T762102@DM0LRZ01.BITNET (02/06/90)
The V-847 Viruses
-----------------
This virus was imported in Bulgaria by foreigner student from
Greece. He claimed that the virus code was created and published by
the PIXEL magazine. The virus is supplied as a program in BASIC,
which when run creates a .COM-file which in fact contains the real
virus.
The virus is extremely stupid. It infects only .COM-files in
the current directory of the current drive. However, it infects *all*
these files at once. The only way to spread the virus is to run an
infected file when one of the directories listed in the PATH variable
is current. Then each time a file from this directory is run, all
files in the current directory will get infected.
The virus is not memory resident. It becomes active only when
an infected file is run.
The virus *prepends* itself in front of the infected files.
Their size increases by 847 bytes, most of which contain garbage. Each
infected file contains the generation number of the virus. There are
no effects before the 5th generation. After the 5th generation
however, when you attempt to execute an infected file, you will
succeed with probability of only 1/2 (the lowest bit of the system
timer is used as a random number generator). If the chances are
against you, you will receive the message:
"Program sick error:Call doctor or buy PIXEL for cure description"
and the program will terminate.
This virus was also hacked a bit. There are two known
mutations in Bulgaria, however they are not widely spread. In fact,
they are very rare. The first is optimized and is 345 bytes long.
The second is even more optimized. Its length is only 299 bytes.