Virus Name: Ill
V Status: Rare
Discovered: January, 1992
Symptoms: .COM file growth; message & beeping
Eff Length: 1,016 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: AVTK, Sweep, ViruScan, F-Prot, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N,
Removal Instructions: Delete infected files
The Ill virus was submitted in January, 1992. Its origin is
unknown. Ill is a non-resident, direct action infector of .COM
programs, including COMMAND.COM.
When a program infected with the Ill virus is executed, the virus
will search the current directory to find the first .COM program
which has not previously been infected. Once this program is
found, it will be infected, and the original program will usually
continue execution. If an uninfected program is not found, the
original program will usually continue execution.
Programs infected with the Ill virus will have a file length
increase of 1,016 bytes. The virus will be located at the end of
the infected file. The program's date and time in the DOS disk
directory listing will not have been altered. No text strings are
visible within the viral code in infected programs.
Occassionally, when an infected program is executed, the following
message will be displayed along with a series of beeps being
emitted from the system speaker:
"WARNING : USE ONLY ORIGINAL PROGRAMS
DON'T COPY IT
and now .. I AM ILL !!"
This message is encrypted within the viral code.