Massacre Virus

 Virus Name:  Massacre 
 Aliases:     Massacre.775 
 V Status:    New 
 Discovered:  July, 1996 
 Symptoms:    .COM & .EXE growth; 
              interrupts 21 & 2F hooked in available free memory 
 Origin:      Unknown 
 Eff Length:  775 Bytes 
 Type Code:   PRfA - Parasitic Resident .COM & EXE Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, ViruScan, NAV, NAVDX, ChAV, 
                    Innoc, AVTK/N, IBMAV/N, NShld, NAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Massacre virus was received in July, 1996.  Its origin or point 
       of isolation is unknown.  Massacre is a memory resident infector of 
       .COM and .EXE files, but not COMMAND.COM. 
       When a program infected with the Massacre virus is executed, this 
       virus will install itself memory resident in available free 
       memory, hooking interrupts 21 and 2F.  Total system and available 
       free memory, as indicated by the DOS CHKDSK program from DOS 5.0, 
       will not be altered. 
       Once the Massacre virus is memory resident, it will infect .COM 
       and .EXE files, but not COMMAND.COM, when they are executed or 
       opened, but not when copied.  Infected files will have a file 
       length increase of 775 bytes with the virus being located at the 
       end of the file.  The program's date and time in the DOS disk 
       directory listing will not be altered.  The following text strings 
       are visible within the viral code: 
           "[MIDNIGHT MASSACRE] V1.2 by Crypt Keeper" 
       It is unknown what this virus may do besides replicate. 
       See:   Keeper 

Show viruses from discovered during that infect .

Main Page