Growing Block Virus

Virus Name: Growing Block Aliases: Jerusalem-1361, Jerusalem-Yellow V Status: Rare Discovered: February, 1991 Symptoms: TSR; .COM & .EXE growth; gradual decreases in available free memory Origin: Australia Eff Length: 1,363 Bytes Type Code: PRsAK - Resident Parasitic .COM &.EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: delete infected files General Comments: The Growing Block virus was isolated in Australia in February, 1991. It is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. The virus was named after a graphic effect which was produced with the original isolated sample. Replicated samples do not produce the same "growing block" graphic effect. The first time a program infected with Growing Block is executed, the virus will install itself memory resident in low system memory. Interrupts 08, 09, and 21 will be hooked by the virus's 1,632 byte TSR. The virus may also allocate a 4,096 byte block of low system memory as well, which will be marked as COMMAND Data. After Growing Block is memory resident, it will infect .COM and .EXE programs when they are executed. Infected .COM programs will increase in size by 1,363 bytes with the virus being located at the beginning of the file. Infected .EXE programs increase in size by 1,361 to 1,375 bytes with the virus being located at the end of the infected file. The file date and time in the disk directory will have been updated to the system date and time when infection occurred. Systems infected with Growing Block will experience a gradual decreasing of available free memory. Each time a program infected with Growing Block is executed, the virus will allocate another 4096 byte block of low system memory, slowly eating away available free memory. Another symptom is that the DOS CHKDSK program will fail to execute properly once it is infected, resulting in the message "Invalid drive or file name", and EDLIN ending execution. See: Jerusalem