No Frills Virus
Virus Name: No Frills
Aliases: No Frills.813.A
V Status: Rare
Discovered: April, 1992
Symptoms: .COM & .EXE growth; decrease in total system & available free
memory; system hangs
Origin: Australia
Eff Length: 813 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, NAV, NAVDX, VAlert,
IBMAV, ChAV,
NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc
Removal Instructions: Delete infected files
General Comments:
The No Frills virus was submitted in April, 1992. Its origin or
point of isolation was Australia. No Frills is a memory resident
infector of .COM and .EXE programs, including COMMAND.COM.
When the first No Frills infected program is executed, the No Frills
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. Interrupt 12's return will
not be moved. Total system and available free memory, as measured
by the DOS CHKDSK program, will have decreased by 2,048 bytes.
Interrupt 21 will be hooked by No Frills in memory. Also at this
time, the No Frills virus will infect COMMAND.COM if it was not
previously infected.
Once the No Frills virus is memory resident, it will infect .COM
and .EXE programs when they are opened, executed, or copied.
Infected programs will have a file length increase of 813 bytes
with the virus being located at the end of the infected file. The
program's date and time in the DOS disk directory listing will not
have been altered.
The following text string can be found within the viral code in all
No Frills infected programs:
"-No Frills by Harry McBungus-"
Systems infected with No Frills may experience system hangs when
the user attempts to execute anti-viral programs with the virus
memory resident.
Known variant(s) of No Frills are:
No Frills 1.01: A later version of the No Frills virus, this
variant decreases total system and available free
memory by 1,536 bytes, also hooking interrupt 21.
Infected programs will have a file length increase
of 815 bytes with the virus located at the end of
the infected file. The text string in the virus
has been changed to:
"-No Frills 1.01 by Harry McBungus-"
No Frills 1.01 does not hang the system when the
user attempts to execute anti-viral programs with
the virus memory resident.
Origin: Australia April, 1992.
No Frills 2.0: A later version of the No Frills 1.01 variant,
infected programs will have a file length increase
of 843 bytes with the virus located at the end of
the infected file. The text strings in the virus
has been changed to:
"+-No Frills 2.0 by Harry McBungus-+"
Origin: Australia October, 1992.
No Frills 3.0: A later version of the No Frills 2.0 variant,
infected programs will have a file length increase
of 835 bytes with the virus located at the end of
the infected file. The text strings in the virus
has been changed to:
"+-NF3.0-H.McB- [PuKE] -+"
"=EXt.=COt-"
Systems infected with No Frills 3.0 may experience
system hangs when an infected program is executed.
Origin: Queensland, Australia June, 1992.
No Frills-1358: A later version of the No Frills virus, this
variant decreases total system and available free
memory by 2,048 bytes, hooking interrupts 09 and 21.
Infected programs will have a file length increase
of 1,358 bytes with the virus located at the end of
the infected file. The text strings visible within
the viral code have been changed to:
"Kcat 3.01 % 5%"
"By Sir Twist & Thunderbird, with Many Thankz to
Harry McBungus whose coded we politely nicked."
"c:\win386.dat"
No Frills-1358 may hang the system when the
user attempts to execute anti-viral programs with
the virus memory resident.
Origin: Australia September, 1993.
NoFrills.813.B: Received in July, 1995, this is a minor variant
of the No Frills virus described above. It does not
infect files on copy. It contains the same text
string as the original virus.
Origin: Unknown July, 1995.