Hafenstrass 2 Virus

 Virus Name:  Hafenstrass 2 
 V Status:    Rare 
 Discovered:  February, 1992 
 Symptoms:    .COM & .EXE growth; ambulance car graphic with siren 
 Origin:      Unknown 
 Eff Length:  796 Bytes (.COM), 1,641 Bytes (.EXE) 
 Type Code:   PNA - Non-Resident Parasitic .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, AVTK, Sweep, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Hafenstrass 2 virus was received in February, 1992 from an 
       unknown location.  This virus, like the original Hafenstrass, is 
       a non-resident, direct action infector of .EXE programs.  A major 
       distinction is that Hafenstrass 2 is actually a virus which 
       contains another virus, Ambulance Car.  The Ambulance Car virus 
       only infects .COM programs. 
       When a .EXE program infected with Hafenstrass 2 is executed, the 
       Hafenstrass 2 virus will infect one .COM program and one .EXE 
       program located in the current directory.  When the user later 
       executes one of the infected .COM programs, one or two .COM 
       programs in the current directory will become infected. 
       Of the .COM and .EXE programs infected by the Hafenstrass 2 virus, 
       only the .EXE programs contain the full Hafenstrass 2 virus.  The 
       .COM programs which were infected as a result of executing a 
       Hafenstrass 2 infected .EXE program will only contain the 
       Ambulance Car virus which is dropped by Hafenstrass 2. 
       .EXE programs infected with Hafenstrass 2 will have a file length 
       increase of 1,641 bytes.  The virus will be located at the end of 
       the infected program.  There will be no change to the file's date 
       and time in the DOS disk directory listing.  No text strings are 
       visible within the viral code. 
       .COM programs infected as a result of a Hafenstrass 2 infection 
       will have a file length increase of 796 bytes due to the presence 
       of the Ambulance Car virus.  Ambulance Car will be located at the 
       end of the infected file. 
       Systems infected with Hafenstrass 2 may experience unexpected 
       system hangs.  Additionally, execution of an Ambulance Car infected 
       .COM file may result in a graphic ambulance being run from left to 
       right along the bottom of the screen, accompanied with a "siren" 
       noise on the system speaker. 
       See:   Ambulance Car   Hafenstrass  

Show viruses from discovered during that infect .

Main Page