Null-178 Virus

Virus Name: Null-178 Aliases: V Status: Rare Discovered: April, 1992 Symptoms: .COM file growth; attempts to write to PRN device; file date/time change Origin: Unknown Eff Length: 178 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: AVTK, ViruScan, F-Prot, Sweep, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, LProt, Innoc, NProt, IBMAV/N, AVTK/N, NAV/N Removal Instructions: Delete infected files General Comments: The Null-178 virus was submitted in April, 1992. Its origin is unknown. This virus is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Null-178 virus is executed, the virus will check the first five .COM files in the current directory, and infect them if they were not previously infected. Once these first five .COM files are infected, it will not infect other .COM files located further down in the directory. Programs infected with the Null-178 virus will have a file length increase of 178 bytes with the virus being located at the end of the infected program. The file's date and time in the DOS disk directory listing will have been updated to the system date and time when infection occurred. One text string can be found within the viral code of the Null-178 virus: "*.com" Systems infected with Null-178 may notice that the virus will occassionally attempt to write to system device PRN. If the system does not have an attached printer, and error message will occur in DOS.