Five Eights Virus
Virus Name: Five Eights
Aliases: Five Eights.635
V Status: New
Discovered: May, 1995
Symptoms: .COM file growth; decrease in total available free memory;
file date/time seconds = "62"
Eff Length: 635 Bytes
Type Code: PRhC - Parasitic Resident .COM Infector
Detection Method: F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert,
ViruScan, PCScan, ChAV,
Sweep/N, NProt, AVTK/N, IBMAV/N, NShld, NAV/N, Innoc 4.0+
Removal Instructions: Delete infected files
The Five Eights virus was received in May, 1995. Its origin or point
of isolation is unknown. Five Eights is a memory resident infector
of .COM files, but not COMMAND.COM.
When the first Five Eights infected program is executed, this virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, hooking interrupt 21. Total available
free memory, as indicated by the DOS CHKDSK program from DOS 5.0,
will have decreased by approximately 1,664 bytes.
Once this virus is memory resident, it will infect .COM files when
they are executed. Infected files will have a file length increase
of 635 bytes with the virus being located at the beginning of the
file. The program's date and time in the DOS disk directory listing
will not appear to be altered, though the seconds field will have been
set to "62". No text strings are visible within the viral code.
It is unknown what the Five Eights virus may do besides replicate.