South African Friday 13. (Sept.20,1989) Entry...............: "South African Friday the 13th" virus Alias(es)...........: Miami, Munich Virus Strain........: Virus detected when.: 1987 where.: South Africa Classification......: .COM file infecting virus/Extending/Direct Length of Virus.....: 419 bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS Version/Release.....: 2.0 or higher Computer model(s)...: IBM PC,XT,AT and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Text "INFECTED" found near start of virus. Type of infection...: Virus adds itself to end of file and places a three-byte jump at the beginning. Infection Trigger...: When an infected file is run, it will infect every .COM file in the current directory, with the excep- tion of COMMAND.COM. Storage media affected: Interrupts hooked...: --- Damage..............: Every infected file run on a Friday the 13th will be deleted. Damage Trigger......: Current date, as reported by DOS. Particularities.....: ---- Similarities........: The effect is similar to that of other, unrelated viruses. VIRUS-B is a modified variant of this virus. --------------------- Agents ------------------------------------------- Countermeasures.....: All programs which check for .COM file length changes will detect infections. Simply making all .COM files read-only is effective against this virus. Countermeasures successful: Detection of infection: F-FCHK (from F.Skulason's F-PROT package) VIRUSCAN Removal: F-FCHK Standard means......: Write-protect every .COM file with "attrib +r *.COM". --------------------- Acknowledgement ---------------------------------- Location............: University of Iceland/Computing Services Classification by...: Fridrik Skulason (frisk@rhi.hi.is) Documentation by....: Fridrik Skulason Date................: Sept 20, 1989 Information Source..: --- .