No_Smoking Virus

Virus Name: No_Smoking Aliases: V Status: New Discovered: February, 1995 Symptoms: .COM file growth Origin: Unknown Eff Length: 1,575 - 1,581 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, IBMAV, AVTK, Sweep, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, IBMAV/N, AVTK/N, Sweep/N, NShld, NAV/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The No_Smoking virus was received in February, 1995. Its origin or point of isolation is unknown. No_Smoking is a non-resident, direct action infector of .COM files, including COMMAND.COM. When a program infected with the No_Smoking virus is executed, this virus will infect up to five .COM files located in the current directory. Infected .COM files will have a file length increase of 1,575 to 1,581 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the viral code: "*.* *.com" "Kamchatka/FRIDAY\" "FRIDAY" It is unknown what the No_Smoking virus does besides replicate. Known variant(s) of No_Smoking are: No_Smoking.1000: Received in July, 1995, this is a 1,000 byte variant of the No_Smoking virus described above. It may be detected as Hamburger by some anti-viral programs. This variant will infect all of the .COM files in the current directory when an infected program is executed. Infected files will have a file length increase of 1,000 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, though the seconds field will have been set to "62". The following text strings are encrypted within the viral code: "*.com" "Water detect in Co-processor !" "I am hungry ! Insert hamburger into drive A:" "No smoking, please ! Thanks." "Don't beat me!" "Attention ! Hard Disk is Radioactive " "I'm so much dirty! Clean me !" "Kiss my keyboard !" "Keep smiling !" "Warning ! In drive A: are two diskettes." "I don't understand you." "Insert tractor toilet paper into printer." "Hard Disk's head has been destroyed. Can you borrow me your one ?" "Coca-Cola is it !" "Kamchatka" "????????COM" Origin: Unknown July, 1995.