Hambone Virus

Virus Name: Hambone Aliases: V Status: Rare Discovered: February, 1994 Symptoms: .COM & .EXE growth; displays characters from memory Origin: Unknown Eff Length: 2,316 Bytes Type Code: PNAK - Non-Resident Parasitic .COM &.EXE Infector Detection Method: AVTK, Sweep, ViruScan, F-Prot, IBMAV, NAV, NAVDX, PCScan, AVTK/N, NShld, Sweep/N, IBMAV/N, NAV/N, NProt Removal Instructions: Delete infected files General Comments: The Hambone virus was received in February, 1994. Its origin or point of isolation is unknown, though it is probably from the United States. Hambone is a non-resident, direct action infector of .COM and .EXE programs, including COMMAND.COM. When a program infected with the Hambone virus is executed, this virus will check to determine if there are any uninfected .EXE files in the current directory. If there are, the virus will infect them. If the virus determines that all of the .EXE files were previously infected, it will then infect any uninfected .COM programs it finds in the current directory. Programs infected with the Hambone virus will have a file length increase of 2,316 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the viral code in all Hambone infected programs: "(C) Martin Luther King Jr. 1994Fuhrer" "Hambone, Hambone, have you heard?" "Lawd have mussy" "Hambone, Hambone, have you heard?" "Oh Dem's Golden Slippers" "Hambone, Hambone, have you heard?" "Mammy!" "Hambone, Hambone, have you heard?" "I don't know nuttin' bout birthin' no babies,Miss Scarlett" "Hambone, Hambone, have you heard?" "Feets do yo' thang" "Hambone, Hambone, have you heard?" "I gots dem ol' Kozmic Blues again, Mama" "Hambone, Hambone, have you heard?" "Mammies lil' baby loves shortin'bread." "Hambone, Hambone, have you heard?" "Nobody know de troubles I seen" "Hambone, Hambone, have you heard?" "I gots a bad case o' de miseries today" "Hambone, Hambone, have you heard?" "In de sweet bye-de-bye" "Hambone, Hambone, have you heard?" "I lo-o-o-o-o-o-oves watermelon!" "Hambone, Hambone, have you heard?" "Great day in de mownin'" "*.com *.exe .." Programs infected with the Hambone virus will sometimes display characters from memory on the system monitor when they are executed.