Flue Virus


 Virus Name:  Flue 
 Aliases:    
 V Status:    Rare 
 Discovered:  October, 1993 
 Symptoms:    .COM file growth; Screen image may be reversed 
 Origin:      The Netherlands 
 Eff Length:  1,209 - 2,193 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, Sweep, F-Prot, IBMAV, NAVDX, 
                    VAlert, NAV, PCScan, ChAV, 
                    NShld, Sweep/N, AVTK/N, IBMAV/N, NAV/N, LProt, Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Flue virus was submitted in October, 1993, and is originally 
       from The Netherlands.  Flue is a non-resident, direct action 
       infector of .COM programs, including COMMAND.COM. 
 
       When a program infected with the Flue virus is executed, this virus 
       will infect from one to six .COM programs located in the current 
       directory.  Infected programs will have a file length increase of 
       approximately 1,209 to 2,193 bytes with the virus being located at 
       the end of the file.  The program's date and time in the DOS disk 
       directory listing will not be altered.  The following text strings 
       are encrypted within the Flue viral code: 
 
               "Hatsjeee!! (C) 1992/1993 by TridenT / [DÓRkReY]" 
               "Oh, BTW it's from Holland, and is called.. THE FLUE" 
               "For those who are interested......" 
 
       Infected programs will also have the following hex string at the 
       very end of the file: "4975F7C3". 
 
       The Flue virus may reverse the screen image while it is infecting 
       files. 
 
       See:   Darkray   Trident 

Show viruses from discovered during that infect .

Main Page