MShark Virus

Virus Name: MShark Aliases: V Status: Rare Discovered: April, 1992 Symptoms: .COM file growth; file date/time change Origin: Unknown Eff Length: 373 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: Sweep, ViruScan, AVTK, F-Prot, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, LProt, NShld, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The MShark virus was submitted in April, 1992. Its origin is unknown. MShark is a non-resident, direct action infector of .COM files, including COMMAND.COM. When a program infected with the MShark virus is executed, the MShark virus will infect all .COM files located in the current directory. If COMMAND.COM is located in this directory, it will become infected. Programs infected with the MShark virus will have a file length increase of 373 bytes with the virus being located at the end of the program. The file's date and time in the DOS disk directory will have been updated to the current system date and time when infection occurred. The following text string can be found within all MShark infected programs: "Mshark-S v1.0" MShark doesn'd do anything besides replicate. Known variant(s) of MShark are: MShark-378: Received in August, 1993, MShark-378 is a 378 byte variant of the MShark virus described above. It adds 378 bytes to the .COM programs it infects. Infected programs will contain the following text string within the MShark-378 viral code: "(C) Mshark-S v.1.0" Origin: Unknown August, 1993