Label Virus

Virus Name: Label Aliases: Int13 V Status: Rare Discovered: December, 1990 Symptoms: Program corruption; programs overwritten; sluggish response on DIR commands; Sector not found errors Origin: USSR Eff Length: 512 Bytes Type Code: ORCK - Overwriting Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, NAV, AVTK, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Label, or Int13, virus was received in December, 1990, from the USSR. Label is a memory resident infector of .COM programs, including COMMAND.COM. The first time a program infected with Label is executed, Label will install itself memory resident. Once resident, it will infect one .COM program in the current directory each time a DOS DIR command is executed. Infected programs will have the first 512 bytes overwritten by the virus. The original first 512 bytes of the infected program are not saved by the virus. There will be no change in the length of infected files, nor will their be a change in the file's date and time in the DOS disk directory. Some .COM programs, as well as some .EXE programs, will be corrupted by the Label virus, but not actually infected. Like infected programs, these files will have been permanently damaged. Systems infected with Label may also experience "Sector not found" errors when the virus is memory resident. These errors will not occur on the same file if the virus is not memory resident.