022, Better World, Fellow 
 V Status:    Rare 
 Discovered:  July, 1990 
 Isolated:    Australia 
 Symptoms:    TSR; .EXE file growth 
 Origin:      Malaysia 
 Eff Length:  1,019 - 1,027 Bytes 
 Type Code:   PRsE - Parasitic Resident .EXE Infector 
 Detection Method:  ViruScan, F-Prot, NAV, AVTK, Sweep, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  F-Prot, NAV, or delete infected files 
 General Comments: 
       The Fellowship or 1022 virus was isolated in Australia in July 1990. 
       Fellowship is a memory resident generic infector of .EXE files.  It 
       does not infect .COM or overlay files. 
       The first time a program infected with the Fellowship virus is 
       executed, the virus will install itself memory resident as a 2,048 
       byte TSR in low system memory.  Available free memory will be 
       decreased by a corresponding 2,048 bytes.  Interrupt 21 will also 
       now be controlled by the virus. 
       After the virus is memory resident, the virus will infect .EXE files 
       when they are executed.  Infected .EXE files will increase in size 
       by between 1,019 and 1,027 bytes.  The virus's code will be located 
       at the end of infected files. 
       Infected files will contain the following text strings very close to 
       the end of the file: 
             "This message is dedicated to 
              all fellow PC users on Earth 
              Toward A Better Tomorrow 
              And A Better Place To Live In" 
             "03/03/90 KV KL MAL" 
       This virus is believed to have originated in Kuala Lumpur, Malaysia. 
       Known variant(s) of Fellowship are: 
       Fellowship-B: Based on the Fellowship virus described above, 
               this variant adds 1,019 to 1,034 bytes to the .EXE files 
               it infects.  The virus will be located at the end of the 
               program, and the file's date and time in the DOS disk 
               directory listing will have been updated to the current 
               system date and time when infection occurred.  The text 
               strings found in the original virus also occur in this 
               Origin:  Malaysia  December, 1992. 

Show viruses from discovered during that infect .

Main Page