Virus Name: Flower
V Status: Rare
Discovered: May, 1992
Symptoms: .EXE file growth; overwrites programs & displays messages on
Eff Length: 883 - 897 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAVDX,
NAV, VAlert, PCScan, ChAV,
NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N,
Removal Instructions: Delete infected files
The Flower, or 880, virus was submitted in May, 1992. Its origin
or point of isolation is unknown. Flower is a non-resident infector
of .EXE programs.
When a program infected with the Flower virus is executed, this
virus will search the current directory for an uninfected .EXE
program to infect. Once an uninfected .EXE program is found, the
virus will infect it. Once it has completed infecting the program,
or if no uninfected .EXE file was found, the host program the user
was attempting to execute will now run.
.EXE programs infected with the Flower virus will have a file length
increase of 883 to 897 bytes. The virus will be located at the
end of the program. The file's date and time in the DOS disk
directory listing will not be altered.
The following text strings are encrypted within the Flower virus
code in infected programs:
"Support the power of women
Use the power of man
Support the flower of woman
Use the word
The word is love"
"Originally released 7 April '92"
"*.EXE \* \"
Flower activates on November 11th of any year, at which time it
will overwrite programs with a trojan program. The trojan program,
when executed, will display the above message.