Virus Name: AcidWarp
V Status: Viron
Discovery: January, 1995
Symptoms: .COM & .EXE programs overwritten; programs fail to execute;
programs may become invalid programs; message;
file date/time changes; system hangs
Eff Length: 5,488 Bytes
Type Code: ONAK - Overwriting Non-Resident .COM & .EXE Infector
Detection Method: NAV, NAVDX, ViruScan, AVTK 7.68+,
NAV/N, NShld, AVTK/N 7.68+
Removal Instructions: Delete infected files
The AcidWarp virus was received in January, 1995. Its origin or
point of isolation is unknown. AcidWarp is a non-resident, direct
action overwriting virus which infects .COM and .EXE files, including
COMMAND.COM. It permanently corrupts the programs it infects.
When a program infected with the AcidWarp virus is executed, this
virus will infect two .EXE or .COM files located in the current
directory. Infected programs will have the first 5,488 bytes of the
host program overwritten by the viral code. Programs smaller than
5,488 bytes will become 5,488 bytes in length, while programs which
were originally larger than 5,488 bytes will not increase in size.
The program's date and time in the DOS disk directory listing will
have been updated to the current system date and time when infection
occurred. The following text strings are visible within the viral
code in all AcidWarp infected programs:
"Program too big to fit in memory"
"Looks like you've been fucked by"
"(o)(o) the ACiDWARP virus!"
"Don't worry, your wife is still a"
"acidwarp virus'copyright (c) 1994 all rights reserved"
"coded by Nothing Man [MHS]"
"Runtime error at"
"Portions Copyright (c) 1983,90 Borland"
Once all of the .COM and .EXE files in the current directory have
become infected by the virus, execution of an infected program will
result in a graphic of Bart Simpson being shown in the lower left
hand corner of the system display, along with the message contained
in the eighth through fourteenth text strings above. A system hang
may occur instead of this graphic.
Some programs infected with the AcidWarp virus will become invalid
programs, and may be flagged as such by some anti-viral software.
These invalid programs will not spread the virus.