Ohm Virus

 Virus Name:  Ohm 
 Aliases:     Ohm.777 
 V Status:    New 
 Discovered:  July, 1995 
 Symptoms:    .COM & .EXE growth; DOS CHKDSK file allocation errors; 
              100 years added to file date; 
              decrease in total system & available free memory 
 Origin:      Unknown 
 Eff Length:  777 Bytes 
 Type Code:   PRtAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method: F-Prot, AVTK, VAlert, Sweep, NAV, NAVDX, IBMAV, 
                   ViruScan, ChAV, 
                   Sweep/N, NAV/N, NShld, IBMAV/N, AVTK/N, NProt, Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Ohm virus was received in July, 1995.  Its origin or point of 
       isolation is unknown.  Ohm is a memory resident infector of .COM 
       and .EXE files, including COMMAND.COM.  It does not infect very 
       small .COM and .EXE files. 
       When the first Ohm infected program is executed, this virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary, moving interrupt 12's return.  Total system 
       and available free memory, as indicated by the DOS CHKDSK program 
       from DOS 5.0, will have decreased by 1,024 bytes.  Interrupt 21 will 
       be hooked by the virus in memory. 
       Once the Ohm virus is memory resident, it will infect .COM and .EXE 
       programs, including COMMAND.COM, when they are executed.  Infected 
       programs will have a file length increase of 777 bytes, though this 
       file length increase will be hidden when the virus is memory 
       resident.  The file's date and time in the DOS disk directory listing 
       may not appear to be altered, though 100 years will have been added 
       to the file's date.  The following text string is visible within 
       the viral code in all infected programs: 
       The DOS CHKDSK program will indicate file allocation errors on all 
       infected programs when the Ohm virus is memory resident. 

Show viruses from discovered during that infect .

Main Page