M.I.R. Virus
Virus Name: M.I.R.
Aliases: MIR
V Status: Rare
Discovered: May, 1991
Symptoms: .COM & .EXE growth; BSC; .SYS file corruption; decrease in
total system & available memory; boot failures; garbling of
system date/time display
Origin: Europe
Eff Length: 1,745 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
NAV/N, IBMAV/N
Removal Instructions: Delete infected files, & DOS SYS command
General Comments:
The M.I.R. virus was submitted in May 1991 by the PCVRF. It is
originally from Europe. This virus is a memory resident infector
of .COM and .EXE programs, including COMMAND.COM. It also modifies
diskette boot sectors and .SYS files, though the virus cannot
replicate from these areas.
The first time a program infected with M.I.R. is executed, the
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. Interrupts 21 and 27 will
be hooked by the virus. Total system and available free memory, as
indicated by the DOS CHKDSK program, will be 3,584 bytes less than
is expected. At this time, the boot sector of diskettes will be
modified, though the modification does not result in an infectious
copy of the virus.
Once M.I.R. is memory resident, it will infect .COM and .EXE files
which are at least 2K in length when they are executed. Infected
.COM programs will have a length increase of 1,745 bytes, while
.EXE programs will increase in size by 1,745 to 1,759 bytes. In
both cases, the virus will be located at the end of the infected
file. M. I. R. does not hide the file length increase, nor does it
alter the program's date and time in the DOS disk directory.
One text string can be found in infected programs, located near the
beginning of the viral code:
"#.I.R. *-*-*-* Sign of the time!"
As an M.I.R. infection progresses, the system file MSDOS.SYS may
become infected by the virus. This file does not contain an
infectious copy of the virus, but is damaged. Attempts to boot
from disks with a M.I.R. modified boot sector and MSDOS.SYS, as
well as an infected COMMAND.COM will result in a garbled system
date and time, followed by the system hanging.
It is unknown if M.I.R. does anything besides replicate.
See: Dark Avenger