Mutation Interrupt Virus
Virus Name: Mutation Interrupt
Aliases:
V Status: Rare
Discovery: February, 1993
Symptoms: .COM file growth; file date/time seconds set to 02;
"Divide overflow" errors; "Cannot load COMMAND, system halted"
errors; "Program too big to fit in memory" error
Origin: Unknown
Eff Length: 688 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, Sweep, NAV, IBMAV, F-Prot, AVTK,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, NAV/N, AVTK/N, IBMAV/N, Innoc, LProt
Removal Instructions: Delete infected files
General Comments:
The Mutation Interrupt virus was submitted in February, 1993. It
appears to be from North America. Mutation Interrupt is a memory
resident infector of .COM programs, including COMMAND.COM.
When the first infected program is executed, the Mutation Interrupt
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary, hooking interrupt 21. Once
memory resident, it may infect .COM programs when they are executed.
Programs infected with the Mutation Interrupt virus will have a file
length increase of 688 bytes with the virus being located at the end
of the file. The program's date and time in the DOS disk directory
will appear to be unaltered, or may have disappeared. Actually, the
seconds field in the file time will have been updated to 02. The
following text strings can be found within the viral code in all
Mutation Interrupt infected programs:
"The Mutation Interrupt Virus RABID'S Back and Kicking in `93"
"-Soltan Griss"
Systems infected with the Mutation Interrupt virus will experience
the following error messages when programs are executed with the
virus memory resident, as well as possible system hangs:
"Divide overflow"
"Cannot load COMMAND, system halted"
"Program too big to fit in memory"
Known variant(s) of Mutation Interrupt are:
Mutation Interrupt-B: A 694 byte variant of the virus described
above, this variant adds 694 bytes to .COM programs it
infects. Like the original virus, it sets the seconds
field in the file date/time to "02". The following text
string can be found within the viral code in all infected
programs:
"The Mutation Interrupt (B) Virus RABID'S Back and
Kickin' the Bucket in `93 -Soltan Griss"
System hangs frequently occur when programs are executed.
Origin: Unknown August, 1993.