Metal Virus


 Virus Name:  Metal 
 Aliases:     Metal.400 
 V Status:    New 
 Discovered:  July, 1995 
 Symptoms:    .COM file growth; file date/time seconds = "50" 
 Origin:      Unknown 
 Eff Length:  400 Bytes 
 Type Code:   PRaCK - Parasitic Resident .COM Infector 
 Detection Method: VAlert, AVTK, NAV, NAVDX, IBMAV, ViruScan, F-Prot, 
                   ChAV, 
                   NAV/N, IBMAV/N, NShld, AVTK/N, NProt, Innoc 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Metal or Metal.400 virus was received in July, 1995, along with 
       one variant.  Metal is a memory resident infector of .COM files, 
       including COMMAND.COM.  It may be related to the  Metallica II 
       virus. 
 
       When the first Metal infected program is executed, this virus will 
       install itself memory resident in allocated system memory.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will not be altered.  Interrupt 21 will be hooked by the 
       virus. 
 
       Once the Metal virus is memory resident, it will infect .COM 
       programs when they are executed or opened.  Infected .COM files 
       will have a file length increase of 400 bytes with the virus being 
       located at the end of the file.  The program's date and time in the 
       DOS disk directory listing will not appear to be altered, though 
       the seconds field will have been set to "50".  The following text 
       string is visible within the viral code in all infected files: 
 
           "MetallicA" 
 
       Known variant(s) of Metal are: 
       Metal.500: Also received in July, 1995, this is a 500 byte 
           variant of Metal which infects both .COM and .EXE files, 
           including COMMAND.COM.  Infected files will have a file length 
           increase of 500 bytes with the virus being located at the end 
           of the file.  The program's date and time in the DOS disk 
           directory listing will not appear to be altered, though the 
           seconds field will have been set to "52".  The following text 
           string is visible within the viral code: 
           "MetalliŠA" 
           Origin:  Unknown  July, 1995. 
 
       See:   Metallica II 

Show viruses from discovered during that infect .

Main Page