"V-277" Virus (11-June-1990)
Entry.................. "V-277" Virus
Alias(es).............. "Viki" Virus
Strain................. Amstrad Virus Strain
Detected: when......... Spring 1990
          where........ Bulgaria
Classification......... Program virus, direct action, prefix
Length of Virus........ 277 bytes
------------------------ Preconditions ------------------------------- 
Operating System(s).... MS-DOS
Version/Release........ 2.xx and upward
Computer models........ IBM-PC's and compatibles
-------------------------- Attributes -------------------------------- 
Easy identification.... The virus identifies infection by checking for
                           the string "UM" at offset 3 in the COM file
Type of infection...... A program virus that infects all COM files
                           in the current directory by prepending
                           itself to its victim.
Infection trigger...... As it is a direct action virus, it will only
                           infect on run-time, but will do this at
                           any time.
Media affected......... Any logical drive that is the "current" drive.
Interrupts hooked...... ---
Damage................. Denial of access. It also similates a RAM
                           parity error. This doesn't mean however
                           that it has destroyed the hardware.
Damage trigger......... The virus carries an evolution counter that
                           is increased every time the virus is
                           executed. When the counter is above or
                           equal to 5, the virus reads the system
                           timer. If the value is odd, the virus will
                           terminate with parity error. (This is
                           effectively a 50% chance of termination.)
Particularities........ This is a variant of the V-299 virus. It
                           is now vying for recognition as the
                           smallest known virus.
Similarities........... Amstrad, V-345, V-299, Cancer Viruses.
                           I don't know why anyone would bother to
                           modify such a stupid virus as the Amstrad.
---------------------------- Agents ---------------------------------- 
Countermeasures........ Checksumming programs will detect the changes
                           to the files.
 - ditto - successful.. ---
Standard Means......... Believe it or not, write protecting programs
                           with ATTR will prevent the virus from
                           spreading to them.
----------------------- Acknowledgements -----------------------------
Location............... Bulgarian Academy of Science and
                        University of Hamburg, Virus Test Center
Classification by...... Morton Swimmer, VTC
Documentation by....... Vesselin Bontchev            
Date................... 11-June-1990
Information source..... ---

.