Invisible Man Virus
Virus Name: Invisible Man
Aliases: Invisible Man I
V Status: Common
Discovered: May, 1993
Symptoms: .COM & .EXE growth; Master Boot Sector Altered; Decrease in
total system & available free memory
Eff Length: 2,926 Bytes
Type Code: PRhAKX - Parasitic Resident .COM, .EXE, & MBR Infector
Detection Method: ViruScan, F-Prot, AVTK, IBMAV, Sweep, NAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, NAV/N, AVTK/N, IBMAV/N, NProt, Innoc,
Removal Instructions: See below
The Invisible Man virus was submitted in May, 1993, and is from
Italy. Invisible Man is a memory resident infector of .COM and .EXE
programs, including COMMAND.COM, and also infects the system hard
disk master boot sector (partition table sector). It is a fast
infector, infecting programs when they are accessed for any reason.
When the first Invisible Man infected program is executed, the
Invisible Man virus will infect the system hard disk master boot
sector (partition table sector), and also become memory resident.
Total system and available free memory, as indicated by the DOS
CHKDSK program, will have decreased by 3,456 bytes, and interrupt
21 will be hooked. Interrupt 12's return will not be moved.
Once the Invisible Man virus is memory resident, it will infect .COM
and .EXE programs when they are executed or accessed for any reason.
Infected programs will have a file length increase of 2,926 bytes
with the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will not be altered.
The following text strings are encrypted within the Invisible Man
viral code, and are not visible within infected files:
"The Invisible Man - Written in SALERNO (ITALY), October 1992."
"Dedicated to Ester:"
"I don't know either how or when, but I will hold you in my
It is unknown what Invisible Man does besides replicate.
Known variant(s) of Invisible Man are:
Invisible Man II: Also received in May, 1993, Invisible Man II
is a later version of the virus. Its size in memory
is 3,504 bytes, hooking interrupt 21. It adds 3,223
bytes to the .COM and .EXE programs it infects, and
like the origin virus, infects the system hard disk's
master boot sector (partition table sector). The
following text strings are encrypted within the viral
code in all Invisible Man II infected programs:
"The Invisible Man II - Written in SALERNO (ITALY),
"Dedicated to E.F.:"
"I don't know either how or when, but I will hold you
in my arms again."
Origin: Italy May, 1993.