Virus Name: Ignorant
V Status: Rare
Discovered: April, 1994
Symptoms: .COM & .EXE file growth; Hard Disk MBR altered;
decrease in total system & available free memory
Eff Length: 1,979 Bytes
Type Code: PRhAKX - Parasitic Resident .COM, .EXE, and MBR Infector
Detection Method: ViruScan, F-Prot, Sweep, IBMAV, AVTK,
NAV, NAVDX, VAlert, PCScan,
NProt, AVTK/N, NShld, Sweep/N, IBMAV/N, NAV/N
Removal Instructions: Delete infected files & DOS 5.0+ F-Disk /MBR
The Ignorant virus was submitted in April, 1994. Its origin or
point of isolation is unknown. Ignorant is a memory resident
fast infector of .COM and .EXE programs, including COMMAND.COM.
It also infects the system hard disk Master Boot Record (Partition
Table Sector), thus it is a multi-partite virus. Ignorant is also
a stealth virus, hiding the file length increase on infected files.
When the first Ignorant infected program is executed, this virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, not moving interrupt 12's return. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 5,120 bytes. Interrupt 21 will be
hooked by the virus in memory. Also at this time, the virus will
infect the system hard disk master boot record if it was not
Once memory resident, the Ignorant virus will infect programs,
including .COM, .EXE, .BIN, and .OVL files, when they are executed
or opened for any reason. Infected programs will have a file length
increase of 1,979 bytes, though the file length increase will be
hidden when the virus is memory resident. The program's date and
time in the DOS disk directory listing will not be altered. The
following text strings are encrypted within the Ignorant viral
"Ignorance is Strength"
"Freedom is Slavery"
"War is Peace"
" bY [T„L”N