Fungus Virus
Virus Name: Fungus
Aliases: X-Fungus
V Status: Rare
Discovered: May, 1992
Symptoms: .COM & .EXE growth; file allocation errors; decrease in total
system and available free memory
Origin: Australia
Eff Length: 1,422 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N,
LProt
Removal Instructions: Delete infected files
General Comments:
The Fungus virus was discovered in Australia in May, 1992. It is
a memory resident infector of .COM and .EXE programs, including
COMMAND.COM, and employs some stealth techniques.
When the first Fungus infected program is executed, the Fungus virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary. Total system and available free
memory, as indicated by the DOS CHKDSK program, will have decreased
by 2,048 bytes. Interrupts 08 and 21 will be hooked by the virus.
Interrupt 12's return will not have been moved. Also at this time,
the virus will infect COMMAND.COM, if it was not previously
infected.
After the Fungus virus has become memory resident, it will
intermittently infect .COM and .EXE programs when they are opened
or executed. Infected programs will have a file length increase
of 1,422 bytes, though the file length increase will not be visible
if the virus is memory resident. The virus' code will be located at
the end of the file. The program's date and time in the DOS disk
directory listing will not have been altered.
Several text strings can be found within the viral code in Fungus
infected programs:
"*X-Fungus by Harry McBungus*"
"*Nugga!*"
"*Greets SCP*"
"*Greets RABID*"
"* Patricia: Grow some programming knowledge *"
"*Grease me!*"
"*Epileptic Downer*"
Besides the decrease in total system and available free memory,
systems infected with the Fungus virus will also experience file
allocation errors on infected files when the DOS CHKDSK program
is executed with the virus memory resident.