Necrosoft Dementia Virus

Virus Name: Necrosoft Dementia Aliases: Necrosoft V Status: Rare Discovered: August, 1993 Symptoms: .COM & .EXE growth; file date/time seconds = 02 decrease in total system & available free memory; "CALLBACK.COM" and/or "!#TEMP#!" files created Origin: United States Eff Length: 4,209 - 4,223 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, NAV, NAVDX, IBMAV, AVTK, F-Prot, ChAV, NShld, NAV/N, IBMAV/N, LProt, AVTK/N, Innoc Removal Instructions: Delete infected files General Comments: The Necrosoft Dementia virus was submitted in August, 1993. It is from the United States. Necrosoft Dementia is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. When the first Necrosoft Dementia infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupt 21. Total system and available free memory will have decreased by 8,416 bytes. Interrupt 12's return will not be moved. Once the Necrosoft Dementia virus is memory resident, it will infect .COM and .EXE programs, including COMMAND.COM, when they are executed or opened. Infected programs will have a file length increase of 4,209 to 4,223 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will appear to be altered, or the time may "disappear" from the DOS Dir directory listing. The seconds field of the file date and time will have been set to "02", which is the infection marker for this virus. The following text strings are encrypted within the viral code: "!#TEMP#! REQUEST.IVA CALLFAST.COM RECEIPT.IVA CALLFAST.COM *.*" "Dementia] Copyright enterprises - All rights reserved" "I am the man that walks alone" "And when I'm walking a dark road" "At night or strolling through the park" "When the light begins to change" "I sometimes feel a little strange" "A little anxious when it's dark" The Necrosoft Dementia virus will sometimes create either one or both of the files named "!#TEMP#!" and "CALLFAST.COM". When these files are created, they are 5,183 bytes in length and contain a copy of the virus. Executing the CALLFAST.COM program will result in the virus becoming active on the system. It is unknown what damage potential this virus contains. Known variant(s) of Necrosoft Dementia are: Necrosoft Dementia-B: A later version of the Necrosoft Dementia virus, this variant's size and functional characteristics are the same as the original. Some of the text strings have been altered. The text strings encrypted within the viral code of this variant are: "!#TEMP#! REQUEST.IVA CALLFAST.COM *.*" "Dementia] Copyright Necrosoft enterprises - All rights reserved" "I am the man that walks alone" "And when I'm walking a dark road" "At night or strolling through the park" "When the light begins to change" "I sometimes feel a little strange" "A little anxious when it's dark" Origin: United States August, 1993.