Nazgul Virus


 Virus Name:  Nazgul 
 Aliases: 
 V Status:    Rare 
 Discovered:  December, 1992 
 Symptoms:    .COM file growth; programs fail to function properly; 
              boot failure 
 Origin:      The Netherlands 
 Eff Length:  266 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  AVTK, IBMAV, Sweep, F-Prot, ViruScan, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, NShld, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, 
                    LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Nazgul virus was submitted in December, 1992.  It is originally 
       from The Netherlands.  Nazgul is a non-resident, direct action 
       infector of .COM programs, including COMMAND.COM. 
 
       When a program infected with the Nazgul virus is executed, the 
       Nazgul virus will infect all of the .COM programs located in the 
       current directory.  If COMMAND.COM is located in this directory, 
       it will become infected.  Programs infected with the Nazgul virus 
       will have a file length increase of 266 bytes with the Nazgul 
       virus being located at the beginning of the file.  The program's 
       date and time in the DOS disk directory listing will not be 
       altered.  The following text string can be found within the viral 
       code in all Nazgul infected programs: 
 
               "*.COM Nazg–l" 
 
       Programs infected with the Nazgul virus will fail to function 
       properly, returning to the DOS prompt after the virus has accessed 
       the current drive current directory to infect programs.  If the 
       boot copy of COMMAND.COM becomes infected, the system will fail 
       to boot. 

Show viruses from discovered during that infect .

Main Page