Geodesic 2.0 Virus
Virus Name: Geodesic 2.0
V Status: Rare
Discovered: February, 1994
Symptoms: .COM & .EXE growth; file date/time seconds changed to 8:58:08a
Eff Length: 666 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: AVTK, ViruScan, Sweep, F-Prot, ChAV,
NAVDX, VAlert, NAV, PCScan,
AVTK/N, Sweep/N, NShld, NAV/N, Innoc
Removal Instructions: Delete infected files
The Geodesic 2.0 virus was submitted in February, 1994. Its origin or
point of isolation is unknown. This virus is a memory resident
infector of .COM and .EXE programs, including COMMAND.COM.
When the first Geodesic 2.0 infected program is executed, this virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, not moving interrupt 12's return. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 1,632 bytes. Interrupt 21 will be
hooked by the virus in memory.
Once memory resident, the Geodesic 2.0 virus will infect .COM and
.EXE programs when they are executed. Infected programs will have a
file length increase of 666 bytes with the virus being located at the
end of the file. The file's date in the DOS disk directory listing
will not be altered, but the file's timestamp will have been updated
to 8:58:08a. The following text strings are encrypted within the
Geodesic 2.0 viral code:
"Geodesic Propagation v2.0"
"Copyright (c) 1993 by Cerebral Quantas, T.O.C."
It is unknown what Geodesic 2.0 does besides replicate.