Virus Name: No_Smoking
V Status: New
Discovered: February, 1995
Symptoms: .COM file growth
Eff Length: 1,575 - 1,581 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, IBMAV, AVTK, Sweep, ViruScan, NAV,
NAVDX, VAlert, PCScan, ChAV,
IBMAV/N, AVTK/N, Sweep/N, NShld, NAV/N, Innoc 4.0+
Removal Instructions: Delete infected files
The No_Smoking virus was received in February, 1995. Its origin
or point of isolation is unknown. No_Smoking is a non-resident,
direct action infector of .COM files, including COMMAND.COM.
When a program infected with the No_Smoking virus is executed,
this virus will infect up to five .COM files located in the
current directory. Infected .COM files will have a file length
increase of 1,575 to 1,581 bytes with the virus being located at
the end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text strings
are encrypted within the viral code:
It is unknown what the No_Smoking virus does besides replicate.
Known variant(s) of No_Smoking are:
No_Smoking.1000: Received in July, 1995, this is a 1,000 byte
variant of the No_Smoking virus described above. It may be
detected as Hamburger by some anti-viral programs. This
variant will infect all of the .COM files in the current
directory when an infected program is executed. Infected files
will have a file length increase of 1,000 bytes with the virus
being located at the end of the file. The program's date and
time in the DOS disk directory listing will not appear to be
altered, though the seconds field will have been set to "62".
The following text strings are encrypted within the viral code:
"Water detect in Co-processor !"
"I am hungry ! Insert hamburger into drive A:"
"No smoking, please ! Thanks."
"Don't beat me!"
"Attention ! Hard Disk is Radioactive "
"I'm so much dirty! Clean me !"
"Kiss my keyboard !"
"Keep smiling !"
"Warning ! In drive A: are two diskettes."
"I don't understand you."
"Insert tractor toilet paper into printer."
"Hard Disk's head has been destroyed. Can you borrow me
your one ?"
"Coca-Cola is it !"
Origin: Unknown July, 1995.