Immolation Virus

Virus Name: Immolation Aliases: V Status: Viron Discovered: May, 1993 Symptoms: .EXE files corrupted; system hangs; system reboots; change in available memory to 64K; programs fail to function properly Origin: Unknown Eff Length: 663 Bytes (Overwriting) Type Code: ONE - Overwriting Non-Resident .EXE Infector Detection Method: F-Prot, Sweep, IBMAV, AVTK, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, IBMAV/N, AVTK/N, NAV/N, LProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Immolation virus was submitted in May, 1993. Its origin is unknown. Immolation is a non-resident, direct action overwriting virus which infects .EXE programs. When a program infected with the Immolation virus is executed, this virus will infect two .EXE programs larger than the virus itself which are located in the current directory or along the system path. A system hang may then occur. Infected programs will not function properly. Programs infected with the Immolation virus will have the first 663 bytes of the host program overwritten by the Immolation viral code, permanently corrupting them. The file's date and time in the DOS disk directory listing will not be altered. One text string is visible within the Immolation viral code in infected programs: "*.EXE" The Immolation virus activates on any Monday before 9:00 AM, at which time the system will be rebooted when an infected program is executed. On Fridays after 12:00 noon, the virus will change the amount of available memory to 64K when an infected program is executed. Finally, one all of the .EXE programs in the current directory and along the system path have been infected, the virus will lockup the system when the next infected program is executed.