Nines Virus

 Virus Name:  Nines 
 V Status:    Rare 
 Discovered:  February, 1992 
 Symptoms:    .COM file growth; TSR; printer interference 
 Origin:      Unknown 
 Eff Length:  705 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, Sweep, AVTK, F-Prot, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Nines virus was submitted in February, 1992.  Its origin or 
       point of isolation is unknown.  Nines is a memory resident infector 
       of .COM programs, including COMMAND.COM. 
       The first time a program infected with the Nines virus is executed, 
       this virus will install itself memory resident as a low system 
       memory TSR of 800 bytes.  Interrupts 17 and 21 will be hooked by the 
       Nines virus in memory. 
       After the Nines virus has become memory resident, it will infect 
       .COM programs when they are executed.  If COMMAND.COM is executed, 
       it will become infected.  Programs infected with the Nines virus 
       will have a file length increase of 705 bytes.  The virus will be 
       located at the end of the program.  The file's date and time in 
       the DOS disk directory listing will not be altered.  No text strings 
       are visible within the viral code in Nines infected programs. 
       Systems infected with the Nines virus may experience interference 
       from the virus when attempting to print to the system printer. 
       Known variant(s) of Nines are: 
       Nines-706: One byte longer than the original Nines virus, this 
                  variant adds 706 bytes to the .COM programs it infects. 
                  Origin:  Unknown  May, 1992. 
       Nines-776: Nines-776 is a 776 byte variant of the Nines virus. 
                  Origin:  Unknown  May, 1992. 

Show viruses from discovered during that infect .

Main Page