F-Secure: Be Sure
Main
F-Secure Logo - Be Sure
Select local site


Privacy Policy
Legal Notices
Contact Us

F-Secure Virus Descriptions : Sandrine





NAME:Sandrine
TYPE:Companion
SIZE:445
REPAIR:Yes

Sandrine, a simple companion virus, spread through a file called 486up.com which was supposed to improve a 486's performance by 20 to 30%. Instead, it contained a simple 445 bytes long companion virus.

Sandrine took advantage of the fact that the DOS EXEC loader executes a COM file before executing a similarly named EXE file if both files are found in the same directory. Sandrine virus has an activation routine, during which it creates a file called SANDRINE.COM. This file contains the text:

        Sandrine Baillieux thoughts of you are in my mind
        (c) 1994 by BrokenHeart

It seems that BrokenHeart was twice unlucky: Sandrine was detected by a F-Secure anti-virus scanner in heuristic mode.