Fellowship Virus

Virus Name: Fellowship Aliases: 1022, Better World, Fellow V Status: Rare Discovered: July, 1990 Isolated: Australia Symptoms: TSR; .EXE file growth Origin: Malaysia Eff Length: 1,019 - 1,027 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: ViruScan, F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: F-Prot, NAV, or delete infected files General Comments: The Fellowship or 1022 virus was isolated in Australia in July 1990. Fellowship is a memory resident generic infector of .EXE files. It does not infect .COM or overlay files. The first time a program infected with the Fellowship virus is executed, the virus will install itself memory resident as a 2,048 byte TSR in low system memory. Available free memory will be decreased by a corresponding 2,048 bytes. Interrupt 21 will also now be controlled by the virus. After the virus is memory resident, the virus will infect .EXE files when they are executed. Infected .EXE files will increase in size by between 1,019 and 1,027 bytes. The virus's code will be located at the end of infected files. Infected files will contain the following text strings very close to the end of the file: "This message is dedicated to all fellow PC users on Earth Toward A Better Tomorrow And A Better Place To Live In" "03/03/90 KV KL MAL" This virus is believed to have originated in Kuala Lumpur, Malaysia. Known variant(s) of Fellowship are: Fellowship-B: Based on the Fellowship virus described above, this variant adds 1,019 to 1,034 bytes to the .EXE files it infects. The virus will be located at the end of the program, and the file's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The text strings found in the original virus also occur in this variant. Origin: Malaysia December, 1992.