*********************************************
             ***   Reports collected and collated by   ***
             ***            PC-Virus Index             ***
             ***      with full acknowledgements       ***
             ***            to the authors             ***
             *********************************************
 
 
==== Computer Virus Catalog 1.2: "Do Nothing" Virus (15-Feb-1990) ====

Entry...............: The "Do Nothing" Virus
Alias(es)...........: The Stupid Virus, 640K Virus
Virus strain........: ---
Virus detected when.: 22-October-1989
              where.: BBSs in Israel
Classifications.....: COM file infecting virus/extending, resident.
Length of virus.....: Infected files grow biggen in 583 bytes.

------------------- Preconditions -----------------------------------

Operating system(s).: MS-DOS
Version/release.....: 2.0 or higher
Computer model(s)...: IBM PC,XT,AT and compatibles

------------------- Attributes --------------------------------------

Identification......: .COM files: The first 3 bytes of the infected
                              files are changed.

Type of infection...: System: The virus copies itself to 9800:100h.
                              This means that only computers with
                              640KB can be infected.  Infects other
                              programs by scanning the directory until
                              it finds a .COM file.
                      .COM files: Extends .COM files. Adds 583 bytes
                              to the end of the file.
                      .EXE files: Not infected.

Infection trigger...: The first .COM file of the current directory is
                      infected whether the file is infected or not.

Interrupts hooked...: 21h, 70h.

Damage..............: None.

Damage trigger......: ---

Particularities.....: 1. Many programs load themself to this area and
                         erase the virus from the memory.
                      2. The virus can work only on 640K systems.
                      3. It changes interrupt 70h to be the same as
                         interrupt 21. In the virus only interrupt
                         70h is used and not interrupt 21h.

--------------------- Agents ---------------------------------------

Countermeasures.....: Virus Buster and more commercial, Israeli anti
                      viral software (JIV, Turbo Anti-Virus).

Countermeasures successful: Virus Buster will locate the virus and
                            upon request, will remove it.

Standard means......: ---

--------------------- Acknowledgement -------------------------------
Classification by...: Yuval Tal (NYYUVAL@WEIZMANN.BITNET)
Documentation by....: Yuval Tal (NYYUVAL@WEIZMANN.BITNET)
Date................: December 19, 1989

===================== Donothing" Virus ==============================
 

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++