Hafenstrass 2 Virus
Virus Name: Hafenstrass 2
Aliases:
V Status: Rare
Discovered: February, 1992
Symptoms: .COM & .EXE growth; ambulance car graphic with siren
Origin: Unknown
Eff Length: 796 Bytes (.COM), 1,641 Bytes (.EXE)
Type Code: PNA - Non-Resident Parasitic .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, AVTK, Sweep, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
NAV/N, IBMAV/N
Removal Instructions: Delete infected files
General Comments:
The Hafenstrass 2 virus was received in February, 1992 from an
unknown location. This virus, like the original Hafenstrass, is
a non-resident, direct action infector of .EXE programs. A major
distinction is that Hafenstrass 2 is actually a virus which
contains another virus, Ambulance Car. The Ambulance Car virus
only infects .COM programs.
When a .EXE program infected with Hafenstrass 2 is executed, the
Hafenstrass 2 virus will infect one .COM program and one .EXE
program located in the current directory. When the user later
executes one of the infected .COM programs, one or two .COM
programs in the current directory will become infected.
Of the .COM and .EXE programs infected by the Hafenstrass 2 virus,
only the .EXE programs contain the full Hafenstrass 2 virus. The
.COM programs which were infected as a result of executing a
Hafenstrass 2 infected .EXE program will only contain the
Ambulance Car virus which is dropped by Hafenstrass 2.
.EXE programs infected with Hafenstrass 2 will have a file length
increase of 1,641 bytes. The virus will be located at the end of
the infected program. There will be no change to the file's date
and time in the DOS disk directory listing. No text strings are
visible within the viral code.
.COM programs infected as a result of a Hafenstrass 2 infection
will have a file length increase of 796 bytes due to the presence
of the Ambulance Car virus. Ambulance Car will be located at the
end of the infected file.
Systems infected with Hafenstrass 2 may experience unexpected
system hangs. Additionally, execution of an Ambulance Car infected
.COM file may result in a graphic ambulance being run from left to
right along the bottom of the screen, accompanied with a "siren"
noise on the system speaker.
See: Ambulance Car Hafenstrass