James Bond Virus


 Virus Name:  James Bond 
 Aliases:    
 V Status:    New 
 Discovery:   May, 1993 
 Symptoms:    .COM file growth; DOS CHKDSK lost clusters; 
              file date/time seconds set to 62 
 Origin:      The Netherlands 
 Eff Length:  356 Bytes 
 Type Code:   PRaCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, IBMAV, Sweep, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, AVTK/N, Sweep/N, NProt, IBMAV/N, Innoc, NAV/N, 
                    LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The James Bond virus was submitted in May, 1993, and is from The 
       Netherlands.  James Bond is a memory resident stealth virus which 
       infects .COM programs, including COMMAND.COM. 
 
       When the first James Bond infected program is executed, the James 
       Bond virus will become memory resident in a "hole" in allocated 
       system memory, hooking interrupt 21.  Total system and available 
       free memory, as indicated by the DOS CHKDSK program, will not be 
       altered. 
 
       Once memory resident, James Bond will infect .COM programs, including 
       COMMAND.COM, when they are executed or opened for any reason. 
       Infected programs will have a file length increase of 356 bytes, with 
       the virus being located at the end of the file.  The file length 
       increase will be hidden by the virus in memory on some infected 
       files, and will be visible on other infected files.  The program's 
       date and time in the DOS disk directory listing appear to be 
       unaltered, but the seconds field will have been set to "62".  The 
       following text string occurs very near to the end of all infected 
       programs: 
 
               "James Bond is Alive!" 
 
       Systems infected with the James Bond virus will find that the DOS 
       CHKDSK program will report a very high number of lost clusters when 
       it is executed with the virus memory resident. 

Show viruses from discovered during that infect .

Main Page