Virus Name: Monika-686
V Status: Rare
Discovered: August, 1993
Symptoms: .COM file growth; file date/time changes
decrease in total system & available free memory
Eff Length: 686 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, IBMAV,
NAV, NAVDX, VAlert, ChAV,
NShld, Sweep/N, NProt, AVTK/N, IBMAV/N, Innoc, NAV/N
Removal Instructions: Delete infected files
The Monika-686 virus was received in August, 1993. Its origin or
point of isolation is unknown. Monika-686 is a memory resident
infector of .COM programs, including COMMAND.COM. It does not
infect very small .COM files.
When the first Monika-686 infected program is executed, this virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, not moving interrupt 12's return. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 704 bytes. Interrupt 21 will be
hooked by Monika-686 in memory. Also at this time, the virus will
infect COMMAND.COM if it was not previously infected.
Once the Monika-686 virus is memory resident, it will infect .COM
programs when they are executed. Infected programs will have a
file length increase of 686 bytes with the virus being located at
the end of the file. The program's date and time in the DOS disk
directory listing will have been updated to the current system date
and time when infection occurred. No text strings are visible within
the viral code in Monika-686 infected programs.
It is unknown what Monika-686 does besides replicate.