5120 Virus

 Virus Name:  5120 
 Aliases:     VBasic Virus, Basic Virus 
 V Status:    Common 
 Discovery:   May, 1990 
 Origin:      West Germany 
 Symptoms:    .COM & .EXE growth; file corruption; unexpected disk activity 
 Eff Length:  5,120 Bytes 
 Type Code:   PNAK - Parasitic Non-Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, NAV, AVTK, Sweep, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  F-Prot, or delete infected files 
 General Comments: 
       The 5120 virus was first isolated in May, 1990.  It is a non- 
       resident generic file infector, infecting .COM and .EXE files, 
       including COMMAND.COM.  This virus is was written in compiled 
       Turbo Basic with some assembly language. 
       When an infected file is executed, the 5120 virus will infect one 
       .COM and one .EXE file on the current drive and directory, followed 
       by attempting to infect one randomly selected .COM or .EXE file in 
       each directory on the system's C: drive.  Infected .COM files 
       increase in length by 5,120 bytes.  .EXE files infected by the 5120 
       virus will increase in length by between 5,120 and 5,135 bytes. 
       Unlike most of the MS-DOS viruses, the 5120 virus does not intercept 
       disk write errors when attempting to infect programs.  Thus, 
       infected systems may notice disk write error messages when no access 
       should be occurring for a drive, such as the C: hard disk partition. 
       Data files may become corrupted on infected systems, and       
       cross-linking of files may occur. 
       The following text strings can be found in files infected with the 
       5120 virus.  These strings will appear near the end of the file: 
               "Access denied" 
       There is one variant of the 5120 virus which does not contain the 
       above strings, but behaves in a very similar manner.  This second 
       variant is not indicated here as the author does not have a copy. 

Show viruses from discovered during that infect .

Main Page