Gosia Virus

Virus Name: Gosia Aliases: V Status: Rare Discovered: November, 1991 Symptoms: .COM file growth Origin: Poland Eff Length: 466 Bytes Type Code: PRCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Gosia virus was received in November, 1991. It is originally from Poland. Gosia is a memory resident infector of .COM files, including COMMAND.COM. The first time a program infected with Gosia is executed, the Gosia virus will become memory resident in a "hole" in system memory. There will be no change in total system or available free memory. At this time, the virus will infect all .COM files which are located in the current directory. Once Gosia is memory resident, it will infect any .COM file which is executed which has not previously been infected by the virus. Gosia infected .COM files will have a file length increase of 466 bytes with the virus being located at the beginning of the file. There will be no change to the file's date and time in a DOS disk directory listing. The following text strings can be found within the viral code in infected programs: "Gosia" "*.COM" "????????COM" The Gosia virus does not do anything besides replicate.