99% Virus

Virus Name: 99% Aliases: 99 Percent, Traveling Jack V Status: Rare Discovery: November, 1992 Symptoms: .EXE file growth; file time seconds set to 14 Origin: Europe Eff Length: 821 - 835 Bytes Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: AVTK, Sweep, F-Prot, ViruScan, IBMAV, NAV, NAVDX, VAlert, ChAV, Sweep/N, NShld, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The 99% virus was submitted in November, 1992. Its origin is unknown, but it appears to be from Europe. 99% is a non-resident direct action infector of .EXE programs. When a program infected with 99% is executed, the 99% virus will infect one .EXE program located in the current directory or in the current drive's root directory. Infected programs will have a file length increase of 821 to 835 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will appear to not be altered, but the file time seconds will have been set to "14". The following text strings are encrypted within the 99% virus' code: "Het 99%-virus heeft toegeslagen. . ." "This is my revenge E.V !" "Originally released 6 April '92" "*.EXE \* \" It is unknown what 99% may do besides replicate. Known variant(s) of 99% are: 99%-B: Received in May 1993 from the Netherlands, 99%-B is a 979 byte variant of the 99% virus. It infects one .EXE file in the current directory whenever an infected program is executed. Infected programs will have a file length increase of 979 to 993 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing. The following text string is encrypted within the 99%-B viral code: "\*. *.EXE \" The 99%-B virus contains code to perform an absolute disk write which may overwrite the current drive. Origin: The Netherlands May, 1993.