Virus Name: Sandwich
Aliases:
V Status: Rare
Discovery: October, 1992
Symptoms: .COM file growth; decrease in total system & available free
memory; messages; system hangs; file allocation errors
Origin: Manchester, England
Eff Length: 1,172 Bytes
Type Code: PRhC - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, NAV, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, AVTK/N, NAV/N, NProt, IBMAV/N, Innoc,
LProt
Removal Instructions: Delete infected files
General Comments:
The Sandwich virus was received in October, 1992, from Manchester,
England. Sandwich is a memory resident infector of .COM programs.
It displays messages requiring a user response in a manner similar
to the Ear virus. It does not infect COMMAND.COM.
The first time a program infected with the Sandwich virus is
executed, the Sandwich virus will install itself memory resident
at the top of system memory but below the 640K DOS boundary. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 3,008 bytes. Interrupt 21 will be
hooked by the Sandwich virus is memory.
Once memory resident, the Sandwich virus will infect .COM programs
when they are executed or opened for any reason. Infected programs
will increase in length by 1,172 bytes with the initial infection,
though the file length increase will not be visible if the virus is
memory resident. The virus will be located at the end of the file.
The program's date and time in the DOS disk directory listing will
not be altered.
Approximately one out of every six program executions will result
in the Sandwich virus displaying a message requiring a user
response. The message is:
"Which ARCV Member Likes a <sandwich> Sandwich?
Is it A. Apache Warrior
B. ICE-9
C. Slartibartfast
Select a Letter: "
The "<sandwich>" text above will be one of the following:
"Cheese, Beef Spread, Cucumber and Crisp"
"Corned Beef and Salad Cream"
"Jaffa Cake and Hamster on Rye"
If the user answers the question correctly, the virus will display
the following text, and the program the user was attempting to
execute will run:
"Well you know you`re ARCV Members."
If the user answers the question incorrectly, the virus will display
the following text, and a system hang may occur:
"Bad Luck.. Better Luck Next Time."
All of the above text is encrypted within the viral code, and thus
not visible in infected programs. The answers for the questions,
based on the sandwich types in the order indicated above, are A,
B, and then C.
Systems infected with the Sandwich virus will also notice file
allocation errors being detected on all infected files when the
Sandwich virus is memory resident.
