Mr. G Virus

Virus Name: Mr. G Aliases: V Status: Rare Discovered: June, 1993 Symptoms: .COM file growth; file date/time changes Origin: Poland Eff Length: 253 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, IBMAV, AVTK, Sweep, ChAV, ViruScan, NAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, NProt, AVTK/N, IBMAV/N, Innoc, NAV/N Removal Instructions: Delete infected files General Comments: The Mr. G virus was submitted in June, 1993, and appears to be from Poland. It is an earlier version of the Mr. D virus. Mr. G is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Mr. G virus is executed, the Mr. G virus will infect all of the .COM programs located in the current directory. Infected programs will have a file length increase of 253 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text string is visible within the viral code in all Mr. G infected programs: "Mr. G" Known variant(s) of Mr. G are: Mr_G.388: Received in February, 1995, Mr_G.388 is a 388 byte variant of the Mr. G virus described above. It infects all of the .COM files in the current directory when an infected program is executed. Infected files will have a file length increase of 388 bytes with the virus being located at the end of the file. The following text strings are encrypted within the viral code: "COMMAND.COM" "*.com" "MR.G" Origin: Unknown February, 1995. See: Mr. D