Italian 803 Virus

Virus Name: Italian 803 Aliases: Italian File, V817, Sept 18 V Status: Rare Discovered: March, 1991 Symptoms: .COM & .EXE growth Origin: Italy Eff Length: 803 Bytes Type Code: PNAK - Parasitic Non-Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Italian 803 virus was submitted in March, 1991. This virus is a non-resident direct action infector of .COM and .EXE files. It will infect COMMAND.COM. When a program infected with Italian 803 is executed, the virus will look for an uninfected .EXE file in the current directory to infect. If one is found, it will become infected. If an uninfected .EXE file does not exist in the current directory, the virus will then look for an uninfected .COM file in the current directory. If an uninfected .COM file is found, it will then be infected. Programs infected with Italian 803 will have a file length increase of 803 to 817 bytes with the virus being located at the end of the infected file. This virus does not alter the file date and time in the disk directory. The Italian 803 virus may reinfect programs already infected with this virus. The reinfection only occurs when an infected program is copied, and then another infected program is executed. Reinfection of Italian 803 will result in an additional 816 bytes being added to the file. Italian 803 does not do anything besides replicate. Known variant(s) of Italian 803 are: Italian 803-B: Similar to Italian 803, this variant differs by only 1 byte.