Freew-692 Virus

Virus Name: Freew-692 Aliases: V Status: Rare Discovered: April, 1992 Symptoms: .COM file growth Origin: Unknown Eff Length: 692 - 1,362 Bytes Type Code: PNC - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Freew-692 virus was submitted in April, 1992. Its origin, or point of isolation, is unknown. Freew-692 is a non-resident, direct action infector of .COM programs. It does not infect COMMAND.COM. When a program infected with Freew-692 is executed, this virus will infect all uninfected .COM programs other than COMMAND.COM which are located in the current directory. Once it completes infecting all of the .COM programs in the current directory, it will then start infecting the .COM programs on the C: drive in other than the root directory. Needless to say, this process results in a very long disk access. Programs infected with the Freew-692 virus will normally increase in size by 692 bytes with the virus being located at the beginning of the infected file. The exception is that in the case where the host programs original file length was less than 672 bytes, the infected file length will become 1,364 bytes. There will be no change to the file's date and time in the DOS disk directory listing. The following text strings can be found within the viral code in all Freew-692 infected programs: "????????COM" "Freew maa" "*.* *.com" "COMMAND.MKS_VIR" It is unknown if Freew-692 does anything besides replicate.