Number One Virus
Virus Name: Number One
Aliases: Number 1, #1, Number One-B, Number One-Argentina
V Status: Viron
Discovered: 1987 (see below)
Symptoms: .COM files fail to function; displayed
Origin: West Germany
Eff Length: 12,032 Bytes
Type Code: ONC - Overwriting Non-Resident .COM Infector
Detection Method: ViruScan, Sweep, F-Prot, AVTK, IBMAV, VAlert,
NAV, NAVDX, ChAV,
NShld, Sweep/N, Innoc, AVTK/N, IBMAV/N, NAV/N
Removal Instructions: Delete infected files
General Comments:
The Number One virus was submitted for inclusion in this listing in
September, 1990. This virus, however, is not a new virus but is an
extinct rather "old" virus. The Number One virus was written in
October, 1987, by M. Vallen using Turbo Pascal 3.01A. It is
documented, complete with source, in a book by Ralf Burger. This
virus is an non-resident overwriting virus which infects .COM files.
When a program infected with the Number One virus is executed, the
virus will infect the first uninfected .COM file it finds in the
current directory. If the .COM file was originally less than 12,032
bytes in length, it will now have a 12,032 bytes. Infected files
will also have their date/timestamps in the directory changed to
reflect the time of infection. After Number One has finished
infecting a .COM file, it will display the message:
"This File Has Been Infected by Number One!
XXXXXXXX.COMinfected."
The XXXXXXXX is the name of the .COM file that has just been
infected by the virus. When there are no more .COM files for
Number One to infect in the current directory, it will display the
following message:
"This File Has Been Infected by Number One!
"
Number One will not infect any files which have the Read Only
Attribute set.
Since Number One is an overwriting virus, it is not possible to
remove the virus from infected files and repair the damage.
Infected files should be erased and replaced with clean copies.
Known variant(s) of Number One are:
Number One-Argentina: Similar to the Number One virus, this
variant was discovered in Argentina in June, 1992.
It overwrites the first 12,032 bytes of the .COM
programs it infects. The text string displayed
has been changed to:
"This file has been infected by Number One".
It may also change the system display video attributes
when an infected program is executed.
Origin: Argentina June, 1992.
Number One-B: Similar to the Number One virus, this variant
displays the text string "