Ill Virus

Virus Name: Ill Aliases: V Status: Rare Discovered: January, 1992 Symptoms: .COM file growth; message & beeping Origin: Unknown Eff Length: 1,016 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: AVTK, Sweep, ViruScan, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Ill virus was submitted in January, 1992. Its origin is unknown. Ill is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Ill virus is executed, the virus will search the current directory to find the first .COM program which has not previously been infected. Once this program is found, it will be infected, and the original program will usually continue execution. If an uninfected program is not found, the original program will usually continue execution. Programs infected with the Ill virus will have a file length increase of 1,016 bytes. The virus will be located at the end of the infected file. The program's date and time in the DOS disk directory listing will not have been altered. No text strings are visible within the viral code in infected programs. Occassionally, when an infected program is executed, the following message will be displayed along with a series of beeps being emitted from the system speaker: "WARNING : USE ONLY ORIGINAL PROGRAMS DON'T COPY IT and now .. I AM ILL !!" This message is encrypted within the viral code.