"Sylvia 2.1" (5-June-1990)
Entry...............: Sylvia V2.1
Alias(es)...........: Holland Girl Virus
Virus Strain........: Sylvia
Classification......: File Virus (Not RAM-resident), infects COM-files
Length of Virus.....: 1332 bytes
--------------------- Preconditions -----------------------------------
Operating System(s).: PCDOS/MSDOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM-PC, XT, AT and compatibles
--------------------- Attributes --------------------------------------
Easy Identification.: Typical texts in Virus body (readable with
                      Hexdump-facilities) :
                           1. "39 38 39 38 4F 45 4F 52 61 59
                               1E 56 5D 5A 52 61 62" (encoded text)
                           2. 'Text-Virus V2.1'
                           3. 'Sylvia Verkade'
Type of infection...: The virus infects only COM-files with less
                      than 30 KB; it does not infect COMMAND.COM,
                      IBMBIO.COM, IBMDOS.COM.
                      1301 bytes of the virus-code are written
                      in front of and 31 bytes are written behind
                      the original code; files are only infected once,
                      because the virus checks the existence of its 
                      signature (808h) at the beginning of the file.
Infection Trigger...: When an infected file is started, the virus
                      tries to infect 5 COM-files on default drive.
Interrupts hooked...: INT24h
Damage..............: The virus displays the following message :
                      "FUCK YOU LAMER !!!! (CRLF)  system halted..."
                      and stops system by jumping into an endless loop.
                      The message is encoded in the program. In this
                      version (V2.1), the message typical for original
                      Sylvia virus ("This program is infected by a 
                      HARMLESS ... ") is NOT displayed.
Damage Trigger......: After being activated, the virus checks itself
                      by creating a check-sum of the first 144 words.
                      When the check-sum is incorrect (# 46A3h) the
                      damaging part of the virus is activated.
--------------------- Agents ------------------------------------------
Countermeasures.....: The virus will be detected by :
                             VIRSUCH 2.15 (D. Hoppenrath)
                             F-FCHK 1.08  (F. Skulason)
                             SCAN 2.3 & 3.1 (McAfee)
Countermeasures successful:  F-FCHK 1.08 successful disinfects programs
--------------------- Acknowledgement ---------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: J|rg Steindecker
Documentation by....: J|rg Steindecker
Date................: 5-June-1990

.