Ignorant Virus

Virus Name: Ignorant Aliases: V Status: Rare Discovered: April, 1994 Symptoms: .COM & .EXE file growth; Hard Disk MBR altered; decrease in total system & available free memory Origin: Unknown Eff Length: 1,979 Bytes Type Code: PRhAKX - Parasitic Resident .COM, .EXE, and MBR Infector Detection Method: ViruScan, F-Prot, Sweep, IBMAV, AVTK, NAV, NAVDX, VAlert, PCScan, NProt, AVTK/N, NShld, Sweep/N, IBMAV/N, NAV/N Removal Instructions: Delete infected files & DOS 5.0+ F-Disk /MBR General Comments: The Ignorant virus was submitted in April, 1994. Its origin or point of isolation is unknown. Ignorant is a memory resident fast infector of .COM and .EXE programs, including COMMAND.COM. It also infects the system hard disk Master Boot Record (Partition Table Sector), thus it is a multi-partite virus. Ignorant is also a stealth virus, hiding the file length increase on infected files. When the first Ignorant infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 5,120 bytes. Interrupt 21 will be hooked by the virus in memory. Also at this time, the virus will infect the system hard disk master boot record if it was not previously infected. Once memory resident, the Ignorant virus will infect programs, including .COM, .EXE, .BIN, and .OVL files, when they are executed or opened for any reason. Infected programs will have a file length increase of 1,979 bytes, though the file length increase will be hidden when the virus is memory resident. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the Ignorant viral code: "Ignorance is Strength" "Freedom is Slavery" "War is Peace" "COMEXEBINOVLSYSSCCLVSF" "[1984] bY [T„L”N