F-Secure Virus Descriptions : Tanpro

This virus was distributed in usenet newsgroups in February 1996.

Tanpro uses a special way to execute the original host file: when an infected file is run, it creates a hidden file with hidden Alt-255 character as a name. The contents of the original file is then copied there and virus loads and executes this file.

After the execution of the host file the virus stays resident and infects all COM and EXE files that are executed and are smaller than 64kB.

Tanpro.524 has no activation routines: it just spreads.

VARIANT:

Tanpro.749

This virus was distributed in usenet newsgroups in March 1996.

This variant has a random activation routine: it emits a siren sound from the speaker and shakes the screen quickly. The PC continues working dispite of this effect. Otherwise it's similar to the 524 byte variant.

[Analysis: Peter Szor, F-Secure, 1996]