Necro Fear Virus
Virus Name: Necro Fear
V Status: Rare
Discovered: November, 1992
Symptoms: .COM file growth; system hangs
Origin: United States
Eff Length: 1,823 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, NAV, IBMAV, AVTK,
NAVDX, VAlert, ChAV, PCScan,
NShld, Sweep/N, NAV/N, AVTK/N, NProt, IBMAV/N, Innoc
Removal Instructions: Delete infected files
The Necro Fear virus was submitted in November, 1992. It is from
the United States. Necro Fear is a memory resident infector of
.COM programs, including COMMAND.COM.
When the first Necro Fear infected program is executed, the Necro
Fear virus will install itself memory resident in low available
system memory, hooking interrupts 21 and 2F. Total system and
available free memory, as indicated by the DOS CHKDSK program, will
not be altered.
Once the Necro Fear virus is memory resident, it will infect .COM
programs, including COMMAND.COM, when they are executed. Infected
programs will have a file length increase of 1,823 bytes with the
virus being located at the end of the file. The program's date and
time in the DOS disk directory listing will not be altered. The
following text strings are encrypted within the viral code:
"I am afraid that you have been bitten by the FEAR"
"bug. Just think, you may have passed in on to all of"
"your friends! What fun that will be when it goes off"
"all of their systems!"
"FEAR Copyright (c) 1992 NecroSoft Technologies"
"The Metropolis of Sodium Chloride in Hydrogeon Dioxide"
System hangs frequently occur on Necro Fear infected systems.