Green Peace Virus
Virus Name: Green Peace
Aliases:
V Status: Viron
Discovered: April, 1991
Symptoms: .EXE files overwritten; message displayed; system hangs;
additional files located on disk; file date/time changes
Origin: United States
Eff Length: 15,022 Bytes
Type Code: ONE - Overwriting Non-Resident .EXE Infector
Detection Method: NAV, NAVDX, ViruScan, AVTK 7.68+,
NAV/N, NShld 2.33+, AVTK/N 7.68+
Removal Instructions: Delete infected files
General Comments:
The Green Peace virus was received in April 1991 from a United
States source. This virus is a non-resident overwriting virus which
infects .EXE programs. It is a research virus, its original source,
as well as an infected .COM file arrived as the original submission.
When a program infected with Green Peace is infected, the virus will
infect all .EXE programs located in the current directory by
overwriting the first 15,022 bytes with the virus. If the .EXE
program was originally smaller than 15,022 bytes, its length on
infection will be 15,022 bytes. Larger files will not have any file
size increase. The date and time of infected files will be updated
to the system date and time when infection occurred. All infected
.EXE files will contain the following text near the beginning of the
program:
"Green PeaceGreen Peace"
After infecting all of the .EXE files in the current directory, the
virus will then scroll the system display and display the message
"Green Peace" in the middle of the screen. The system will then
appear to be hung until CTRL-C is hit several times.
Two additional files can be found in disk directories containing
programs infected with Green Peace. These files are named INH and
7.EXE. The INH file contains a list of all files in the current
directory which are infected. 7.EXE contains a pure copy of the
Green Peace virus.
The original sample received of this virus is a .COM file which
"drops" the Green Peace virus. It does not contain the above text
string, but instead contains the text string "GREEN".
Green Peace does not do anything besides replicate (overwriting its
host) and displaying its message.