June 12TH Virus
Virus Name: June 12TH
Aliases:
V Status: Rare
Discovered: September, 1993
Symptoms: .COM & .EXE growth; graphic with messages & music on June 12th;
decrease in total system & available free memory
Origin: Philipines
Eff Length: 2,660 - 2,687 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, AVTK, Sweep, ViruScan, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
Sweep/N, NShld, AVTK/N, Innoc, IBMAV/N, NAV/N, LProt
Removal Instructions: Delete infected files
General Comments:
The June 12TH virus was submitted in September, 1993. It appears to
be from The Philipines. June 12TH is a memory resident infector of
.COM and .EXE programs, but not COMMAND.COM. It activates on June
12th of any year.
When a program infected with the June 12TH virus is executed, the
June 12TH virus will install itself memory resident as a low system
memory TSR of 2,672 bytes. Interrupt 21 will be hooked by June 12TH
in memory.
Once the June 12TH virus is memory resident, it will infect .COM and
.EXE programs, other than COMMAND.COM, when they are executed or
opened for any reason. Infected .COM files will increase in size by
2,675 to 2,687 bytes, while .EXE files will increase by 2,660 to
2,674 bytes. In both cases the virus will be located at the end of
the file. The program's date and time in the DOS disk directory
listing will not be altered. The following text string can be found
within the viral code in all June 12TH infected programs:
"VDSFSCAN"
The June 12TH virus activates once it has become memory resident on
June 12th of any year. Once resident, it will display the following
three lines of text on the system display, with a graphic of the
Philipine flag after the first line of text, and before the second
line:
"June 12 - the Independence Day of the Philippines."
"MABUHAY ANG PILIPINAS!"
"Dedicated to Manong Eddie."
A song is played on the system speaker while the text and flag
appear. At the completion of the song, the screen is cleared and
the program the user was attempting to execute will run.
The text strings from the graphic display are encrypted within the
virus and are not visible within infected programs.