Multi-123 Virus

Virus Name: Multi-123 Aliases: Bulgarian 123, V123, Multi, SD-123 V Status: Rare Discovered: November, 1991 Symptoms: .COM file growth; file date/time changes; slow program loads Origin: Bulgaria Eff Length: 123 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, Sweep, AVTK, PCScan, ChAV, F-Prot, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Multi-123 virus was received in November, 1991. It is originally from Bulgaria. Multi-123 is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with Multi-123 is executed, the virus will search the current directory and infect all .COM files it finds. Infected programs will have a file length increase of 123 bytes with the virus being located at the end of the infected file. The file's date and time in the DOS disk directory will have been updated to the system date and time when infection occurred. The Multi-123 virus cannot recognize files that it has previously infected. As a result, it will continue to infect already infected files, adding additional increments of 123 bytes. Besides file length increases and file date and time changes, an additional symptom of a Multi-123 infection is that execution of an infected program will result in a long period of disk access before the requested program actually runs. Multi-123 doesn't do anything besides replicate.