Mono Virus

Virus Name: Mono Aliases: 1063 V Status: Rare Discovered: November, 1991 Symptoms: .COM file growth; TSR; programs deleted Origin: Poland Eff Length: 1,063 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N, LProt, NAV/N Removal Instructions: Delete infected files General Comments: The Mono, or 1063, virus was received in November, 1991. This virus is originally from Poland. Mono is a memory resident infector of .COM programs, including COMMAND.COM. It will not, however, infect programs unless the system is running in monochrome 80x25 mode. The first time a program infected with Mono is executed, the virus will install itself memory resident as a low system memory TSR of 2,048 bytes. This TSR may appear indicated as Command data by some memory mapping utilities. Interrupt 21 will be hooked by the Mono virus in memory. Once Mono is memory resident, it will infect .COM programs when they are executed if the system is in monochrome mode with an 80 column by 25 line display. If the display is set to anything else, it will not spread. Mono infected programs will have a file length increase of 1,063 bytes. The virus will be located at the end of the infected file. There will be no change to the file's date and time in a DOS directory listing. There are no visible text strings within the viral code. Mono contains code to delete files, but it is unknown what activates it.