Metal Virus

Virus Name: Metal Aliases: Metal.400 V Status: New Discovered: July, 1995 Symptoms: .COM file growth; file date/time seconds = "50" Origin: Unknown Eff Length: 400 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: VAlert, AVTK, NAV, NAVDX, IBMAV, ViruScan, F-Prot, ChAV, NAV/N, IBMAV/N, NShld, AVTK/N, NProt, Innoc Removal Instructions: Delete infected files General Comments: The Metal or Metal.400 virus was received in July, 1995, along with one variant. Metal is a memory resident infector of .COM files, including COMMAND.COM. It may be related to the Metallica II virus. When the first Metal infected program is executed, this virus will install itself memory resident in allocated system memory. Total system and available free memory, as indicated by the DOS CHKDSK program, will not be altered. Interrupt 21 will be hooked by the virus. Once the Metal virus is memory resident, it will infect .COM programs when they are executed or opened. Infected .COM files will have a file length increase of 400 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, though the seconds field will have been set to "50". The following text string is visible within the viral code in all infected files: "MetallicA" Known variant(s) of Metal are: Metal.500: Also received in July, 1995, this is a 500 byte variant of Metal which infects both .COM and .EXE files, including COMMAND.COM. Infected files will have a file length increase of 500 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, though the seconds field will have been set to "52". The following text string is visible within the viral code: "MetalliáA" Origin: Unknown July, 1995. See: Metallica II