Virus Name: Mohova
V Status: New
Discovered: January, 1995
Symptoms: .EXE file growth;
decrease in available free memory (DOS 5.0)
Eff Length: 663 - 675 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: F-Prot, AVTK, IBMAV, Sweep, NAV, ViruScan,
NAVDX, VAlert, PCScan, ChAV,
AVTK/N, IBMAV/N, Sweep/N, NProt, NShld, NAV/N, Innoc
Removal Instructions: Delete infected files
The Mohova or Mohova.659 virus was received in January, 1995. Its
origin or point of isolation is unknown. Mohova is a memory resident
infector of .EXE files. It does not infect very small .EXE files.
When the first Mohova infected program is executed, the Mohova virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, not moving interrupt 12's return.
Available free memory, as indicated by the DOS CHKDSK program from
DOS 5.0, will have decreased by approximately 1,104 bytes. Interrupt
21 will be hooked by the virus in memory.
Once the Mohova virus is memory resident, it will infect .EXE files
when they are executed. Infected files will have a file length
increase of 663 to 675 bytes with the virus being located at the
end of the file. The file's date and time in the DOS disk directory
listing will not be altered. The following text strings are visible
within the viral code in all Mohova infected programs:
"Mohova N.I. is my love!Ice"
It is unknown what the Mohova virus does besides replicate.