Virus Name: Newcom
V Status: Rare
Discovered: July, 1991
Symptoms: .COM & .EXE growth; decrease in total system and available
Eff Length: 3,045 - 3,060 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV,
IBMAV, NAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, LProt, Innoc, NProt, IBMAV/N,
Removal Instructions: Delete infected files
The Newcom virus was isolated in July, 1991. Its origin is
unknown. Newcom is a memory resident infector of .COM and .EXE
files, including COMMAND.COM.
When the first program infected with Newcom is executed, the virus
will install itself memory resident at the top of system memory
but below the 640K DOS boundary. Total system and available free
memory, as measured by the DOS CHKDSK program, will decrease by
3,312 bytes. Interrupts 1C and 21 are hooked by the virus.
Interrupt 12's return is not moved.
After becoming memory resident, Newcom will infect .COM and .EXE
programs when they are executed. If COMMAND.COM is executed, it
will become infected. Infected programs increase in size by 3,045
to 3,060 bytes with the virus being located at the end of the
infected file. The file's date and time in the DOS disk directory
will not be altered by the virus.
It is unknown what Newcom does besides replicate.