Multi-Face Virus

 Virus Name:  Multi-Face 
 Aliases:     MFace 
 V Status:    Rare 
 Discovered:  January, 1992 
 Symptoms:    .COM file growth; TSR; file date/time changes; smiley face 
              characters moving on display; write protect errors; 
              system slowdown 
 Origin:      Unknown 
 Eff Length:  1,441 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM Infector 
 Detection Method:  Sweep, ViruScan, F-Prot, AVTK, NAV, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Multi-Face virus was submitted in January, 1992.  Its origin 
       or point of original isolation is unknown.  Multi-Face is a memory 
       resident infector of .COM programs, including COMMAND.COM. 
       The first time a program infected with the Multi-Face virus is 
       executed, this virus will install itself memory resident in low 
       available system memory.  Memory mapping utilities may indicate 
       that the Config area of memory has increased in size by 1,456 
       bytes.  The DOS CHKDSK program will indicate that available free 
       memory has decreased by approximately 64K in addition to the 1,456 
       bytes in size by the virus. Interrupts 08, 13, and 21 will be 
       hooked by the Multi-Face virus in memory. 
       After the Multi-Face virus is memory resident, it will infect 
       .COM programs, including COMMAND.COM, when they are executed. 
       Infected programs will have a file length increase of 1,441 bytes 
       with the virus being located at the end of the infected file. 
       The file's date and time in the DOS disk directory listing will 
       have been updated to the current system date and time. 
       Symptoms of an infection of the Multi-Face virus are that a minor 
       system slowdown will have occurred.  The slowdown is most noticable 
       when the system display is scrolled.  .COM program date and time 
       in the DOS disk directory listing will have been updated when 
       programs are executed if the system date is different from the 
       program date.  Write protect errors will occur when attempting to 
       execute .COM programs on write protected diskettes.  Lastly, 
       multiple smiley face characters may appear on the system display, 
       moving around the other characters on the screen. 

Show viruses from discovered during that infect .

Main Page