Mix1 Virus

 Virus Name:  Mix1 
 Aliases:     MIX1, MIX/1 
 V Status:    Rare 
 Discovered:  August, 1989 
 Symptoms:    TSR; .EXE growth; location 0:33C = 77h; garbled output 
 Origin:      Israel 
 Eff Length:  1,618 - 1,634 Bytes 
 Type Code:   PRsE - Parasitic Resident .EXE Infector 
 Detection Method:  ViruScan, F-Prot, AVTK, NAV, Sweep, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  F-Prot, or delete infected files 
 General Comments: 
       The Mix1 virus was originally isolated on August 22, 1989, on 
       several BBSes in Israel.  This virus is a parasitic, memory- 
       resident .EXE file infector.  Once an infected program has been 
       executed, the virus will take up 2,048 bytes in RAM.  Each .EXE 
       file then executed will grow in length between 1,618 and 1,634 
       bytes, depending on the original file size.  The virus will not, 
       however, infect files of less than 8K in size. 
       Infected files can be manually identified by a characteristic 
       "MIX1" always being the last 4 bytes of an infected file. Using 
       DEBUG, if byte 0:33C equals 77h, then the Mix1 virus is in memory. 
       This virus will cause garbled output on both serial and parallel 
       devices, as well as the Num-Lock being constantly on.  After the 
       6th infection, booting the system will crash the system due to a 
       bug in the code, and a ball will start bouncing on the system 
       There is a variant of this virus which does not have the problem of 
       system crashes occurring, and will only infect files that are 
       greater than 16K in length. 
       Mix1 has several code similarities to Icelandic, which it may have 
       been derived from. 
       Known variant(s) of Mix1 are: 
       Mix1-B: A 1,636 byte variant of the Mix1 virus, Mix1-B or 
             Mix1-1636 adds 1,636 to 1,650 bytes to the .EXE programs it 
             infects.  The text string "MIX1" can be found at the end of 
             all infected files. 
             Origin:  Unknown  January, 1993. 
       Snow: Functionally similar to the Mix1 virus, the "MIX1" text 
             string at the end of infected files is now "SNOW".  Snow 
             is unable to determine when it has previously infected files, 
             so .EXE files will be reinfected.  Initial infection by the 
             virus will increase the file length by 1,618 - 1,632 bytes 
             with the virus being located at the end of the file.  Each 
             reinfection will add an additional 1,632 bytes to the file. 
             Origin:  Unknown  December, 1992. 
       See:   Icelandic   Mix2 

Show viruses from discovered during that infect .

Main Page