Virus Name: Miky
V Status: Rare
Discovered: September, 1991
Symptoms: .COM & .EXE growth; TSR; lost cluster; screen rotation and
Eff Length: 2,350 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, NAV, Sweep, AVTK, ChAV,
IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The Miky virus was discovered in September, 1991. It originated in
Bolivia. Miky is a memory resident infector of .COM and .EXE files,
and will not infect COMMAND.COM.
The first time a program infected with Miky is executed, Miky will
become memory resident as a low system memory TSR of 2,096 bytes.
Interrupts 16, 21, and 80 will be hooked by the virus in memory.
Once resident, Miky will infect .COM and .EXE programs when they
are executed, but not COMMAND.COM. .COM programs will increase in
size by 2,350 bytes with the virus being located at the beginning
of infected files. .EXE programs will increase in size by
2,350 to 2,364 bytes with the virus being located at the end of
infected files. There will be no change in the infected file's
date and time in the DOS disk directory.
Miky activates based on a random basis after keyboard input has
occurred. Upon activation, it will rotate the system display to
the right, with the characters or graphics reappearing around the
left hand side, and down one line. After a full rotation has
occurred, the following message will be centered on the display:
"MIKY 786290 Blivia"
This message cannot be seen in infected files as the virus is
Systems infected with Miky will also notice a much higher than
normal number of lost clusters being detected by the DOS CHKDSK
program. One lost cluster occurs each time a program is infected
Known variant(s) of Miky are:
Miky-2390: Received in May, 1992, Miky-2390 is a slightly
larger variant of the Miky virus. Its in memory
TSR is 2,144 bytes in size. It adds 2,390 bytes to
the .COM programs it infects, and 2,390 to 2,404 bytes
to the .EXE programs it infects. The following
two text strings can be found within the viral code
in Miky-2390 infected programs:
"COMMAND.COM symbolic M"
Origin: Unknown May, 1992.