Frere Jacques Virus

 Virus Name:  Frere Jacques 
 Aliases:     Frere Virus, Frere Jacques-B, Frere Jacques-C, 
              Frere Jacques-D, Two Tigers 
 V Status:    Rare 
 Discovered:  May 1990 
 Symptoms:    .COM & .EXE growth; available memory decreases; system hangs; 
              music (Frere Jacques) on Fridays 
 Origin:      California, United States 
 Eff Length:  1,808 - 1,822 Bytes 
 Type Code:   PRA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, NAV, AVTK, Sweep, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  NAV, or delete infected files 
 General Comments: 
       The Frere Jacques virus was isolated in May, 1990.  It is a memory 
       resident generic file infector, infecting .COM, .EXE, and Overlay 
       files.  It does not infect COMMAND.COM.  This virus is based on the 
       Jerusalem virus. 
       The first time an infected program is executed, the virus will 
       install itself memory resident in low available free memory. The 
       memory resident virus occupies 2,064 bytes, and attaches itself to 
       interrupt 21.  After becoming memory resident, Frere Jacques will 
       infect any program which is then executed.  Infected programs will 
       increase in size by between 1,808 bytes and 1,822 bytes, though .COM 
       files always increase in size by 1,813 bytes. 
       Systems infected with Frere Jacques will experience a decrease in 
       available free memory, as well as executable files increasing in 
       size.  System hangs will also intermittently occur when the virus 
       attempts to infect programs, thus resulting in the possible loss of 
       system data. 
       On Fridays, the Frere Jacques virus activates, and will play the 
       tune "Frere Jacques" on the system speaker. 
       Known variant(s) of Frere Jacques are: 
       Frere Jacques-B: Similar to Frere Jacques, this variant will 
                        play the tune "Frere Jacques" on the system speaker 
                        every few minutes on Fridays.  On Fridays, it will 
                        have a 2,112 byte TSR in memory with interrupts 
                        08, 21, and 22 hooked. 
       Frere Jacques-C: Frere Jacques-C differs from Frere Jacques-C 
                        by two bytes within its viral code.  Unlike the 
                        other Frere Jacques, this variant will play music 
                        every few minutes on any day of the week.  Its 
                        memory resident TSR is always 2,064 bytes in 
                        length with interrupts 08 and 21 hooked. 
       Frere Jacques-D: Frere Jacques-D is similar to Frere Jacques-C, 
                        however it will only play music on Fridays, and the 
                        delay before the music starts is longer.  On 
                        Fridays, its memory resident TSR is 2,064 bytes with 
                        interrupts 08 and 21 hooked. 
       Also see:   Jerusalem 

Show viruses from discovered during that infect .

Main Page