Virus Name: Ha
V Status: Rare
Discovered: October, 1992
Symptoms: .COM & .EXE growth; decrease in total system & available free
Origin: Warsaw, Poland
Eff Length: 1,458 - 1,472 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV, NAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, LProt,
Removal Instructions: Delete infected files
The Ha virus was submitted in October, 1992. It is originally
from Warsaw, Poland. Ha is a memory resident infector of .COM
and .EXE programs, including COMMAND.COM.
When the first Ha virus infected program is executed, the Ha virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary. Total system and available free
memory, as indicated by the DOS CHKDSK program, will have decreased
by 1,456 bytes. Interrupt 21 will be hooked by Ha in memory.
Once memory resident, the Ha virus will infect .COM and .EXE
programs, including COMMAND.COM, when they are executed. Infected
programs will have a file length increase of 1,458 to 1,472 bytes
with the virus being located at the end of the file. The following
text string is encrypted within the virus, and hence not visible in
"ha! version A"
It is unknown what Ha may do besides replicate.