Funeral Virus
Virus Name: Funeral
Aliases:
V Status: Rare
Discovered: August, 1992
Symptoms: .COM & .EXE growth; music; file date/time changes; decrease
in total system and available free memory
Origin: Eastern Europe
Eff Length: 921 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, Sweep, IBMAV, ViruScan, AVTK,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, NAV/N,
IBMAV/N
Removal Instructions: Delete infected files
General Comments:
The Funeral virus was received in August, 1992. It is originally
from Eastern Europe. Funeral is a memory resident infector of
.COM and .EXE programs, including COMMAND.COM.
When the first Funeral infected program is executed, the Funeral
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. Total system and available
free memory, as indicated by the DOS CHKDSK program, will have
decreased by 976 bytes. Interrupts 08 and 21 will be hooked
by the virus in memory. Also at this time, the virus will infect
the boot copy of COMMAND.COM if it was not previously infected.
Once the Funeral virus is memory resident, it will infect .COM and
.EXE programs when they are executed or opened. Infected programs
will have a file length increase of 921 bytes with the virus being
located at the end of the file. The program's date and time in
the DOS disk directory will have been updated to the current system
date and time when infection occurred.
After the Funeral virus has been memory resident for 1 hour, it
will play a short funeral march on the system speaker, and then a
system reboot will occur. The funeral march is the same as the
tune played by the ZK900 virus.