Virus Name: Ministry
V Status: Rare
Discovered: April, 1992
Symptoms: .COM file growth
Origin: Unknown Eff Length: 1,168 Bytes
Type Code: PNC - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, AVTK, Sweep, IBMAV, ChAV,
NAV, ViruScan, NAVDX, VAlert, PCScan,
NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N,
Removal Instructions: Delete infected files
The Ministry virus was submitted in April, 1992. Its origin is
unknown. Ministry is a non-resident direct action infector of
.COM programs. It does not infect COMMAND.COM. This virus is
based on the Beta virus.
When a program infected with the Ministry virus is executed, this
virus will check the first three non-COMMAND.COM programs in the
current directory to determine if they are infected. If the
programs aren't infected, it will infect them.
Programs infected with the Ministry virus will have a file length
increase of 1,168 bytes with the virus being located at the end
of the infected program. The file's date and time in the DOS
disk directory listing will not be altered.
Ministry is an encrypted virus, and their are no text strings
visible within the viral code in infected programs. The following
text strings are encrypted within the virus:
"I'm Buring Inside!"
"Breathe You Fucker!"
"Jesus Built My Hotrod!"
"Everyday is Halloween!"
"The Ministry Virus - Written by NegativX - (c) 1991 -SiTT-"
It is unknown what Ministry does besides replicate.
See: Beta Elvis-1250