June 12TH Virus

 Virus Name:  June 12TH 
 V Status:    Rare 
 Discovered:  September, 1993 
 Symptoms:    .COM & .EXE growth; graphic with messages & music on June 12th; 
              decrease in total system & available free memory 
 Origin:      Philipines 
 Eff Length:  2,660 - 2,687 Bytes 
 Type Code:   PRsA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  F-Prot, AVTK, Sweep, ViruScan, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, NShld, AVTK/N, Innoc, IBMAV/N, NAV/N, LProt 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The June 12TH virus was submitted in September, 1993.  It appears to 
       be from The Philipines.  June 12TH is a memory resident infector of 
       .COM and .EXE programs, but not COMMAND.COM.  It activates on June 
       12th of any year. 
       When a program infected with the June 12TH virus is executed, the 
       June 12TH virus will install itself memory resident as a low system 
       memory TSR of 2,672 bytes.  Interrupt 21 will be hooked by June 12TH 
       in memory. 
       Once the June 12TH virus is memory resident, it will infect .COM and 
       .EXE programs, other than COMMAND.COM, when they are executed or 
       opened for any reason.  Infected .COM files will increase in size by 
       2,675 to 2,687 bytes, while .EXE files will increase by 2,660 to 
       2,674 bytes.  In both cases the virus will be located at the end of 
       the file.  The program's date and time in the DOS disk directory 
       listing will not be altered.  The following text string can be found 
       within the viral code in all June 12TH infected programs: 
       The June 12TH virus activates once it has become memory resident on 
       June 12th of any year.  Once resident, it will display the following 
       three lines of text on the system display, with a graphic of the 
       Philipine flag after the first line of text, and before the second 
               "June 12 - the Independence Day of the Philippines." 
               "MABUHAY ANG PILIPINAS!" 
               "Dedicated to Manong Eddie." 
       A song is played on the system speaker while the text and flag 
       appear.  At the completion of the song, the screen is cleared and 
       the program the user was attempting to execute will run. 
       The text strings from the graphic display are encrypted within the 
       virus and are not visible within infected programs. 

Show viruses from discovered during that infect .

Main Page