Hymn Virus

 Virus Name:  Hymn 
 V Status:    Rare 
 Discovered:  December, 1990 
 Symptoms:    .COM & .EXE growth; decrease in system and available free 
 Origin:      USSR 
 Eff Length:  1,865 - 1,883 Bytes 
 Type Code:   PRhAK - Resident Parasitic .COM & .EXE Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, NAV, Sweep, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Hymn virus was submitted in December, 1990, and originated in 
       the USSR.  This virus is a memory resident infector of .COM and .EXE 
       files, and will infect COMMAND.COM. 
       The first time a program infected with the Hymn virus is executed, 
       the virus will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary.  The DOS CHKDSK program will 
       show that total system memory and available free memory have 
       decreased by 3,712 bytes.  This virus does not move the interrupt 12 
       return.  COMMAND.COM will also become infected at this time. 
       Once Hymn is memory resident, it will infect .COM and .EXE files 
       which are over approximately 2K in length when they are executed or 
       opened for any reason.  Infected .COM files will increase in length 
       by 1,865 bytes.  Infected .EXE files will have a file length 
       increase of 1,869 to 1,883 bytes.  In both cases the virus will be 
       located at the end of the infected file. 
       Infected programs will contain two text strings within the viral 
       code: "ibm@SNS" "@ussr@" 
       It is not known what Hymn does when it activates, but it is assumed 
       from the name that under some conditions it may play music. 

Show viruses from discovered during that infect .

Main Page