Virus Name: Multi-123
Aliases: Bulgarian 123, V123, Multi, SD-123
V Status: Rare
Discovered: November, 1991
Symptoms: .COM file growth; file date/time changes; slow program loads
Eff Length: 123 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, Sweep, AVTK, PCScan, ChAV,
F-Prot, NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The Multi-123 virus was received in November, 1991. It is originally
from Bulgaria. Multi-123 is a non-resident, direct action infector
of .COM programs, including COMMAND.COM.
When a program infected with Multi-123 is executed, the virus will
search the current directory and infect all .COM files it finds.
Infected programs will have a file length increase of 123 bytes
with the virus being located at the end of the infected file. The
file's date and time in the DOS disk directory will have been
updated to the system date and time when infection occurred.
The Multi-123 virus cannot recognize files that it has previously
infected. As a result, it will continue to infect already infected
files, adding additional increments of 123 bytes.
Besides file length increases and file date and time changes, an
additional symptom of a Multi-123 infection is that execution of
an infected program will result in a long period of disk access
before the requested program actually runs.
Multi-123 doesn't do anything besides replicate.