Mirror Virus

Virus Name: Mirror Aliases: V Status: Rare Discovered: October, 1990 Symptoms: .EXE growth; decrease in available free memory; mirror effect of display on activation Origin: Unknown Eff Length: 927 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Mirror virus was discovered in October, 1990. This virus is a memory resident direct action infector of .EXE files. The first time a program infected with the Mirror virus is executed, the virus will install itself memory resident at the top of free available memory. Free available memory will decrease by 928 bytes, and the virus will hook interrupt 21. At this time, the virus will also infect all other .EXE programs located in the current directory. Infected programs will increase in length by 927 to 940 bytes, with the virus being located at the end of the infected file. Infected programs will also always end with the two text characters "IH". The Mirror virus gets its name from its behavior. Every once in awhile it will change the system's video display so that a mirror image of what was previously on the display appears.