Virus Name: 5120
Aliases: VBasic Virus, Basic Virus
V Status: Common
Discovery: May, 1990
Origin: West Germany
Symptoms: .COM & .EXE growth; file corruption; unexpected disk activity
Eff Length: 5,120 Bytes
Type Code: PNAK - Parasitic Non-Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, NAV, AVTK, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: F-Prot, or delete infected files
The 5120 virus was first isolated in May, 1990. It is a non-
resident generic file infector, infecting .COM and .EXE files,
including COMMAND.COM. This virus is was written in compiled
Turbo Basic with some assembly language.
When an infected file is executed, the 5120 virus will infect one
.COM and one .EXE file on the current drive and directory, followed
by attempting to infect one randomly selected .COM or .EXE file in
each directory on the system's C: drive. Infected .COM files
increase in length by 5,120 bytes. .EXE files infected by the 5120
virus will increase in length by between 5,120 and 5,135 bytes.
Unlike most of the MS-DOS viruses, the 5120 virus does not intercept
disk write errors when attempting to infect programs. Thus,
infected systems may notice disk write error messages when no access
should be occurring for a drive, such as the C: hard disk partition.
Data files may become corrupted on infected systems, and
cross-linking of files may occur.
The following text strings can be found in files infected with the
5120 virus. These strings will appear near the end of the file:
There is one variant of the 5120 virus which does not contain the
above strings, but behaves in a very similar manner. This second
variant is not indicated here as the author does not have a copy.