Violetta Virus (25-Jan-1992)
Entry...............: Violetta Virus
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: January 1992
              where.: 
Classification......: Program virus, resident
Length of Virus.....: 3,840 Bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM - PC, XT, AT, upward and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: Infected files will contain the string
                         "VIOLETTA" twice (offset 2H and 202H in file)
Type of infection...: All *.COM files except COMMAND.COM when executed 
                         will be infected. The virus saves the first 
                         3,840 bytes of the host to the end of the file
                         and overwrites the first 3,840 bytes with the
                         virus code. Files smaller than 3,840 bytes 
                         are first enlarged to 3,840 bytes.
Infection Trigger...: Load and Execute of a *.COM file.
Infection targets:..: All *.COM files except COMMAND.COM
Interrupts hooked...: INT 21
Interrupts used.....: INT F1, INT FF both used, but not chained; this 
                         might cause trouble with Zenith Z100 warm 
                         boot procedure.
Damage..............: No active payload
Damage Trigger......: ---
Similarities........: ---
Particularities.....: Unusual coding, much dead code, several code
                         sections overwritten with NOPs.
--------------------- Agents -----------------------------------------
Countermeasures.....: 
- ditto - successful:
             Removal: Not always possible: correct size of files 
                         smaller than 3,840 cannot be restored. 
Standard means......:
--------------------- Acknowledgement --------------------------------
Location............: Micro-BIT Virus Center, Univ Karlsruhe, Germany
Classification by...: Christoph Fischer
Documentation by....: Christoph Fischer
Date................: January 25, 1992

.