Ha Virus

 Virus Name:  Ha 
 V Status:    Rare 
 Discovered:  October, 1992 
 Symptoms:    .COM & .EXE growth; decrease in total system & available free 
 Origin:      Warsaw, Poland 
 Eff Length:  1,458 - 1,472 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, Sweep, IBMAV, NAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, LProt, 
                    Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Ha virus was submitted in October, 1992.  It is originally 
       from Warsaw, Poland.  Ha is a memory resident infector of .COM 
       and .EXE programs, including COMMAND.COM. 
       When the first Ha virus infected program is executed, the Ha virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary.  Total system and available free 
       memory, as indicated by the DOS CHKDSK program, will have decreased 
       by 1,456 bytes.  Interrupt 21 will be hooked by Ha in memory. 
       Once memory resident, the Ha virus will infect .COM and .EXE 
       programs, including COMMAND.COM, when they are executed.  Infected 
       programs will have a file length increase of 1,458 to 1,472 bytes 
       with the virus being located at the end of the file.  The following 
       text string is encrypted within the virus, and hence not visible in 
       infected programs: 
               "ha! version A" 
       It is unknown what Ha may do besides replicate. 

Show viruses from discovered during that infect .

Main Page