Ha Virus

Virus Name: Ha Aliases: V Status: Rare Discovered: October, 1992 Symptoms: .COM & .EXE growth; decrease in total system & available free memory Origin: Warsaw, Poland Eff Length: 1,458 - 1,472 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, LProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Ha virus was submitted in October, 1992. It is originally from Warsaw, Poland. Ha is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. When the first Ha virus infected program is executed, the Ha virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,456 bytes. Interrupt 21 will be hooked by Ha in memory. Once memory resident, the Ha virus will infect .COM and .EXE programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 1,458 to 1,472 bytes with the virus being located at the end of the file. The following text string is encrypted within the virus, and hence not visible in infected programs: "ha! version A" It is unknown what Ha may do besides replicate.