Mannequin Virus

 Virus Name:  Mannequin 
 V Status:    Rare 
 Discovered:  January, 1992 
 Symptoms:    .COM & .EXE growth; decrease in total system & available free 
              memory; interference with printing 
 Origin:      Unknown 
 Eff Length:  778 Bytes 
 Type Code:   PRhA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, ChAV, 
                    IBMAV, NAV, NAVDX, VAlert, PCScan, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Mannequin virus was received in January, 1992.  Its origin or 
       point of original isolation is unknown.  Mannequin is a memory 
       resident infector of .COM and .EXE files.  It does not infect 
       The first time a program infected with Mannequin is executed, the 
       Mannequin virus will install itself memory resident at the top of 
       system memory but below the 640K DOS boundary.  Total system and 
       available free memory, as indicated by the DOS CHKDSK program, will 
       have decreased by 848 bytes.  Interrupt 12's return will not have 
       been moved.  Interrupts 17 and 21 will be hooked by the Mannequin 
       virus in memory. 
       Once the Mannequin virus is memory resident, it will infect .COM 
       and .EXE programs when they are executed.  Infected programs will 
       have a file length increase of 778 bytes with the virus being 
       located at the end of the infected file.  The file's date and time 
       in a DOS disk directory listing will not have been altered.  Two 
       text strings can be found within the viral code in Mannequin 
       infected files: 
       Systems infected with Mannequin may experience difficults or 
       interference when attempting to print to the system printer. 

Show viruses from discovered during that infect .

Main Page