Virus Name: Multi-Face
V Status: Rare
Discovered: January, 1992
Symptoms: .COM file growth; TSR; file date/time changes; smiley face
characters moving on display; write protect errors;
Eff Length: 1,441 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: Sweep, ViruScan, F-Prot, AVTK, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Multi-Face virus was submitted in January, 1992. Its origin
or point of original isolation is unknown. Multi-Face is a memory
resident infector of .COM programs, including COMMAND.COM.
The first time a program infected with the Multi-Face virus is
executed, this virus will install itself memory resident in low
available system memory. Memory mapping utilities may indicate
that the Config area of memory has increased in size by 1,456
bytes. The DOS CHKDSK program will indicate that available free
memory has decreased by approximately 64K in addition to the 1,456
bytes in size by the virus. Interrupts 08, 13, and 21 will be
hooked by the Multi-Face virus in memory.
After the Multi-Face virus is memory resident, it will infect
.COM programs, including COMMAND.COM, when they are executed.
Infected programs will have a file length increase of 1,441 bytes
with the virus being located at the end of the infected file.
The file's date and time in the DOS disk directory listing will
have been updated to the current system date and time.
Symptoms of an infection of the Multi-Face virus are that a minor
system slowdown will have occurred. The slowdown is most noticable
when the system display is scrolled. .COM program date and time
in the DOS disk directory listing will have been updated when
programs are executed if the system date is different from the
program date. Write protect errors will occur when attempting to
execute .COM programs on write protected diskettes. Lastly,
multiple smiley face characters may appear on the system display,
moving around the other characters on the screen.