Nines Virus

Virus Name: Nines Aliases: V Status: Rare Discovered: February, 1992 Symptoms: .COM file growth; TSR; printer interference Origin: Unknown Eff Length: 705 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Nines virus was submitted in February, 1992. Its origin or point of isolation is unknown. Nines is a memory resident infector of .COM programs, including COMMAND.COM. The first time a program infected with the Nines virus is executed, this virus will install itself memory resident as a low system memory TSR of 800 bytes. Interrupts 17 and 21 will be hooked by the Nines virus in memory. After the Nines virus has become memory resident, it will infect .COM programs when they are executed. If COMMAND.COM is executed, it will become infected. Programs infected with the Nines virus will have a file length increase of 705 bytes. The virus will be located at the end of the program. The file's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code in Nines infected programs. Systems infected with the Nines virus may experience interference from the virus when attempting to print to the system printer. Known variant(s) of Nines are: Nines-706: One byte longer than the original Nines virus, this variant adds 706 bytes to the .COM programs it infects. Origin: Unknown May, 1992. Nines-776: Nines-776 is a 776 byte variant of the Nines virus. Origin: Unknown May, 1992.