Alfons Virus

 Virus Name:  Alfons 
 Aliases:     Alfons.1344 
 V Status:    In The Wild 
 Discovery:   July, 1996 
 Symptoms:    .COM & .EXE growth; TSR 
 Origin:      Unknown 
 Eff Length:  1,344 - 1,426 Bytes 
 Type Code:   PRsA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, ViruScan, PCScan, NAV, NAVDX, 
                    Innoc, AVTK/N, IBMAV/N, NShld, NAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Alfons or Alfons.1344 virus was received in July, 1996.  It has 
       been reported to be "in the wild", also in what countries is 
       unknown.  Alfons is a memory resident infector of .COM and .EXE 
       files, but not COMMAND.COM. 
       When a program infected with the Alfons virus is executed, this 
       virus will install itself memory resident as a low system memory 
       TSR of 1,680 bytes.  Interrupt 21 will be hooked by the virus in 
       Once the Alfons virus is memory resident, it will infect .COM and 
       .EXE files, other than COMMAND.COM, when they are executed.  Infected 
       .COM files will have a file length increase of 1,426 bytes with the 
       virus being located at the beginning of the file.  .EXE files 
       infected with this virus will have a file length increase of 1,344 
       to 1,358 bytes with the virus being located at the end of the file. 
       The program's date and time in the DOS disk directory listing will 
       not be altered.  The following text strings are visible within the 
       viral code: 
       It is unknown what the Alfons virus may do besides replicate. 

Show viruses from discovered during that infect .

Main Page