Mix2 Virus


 Virus Name:  Mix2 
 Aliases: 
 V Status:    Rare 
 Discovered:  March, 1991 
 Symptoms:    .COM & .EXE growth; system hangs; decrease in total system 
              and available free memory 
 Origin:      Europe 
 Eff Length:  2,287 Bytes 
 Type Code:   PRhA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, NAV, Sweep, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, 
                    LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Mix2 virus was submitted in March, 1991.  Original reports of 
       this virus were received from Europe.  Mix2 is based on the Mix1 
       virus, and is a memory resident infector of .COM and .EXE files. 
       It does not infect COMMAND.COM 
 
       When the first program infected with Mix2 is executed, Mix2 will 
       install itself memory resident at the top of system memory, but 
       below the 640K DOS boundary.  It will mark this area of reserved 
       memory "COMMAND Data" and will hook interrupt 21.  Total system and 
       available free memory, as indicated by the DOS CHKDSK program, will 
       decrease by 3,040 bytes. Interrupt 12's return will not be moved. 
 
       Once Mix2 is memory resident, it will infect .COM and .EXE programs 
       over 9K in length when they are executed.  Infected programs will 
       increase in length by 2,287 to 2,294 bytes with the virus being 
       located at the end of the infected file.  This virus does not alter 
       the file date and time in the disk directory. 
 
       Some programs which are memory intensive, or which allocate all 
       available memory will hang when executed with Mix2 memory resident. 
 
       It is unknown what Mix2 does besides replicate. 
 
       See:   Mix1 

Show viruses from discovered during that infect .

Main Page