Alfons Virus

Virus Name: Alfons Aliases: Alfons.1344 V Status: In The Wild Discovery: July, 1996 Symptoms: .COM & .EXE growth; TSR Origin: Unknown Eff Length: 1,344 - 1,426 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, AVTK, IBMAV, ViruScan, PCScan, NAV, NAVDX, ChAV, Innoc, AVTK/N, IBMAV/N, NShld, NAV/N Removal Instructions: Delete infected files General Comments: The Alfons or Alfons.1344 virus was received in July, 1996. It has been reported to be "in the wild", also in what countries is unknown. Alfons is a memory resident infector of .COM and .EXE files, but not COMMAND.COM. When a program infected with the Alfons virus is executed, this virus will install itself memory resident as a low system memory TSR of 1,680 bytes. Interrupt 21 will be hooked by the virus in memory. Once the Alfons virus is memory resident, it will infect .COM and .EXE files, other than COMMAND.COM, when they are executed. Infected .COM files will have a file length increase of 1,426 bytes with the virus being located at the beginning of the file. .EXE files infected with this virus will have a file length increase of 1,344 to 1,358 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code: "rjS" "SNLW" "MQE" "iutt99>,50" It is unknown what the Alfons virus may do besides replicate.