Growing Block Virus
Virus Name: Growing Block
Aliases: Jerusalem-1361, Jerusalem-Yellow
V Status: Rare
Discovered: February, 1991
Symptoms: TSR; .COM & .EXE growth; gradual decreases in available free
Eff Length: 1,363 Bytes
Type Code: PRsAK - Resident Parasitic .COM &.EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: delete infected files
The Growing Block virus was isolated in Australia in February, 1991.
It is a memory resident infector of .COM and .EXE programs,
including COMMAND.COM. The virus was named after a graphic effect
which was produced with the original isolated sample. Replicated
samples do not produce the same "growing block" graphic effect.
The first time a program infected with Growing Block is executed,
the virus will install itself memory resident in low system memory.
Interrupts 08, 09, and 21 will be hooked by the virus's 1,632 byte
TSR. The virus may also allocate a 4,096 byte block of low system
memory as well, which will be marked as COMMAND Data.
After Growing Block is memory resident, it will infect .COM and .EXE
programs when they are executed. Infected .COM programs will
increase in size by 1,363 bytes with the virus being located at the
beginning of the file. Infected .EXE programs increase in size
by 1,361 to 1,375 bytes with the virus being located at the end of
the infected file. The file date and time in the disk directory
will have been updated to the system date and time when infection
Systems infected with Growing Block will experience a gradual
decreasing of available free memory. Each time a program infected
with Growing Block is executed, the virus will allocate another
4096 byte block of low system memory, slowly eating away available
free memory. Another symptom is that the DOS CHKDSK program will
fail to execute properly once it is infected, resulting in the
message "Invalid drive or file name", and EDLIN ending execution.