Iraqui Warrior Virus

Virus Name: Iraqui Warrior Aliases: Iraqui, Vienna-Iraqui V Status: Rare Discovered: January, 1991 Symptoms: .COM growth; closely spaced beeps from system speaker; system hangs; boot failures Origin: United States Eff Length: 777 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Iraqui Warrior virus was isolated on January 17, 1991 in the United States. This virus is a non-memory resident infector of .COM files, including COMMAND.COM. It is based on the Vienna virus. When a program infected with the Iraqui Warrior virus is executed, the virus will infect one of the first four .COM files located on the current drive and current directory. Infected .COM files will have a file length increase of 777 bytes with the virus being located at the end of the file. The following text strings can be found in infected files, the first two occurring near the beginning of the virus, and the last being located very near the end of the infected file: "I come to you from The Ayatollah!" "(c)1990, VirusMasters" "An Iraqui Warrior is in your computer..." None of these messages are displayed by the virus. Systems infected with the Iraqui Warrior virus may occasionally experience the system speaker issuing a series of closely spaced beeps when an infected program is executed. When this occurs, the system will hang and have to be rebooted. The beeps continue until the reboot occurs. Booting from a disk where COMMAND.COM has been infected will result in a "Memory allocation error, Cannot start COMMAND, exiting" message appearing. The Iraqui Warrior does not appear to do anything else besides the above. See: Vienna