Virus Name: Hexametricx
V Status: Rare
Discovered: February, 1994
Symptoms: .COM file growth; file date/time seconds = 12
Eff Length: 545 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: AVTK, IBMAV, ViruScan, Sweep, NAV, F-Prot,
NAVDX, VAlert, PCScan, ChAV,
AVTK/N, Sweep/N, IBMAV/N, NShld, NAV/N, NProt, LProt,
Removal Instructions: Delete infected files
The Hexametricx virus was received in February, 1994. It appears to
be from Germany. This virus is a non-resident, direct action infector
of .COM programs, including COMMAND.COM, which are located in the
C: drive root directory. In its current state, it does not infect
programs located in other directories, or on other drives.
When a program infected with the Hexametricx virus is executed, this
virus will infect one .COM program located in the C: drive root
directory. Infected programs will have a file length increase of
545 bytes with the virus being located at the end of the file. The
program's date and time in the DOS disk directory listing will
appear to be unaltered, though the seconds field will have been
set to "12". The following text strings are encrypted within the
Hexametricx viral code:
"Hello User, You have got The HEXAMETRICX Virus !!!"
"Today is the month's B i r t h d a y !"
"I was written in the City of Langen(Hessen), Germany"
"GREETINGS TO ALL OTHER VIRUS WRITERS!"
It is unknown what Hexametricx does besides replicate.