Medical Virus

Virus Name: Medical Aliases: V Status: Rare Discovered: October, 1992 Symptoms: .COM file growth; system hangs; file date/time disappears; boot failure; program execution failure Origin: Republic of South Africa Eff Length: 189 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, Innoc, AVTK/N, LProt, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Medical virus was received in October, 1992. It is originally from the Republic of South Africa. Medical is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Medical virus is executed, the virus will attempt to infect one .COM file located in the current directory. The infection attempt is not always successful, and will sometimes result in a corrupted file. Both corrupted and infected .COM programs will have a file length increase of 189 bytes. On infected programs, the virus will be located at the end of the file. Corrupted programs will also have some code added to the end of the file. The program's date and time in the DOS disk directory listing will have been changed to "0-00-80 12:00:00", and as a result, the file's date and time will not appear in the DOS disk directory listing. Programs infected with the Medical virus will not function properly. After the virus has attempted to infect one other .COM file in the current directory, the user will either be returned to the DOS prompt or a system hang may occur. Attempts to boot from an infected or corrupted COMMAND.COM will result in a system hang.