Freak Virus

Virus Name: Freak Aliases: Freak.942 V Status: Rare Discovered: September, 1993 Symptoms: .COM file growth; file date/time changes; messages; system hangs Origin: Turkey Eff Length: 942 - 947 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, AVTK, Sweep, IBMAV, NAVDX, ViruScan, NAV, VAlert, PCScan, ChAV, NProt, Sweep/N, AVTK/N, NShld, IBMAV/N, Innoc, NAV/N Removal Instructions: Delete infected files General Comments: The Freak virus was submitted in September, 1993. It appears to be from Istanbul, Turkey. Freak is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Freak virus is executed, the Freak virus will infect one .COM program in the current directory. The next time a Freak infected program is executed in this directory, the virus will remove itself from this file. It alternates between infecting and disinfecting programs each time an infected program is executed, and these actions by the virus may be accompanied by appearance of one of the two messages indicated below. Infected programs will have a file length increase of approximately 942 to 949 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code in all Freak infected programs: "Freak" "YOUR SYSTEM HAVE A HARMFULL VIRUS : FREAK !!!" "This program was written in the city of Istanbul by Freakeinstein,(c)1992-93" "Press any key to return to DOS" "Any key to continue" "(Freakeinstein 92-93 Version gg.4)" "Killing" "Fuck of Armenian Slaughters" "Press any key to continue" "***.com" "$#%#@!@!.gg" "Freak Was Here..." Programs which have been disinfected by the Freak virus will have a file length increase of 2 to 17 bytes, and will contain part of the following text string at the end of the file: "Freak Was Here..." The Freak virus may display the following message when it infects programs, where is the name of the file being infected: "(Freakeinstein 92-93 Version gg.4) Killing Any key to continue" It may also display the following message when an infected program is executed: "YOUR SYSTEM HAVE A HARMFULL VIRUS : FREAK !!!" "This program was written in the city of Istanbul by Freakeinstein,(c)1992-93" "Press any key to return to DOS" "Fuck of Armenian Slaughters" "Any key to continue" Once all of the .COM programs in the current directory have been infected and disinfected by the Freak virus, executing an infected program will result in a system hang. Known variant(s) of Freak are: Freak.604: Received in January, 1996, this is a 604 byte variant of the Freak virus described above. It adds 604 to 614 bytes to the .COM files it infects. The following text strings are visible within the viral code: "*.com" "????????COM" "Fuck of Serbia , Turkish Cool Boys,(c)1994" Origin: Unknown January, 1996.