Gusano Virus


 Virus Name:  Gusano 
 Aliases: 
 V Status:    Rare 
 Discovered:  July, 1994 
 Symptoms:    .EXE file growth; message; file date/time changes 
 Origin:      Unknown - Spain? 
 Eff Length:  822 - 830 Bytes 
 Type Code:   PNE - Parasitic Resident .EXE Infector 
 Detection Method:  F-Prot, IBMAV, AVTK, ViruScan, Sweep, NAV, NAVDX, 
                    VAlert, PCScan, 
                    AVTK/N, Sweep/N, NProt, IBMAV/N, NShld, NAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Gusano virus was received in July, 1994.  Its origin or point of 
       isolation is unknown, but it may be from Spain or another Spanish 
       speaking country.  Gusano is a non-resident, direct action infector 
       of .EXE files. 
 
       When a program infected with the Gusano virus is executed, will 
       infect all of the .EXE files located in the current directory.  When 
       it has completed infecting the files, the Gusano virus will cause a 
       snake-like pattern of "o's" to appear on the system monitor.  This 
       pattern will zig-zag from the lower right corner to the middle of the 
       screen and may be accompanied by beeping.  When the "snake" reachs the 
       center of the screen, the following message will briefly appear: 
 
                旼컴컴컴컴컴 
                쿍UEN DIA!!! 
                 Yo soy un  
                  GUSANO.   
                읕컴컴컴컴컴 
 
       Programs infected with the Gusano virus will have a file length 
       increase of 822 to 830 bytes with the virus being located at the end 
       of the file.  The program's date and time in the DOS disk directory 
       listing will have been updated to the current system date and time 
       when infection occurred.  The text strings, including graphic 
       characters, from the above message can be found within the viral code 
       in all infected program, along with the following additional text 
       strings: 
 
               "*.EXE" 
               "????????" 
 
       The Gusano virus will sometimes reinfect a previously infected file, 
       resulting in an additional 820 bytes being added to the file's length. 
         

Show viruses from discovered during that infect .

Main Page