Virus Name: Label
V Status: Rare
Discovered: December, 1990
Symptoms: Program corruption; programs overwritten; sluggish response
on DIR commands; Sector not found errors
Eff Length: 512 Bytes
Type Code: ORCK - Overwriting Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, NAV, AVTK,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Label, or Int13, virus was received in December, 1990, from the
USSR. Label is a memory resident infector of .COM programs,
The first time a program infected with Label is executed, Label
will install itself memory resident. Once resident, it will infect
one .COM program in the current directory each time a DOS DIR
command is executed. Infected programs will have the first 512
bytes overwritten by the virus. The original first 512 bytes of
the infected program are not saved by the virus. There will be no
change in the length of infected files, nor will their be a change
in the file's date and time in the DOS disk directory.
Some .COM programs, as well as some .EXE programs, will be corrupted
by the Label virus, but not actually infected. Like infected
programs, these files will have been permanently damaged.
Systems infected with Label may also experience "Sector not found"
errors when the virus is memory resident. These errors will not
occur on the same file if the virus is not memory resident.