Virus Name: Mix2
V Status: Rare
Discovered: March, 1991
Symptoms: .COM & .EXE growth; system hangs; decrease in total system
and available free memory
Eff Length: 2,287 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N,
Removal Instructions: Delete infected files
The Mix2 virus was submitted in March, 1991. Original reports of
this virus were received from Europe. Mix2 is based on the Mix1
virus, and is a memory resident infector of .COM and .EXE files.
It does not infect COMMAND.COM
When the first program infected with Mix2 is executed, Mix2 will
install itself memory resident at the top of system memory, but
below the 640K DOS boundary. It will mark this area of reserved
memory "COMMAND Data" and will hook interrupt 21. Total system and
available free memory, as indicated by the DOS CHKDSK program, will
decrease by 3,040 bytes. Interrupt 12's return will not be moved.
Once Mix2 is memory resident, it will infect .COM and .EXE programs
over 9K in length when they are executed. Infected programs will
increase in length by 2,287 to 2,294 bytes with the virus being
located at the end of the infected file. This virus does not alter
the file date and time in the disk directory.
Some programs which are memory intensive, or which allocate all
available memory will hang when executed with Mix2 memory resident.
It is unknown what Mix2 does besides replicate.