Multi Child Virus
Virus Name: Multi Child
Aliases: Multi Child-104
V Status: Rare
Discovered: October, 1993
Symptoms: .COM file growth; file date/time changes
Eff Length: 104 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: IBMAV, F-Prot, AVTK, NAV, Sweep, ViruScan,
NAVDX, VAlert, Innoc, ChAV, PCScan,
AVTK/N, Sweep/N, NAV/N, NProt, IBMAV/N, NShld, Innoc
Removal Instructions: Delete infected files
The Multi Child, or Multi Child-104, virus was received in October,
1993. Its origin or point of isolation is unknown. Multi Child
is a memory resident infector of .COM programs, including
When the first Multi Child infected program is executed, this virus
will install itself memory resident in low allocated system memory,
usually a DOS buffer. Interrupt 21 will be hooked by the virus in
memory. It may also at this time infect one .COM program located
in the current directory.
Once the Multi Child virus is memory resident, it will infect .COM
programs, including COMMAND.COM, when they are copied to a target
sub-directory. Infected programs will have a file length increase
of 104 bytes with the virus being located at the end of the file.
The program's date and time in the DOS disk directory listing will
have been updated to the current system date and time when infection
occurred. No text strings are visible within the viral code in
Multi Child infected programs.
Multi Child doesn't appear to do anything besides replicate.
Known variant(s) of Multi Child are:
Multi Child-110: Received in October, 1993, Multi Child-110
is a 110 byte variant of the Multi Child virus. It
is functionally similar to the original virus.
Origin: Unknown October, 1993.