"CANCER" Virus (11-June-1990)
Entry.................. "CANCER" Virus
Alias(es).............. ---
Strain................. Amstrad Virus Strain
Detected: when......... Fall 1989
          where........ Bulgaria
Classification......... Program virus, direct action, prefix
Length of Virus........ COM file will be increased by multiples of
                           740 bytes, but the actual virus is only
                           228 bytes long!
------------------------ Preconditions-------------------------------- 
Operating System(s).... MS-DOS
Version/Release........ 2.xx and upward
Computer models........ IBM-PC's and compatibles
-------------------------- Attributes--------------------------------- 
Easy identification.... An infected file will contain the string "IV"
                           at offset 3 in the COM file. Unlike the
                           other variants of Amstrad, this is never
                           used by this virus.
Type of infection...... A program virus that infects all COM files in
                           the current directory by prepending itself
                           to its victim. The virus will not spread
                           very quickly.
Infection trigger...... As it is a direct action virus, it will only
                           infect on run-time, but will do this at
                           any time.
Media affected......... Any logical drive that is the "current" drive.
Interrupts hooked...... ---
Damage................. The virus will repeatedly infect a file, until
                           it is no longer loadable (hence its name).
Damage trigger......... none, its damage is its infection and the
                           resulting file length increase.
Particularities........ ---
Similarities........... Cancer is a variant of Amstrad.
---------------------------- Agents----------------------------------- 
Countermeasures........ Checksumming programs will detect the changes
                           to the files.
 - ditto - successful.. V847clr will find Cancer as a possible variant
                           of Amstrad, but can not destroy it.
Standard Means......... Believe it or not, write protecting programs
                           with ATTR will prevent the virus from
                           spreading to them.
----------------------- Acknowledgements------------------------------
Location............... Bulgarian Academy of Science and
                        University of Hamburg, Virus Test Center
Classification by...... Vesselin Bontchev
Documentation by....... Morton Swimmer
Date................... 11-June-1990
Information source..... ---

.