Virus Name: Micropox
V Status: Rare
Discovered: February, 1992
Symptoms: .COM & .EXE growth; decrease in total system & available free
memory; corrupts system hard disk
Origin: United States
Eff Length: 4,928 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, Sweep, F-Prot, AVTK, PCScan, ChAV,
NAV, IBMAV, NAVDX, VAlert,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected programs
The Micropox virus was submitted in February, 1992. It was
isolated in the United States. Micropox is a memory resident
infector of .COM and .EXE programs, it does not infect COMMAND.COM.
It is destructive when it activates.
The first time a program infected with the Micropox virus is
executed, the Micropox virus will install itself memory resident
at the top of system memory but below the 640K DOS boundary, not
moving interrupt 12's return. Total system and available free
memory, as indicated by the DOS CHKDSK program, will have decreased
by 4,944 bytes. Interrupts 1C and 21 will be hooked by the virus.
One .COM and one .EXE program located in the current directory may
be infected by the virus at this time.
Once the Micropox virus is memory resident, it will infect .COM and
.EXE programs when they are executed. Infected programs will have
a file length increase of 4,928 bytes. The virus will be located
at the end of the program. The file's date and time in the DOS
disk directory listing will not be altered. No text strings are
visible in the viral code in infected programs.
The Micropox virus activates when it becomes memory resident in the
month of March. During the month of March, execution of the first
infected program when the virus is not already memory resident will
result in the virus overwriting the system hard disk.