Flying Virus

Virus Name: Flying Aliases: Flying.633 V Status: New Discovered: May, 1996 Isolated: Unknown Symptoms: .COM files created; decrease in available free memory Origin: Unknown Eff Length: 633 Bytes Type Code: SRhE - Spawning or Companion Resident .EXE Infector Detection Method: F-Prot, AVTK, IBMAV, PCScan, NAV, NAVDX, ViruScan, ChAV, AVTK/N, IBMAV/N, NAV/N, NShld, Innoc Removal Instructions: Delete infected files General Comments: The Flying virus was received in May, 1996. Its origin or point of isolation is unknown. Flying is a memory resident spawning or companion virus. When a program infected with the Flying virus is executed, this virus may become memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return, though it may take repeated executions before the virus becomes memory resident. Available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 1,328 bytes. Interrupt 21 will be hooked by the virus in memory. Once the Flying virus is memory resident, it will infect .EXE files when they are executed by creating a .COM file with the same base file name. These newly created .COM files will be 633 bytes in size and have the read only and hidden attributes set. The file's date and time in the DOS disk directory will be the system date and time when the file was created. These 633 byte hidden .COM files contain the Flying viral code. The following text strings are encrypted within the viral code: "Flying-V" "[DAN]" It is unknown what the Flying virus may do besides replicate.