%%File: VIRS0099.TXT
%%Name/Aliases: 4096, Century, Century Virus,100 Years Virus, Frodo, 
IDF, Stealth
%%Platform: PC/MS-DOS
%%Type: Program., Encrypted/Stealth The virus actively hides., 
%%Disk Location: COM application., EXE application., Program overlay 
files., COMMAND.COM
%%Features: Encrypted, Direct acting.
%%Damage: Interferes with a running application., Corrupts a program or 
overlay files., Corrupts a data file., Corrupts the file linkages or the 
FAT.
%%Size: 4096 bytes increase in length, but hidden from the DIR cmd.
%%See Also: 
%%Notes: It infects both .COM or .EXE applications. It is nearly 
impossible to detect once it has been installed since it actively hides 
itself from the scanning packages. Whenever an application such as a 
scanner accesses an infected file, the virus disinfects it on the fly. 
DIR will also not show the change in length.
virus-l, v5-063: tries to place a new boot sector over the orig. on Sept 
21 but the code to do this is garbled, so the computer will hang.
v6-084: Frodo can infect certain types of non-executable files  Almost 
none.
The computer will hang at a Get Dos Version call when the date is after 
9/22 and before 1/1 of next year.
virus-l, v5-063: report that this virus will Activate on Sept 21.   
Compare file lengths with DIR and a Disk editor like Norton utilities. 
If they differ by 4096 you have the virus. If the date of the file is 
20XX (XX being the last 2 digits of the original date) then the file has 
probably been infected by the 4096 virus  Copying a file to a file with 
a non-executable extension results in a disinfected file because the 
virus removes itself when the file is copyed by COMMAND.COM.
A Do-it-yourself way: Infect system by running an infected file, 
ARC/ZIP/LHARC/ZOO all infected .COM and .EXE files, boot from uninfected 
floppy, and UNARC/UNZIP/LHARC E etc. all files. Pay special attention to 
disinfection of COMMAND.COM.
v6-151: At least one anti-virus program can detect and remove Frodo (F, 
G, and H)