Freak Virus


 Virus Name:  Freak 
 Aliases:     Freak.942 
 V Status:    Rare 
 Discovered:  September, 1993 
 Symptoms:    .COM file growth; file date/time changes; messages; 
              system hangs 
 Origin:      Turkey 
 Eff Length:  942 - 947 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  F-Prot, AVTK, Sweep, IBMAV, NAVDX, 
                    ViruScan, NAV, VAlert, PCScan, ChAV, 
                    NProt, Sweep/N, AVTK/N, NShld, IBMAV/N, Innoc, NAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Freak virus was submitted in September, 1993.  It appears to be 
       from Istanbul, Turkey.  Freak is a non-resident, direct action 
       infector of .COM programs, including COMMAND.COM. 
 
       When a program infected with the Freak virus is executed, the Freak 
       virus will infect one .COM program in the current directory.  The next 
       time a Freak infected program is executed in this directory, the virus 
       will remove itself from this file.  It alternates between infecting 
       and disinfecting programs each time an infected program is executed, 
       and these actions by the virus may be accompanied by appearance of 
       one of the two messages indicated below. 
 
       Infected programs will have a file length increase of approximately 
       942 to 949 bytes with the virus being located at the end of the file. 
       The program's date and time in the DOS disk directory listing will 
       not be altered.  The following text strings can be found within the 
       viral code in all Freak infected programs: 
 
               "Freak" 
               "YOUR SYSTEM HAVE A HARMFULL VIRUS : FREAK !!!" 
               "This program was written in the city of Istanbul by 
                Freakeinstein,(c)1992-93" 
               "Press any key to return to DOS" 
               "Any key to continue" 
               "(Freakeinstein 92-93 Version gg.4)" 
               "Killing" 
               "Fuck of Armenian Slaughters" 
               "Press any key to continue" 
               "***.com" 
               "$#%#@!@!.gg" 
               "Freak Was Here..." 
 
       Programs which have been disinfected by the Freak virus will have a 
       file length increase of 2 to 17 bytes, and will contain part of the 
       following text string at the end of the file: 
 
               "Freak Was Here..."       
 
       The Freak virus may display the following message when it infects 
       programs, where  is the name of the file being infected: 
 
               "(Freakeinstein 92-93 Version gg.4) 
                Killing  
                Any key to continue" 
 
       It may also display the following message when an infected program is 
       executed: 
  
               "YOUR SYSTEM HAVE A HARMFULL VIRUS : FREAK !!!" 
               "This program was written in the city of Istanbul by 
                Freakeinstein,(c)1992-93" 
               "Press any key to return to DOS" 
               "Fuck of Armenian Slaughters" 
               "Any key to continue" 
 
       Once all of the .COM programs in the current directory have been 
       infected and disinfected by the Freak virus, executing an infected 
       program will result in a system hang. 
 
       Known variant(s) of Freak are: 
       Freak.604: Received in January, 1996, this is a 604 byte variant 
           of the Freak virus described above.  It adds 604 to 614 bytes to 
           the .COM files it infects.  The following text strings are 
           visible within the viral code: 
           "*.com" 
           "????????COM" 
           "Fuck of Serbia , Turkish Cool Boys,(c)1994" 
           Origin:  Unknown  January, 1996. 

Show viruses from discovered during that infect .

Main Page