Virus Name: 99%
Aliases: 99 Percent, Traveling Jack
V Status: Rare
Discovery: November, 1992
Symptoms: .EXE file growth; file time seconds set to 14
Eff Length: 821 - 835 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: AVTK, Sweep, F-Prot, ViruScan, IBMAV, NAV,
NAVDX, VAlert, ChAV,
Sweep/N, NShld, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N,
Removal Instructions: Delete infected files
The 99% virus was submitted in November, 1992. Its origin is
unknown, but it appears to be from Europe. 99% is a non-resident
direct action infector of .EXE programs.
When a program infected with 99% is executed, the 99% virus will
infect one .EXE program located in the current directory or in the
current drive's root directory. Infected programs will have a file
length increase of 821 to 835 bytes with the virus being located at
the end of the file. The program's date and time in the DOS disk
directory listing will appear to not be altered, but the file time
seconds will have been set to "14".
The following text strings are encrypted within the 99% virus' code:
"Het 99%-virus heeft toegeslagen. . ."
"This is my revenge E.V !"
"Originally released 6 April '92"
"*.EXE \* \"
It is unknown what 99% may do besides replicate.
Known variant(s) of 99% are:
99%-B: Received in May 1993 from the Netherlands, 99%-B is a
979 byte variant of the 99% virus. It infects one .EXE
file in the current directory whenever an infected program
is executed. Infected programs will have a file length
increase of 979 to 993 bytes with the virus being located
at the end of the file. The program's date and time in the
DOS disk directory listing. The following text string is
encrypted within the 99%-B viral code:
"\*. *.EXE \"
The 99%-B virus contains code to perform an absolute disk
write which may overwrite the current drive.
Origin: The Netherlands May, 1993.