davidf%CS.HW.AC.UK@ibm1.cc.lehigh.edu (David.J.Ferbrache) (06/20/89)
I have just run into a virus, that does not fit the description of any other virus that I know of. It is an .EXE file infector and does not touch .COM files. Every time an infected program is run, a random number is generated. In most cases nothing happens, but sometimes the virus will select a free cluster on the current drive, and mark it as bad. On the computer where I found it originally, 10Mbytes out of 20 had been marked as bad. This virus stays resident in memory, and hooks INT 21. When an uninfected program is run, it is first infected. This virus uses a few tricks to avoid detection, but I have not quite finished disassembling it yet. It seems to refrain from infecting programs, if disk protection software is installed. This virus does not appear to be a modification of the other .EXE infectors that I know of (Jerusalem & April-1), but I am not quite sure of it, since I do not have a copy of those viruses. If you have heard of this virus please let me know. I will distribute a report, when I have finished disassembling the virus. (Quite a job, since it is very large).