Multi Child Virus

Virus Name: Multi Child Aliases: Multi Child-104 V Status: Rare Discovered: October, 1993 Symptoms: .COM file growth; file date/time changes Origin: Unknown Eff Length: 104 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: IBMAV, F-Prot, AVTK, NAV, Sweep, ViruScan, NAVDX, VAlert, Innoc, ChAV, PCScan, AVTK/N, Sweep/N, NAV/N, NProt, IBMAV/N, NShld, Innoc Removal Instructions: Delete infected files General Comments: The Multi Child, or Multi Child-104, virus was received in October, 1993. Its origin or point of isolation is unknown. Multi Child is a memory resident infector of .COM programs, including COMMAND.COM. When the first Multi Child infected program is executed, this virus will install itself memory resident in low allocated system memory, usually a DOS buffer. Interrupt 21 will be hooked by the virus in memory. It may also at this time infect one .COM program located in the current directory. Once the Multi Child virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are copied to a target sub-directory. Infected programs will have a file length increase of 104 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. No text strings are visible within the viral code in Multi Child infected programs. Multi Child doesn't appear to do anything besides replicate. Known variant(s) of Multi Child are: Multi Child-110: Received in October, 1993, Multi Child-110 is a 110 byte variant of the Multi Child virus. It is functionally similar to the original virus. Origin: Unknown October, 1993.