Maverick Virus
Virus Name: Maverick
Aliases: Maverick.1536.A
V Status: New
Discovered: July, 1995
Symptoms: .COM & .EXE growth; file date/time seconds = "30";
decrease in available free memory;
Origin: Unknown, but possibly USSR/Russia
Eff Length: 1,536 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, AVTK, Sweep, IBMAV, ViruScan, ChAV,
NAV 3.10 9612+, NAVBoot 2.0 9612+,
Sweep/N, IBMAV/N, AVTK/N, NShld, Innoc, NAV/N 2.0 9612+
Removal Instructions: Delete infected files
General Comments:
The Maverick or Maverick.1536.A virus was received in July, 1995.
Its origin or point of isolation is unknown, though it appears it
may be from Russia or the USSR. Maverick is a memory resident
stealth infector of .COM and .EXE files, including COMMAND.COM.
When the first Maverick infected program is executed, this virus
will install itself memory resident at the top of system memory
but below the 640K DOS boundary, not moving interrupt 12's return.
Total available free memory, as indicated by the DOS CHKDSK program
from DOS 5.0, will have decreased by approximately 1,264 bytes.
Interrupt 21 will be hooked by the virus in memory.
Once the Maverick virus is memory resident, it will infect .COM and
.EXE files when they are executed or opened, but not on copy.
Infected programs will have a file length increase of 1,536 bytes,
though this file length increase will be hidden when the virus is
memory resident. The virus will be located at the end of the file.
The program's date and time in the DOS disk directory listing will
not appear to be altered, though the seconds field will have been
set to "30". The following text string is encrypted within the
viral code:
"(c) ETERNAL MAVERICK. Kiev Computer Virus Club 1994."
It is unknown what the Maverick virus may do besides replicate.
Known variant(s) of Maverick are:
Maverick.1536.B: Also received in July, 1995, this is a minor
variant of the Maverick virus described above. It is
functionally similar.
Origin: Unknown July, 1995.