Five Eights Virus

Virus Name: Five Eights Aliases: Five Eights.635 V Status: New Discovered: May, 1995 Symptoms: .COM file growth; decrease in total available free memory; file date/time seconds = "62" Origin: Unknown Eff Length: 635 Bytes Type Code: PRhC - Parasitic Resident .COM Infector Detection Method: F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert, ViruScan, PCScan, ChAV, Sweep/N, NProt, AVTK/N, IBMAV/N, NShld, NAV/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Five Eights virus was received in May, 1995. Its origin or point of isolation is unknown. Five Eights is a memory resident infector of .COM files, but not COMMAND.COM. When the first Five Eights infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupt 21. Total available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by approximately 1,664 bytes. Once this virus is memory resident, it will infect .COM files when they are executed. Infected files will have a file length increase of 635 bytes with the virus being located at the beginning of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, though the seconds field will have been set to "62". No text strings are visible within the viral code. It is unknown what the Five Eights virus may do besides replicate.