Agena Virus


 Virus Name:  Agena 
 Aliases:    
 V Status:    Rare 
 Discovery:   September, 1992 
 Symptoms:    .COM & .EXE file growth; decrease in total system & available 
              free memory 
 Origin:      Spain 
 Eff Length:  723 - 738 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, IBMAV, 
                    NAV, NAVDX, VAlert, ChAV, 
                    NShld, Sweep/N, AVTK/N, NProt, Innoc, NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Agena virus was discovered in Spain in September, 1992.  Agena 
       is a memory resident infector of .COM and .EXE programs, including 
       COMMAND.COM. 
 
       When the first program infected with the Agena virus is executed, 
       the Agena virus will install itself memory resident at the top of 
       system memory but below the 640K DOS boundary.  Total system and 
       available free memory, as indicated by the DOS CHKDSK program, 
       will have decreased by 1,296 bytes.  Interrupts 20 and 21 will be 
       hooked by Agena in memory. 
 
       Once the Agena virus is memory resident, it will infect .COM and 
       .EXE programs, including COMMAND.COM, when they are executed. 
       Infected programs will have a file length increase of 723 to 738 
       bytes with the virus being located at the end of the file.  The 
       program's date and time in the DOS disk directory listing will not 
       be altered.  No text strings are visible within the viral code in 
       infected programs. 
 
       It is unknown what Agena may do besides replicate. 

Show viruses from discovered during that infect .

Main Page