MG Virus


 Virus Name:  MG 
 Aliases: 
 V Status:    Rare 
 Discovered:  September, 1990 
 Symptoms:    .COM file growth; DIR command may not function properly; 
              file allocation errors; system hangs 
 Origin:      Bulgaria 
 Eff Length:  500 Bytes 
 Type Code:   PRCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, AVTK, Sweep, NAV, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The MG virus was submitted in January, 1991, though it has been 
       mentioned by Bulgarian researchers several times since September, 
       1990. This virus is named MG as it was originally isolated at 
       Matematicheska Gimnazia, a school in Varna, Bulgaria.  It is a 
       memory resident infector of .COM files, including COMMAND.COM. 
 
       The first time a program infected with MG is executed, the virus 
       will install itself memory resident in a portion of the interrupt 
       table in memory.  Interrupt 24 is hooked by the virus, as are 
       several other interrupts. 
 
       After MG is memory resident, it will infect programs when one of 
       two things occurs: either the user attempts to execute any program, 
       or a DIR command is performed.  In the case of a program being 
       executed, the virus will infect one program in the current 
       directory, though not necessarily the program being executed.  When 
       a DIR command is executed, one program in the current directory 
       will be infected as well. 
 
       .COM programs infected with MG will increase in length by 500 
       bytes, though the file length increase will not be visible in a DIR 
       listing if the virus is memory resident.  File date and time in the 
       disk directory are also not altered.  The virus will be located at 
       the end of infected programs. 
 
       Symptoms of a MG infection are that the DOS CHKDSK program will 
       show File allocation errors on all infected .COM programs if the 
       virus is present in memory.  The DOS DIR command may also not 
       function properly, for example DIR A:*.COM will yield "File not 
       found" even though .COM files exist on the A: drive.  At other 
       times, pauses will occur in the disk directory being displayed by 
       the DIR command.  Another symptom is that unexpected system hangs 
       may occur due to the interrupt table being infected in memory. 
 
       Known variant(s) of MG are: 
       MG-2: MG-2 is a direct action, memory resident infector of 
             .COM programs, including COMMAND.COM.  It is very similar 
             to the MG virus on which it is based.  When MG-2 becomes 
             memory resident, total system and available free memory 
             will be decreased by 55,104 bytes.  MG-2 remaps many 
             interrupts, including interrupt 24, and may allocate some 
             memory above 640K.  After it is resident, it will infect 
             .COM programs in the current directory when they are 
             executed.  Infected files increase in size by 500 bytes, 
             though the file length increase will not be visible if the 
             virus is resident.  The virus is located at the end of the 
             file. 
             Origin:  Bulgaria  December, 1990. 
       MG-3: Functionally similar to MG-2, this variant has been 
             altered to avoid detection.  It is also 500 bytes in length. 
             Origin:  Bulgaria  December, 1990. 
       MG-3B: Similar to MG-3, this variant becomes memory resident in 
             video card memory with a "hook" left in low system memory. 
             Total system and available free memory will not change at all 
             when the virus is resident.  MG-3B behaves as both a direct 
             and indirect file infector.  .COM programs are infected when 
             they are executed, as well as infecting one program in the 
             current directory each time an infected program is executed. 
             It will also infect a program in the directory when a DIR 
             command is issued. 
             Origin:  Bulgaria  December, 1990. 

Show viruses from discovered during that infect .

Main Page