Metallica II Virus
Virus Name: Metallica II
V Status: Rare
Discovered: September, 1993
Symptoms: .COM & .EXE growth; system hangs; programs fail to function;
decrease in total system & available free memory;
boot sector altered; file date/time changes
Eff Length: 1,129 - 1,143 Bytes
Type Code: PRtA - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, IBMAV, ViruScan, Sweep, AVTK, NAV, NAVDX,
VAlert, PCScan, ChAV,
NProt, NShld, Sweep/N, IBMAV/N, Innoc, NAV/N, AVTK/N,
Removal Instructions: Delete infected files
The Metallica II virus was submitted in September, 1993, and appears
to be from the USSR. Metallica II is a memory resident infector of
.COM and .EXE programs, but not COMMAND.COM.
When the first Metallica II infected program is executed, this virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, moving interrupt 12's return to 9F80.
Total system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by approximately 2K. Interrupt 21 will
be hooked by Metallica II in memory.
Once memory resident, the Metallica II virus will infect .COM and .EXE
programs, other than COMMAND.COM, when they are executed. Infected
.COM files increase in size by 1,129 bytes while .EXE files increase
in size by 1,129 to 1,143 bytes. In both cases, the virus will be
located at the end of the file. The program's date and time in the
DOS disk directory listing will be altered, but usually not to the
current system date and time. The following text strings can be
found within the viral code in all Metallica II infected programs:
"Metallica Ver 2.0"
"(c) USSR Moscow 92"
Systems infected with this virus may experience frequent system
hangs when the user attempts to execute programs from write protected
diskettes. Additionally, some programs will not function properly
once they become infected. Disk boot sectors may also be altered.