Grace Virus

 Virus Name:  Grace 
 Aliases:     Grace.1346 
 V Status:    New 
 Discovered:  January, 1996 
 Symptoms:    .COM & .EXE growth; decrease in available free memory; 
              system hangs 
 Origin:      Unknown 
 Eff Length:  1,346 or more Bytes 
 Type Code:   PRhA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  NAV, NAVDX, AVTK, ViruScan, IBMAV, F-Prot, ChAV, 
                    NAV/N, AVTK/N, NShld, IBMAV/N, Innoc 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Grace or Grace.1346 virus was received in January, 1996.  Its 
       origin or point of isolation is unknown.  Grace is a memory resident 
       fast infector of .COM and .EXE files, but not COMMAND.COM. 
       When the first Grace infected program is executed, this virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary, not moving interrupt 12's return.  Available 
       free memory, as indicated by the DOS CHKDSK program from DOS 5.0, 
       will have decreased by 5,120 bytes.  Interrupt 21 will be hooked by 
       the virus in memory. 
       Once the Grace virus is memory resident, it will infect .COM and 
       .EXE files when they are executed, opened, or copied.  Infected .COM 
       files will have a file length increase of 1,346 bytes with the virus 
       being located at the end of the file.  .EXE files will increase in 
       size by more than 1,346 bytes, and the virus will be located 
       somewhere between the middle and the end of the file.  In both cases, 
       the program's date and time in the DOS disk directory listing will 
       not be altered.  The following text strings are visible within the 
       viral code in all infected programs: 
           "-[Grace] by TLN 94-" 
           "You make me sick I make viruses" 
           "Have a nice $piss-up!" 
       System hangs may occur when small .COM and .EXE files are executed 
       with the virus memory resident. 

Show viruses from discovered during that infect .

Main Page