Virus Name: Harm-1082
V Status: Rare
Discovered: June, 1993
Symptoms: .EXE file growth;
decrease in total system & available free memory
Eff Length: 1,082 - 1,098 Bytes
Type Code: PRhE - Resident Parasitic .EXE Infector
Detection Method: F-Prot, AVTK, IBMAV, Sweep, ViruScan, NAV, NAVDX,
VAlert, PCScan, ChAV,
AVTK/N, NShld, Sweep/N, NProt, IBMAV/N, Innoc, NAV/N,
Removal Instructions: Delete infected files
The Harm-1082 virus was submitted in June, 1993. It appears to be
from the USSR. Harm-1082 is a memory resident infector of .EXE
programs, though it does not infect very small files.
When the first Harm-1082 infected program is executed, the Harm-1082
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary, hooking interrupt 21. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 1,472 bytes. Interrupt 12's return
will not have been moved.
Once the Hard Days virus is memory resident, it will infect .EXE
programs when they are executed. Infected programs will have a file
length increase of 1,082 to 1,098 bytes with the virus being located
at the end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text strings
are encrypted within the viral code in all Harm-1082 infected
"Eat me Lozinsky!"
"Harmless v1.0, 10/06/92 Tyumen"
It is unknown what Harm-1082 does besides replicate.