Number One Virus

 Virus Name:  Number One 
 Aliases:     Number 1, #1, Number One-B, Number One-Argentina 
 V Status:    Viron 
 Discovered:  1987 (see below) 
 Symptoms:    .COM files fail to function;  displayed 
 Origin:      West Germany 
 Eff Length:  12,032 Bytes 
 Type Code:   ONC - Overwriting Non-Resident .COM Infector 
 Detection Method:  ViruScan, Sweep, F-Prot, AVTK, IBMAV, VAlert, 
                    NAV, NAVDX, ChAV, 
                    NShld, Sweep/N, Innoc, AVTK/N, IBMAV/N, NAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Number One virus was submitted for inclusion in this listing in 
       September, 1990.  This virus, however, is not a new virus but is an 
       extinct rather "old" virus.  The Number One virus was written in 
       October, 1987, by M. Vallen using Turbo Pascal 3.01A.  It is 
       documented, complete with source, in a book by Ralf Burger.  This 
       virus is an non-resident overwriting virus which infects .COM files. 
       When a program infected with the Number One virus is executed, the 
       virus will infect the first uninfected .COM file it finds in the 
       current directory.  If the .COM file was originally less than 12,032 
       bytes in length, it will now have a 12,032 bytes.  Infected files 
       will also have their date/timestamps in the directory changed to 
       reflect the time of infection.  After Number One has finished 
       infecting a .COM file, it will display the message: 
               "This File Has Been Infected by Number One! 
       The XXXXXXXX is the name of the .COM file that has just been 
       infected by the virus.  When there are no more .COM files for 
       Number One to infect in the current directory, it will display the 
       following message: 
                "This File Has Been Infected by Number One! 
       Number One will not infect any files which have the Read Only 
       Attribute set. 
       Since Number One is an overwriting virus, it is not possible to 
       remove the virus from infected files and repair the damage. 
       Infected files should be erased and replaced with clean copies. 
       Known variant(s) of Number One are: 
       Number One-Argentina: Similar to the Number One virus, this 
                     variant was discovered in Argentina in June, 1992. 
                     It overwrites the first 12,032 bytes of the .COM 
                     programs it infects.  The text string displayed 
                     has been changed to: 
                     "This file has been infected by Number One". 
                     It may also change the system display video attributes 
                     when an infected program is executed. 
                     Origin:  Argentina  June, 1992. 
       Number One-B: Similar to the Number One virus, this variant 
                     displays the text string "" in place of the 
                     ASCII character after all .COM programs have been 
                     infected and another infected program is executed. 
                     Origin:  Unknown  January, 1992. 
       See:   AIDS 

Show viruses from discovered during that infect .

Main Page