Iraqui Warrior Virus
Virus Name: Iraqui Warrior
Aliases: Iraqui, Vienna-Iraqui
V Status: Rare
Discovered: January, 1991
Symptoms: .COM growth; closely spaced beeps from system speaker;
system hangs; boot failures
Origin: United States
Eff Length: 777 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Iraqui Warrior virus was isolated on January 17, 1991 in the
United States. This virus is a non-memory resident infector of .COM
files, including COMMAND.COM. It is based on the Vienna virus.
When a program infected with the Iraqui Warrior virus is executed,
the virus will infect one of the first four .COM files located on
the current drive and current directory. Infected .COM files will
have a file length increase of 777 bytes with the virus being
located at the end of the file.
The following text strings can be found in infected files, the first
two occurring near the beginning of the virus, and the last being
located very near the end of the infected file:
"I come to you from The Ayatollah!"
"An Iraqui Warrior is in your computer..."
None of these messages are displayed by the virus.
Systems infected with the Iraqui Warrior virus may occasionally
experience the system speaker issuing a series of closely spaced
beeps when an infected program is executed. When this occurs, the
system will hang and have to be rebooted. The beeps continue until
the reboot occurs.
Booting from a disk where COMMAND.COM has been infected will result
in a "Memory allocation error, Cannot start COMMAND, exiting"
The Iraqui Warrior does not appear to do anything else besides the