Green Joker Virus
Virus Name: Green Joker
V Status: Rare
Discovered: June, 1992
Symptoms: .COM file growth; file date/time changes; messages; beeping
Eff Length: 743 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: AVTK, ViruScan, F-Prot, Sweep, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Green Joker, or Green, virus was submitted in June, 1992. Its
origin or point of isolation is unknown. Green Joker is a non-
resident, direct action infector of .COM programs, including
COMMAND.COM. It may be related to the Ash virus.
When a program infected with the Green Joker virus is executed, this
virus will infect all of the .COM programs located in the current
directory. If COMMAND.COM is located in this directory, it will
become infected. Programs infected with the Green Joker virus will
have a file length increase of 743 bytes with the virus being
located at the end of the file. The program's date and time in the
DOS disk directory listing will have been updated to the current
system date and time when infection occurred.
The Green Joker virus will usually display a message on the system
display when an infected program is executed. Occassionally, the
message will be accompanied by beeping on the system speaker. The
messages which may be displayed by the virus are:
"Fail on INT 24"
"Impotence error reading user's dick
Abort, Retry, Ignore, Fail?"
"Program too big to fit in memory"
"Cannot load COMMAND, system halted"
The above message text strings can be found within the viral code
in infected programs, along with the following two additional text
Green Joker doesn't do anything besides display its messages and