Fingers Virus

Virus Name: Fingers Aliases: V08-15, KEZB V Status: Rare Discovered: May 1991 Symptoms: .COM & .EXE growth; TSR; message; system hang Origin: Germany Eff Length: 1,322 Bytes Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Fingers virus was isolated in Germany in May, 1990. Fingers is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. The first time a program infected with Fingers is executed, the virus will install itself memory resident as a low system memory TSR of 1,728 bytes. It will hook 21. If the system date is after November 11, 1990, the virus will also hook interrupt 09. After Fingers is memory resident, it will infect .COM and .EXE programs when they are executed. If COMMAND.COM is executed, it will be infected. Infected files increase in size by 1,322 to 1,337 bytes. Fingers will be found at the end of infected programs. The file date and time in the DOS disk directory will not have been altered. Programs infected with Fingers will contain the following text strings: "COMMAND.COM" "CRITICAL ERROR 08/15: TOO MANY FINGERS ON KEYBOARD ERROR." Fingers activates when the system date is after November 11, 1990, and the system user has entered 3000 characters from the keyboard. At that time, the virus will display the second text string above and the system will be halted.