Flower Virus

Virus Name: Flower Aliases: 880 V Status: Rare Discovered: May, 1992 Isolated: Unknown Symptoms: .EXE file growth; overwrites programs & displays messages on November 11. Origin: Unknown Eff Length: 883 - 897 Bytes Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAVDX, NAV, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Flower, or 880, virus was submitted in May, 1992. Its origin or point of isolation is unknown. Flower is a non-resident infector of .EXE programs. When a program infected with the Flower virus is executed, this virus will search the current directory for an uninfected .EXE program to infect. Once an uninfected .EXE program is found, the virus will infect it. Once it has completed infecting the program, or if no uninfected .EXE file was found, the host program the user was attempting to execute will now run. .EXE programs infected with the Flower virus will have a file length increase of 883 to 897 bytes. The virus will be located at the end of the program. The file's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the Flower virus code in infected programs: "FLOWER" "Support the power of women Use the power of man Support the flower of woman Use the word FUCK The word is love" "Originally released 7 April '92" "*.EXE \* \" Flower activates on November 11th of any year, at which time it will overwrite programs with a trojan program. The trojan program, when executed, will display the above message.