Flying Virus

 Virus Name:  Flying 
 Aliases:     Flying.633 
 V Status:    New 
 Discovered:  May, 1996 
 Isolated:    Unknown 
 Symptoms:    .COM files created; decrease in available free memory 
 Origin:      Unknown 
 Eff Length:  633 Bytes 
 Type Code:   SRhE - Spawning or Companion Resident .EXE Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, PCScan, NAV, NAVDX, ViruScan, 
                    AVTK/N, IBMAV/N, NAV/N, NShld, Innoc 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Flying virus was received in May, 1996.  Its origin or point of 
       isolation is unknown.  Flying is a memory resident spawning or 
       companion virus. 
       When a program infected with the Flying virus is executed, this 
       virus may become memory resident at the top of system memory but 
       below the 640K DOS boundary, not moving interrupt 12's return, though 
       it may take repeated executions before the virus becomes memory 
       resident.  Available free memory, as indicated by the DOS CHKDSK 
       program from DOS 5.0, will have decreased by 1,328 bytes.  Interrupt 
       21 will be hooked by the virus in memory. 
       Once the Flying virus is memory resident, it will infect .EXE files 
       when they are executed by creating a .COM file with the same base 
       file name.  These newly created .COM files will be 633 bytes in 
       size and have the read only and hidden attributes set.  The file's 
       date and time in the DOS disk directory will be the system date and 
       time when the file was created.  These 633 byte hidden .COM files 
       contain the Flying viral code.  The following text strings are 
       encrypted within the viral code: 
       It is unknown what the Flying virus may do besides replicate. 

Show viruses from discovered during that infect .

Main Page