Virus Name: Hymn
V Status: Rare
Discovered: December, 1990
Symptoms: .COM & .EXE growth; decrease in system and available free
Eff Length: 1,865 - 1,883 Bytes
Type Code: PRhAK - Resident Parasitic .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Hymn virus was submitted in December, 1990, and originated in
the USSR. This virus is a memory resident infector of .COM and .EXE
files, and will infect COMMAND.COM.
The first time a program infected with the Hymn virus is executed,
the virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. The DOS CHKDSK program will
show that total system memory and available free memory have
decreased by 3,712 bytes. This virus does not move the interrupt 12
return. COMMAND.COM will also become infected at this time.
Once Hymn is memory resident, it will infect .COM and .EXE files
which are over approximately 2K in length when they are executed or
opened for any reason. Infected .COM files will increase in length
by 1,865 bytes. Infected .EXE files will have a file length
increase of 1,869 to 1,883 bytes. In both cases the virus will be
located at the end of the infected file.
Infected programs will contain two text strings within the viral
code: "ibm@SNS" "@ussr@"
It is not known what Hymn does when it activates, but it is assumed
from the name that under some conditions it may play music.