Threat Description

Signs

Details

Aliases:Signs
Category:Malware
Type:Virus
Platform: W32

Summary



When an infected file is executed, the virus will install itself in memory and hook INT 21h. If the day is 5th of any month, virus will also hook INT 8h (system timer).



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



The INT 21h handler intercepts calls to DOS function 4Bh (load program). If the filename fits "*.COM" it is considered for infection. Only those files that are smaller than 62.5kB and have no EXE 'MZ' header are infected. Files which have the word 1972h at offset 3 are left alone. Nothing is done about changing file attributes so if the virus tries to infect files with read-only attribute, DOS will produce an error message.

If the day was 5th of any month, virus will trigger some time after the execution of an infected program. Depending on the video mode, the virus may cause a scrolling effect on the screen or emit a beep through the speaker.

Virus code contains a text saying 'Signs Of Life !'






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More