Harakiri Virus

Virus Name: Harakiri Aliases: V Status: Viron Discovered: May, 1992 Symptoms: .COM & .EXE programs overwritten; file date/time change; messages Origin: Sweden Eff Length: 5,488 Bytes Type Code: ONAK - Overwriting Non-Resident .COM & .EXE Infector Detection Method: AVTK, F-Prot, Sweep, IBMAV, ChAV, ViruScan, NAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, Innoc, AVTK/N, NAV/N, IBMAV/N, NProt, LProt Removal Instructions: Delete infected files General Comments: The Harakiri virus was submitted in May, 1992. It appears to be from Sweden due to the message within the virus. Harakiri is a non-resident overwriting virus which infects both .COM and .EXE programs. When a program infected with Harakiri is executed, the Harakiri virus will search the current directory for uninfected .EXE programs to infect. Assuming that the .EXE files in the current directory are uninfected, and named A.EXE, B.EXE, C.EXE, and D.EXE, the virus will display the following messages: "--> \A.EXE Ej Infekterad...! Infecting file \A.EXE 1 --> \B.EXE Ej Infekterad...! Infecting file \B.EXE 2 --> \C.EXE Ej Infekterad...! Infecting file \C.EXE 3 --> \D.EXE Ej Infekterad...! Infecting file \D.EXE Program too big to fit in memory" The "Ej Infekterad...!" text string translates from Swedish to English as "Not Infected...!". If the virus finds less than four .EXE programs which it can infect, it will then start infecting .COM files until it has infected four programs on this execution. If the virus encounters an already infected program when it is searching for files to infect, it will display the following message: "File Already Infected" Once all of the .COM and .EXE files in the current directory have been infected, the virus will display the following message: "Your PC is alive and infected with the HARAKIRI virus !" All of the above text strings can be seen within the viral code in Harakiri infected programs.