Little Girl Virus
Virus Name: Little Girl
Aliases: Little Girl 2.0
V Status: Rare
Discovered: June, 1992
Symptoms: .COM & .EXE file growth; decrease in total system & available
free memory; file date/time change; write protect errors;
hard disk corruption; message
Origin: California, United States
Eff Length: 1,008 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, NAV, Sweep, IBMAV, AVTK,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, IBMAV/N,
NAV/N
Removal Instructions: Delete infected programs
General Comments:
The Little Girl virus was discovered at a large corporation in the
state of California, in the United States in June, 1992. Little
Girl is a memory resident infector of .COM and .EXE programs,
including COMMAND.COM. It is a destructive virus, occassionally
overwriting the contents of the current drive.
The first time a program infected with the Little Girl virus is
executed, the Little Girl virus will install itself memory
resident at the top of system memory but below the 640K DOS boundary.
Total system and available free memory, as indicated by the DOS
CHKDSK program, will have decreased by 1,280 bytes. Interrupt 21
will be hooked. Also at this time, the Little Girl virus will
infect COMMAND.COM if it was not previously infected.
Once the Little Girl virus is memory resident, it will infect .COM
and .EXE programs when they are executed or opened for any reason.
Programs infected with Little Girl will have a file length increase
of 1,008 bytes with the virus being located at the end of the file.
The program's date and time in the DOS disk directory listing will
have been updated to the current system date and time when infection
occurred. The following text strings can be found within the viral
code in Little Girl infected programs:
"File was destroyed by virus Little girl ver 2.00"
"COMEXE"
The Little Girl virus activates on a random basis, at which time
execution of an infected program will result in the virus overwriting
the current drive and displaying the following message:
"File was destroyed by virus Little girl ver 2.00"
Systems infected with the Little Girl virus may experience write
protect errors when attempting to access files located on a write
protected diskette. The virus also interfers with batch files, and
the user may be prompted to reinsert the disk with the batch file,
even though it is still in the current drive.
Known variant(s) of Little Girl are:
Little Girl 3.0: A 1,200 byte variant of the Little Girl virus
described above, this variant's size in memory is 1,536
bytes, hooking interrupt 21. It infects .COM and .EXE
programs when they are executed, opened, or copied,
adding 1,200 bytes to the file's length. The virus will
be located at the end of the file. The program's
date and time will have been updated to the current
system date and time when infection occurred. The
following text strings can be found within the
viral code in all Little Girl 3.0 infected programs:
"COMEXE"
"File was destroyed by The little girl virus ver 3.0"
The Little Girl 3.0 virus corrupts .BAT, .SYS, and
data files when they are accessed, overwriting them
with the second text string indicated above. Write
protect errors will also occur when the user attempts
to execute programs from write protected diskettes.
Origin: United States January, 1993.