Virus Name: JW2
Aliases: 812, Jabberwocky
V Status: Rare
Discovered: September, 1991
Symptoms: .COM & .EXE growth; TSR
Eff Length: 812 Bytes
Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, NAV, F-Prot, Sweep, ChAV,
IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The JW2, or 812, virus was submitted in September, 1991. Its
origin, or point of isolation, is unknown. JW2 is a memory
resident infector of .COM and .EXE files, including COMMAND.COM.
The first time a program infected with JW2 is executed, JW2 will
become memory resident as a low system memory TSR of 1,136 bytes.
Interrupt 21 will be hooked by JW2 in memory.
Once JW2 is memory resident, it will infect .COM and .EXE programs,
including COMMAND.COM, when they are executed. Infected programs
increase in size by 812 bytes with the virus being located at the
end of the infected file. There will be no change in the file's
date and time in the DOS disk directory.
Programs infected with JW2 will contain the text string "JW2" in
the fourth through sixth characters of the infected file, this
string is the infection marker.
It is unknown if JW2 does anything besides replicate.
Known variant(s) of JW2 are:
Jabberwocky: A variant of JW2, it has six bytes which differ
from the original virus. This variant will
occasionally display the following message when a
program is executed: "BEWARE THE JABBERWOCK!". The
message cannot be seen in infected files as it is
Jabberwocky.615: Received in July, 1994, Jabberwocky.615 is a 615
byte variant of the virus described above. Its low
system memory TSR is 944 bytes, hooking interrupt 21.
It infects .COM programs, including COMMAND.COM, when
they are executed. Infected programs will have a file
length increase of 615 bytes with the virus being
located at the end of the file. The program's date and
time in the DOS disk directory listing will not be
altered. The following text string is visible within
all infected programs starting at the 4th byte of the
Origin: Unknown July, 1994.
Jabberwocky-B: Functionally similar to Jabberwocky, Jabberwocky-B
is another minor variant with 7 bytes which differ.
Origin: Unknown September, 1992.