Flex Virus

Virus Name: Flex Aliases: V Status: Rare Discovered: January, 1993 Symptoms: .COM file growth; decrease in total system & available free memory; write protect errors; message Origin: North America Eff Length: 491 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: F-Prot, ViruScan, Sweep, NAV, IBMAV, AVTK, NAVDX, VAlert, PCScan, ChAV, NShld, NProt, Sweep/N, NAV/N, AVTK/N, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The Flex virus was submitted in January, 1993. Flex is a memory resident infector of .COM programs, including COMMAND.COM. It is from North America. When the first Flex infected program is executed, the Flex virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,008 bytes. Interrupts 09 and 21 will be hooked by the Flex virus. Once the Flex virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 491 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code in all Flex infected programs: "[FLEX]" The Flex virus may occassionally display the following message on the system monitor: "Flex-It-Up gal!" "Time to have sex!" "Admiral Bailey" These text strings are encrypted within the viral code.