Madismo Virus

Virus Name: Madismo Aliases: V Status: Viron Discovered: September, 1992 Symptoms: .EXE programs overwritten; file date/time changes; message Origin: Unknown Eff Length: 6,007 Bytes Type Code: ONE - Overwriting Non-Resident .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, NAV, NAVDX, VAlert, IBMAV, ChAV, NShld, AVTK/N, Sweep/N, NAV/N, IBMAV/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Madismo virus was received in September, 1992. Its origin or point of isolation is unknown. Madismo is a non-resident direct action overwriting virus which infects .EXE programs. When a program infected with the Madismo virus is executed, this virus will access both the C: drive and the current drive, then infect all .EXE programs located in the current directory which are larger than 6,000 bytes in size. Once the virus completes infecting programs, it will display the following message and return the user to the DOS prompt: "Madismo Strikes Again!" Infected programs will have the first 6,007 bytes overwritten by the Madismo virus code. The file's date and time in the DOS disk directory listing will have been updated to the system date and time when infection occurred. The following text strings are encrypted within the viral code: "C:\COMMAND.COM" "MADISMO *.EXE>MADISMO.TXT" "MADISMO.TXT" "Sector not found reading drive" "Abort, Retry, Ignore, Fail?" "Error in EXE file" "Madismo Strikes Again!" "*.*" "No matching files found." Programs infected with the Madismo virus are permanently corrupted since the virus does not store the 6,007 bytes it overwrites. They should be replaced with uninfected copies.