Growing Block Virus

 Virus Name:  Growing Block 
 Aliases:     Jerusalem-1361, Jerusalem-Yellow 
 V Status:    Rare 
 Discovered:  February, 1991 
 Symptoms:    TSR; .COM & .EXE growth; gradual decreases in available free 
 Origin:      Australia 
 Eff Length:  1,363 Bytes 
 Type Code:   PRsAK - Resident Parasitic .COM &.EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, NAV, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  delete infected files 
 General Comments: 
       The Growing Block virus was isolated in Australia in February, 1991. 
       It is a memory resident infector of .COM and .EXE programs, 
       including COMMAND.COM.  The virus was named after a graphic effect 
       which was produced with the original isolated sample.  Replicated 
       samples do not produce the same "growing block" graphic effect. 
       The first time a program infected with Growing Block is executed, 
       the virus will install itself memory resident in low system memory. 
       Interrupts 08, 09, and 21 will be hooked by the virus's 1,632 byte 
       TSR.  The virus may also allocate a 4,096 byte block of low system 
       memory as well, which will be marked as COMMAND Data. 
       After Growing Block is memory resident, it will infect .COM and .EXE 
       programs when they are executed.  Infected .COM programs will     
       increase in size by 1,363 bytes with the virus being located at the 
       beginning of the file.  Infected .EXE programs increase in size 
       by 1,361 to 1,375 bytes with the virus being located at the end of 
       the infected file.  The file date and time in the disk directory  
       will have been updated to the system date and time when infection 
       Systems infected with Growing Block will experience a gradual     
       decreasing of available free memory.  Each time a program infected 
       with Growing Block is executed, the virus will allocate another 
       4096 byte block of low system memory, slowly eating away available 
       free memory.  Another symptom is that the DOS CHKDSK program will 
       fail to execute properly once it is infected, resulting in the 
       message "Invalid drive or file name", and EDLIN ending execution. 
       See:   Jerusalem 

Show viruses from discovered during that infect .

Main Page