Hero-394 Virus

 Virus Name:  Hero-394 
 Aliases:     Hero-B 
 V Status:    Rare 
 Discovered:  November, 1991 
 Symptoms:    .EXE file growth; display of random characters; system hangs; 
              file date/time changes 
 Origin:      Unknown 
 Eff Length:  394 Bytes 
 Type Code:   PRfE - Parasitic Resident .EXE Infector 
 Detection Method:  ViruScan, Sweep, AVTK, NAV, ChAV, 
                    F-Prot, IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Hero-394 virus was submitted in November, 1991.  Its origin is 
       unknown.  This virus is a memory resident infector of .EXE files, and 
       is based on the Hero virus. 
       The first time a program infected with Hero-394 is executed, the 
       Hero-394 virus will install itself memory resident in available free 
       memory.  Hero-394 hooks many interrupts in the interrupt area, 
       including interrupt 21. 
       Once Hero-394 is memory resident, it will infect .EXE programs when 
       they are executed.  Infected programs will have a file length 
       increase of 394 bytes with the virus being located at the end of 
       the file.  The program's date and time in the DOS disk directory 
       will have been updated to the current system date and time when 
       infection occurred. 
       Symptoms of a Hero-394 infection is that random characters from 
       memory may be displayed when .EXE programs are executed, as well 
       as the system appearing to be hung.  Usually, if the user presses 
       "enter", the program will continue processing. 
       See:   Hero 

Show viruses from discovered during that infect .

Main Page