Home > Threat descriptions >

Sandrine

Classification

Category: Malware

Type: Virus

Aliases: Sandrine

Summary


Sandrine, a simple companion virus, spread through a file called 486up.com which was supposed to improve a 486's performance by 20 to 30%. Instead, it contained a simple 445 bytes long companion virus.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


Sandrine took advantage of the fact that the DOS EXEC loader executes a COM file before executing a similarly named EXE file if both files are found in the same directory. Sandrine virus has an activation routine, during which it creates a file called SANDRINE.COM. This file contains the text:

Sandrine Baillieux thoughts of you are in my mind
 (c) 1994 by BrokenHeart

It seems that BrokenHeart was twice unlucky: Sandrine was detected by a F-Secure anti-virus scanner in heuristic mode.