Mohova Virus

 Virus Name:  Mohova 
 Aliases:     Mohova.659 
 V Status:    New 
 Discovered:  January, 1995 
 Symptoms:    .EXE file growth; 
              decrease in available free memory (DOS 5.0) 
 Origin:      Unknown 
 Eff Length:  663 - 675 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, Sweep, NAV, ViruScan, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    AVTK/N, IBMAV/N, Sweep/N, NProt, NShld, NAV/N, Innoc 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Mohova or Mohova.659 virus was received in January, 1995.  Its 
       origin or point of isolation is unknown.  Mohova is a memory resident 
       infector of .EXE files.  It does not infect very small .EXE files. 
       When the first Mohova infected program is executed, the Mohova virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, not moving interrupt 12's return. 
       Available free memory, as indicated by the DOS CHKDSK program from 
       DOS 5.0, will have decreased by approximately 1,104 bytes.  Interrupt 
       21 will be hooked by the virus in memory. 
       Once the Mohova virus is memory resident, it will infect .EXE files 
       when they are executed.  Infected files will have a file length 
       increase of 663 to 675 bytes with the virus being located at the 
       end of the file.  The file's date and time in the DOS disk directory 
       listing will not be altered.  The following text strings are visible 
       within the viral code in all Mohova infected programs: 
               "Mohova N.I. is my love!Ice" 
       It is unknown what the Mohova virus does besides replicate. 

Show viruses from discovered during that infect .

Main Page