Month 4-6 Virus

 Virus Name:  Month 4-6 
 Aliases:     Agi-plan 
 V Status:    Rare 
 Discovered:  1989? 
 Symptoms:    .COM file growth; TSR; system hangs; disk corruption 
 Origin:      Unknown 
 Eff Length:  1,536 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM Infector 
 Detection Method:  F-Prot, ViruScan, NAV, Sweep, AVTK, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    LProt, NShld, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Month 4-6 or Agiplan virus was received in October, 1992, though 
       it has been rumored to exist since 1989.  The origin of the sample 
       received is unknown.  Month 4-6 is a memory resident infector of 
       .COM programs, including COMMAND.COM. 
       When the first Month 4-6 virus infected program is executed, this 
       virus will install itself memory resident as a low system memory 
       TSR, hooking interrupts 21 and 24.  Unless the virus becomes memory 
       resident from COMMAND.COM, the system will usually hang at this 
       point, receiving an error that it cannot load the command 
       Once memory resident, Month 4-6 will infect .COM programs when they 
       are executed.  Infected programs will have a file length increase of 
       1,536 bytes with the virus being located at the beginning of the 
       file.  The file's date and time will not be altered.  Two text 
       strings can be found within the viral code in infected programs: 
               "load error" 
       The Month 4-6 virus activates when it becomes memory resident 
       between April 1st and June 30th of any year, hence its name.  At 
       that time, the virus will trash the current drive. 

Show viruses from discovered during that infect .

Main Page