This is a group of viruses that are very similar in structure.
The virus family is known as Moose. There are four known variants,
all of which contain the word 'Moose' in the code. The viruses
also contain a version number, much like the Yankee Doodle family.
All viruses in the Moose family infect program files by appending the
viral code to the original file. Different variants infect different
types of files, either COM, EXE or SYS. When the virus infects a SYS
file it overwrites the file's header information. Infected SYS files
crash the computer.
Moose viruses are not memory-resident. They only infect files when
run. The virus tries to find a suitable program in the current
directory, and if there are no files to infect, it switches one
level up and tries again. It repeates this until it reaches the root
directory of the drive.
When a suitable file is found, Moose appends its code in the file and
modifies the entry point of the file. Besides this Moose may change
one byte somewhere in the host file.
The result of this one-byte corruption is always unknown. Usually
it does not affect the program in any way but sometimes it causes
the program to crash at runtime. The virus uses the computer's real
time clock to decide whether to corrupt a byte in the host file or
not. In most cases the corrupted program is not repairable. It has
to be restored from a backup copy or the original setup media.
The Moose viruses were found in Gothenburg, Sweden in 1993. They
were discovered at the local university which may mean that the author
was a student at the university.
