Invisible Man Virus

Virus Name: Invisible Man Aliases: Invisible Man I V Status: Common Discovered: May, 1993 Symptoms: .COM & .EXE growth; Master Boot Sector Altered; Decrease in total system & available free memory Origin: Italy Eff Length: 2,926 Bytes Type Code: PRhAKX - Parasitic Resident .COM, .EXE, & MBR Infector Detection Method: ViruScan, F-Prot, AVTK, IBMAV, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, NAV/N, AVTK/N, IBMAV/N, NProt, Innoc, LProt Removal Instructions: See below General Comments: The Invisible Man virus was submitted in May, 1993, and is from Italy. Invisible Man is a memory resident infector of .COM and .EXE programs, including COMMAND.COM, and also infects the system hard disk master boot sector (partition table sector). It is a fast infector, infecting programs when they are accessed for any reason. When the first Invisible Man infected program is executed, the Invisible Man virus will infect the system hard disk master boot sector (partition table sector), and also become memory resident. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 3,456 bytes, and interrupt 21 will be hooked. Interrupt 12's return will not be moved. Once the Invisible Man virus is memory resident, it will infect .COM and .EXE programs when they are executed or accessed for any reason. Infected programs will have a file length increase of 2,926 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the Invisible Man viral code, and are not visible within infected files: "The Invisible Man - Written in SALERNO (ITALY), October 1992." "Dedicated to Ester:" "I don't know either how or when, but I will hold you in my arms again." It is unknown what Invisible Man does besides replicate. Known variant(s) of Invisible Man are: Invisible Man II: Also received in May, 1993, Invisible Man II is a later version of the virus. Its size in memory is 3,504 bytes, hooking interrupt 21. It adds 3,223 bytes to the .COM and .EXE programs it infects, and like the origin virus, infects the system hard disk's master boot sector (partition table sector). The following text strings are encrypted within the viral code in all Invisible Man II infected programs: "The Invisible Man II - Written in SALERNO (ITALY), December 1992." "Dedicated to E.F.:" "I don't know either how or when, but I will hold you in my arms again." Origin: Italy May, 1993.