Funeral Virus


 Virus Name:  Funeral 
 Aliases:    
 V Status:    Rare 
 Discovered:  August, 1992 
 Symptoms:    .COM & .EXE growth; music; file date/time changes; decrease 
              in total system and available free memory 
 Origin:      Eastern Europe 
 Eff Length:  921 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  F-Prot, Sweep, IBMAV, ViruScan, AVTK, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, NAV/N, 
                    IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Funeral virus was received in August, 1992.  It is originally 
       from Eastern Europe.  Funeral is a memory resident infector of 
       .COM and .EXE programs, including COMMAND.COM. 
 
       When the first Funeral infected program is executed, the Funeral 
       virus will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary.  Total system and available 
       free memory, as indicated by the DOS CHKDSK program, will have 
       decreased by 976 bytes.  Interrupts 08 and 21 will be hooked 
       by the virus in memory.  Also at this time, the virus will infect 
       the boot copy of COMMAND.COM if it was not previously infected. 
 
       Once the Funeral virus is memory resident, it will infect .COM and 
       .EXE programs when they are executed or opened.  Infected programs 
       will have a file length increase of 921 bytes with the virus being 
       located at the end of the file.  The program's date and time in 
       the DOS disk directory will have been updated to the current system 
       date and time when infection occurred. 
 
       After the Funeral virus has been memory resident for 1 hour, it 
       will play a short funeral march on the system speaker, and then a 
       system reboot will occur.  The funeral march is the same as the 
       tune played by the ZK900 virus. 

Show viruses from discovered during that infect .

Main Page