Hero-394 Virus

Virus Name: Hero-394 Aliases: Hero-B V Status: Rare Discovered: November, 1991 Symptoms: .EXE file growth; display of random characters; system hangs; file date/time changes Origin: Unknown Eff Length: 394 Bytes Type Code: PRfE - Parasitic Resident .EXE Infector Detection Method: ViruScan, Sweep, AVTK, NAV, ChAV, F-Prot, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Hero-394 virus was submitted in November, 1991. Its origin is unknown. This virus is a memory resident infector of .EXE files, and is based on the Hero virus. The first time a program infected with Hero-394 is executed, the Hero-394 virus will install itself memory resident in available free memory. Hero-394 hooks many interrupts in the interrupt area, including interrupt 21. Once Hero-394 is memory resident, it will infect .EXE programs when they are executed. Infected programs will have a file length increase of 394 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory will have been updated to the current system date and time when infection occurred. Symptoms of a Hero-394 infection is that random characters from memory may be displayed when .EXE programs are executed, as well as the system appearing to be hung. Usually, if the user presses "enter", the program will continue processing. See: Hero