Virus Name: Macedonia
V Status: Rare
Discovered: January, 1992
Symptoms: .COM file growth
Eff Length: 400 Bytes
Type Code: PRC - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files, & DOS SYS command
The Macedonia virus was received in January, 1992. Its origin or
point of original isolation is unknown. Macedonia is a memory
resident infector of .COM programs.
The first time a program infected with Macedonia is executed, the
virus will install itself memory resident in available system memory.
There will be no decrease in total system or available free memory
as indicated by the DOS CHKDSK program. Interrupt 21 will be hooked
by the virus.
Once Macedonia is memory resident, it will occasionally infect a
.COM file when another program is executed. Infected .COM files
will have a file length increase of 400 bytes with the virus being
located at the end of the infected program. There will be no
change to the file's date and time in the DOS disk directory
listing. The following text strings can be found within the viral
code in Macedonia infected programs:
It is unknown if Macedonia does anything besides replicate.