Virus Name: Flue
V Status: Rare
Discovered: October, 1993
Symptoms: .COM file growth; Screen image may be reversed
Origin: The Netherlands
Eff Length: 1,209 - 2,193 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, IBMAV, NAVDX,
VAlert, NAV, PCScan, ChAV,
NShld, Sweep/N, AVTK/N, IBMAV/N, NAV/N, LProt, Innoc 4.0+
Removal Instructions: Delete infected files
The Flue virus was submitted in October, 1993, and is originally
from The Netherlands. Flue is a non-resident, direct action
infector of .COM programs, including COMMAND.COM.
When a program infected with the Flue virus is executed, this virus
will infect from one to six .COM programs located in the current
directory. Infected programs will have a file length increase of
approximately 1,209 to 2,193 bytes with the virus being located at
the end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text strings
are encrypted within the Flue viral code:
"Hatsjeee!! (C) 1992/1993 by TridenT / [DÓRkReY]"
"Oh, BTW it's from Holland, and is called.. THE FLUE"
"For those who are interested......"
Infected programs will also have the following hex string at the
very end of the file: "4975F7C3".
The Flue virus may reverse the screen image while it is infecting
See: Darkray Trident