Mohova Virus

Virus Name: Mohova Aliases: Mohova.659 V Status: New Discovered: January, 1995 Symptoms: .EXE file growth; decrease in available free memory (DOS 5.0) Origin: Unknown Eff Length: 663 - 675 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: F-Prot, AVTK, IBMAV, Sweep, NAV, ViruScan, NAVDX, VAlert, PCScan, ChAV, AVTK/N, IBMAV/N, Sweep/N, NProt, NShld, NAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Mohova or Mohova.659 virus was received in January, 1995. Its origin or point of isolation is unknown. Mohova is a memory resident infector of .EXE files. It does not infect very small .EXE files. When the first Mohova infected program is executed, the Mohova virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by approximately 1,104 bytes. Interrupt 21 will be hooked by the virus in memory. Once the Mohova virus is memory resident, it will infect .EXE files when they are executed. Infected files will have a file length increase of 663 to 675 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all Mohova infected programs: "AIDSADIN" "Mohova N.I. is my love!Ice" It is unknown what the Mohova virus does besides replicate.