Hymn Virus

Virus Name: Hymn Aliases: V Status: Rare Discovered: December, 1990 Symptoms: .COM & .EXE growth; decrease in system and available free memory Origin: USSR Eff Length: 1,865 - 1,883 Bytes Type Code: PRhAK - Resident Parasitic .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Hymn virus was submitted in December, 1990, and originated in the USSR. This virus is a memory resident infector of .COM and .EXE files, and will infect COMMAND.COM. The first time a program infected with the Hymn virus is executed, the virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. The DOS CHKDSK program will show that total system memory and available free memory have decreased by 3,712 bytes. This virus does not move the interrupt 12 return. COMMAND.COM will also become infected at this time. Once Hymn is memory resident, it will infect .COM and .EXE files which are over approximately 2K in length when they are executed or opened for any reason. Infected .COM files will increase in length by 1,865 bytes. Infected .EXE files will have a file length increase of 1,869 to 1,883 bytes. In both cases the virus will be located at the end of the infected file. Infected programs will contain two text strings within the viral code: "ibm@SNS" "@ussr@" It is not known what Hymn does when it activates, but it is assumed from the name that under some conditions it may play music.