JoJo 2 Virus
Virus Name: JoJo 2
V Status: Rare
Discovered: January, 1991
Symptoms: .COM growth; message; "Not enough memory" errors; system
hangs; cursor position off 1 character
Origin: United States
Eff Length: 1,703 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The JoJo 2 virus was submitted in January, 1991, by David Grant of
the United States. This virus is based on the JoJo virus as well as
containing part of the decryption string for the Cascade virus. It
is a memory resident infector of .COM files, including COMMAND.COM.
The first time a program infected with the JoJo 2 virus is executed,
the virus will install itself memory resident by altering the
command interpreter in memory. The command interpreter in memory
will have a size increase of 1,904 bytes. There is an additional 48
bytes which is reserved by the virus as well, similar to JoJo.
Once the virus is memory resident, it will infect .COM files as they
are executed. If COMMAND.COM is executed for any reason, it will
become infected. Infected .COM programs will have a file size
increase of 1,703 bytes with the virus being located at the end of
the infected file.
Text strings which can be found in files infected with the JoJo 2
"The JOJO virus strikes again.xxxxxxxxxxxx zzz"
"Fuck the system 1990 - (c)"
Systems infected with the JoJo 2 virus may experience system hangs
when some infected programs are executed. Infected programs may
also display the "Fuck the system 1990 - (c)" string, or a string of
garbage characters from memory. Attempts to execute some programs
may also fail due to "Not enough memory" errors. Lastly, after the
virus has been resident for awhile, the user may notice that the
cursor on the system monitor is off by one position to the right
from where it should be.
JoJo 2 may be detected by some anti-viral utilities as an infection
of JoJo and Cascade/1701/1704.