Virus Name: JD
Aliases: JD-158, JD-276, JD-356, JD-392
V Status: Rare
Discovered: January, 1992
Symptoms: .COM file growth; file date/time changes
Eff Length: 158 - 392 Bytes (depending on variant)
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: Sweep, F-Prot, ViruScan, AVTK, ChAV,
IBMAV, NAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The JD virus family was received in January, 1992. Its origin
is unknown. This family is a group of four closely related
viruses, the larger of which will hide the file length increase
on infected files without file allocation errors resulting.
The entry below describes this family in general, with virus
specific information indicated under variants below.
When a program infected with a JD family virus is executed, the
virus will become memory resident in a "hole" in allocated system
memory. As such, there will be no change to total system or
available free memory. Interrupt 21 will be hooked in memory,
as well as possibly interrupts 13 or 1E, depending on the variant
Once a JD family virus is memory resident, it will infect .COM
programs when they are executed. If COMMAND.COM is executed, it
will also become infected. The virus will be located at the
end of the infected file which will have a file length increase
of 158 to 392 bytes.
The JD family of viruses don't do anything besides replicate.
Known member(s) of the JD family of viruses are:
JD-158: The smallest member of the JD family, this virus adds
158 bytes to the .COM files it infects. The program's
date and time in the DOS disk directory listing will have
been updated. It hooks interrupt 13 in addition to
interrupt 21 in memory.
JD-276: This member of the JD family adds 276 bytes to the .COM
programs it infects. There will be no change to the file's
date and time in the DOS disk directory listing. This
virus only hooks interrupt 21 in memory.
JD-356: JD-356 adds 356 bytes to the .COM files it infects,
however the file length increase will not be visible if the
virus is memory resident. It hooks interrupt 1E in addition
to interrupt 21. There will be no change to the file's
date and time in the DOS disk directory listing.
JD-392: Similar in behavior to JD-356, this virus adds 392
bytes to the .COM programs it infects.