Mono Virus

 Virus Name:  Mono 
 Aliases:     1063 
 V Status:    Rare 
 Discovered:  November, 1991 
 Symptoms:    .COM file growth; TSR; programs deleted 
 Origin:      Poland 
 Eff Length:  1,063 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, Sweep, F-Prot, ChAV, 
                    NAV, IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N, 
                    LProt, NAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Mono, or 1063, virus was received in November, 1991.  This virus 
       is originally from Poland.  Mono is a memory resident infector of 
       .COM programs, including COMMAND.COM.  It will not, however, infect 
       programs unless the system is running in monochrome 80x25 mode. 
       The first time a program infected with Mono is executed, the virus 
       will install itself memory resident as a low system memory TSR of 
       2,048 bytes.  This TSR may appear indicated as Command data by some 
       memory mapping utilities.  Interrupt 21 will be hooked by the Mono 
       virus in memory. 
       Once Mono is memory resident, it will infect .COM programs when they 
       are executed if the system is in monochrome mode with an 80 column 
       by 25 line display.  If the display is set to anything else, it will 
       not spread. 
       Mono infected programs will have a file length increase of 1,063 
       bytes.  The virus will be located at the end of the infected file. 
       There will be no change to the file's date and time in a DOS 
       directory listing.  There are no visible text strings within the 
       viral code. 
       Mono contains code to delete files, but it is unknown what 
       activates it. 

Show viruses from discovered during that infect .

Main Page