Frere Jacques Virus
Virus Name: Frere Jacques
Aliases: Frere Virus, Frere Jacques-B, Frere Jacques-C,
Frere Jacques-D, Two Tigers
V Status: Rare
Discovered: May 1990
Symptoms: .COM & .EXE growth; available memory decreases; system hangs;
music (Frere Jacques) on Fridays
Origin: California, United States
Eff Length: 1,808 - 1,822 Bytes
Type Code: PRA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, NAV, AVTK, Sweep,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
NAV/N, IBMAV/N
Removal Instructions: NAV, or delete infected files
General Comments:
The Frere Jacques virus was isolated in May, 1990. It is a memory
resident generic file infector, infecting .COM, .EXE, and Overlay
files. It does not infect COMMAND.COM. This virus is based on the
Jerusalem virus.
The first time an infected program is executed, the virus will
install itself memory resident in low available free memory. The
memory resident virus occupies 2,064 bytes, and attaches itself to
interrupt 21. After becoming memory resident, Frere Jacques will
infect any program which is then executed. Infected programs will
increase in size by between 1,808 bytes and 1,822 bytes, though .COM
files always increase in size by 1,813 bytes.
Systems infected with Frere Jacques will experience a decrease in
available free memory, as well as executable files increasing in
size. System hangs will also intermittently occur when the virus
attempts to infect programs, thus resulting in the possible loss of
system data.
On Fridays, the Frere Jacques virus activates, and will play the
tune "Frere Jacques" on the system speaker.
Known variant(s) of Frere Jacques are:
Frere Jacques-B: Similar to Frere Jacques, this variant will
play the tune "Frere Jacques" on the system speaker
every few minutes on Fridays. On Fridays, it will
have a 2,112 byte TSR in memory with interrupts
08, 21, and 22 hooked.
Frere Jacques-C: Frere Jacques-C differs from Frere Jacques-C
by two bytes within its viral code. Unlike the
other Frere Jacques, this variant will play music
every few minutes on any day of the week. Its
memory resident TSR is always 2,064 bytes in
length with interrupts 08 and 21 hooked.
Frere Jacques-D: Frere Jacques-D is similar to Frere Jacques-C,
however it will only play music on Fridays, and the
delay before the music starts is longer. On
Fridays, its memory resident TSR is 2,064 bytes with
interrupts 08 and 21 hooked.
Also see: Jerusalem