March 25th Virus

 Virus Name:  March 25th 
 V Status:    Rare 
 Discovered:  April, 1994 
 Symptoms:    .COM & .EXE file growth; 
              decrease in total system & available free memory; 
              corrupts system hard disk FAT & possibly files on 3/25 
 Origin:      Unknown 
 Eff Length:  1,026 - 1,040 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  F-Prot, Sweep, ViruScan, AVTK, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, 
                    NShld, Sweep/N, AVTK/N, IBMAV/N, NProt, NAV/N, LProt 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The March 25th virus was received in April, 1994.  Its origin or 
       point of isolation is unknown.  This virus is a memory resident 
       infector of .COM and .EXE programs, including COMMAND.COM.  It is 
       destructive when it activates on March 25th of any year. 
       When the first March 25th infected program is executed, this virus 
       will install itself memory resident at the top of system memory 
       but below the 640K DOS boundary, hooking interrupt 21.  Total system 
       and available free memory, as indicated by the DOS CHKDSK program, 
       will have decreased by 1,056 bytes.  Interrupt 12's return will not 
       be moved. 
       Once memory resident, the March 25th virus will infect .COM and .EXE 
       programs located on the system hard disk, including COMMAND.COM, when 
       they are executed or opened.  It only infects COMMAND.COM on the 
       A: drive. 
       Programs infected with this virus will have a file length increase 
       of 1,026 to 1,040 bytes with the virus being located at the end of 
       the file.  The program's date and time in the DOS disk directory 
       listing will not be altered.  No text strings are visible within the 
       viral code. 
       The March 25th virus activates when the virus becomes memory resident 
       on March 25th of any year.  At this time, the virus will overwrite 
       the system hard disk file allocation table.  It may also corrupt 
       .COM and .EXE files. 

Show viruses from discovered during that infect .

Main Page