Gusano Virus

Virus Name: Gusano Aliases: V Status: Rare Discovered: July, 1994 Symptoms: .EXE file growth; message; file date/time changes Origin: Unknown - Spain? Eff Length: 822 - 830 Bytes Type Code: PNE - Parasitic Resident .EXE Infector Detection Method: F-Prot, IBMAV, AVTK, ViruScan, Sweep, NAV, NAVDX, VAlert, PCScan, AVTK/N, Sweep/N, NProt, IBMAV/N, NShld, NAV/N Removal Instructions: Delete infected files General Comments: The Gusano virus was received in July, 1994. Its origin or point of isolation is unknown, but it may be from Spain or another Spanish speaking country. Gusano is a non-resident, direct action infector of .EXE files. When a program infected with the Gusano virus is executed, will infect all of the .EXE files located in the current directory. When it has completed infecting the files, the Gusano virus will cause a snake-like pattern of "o's" to appear on the system monitor. This pattern will zig-zag from the lower right corner to the middle of the screen and may be accompanied by beeping. When the "snake" reachs the center of the screen, the following message will briefly appear: ÚÄÄÄÄÄÄÄÄÄÄÄ¿ ³BUEN DIA!!!³ ³ Yo soy un ³ ³ GUSANO. ³ ÀÄÄÄÄÄÄÄÄÄÄÄÙ Programs infected with the Gusano virus will have a file length increase of 822 to 830 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The text strings, including graphic characters, from the above message can be found within the viral code in all infected program, along with the following additional text strings: "*.EXE" "????????" The Gusano virus will sometimes reinfect a previously infected file, resulting in an additional 820 bytes being added to the file's length.