James Bond Virus
Virus Name: James Bond
V Status: New
Discovery: May, 1993
Symptoms: .COM file growth; DOS CHKDSK lost clusters;
file date/time seconds set to 62
Origin: The Netherlands
Eff Length: 356 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, IBMAV, Sweep,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, AVTK/N, Sweep/N, NProt, IBMAV/N, Innoc, NAV/N,
Removal Instructions: Delete infected files
The James Bond virus was submitted in May, 1993, and is from The
Netherlands. James Bond is a memory resident stealth virus which
infects .COM programs, including COMMAND.COM.
When the first James Bond infected program is executed, the James
Bond virus will become memory resident in a "hole" in allocated
system memory, hooking interrupt 21. Total system and available
free memory, as indicated by the DOS CHKDSK program, will not be
Once memory resident, James Bond will infect .COM programs, including
COMMAND.COM, when they are executed or opened for any reason.
Infected programs will have a file length increase of 356 bytes, with
the virus being located at the end of the file. The file length
increase will be hidden by the virus in memory on some infected
files, and will be visible on other infected files. The program's
date and time in the DOS disk directory listing appear to be
unaltered, but the seconds field will have been set to "62". The
following text string occurs very near to the end of all infected
"James Bond is Alive!"
Systems infected with the James Bond virus will find that the DOS
CHKDSK program will report a very high number of lost clusters when
it is executed with the virus memory resident.