Virus Name: Harakiri
V Status: Viron
Discovered: May, 1992
Symptoms: .COM & .EXE programs overwritten; file date/time change;
Eff Length: 5,488 Bytes
Type Code: ONAK - Overwriting Non-Resident .COM & .EXE Infector
Detection Method: AVTK, F-Prot, Sweep, IBMAV, ChAV,
ViruScan, NAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, Innoc, AVTK/N, NAV/N, IBMAV/N, NProt,
Removal Instructions: Delete infected files
The Harakiri virus was submitted in May, 1992. It appears to be
from Sweden due to the message within the virus. Harakiri is a
non-resident overwriting virus which infects both .COM and .EXE
When a program infected with Harakiri is executed, the Harakiri
virus will search the current directory for uninfected .EXE programs
to infect. Assuming that the .EXE files in the current directory
are uninfected, and named A.EXE, B.EXE, C.EXE, and D.EXE, the virus
will display the following messages:
Program too big to fit in memory"
The "Ej Infekterad...!" text string translates from Swedish to
English as "Not Infected...!".
If the virus finds less than four .EXE programs which it can infect,
it will then start infecting .COM files until it has infected four
programs on this execution. If the virus encounters an already
infected program when it is searching for files to infect, it will
display the following message:
"File Already Infected"
Once all of the .COM and .EXE files in the current directory have
been infected, the virus will display the following message:
"Your PC is alive and infected with the HARAKIRI virus !"
All of the above text strings can be seen within the viral code in
Harakiri infected programs.