Flower Virus

 Virus Name:  Flower 
 Aliases:     880 
 V Status:    Rare 
 Discovered:  May, 1992 
 Isolated:    Unknown 
 Symptoms:    .EXE file growth; overwrites programs & displays messages on 
              November 11. 
 Origin:      Unknown 
 Eff Length:  883 - 897 Bytes 
 Type Code:   PNE - Parasitic Non-Resident .EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAVDX, 
                    NAV, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Flower, or 880, virus was submitted in May, 1992.  Its origin 
       or point of isolation is unknown.  Flower is a non-resident infector 
       of .EXE programs. 
       When a program infected with the Flower virus is executed, this 
       virus will search the current directory for an uninfected .EXE 
       program to infect.  Once an uninfected .EXE program is found, the 
       virus will infect it.  Once it has completed infecting the program, 
       or if no uninfected .EXE file was found, the host program the user 
       was attempting to execute will now run. 
       .EXE programs infected with the Flower virus will have a file length 
       increase of 883 to 897 bytes.  The virus will be located at the 
       end of the program.  The file's date and time in the DOS disk 
       directory listing will not be altered. 
       The following text strings are encrypted within the Flower virus 
       code in infected programs: 
               "Support the power of women 
                Use the power of man 
                Support the flower of woman 
                Use the word 
                The word is love" 
               "Originally released 7 April '92" 
               "*.EXE \* \" 
       Flower activates on November 11th of any year, at which time it 
       will overwrite programs with a trojan program.  The trojan program, 
       when executed, will display the above message. 

Show viruses from discovered during that infect .

Main Page