Virus Name: Jos
V Status: Rare
Discovered: November, 1992
Symptoms: .COM file growth; TSR
Eff Length: 1,000 Bytes
Type Code: PRsC - Parasitic Resident .COM Infector
Detection Method: AVTK, F-Prot, IBMAV, Sweep, NAVDX, VAlert,
NAV, ViruScan, PCScan, ChAV,
NShld, AVTK/N, Sweep/N, NAV/N, NProt, IBMAV/N, Innoc
Removal Instructions: Delete infected files
The Jos virus was submitted in November, 1992. It is originally
from Romania. Jos is a memory resident infector of .COM programs,
but not COMMAND.COM.
When the first Jos infected program is executed, the Jos virus will
install itself memory resident as a low system memory TSR of 1,312
bytes. Interrupts 09 and 21 will be hooked by Jos in memory.
Once the Jos virus is memory resident, it will infect .COM programs
when they are executed. Infected programs will have a file length
increase of 1,000 bytes with the virus being located at the beginning
of the file. The program's date and time in the DOS disk directory
listing will not be altered. The following text strings are visible
within the viral code in all Jos infected programs:
, the first Romanian Political Virussian"
"Release date 12-22-1990"
Jos is not related to the JW2 or Jabberwocky virus.
It is unknown what Jos does besides replicate.