"V-299" Virus (11-June-1990)
Entry.................. "V-299" Virus
Alias(es).............. ---
Strain................. Amstrad Virus Strain
Detected: when......... Winter 1989
          where........ Bulgaria
Classification......... Program virus, direct action, prefix
Length of Virus........ 299 bytes
------------------------ Preconditions ------------------------------- 
Operating System(s).... MS-DOS
Version/Release........ 2.xx and upward
Computer models........ IBM-PC's and compatibles
-------------------------- Attributes -------------------------------- 
Easy identification.... The virus contains the string "Program sick
                           error:Call doctor or buy PIXEL for cure
                           description". The virus identifies 
                           infection by checking for the string "IV"
                           at offset 3 in the COM file.
Type of infection...... A program virus that infects all COM files
                           in the current directory by prepending
                           itself to its victim. The virus will not
                           spread very quickly.
Infection trigger...... As it is a direct action virus, it will only
                           infect on run-time, but will do this
                           at any time.
Media affected......... Any logical drive that is the "current" drive
Interrupts hooked...... ---
Damage................. Denial of access
Damage trigger......... The virus carries an evolution counter that
                           is increased every time the virus is
                           executed. When the counter is above or
                           equal to 5, the virus reads the system
                           timer. If the value is odd, the virus will
                           terminate with the message described
                           above. (This is effectively a 50% chance
                           of termination.)
Particularities........ This is an optimized variant of the V-345
                           virus. At the time of its creation it was
                           the smallest known virus.
Similarities........... Amstrad, V-345, Cancer Viruses
---------------------------- Agents ---------------------------------- 
Countermeasures........ Checksumming programs will detect the changes
                           to the files.
 - ditto - successful.. V847clr by Vesselin Bontchev will successfully
                           search and clear the Amstrad, V-345 and 
                           V-299 viruses, and find the Cancer virus.
Standard Means......... Believe it or not, write protecting programs
                           with ATTR will prevent the virus from
                           spreading to them.
----------------------- Acknowledgements ----------------------------- 
Location............... Bulgarian Academy of Science and
                        University of Hamburg, Virus Test Center
Classification by...... Morton Swimmer
Documentation by....... Vesselin Bontchev
Date................... 11-June-1990
Information source..... ---

.