"Amstrad" Virus (11-June-1990)
Entry.................. "Amstrad" Virus
Alias(es).............. Pixel, V-847 Virus
Strain................. Amstrad Virus Strain
Detected: when......... Fall 1989
          where........ Reported to have been published in PIXEL
                           magazine
Classification......... Program virus, direct action, prefix
Length of Virus........ COM files increase by 847 bytes, but the
                           actual length of the virus is 591 bytes
                           (the rest is garbage).
------------------------ Preconditions-------------------------------- 
Operating System(s).... MS-DOS
Version/Release........ 2.xx and upward
Computer models........ IBM-PC's and compatibles
-------------------------- Attributes--------------------------------- 
Easy identification.... The virus contains the string "Program sick
                           error:Call doctor or buy PIXEL for cure
                           description". The virus identifies 
                           infection by checking for the string "IV"
                           at offset 3 in the COM file.
Type of infection...... A program virus that infects all COM files
                           in the current directory by prepending
                           itself to its victim. The virus will not
                           spread very quickly.
Infection trigger...... As it is a direct action virus, it will
                           only infect on run-time, but will do this
                           at any time.
Media affected......... Any logical drive that is the "current" drive
Interrupts hooked...... ---
Damage................. Denial of access
Damage trigger......... The virus carries an evolution counter that
                            is increased every time the virus is
                            executed. When the counter is above or
                            equal to 5, the virus reads the system
                            timer. If the value is odd, the virus will
                            terminate with the message described
                            above. (This is effectively a 50% chance
                            of termination.)
Particularities........ This is a rare example of a prefix program
                            virus.
Similarities........... V-345, V-299, Cancer Viruses
---------------------------- Agents----------------------------------- 
Countermeasures........ Checksumming programs will detect the changes
                           to the files.
 - ditto - successful.. V847clr by Vesselin Bontchev will successfully
                           search and clear the Amstrad, V-345 and
                           V-299 viruses, and find the Cancer virus.
Standard Means......... Believe it or not, write protecting programs
                           with ATTR will prevent the virus from
                           spreading to them.
----------------------- Acknowledgements------------------------------ 
Location............... Bulgarian Academy of Science and
                        Virus Test Center, University of Hamburg
Classification by...... Vesselin Bontchev
Documentation by....... Morton Swimmer
Date................... 11-June-1990
Information source..... ---

.