Virus Name: Fifo
V Status: New
Discovered: February, 1995
Symptoms: .COM file growth; message "Bad command or file name"
Eff Length: 300 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, ViruScan, AVTK, IBMAV, Sweep,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, NProt, IBMAV/N, AVTK/N, Sweep/N, NAV/N,
Removal Instructions: Delete infected files
The Fifo virus was received in February, 1995. Its origin or point
of isolation is unknown. Fifo is a memory resident infector of .COM
files, including COMMAND.COM.
When the first Fifo infected program is executed, the Fifo virus will
infect all of the .COM files located in the current directory, as
well as become memory resident. This virus installs itself memory
resident in allocated system memory, resulting in no change in total
system and available free memory. Interrupt 21 will be hooked by the
virus in memory.
Once the Fifo virus is memory resident, it will infect .COM files
when they are executed. Infected files will have a file length
increase of 300 bytes with the virus being located at the beginning
of the file. The program's date and time in the DOS disk directory
listing will not be altered. The following text strings are visible
within the viral code in all infected programs:
When the virus is memory resident, attempts to execute EXE files
may result in the error message "Bad command or file name"
being displayed, and the user being returned to the DOS prompt.