Virus Name: NaziPhobia
V Status: Viron
Discovered: January, 1993
Symptoms: .EXE file corruption; file date/time changes; message;
programs fail to execute properly
Origin: United States
Eff Length: 4,240 Bytes OW
Type Code: ONE - Non-Resident Overwriting .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, IBMAV, Sweep,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, AVTK/N, Sweep/N, NProt, IBMAV/N, NAV/N, LProt,
Removal Instructions: Delete infected files
The NaziPhobia virus was submitted in January, 1993, and appears to
be from the United States. NaziPhobia is a non-resident direct
action infector of .EXE programs. It permanently corrupts the
programs it infects.
When a program infected with the NaziPhobia virus is executed, the
NaziPhobia virus will infect one .EXE file in the current directory,
but not the first .EXE file in the directory. Infected programs
will have the first 4,240 bytes of the host file overwritten by the
NaziPhobia viral code. The files will not increase in length unless
they were originally smaller than 4,240 bytes in length, in which
case they will become 4,240 bytes in length. The program's date and
time in the DOS disk directory listing will have been updated to the
current system date and time.
The NaziPhobia virus activates on any Friday. On Fridays, execution
of an infected program will result in the following message being
displayed and the user returned to the DOS prompt.
'ON THE SABBATH.. THE GHOST OF HITLER SPEAKS :
"MY FELLOW NAZI'S.. I WAS WRONG.."
"I NOW COMMAND YOU TO COMMIT SUICIDE.. NOT GENOCIDE.."
"DO IT.. SO THE WORLD WILL BE RID OF THE NAZIPEST..
"AND ALL AUSLANDER CAN TRUELY BE FREE OF NAZIPHOBIA..
NaZiPhobia (c) [VooDoo].. We support the message..'
The text strings from the above message are visible within the viral
code in all NaziPhobia infected programs.