Virus Name: Genc
V Status: Rare
Discovery: July, 1994
Symptoms: .COM & .SYS file growth; message;
decrease in total system & available free memory
Eff Length: 502 Bytes
Type Code: PRhCK - Parasitic Resident .COM & .SYS Infector
Detection Method: F-Prot, IBMAV, AVTK, ViruScan, Sweep, NAV, NAVDX,
AVTK/N, Sweep/N, NProt, IBMAV/N, NShld, NAV/N
Removal Instructions: Delete infected files
The Genc or Genc.502 virus was received in July, 1994. Its origin or
point of isolation is unknown. This virus is a memory resident
infector of .COM and .SYS files, including COMMAND.COM. It is a fast
infector and can quickly spread on a system.
When the first Genc infected program is executed, this virus will
install itself memory resident at the top of system memory but below
the 640K DOS boundary, not moving interrupt 12's return. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 1,296 bytes. Interrupts 21 and 24
will be hooked by the virus in memory. Also at this time, the virus
will infect COMMAND.COM if it wasn't previously infected.
Once memory resident, this virus will infect .COM and .SYS files
when they are executed, copied, or opened for any reason. Infected
files will increase in size by 502 bytes with the virus being
located at the end of the file. The program's date and time in the
DOS disk directory listing will not be altered. The following text
string is visible within the viral code in all infected programs:
"This virus is Shaware!"
The above text string will also be occassionally displayed by the
virus when .EXE files are executed.
Known variant(s) of Genc are:
Genc.1000: Received in July, 1994, Genc.1000 is a 1,000 byte
variant of the Genc virus described above. Its size in memory
is 1,280 bytes, hooking interrupt 21. It infects .COM files,
including COMMAND.COM, when they are executed. Infected files
increase in size by 1,000 bytes with the virus being located
at the end of the file. The file's date in the DOS disk
directory listing will have been altered on all infected files.
The following text string is visible within the viral code in
all infected programs:
"GencVir (C) 1993 by HACKER"
The Genc.1000 virus will occassionally display this text string
as a message.
Origin: Unknown July, 1994.