Flue Virus

Virus Name: Flue Aliases: V Status: Rare Discovered: October, 1993 Symptoms: .COM file growth; Screen image may be reversed Origin: The Netherlands Eff Length: 1,209 - 2,193 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, IBMAV, NAVDX, VAlert, NAV, PCScan, ChAV, NShld, Sweep/N, AVTK/N, IBMAV/N, NAV/N, LProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Flue virus was submitted in October, 1993, and is originally from The Netherlands. Flue is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Flue virus is executed, this virus will infect from one to six .COM programs located in the current directory. Infected programs will have a file length increase of approximately 1,209 to 2,193 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the Flue viral code: "Hatsjeee!! (C) 1992/1993 by TridenT / [DàRkReY]" "Oh, BTW it's from Holland, and is called.. THE FLUE" "For those who are interested......" Infected programs will also have the following hex string at the very end of the file: "4975F7C3". The Flue virus may reverse the screen image while it is infecting files. See: Darkray Trident