Virus Name: Malaga
V Status: Rare
Discovered: February, 1992
Symptoms: .COM & .EXE growth; boot sector altered; decrease in total
system & available free memory; boot failure on diskettes
Eff Length: 2,612 - 2,626 Bytes
Type Code: PRshAB - Parasitic Resident .COM, .EXE, & Boot Sector Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, LProt, Innoc, NProt, IBMAV/N,
Removal Instructions: Delete infected files
The Malaga virus was received in February, 1992. Its origin is
unknown. Malaga is a memory resident infector of .COM and .EXE
programs, as well as the boot sector of diskettes and hard disks.
It does not infect COMMAND.COM. It is a stealth virus in that
it imploys a technique similar to the Brain virus to hide the
boot sector infection when the virus is memory resident.
The first time a program infected with the Malaga virus is executed,
the Malaga virus will install itself memory resident as a low
system memory TSR of 5,168 bytes, hooking interrupts 08, 13, and
21. At this time, it will also infect the boot sector of the
current drive, and the first .EXE program in the current directory.
Later, when the user boots from the infected diskette, the boot
will fail if it is a diskette, but the Malaga virus will infect the
hard disk boot drive DOS boot sector. Booting from the hard disk
will then result in the virus becoming memory resident at the top
of system memory but below the 640K DOS boundary. Total system and
available free memory, as indicated by the DOS CHKDSK program, will
have decreased by 4,096 bytes.
Once the Malaga virus is memory resident, it will infect one .EXE or
.COM program each time the system user executes any program or
a DOS DIR command is issued. (Infection of programs when a DIR
command is performed only occurs when the virus becomes memory
resident from a file infection, or is resident as a low system
memory TSR.) In the case of program execution, it will also infect
the program the user is currently executing if it was not previously
Programs infected with the Malaga virus will have a file length
increase of 2,612 to 2,626 bytes, the virus will be located at the
end of the program. The file's date and time in the DOS disk
directory listing will not be altered. The following text strings
can be found within the viral code in all infected programs:
"*.EXE *.COM COMMAND.COM"
In the case of the infection of boot sectors, the original boot
sector and a copy of the Malaga virus code will be written to the
disk starting at sector 0 of the last available side or track of
the disk. The original boot sector will precede the copy of the
Since Malaga is a stealth virus with regards to the boot sector
infection, if you check your system with anti-viral utilities and
find it on files, you need to power off the system and check the
system again after booting from a uninfected, write-protected
system diskette. Otherwise, the boot sector infection may be
missed, and you will promptly become reinfected.
It is unknown if Malaga does anything besides replicate.
Known variant(s) of Malaga are:
Inofensivo: Based on the Malaga virus described above, Inofensivo
is a 2,661 byte variant. Its size in memory is 5,184
bytes, hooking interrupts 08, 13, and 21. Once memory
resident, it infects .COM and .EXE programs when they are
executed, as well as one program each time a DOS DIR
command is issued. Infected files increase in size by
2,661 to 2,674 bytes in length with the virus being located
at the end of the file. The program's date and time in the
DOS disk directory listing will not be altered. The
following text strings can be found within the viral code
in all Inofensivo infected programs:
"*.EXE *.COM COMMAND.COM"
Origin: Unknown April, 1993.
Malaga-B: Functionally similar to the original virus, this is
a minor variant which has nineteen bytes which differ
from the original.
Origin: Unknown February, 1992.