%%File: VIRS0284.TXT
%%Name/Aliases: Datalock, Datalock 1.00, V920, Datalock 2, Datalock-1043
%%Platform: PC/MS-DOS
%%Type: Program., 
%%Disk Location: COM application., EXE application., Only .COM files > 
22999 bytes long
%%Features: Memory resident; TSR.
%%Damage: Corrupts a program or overlay files.
%%Size: 920, 1043 - Datalock-1043 variant
%%See Also: 
%%Notes: It infects all EXE files but COM files must be greater than 
22999 bytes long. If a file is opened that matches the selector *.?BF 
(.DBF files) is will give the message "Too many files open" and prevent 
access to the file.
From a report in virus-l, v4-220: system lock-ups, drop out of 
application with no messages.  Some programs would display the message 
"overlay not found" prior to dropping to DOS, a .EXE file grew by 920 
bytes during first execution and after re-installation.  Using debugger, 
found string "DataLock version 1.0".
Datalock 2 variant found in wild in DC area that is buggy(virus-l, v5-
092)
 DATALOCK 2 does NOT contain string "Datalock version 1.0"  SCAN 89b and 
FPROT 2.03a don't find Datalock 2 variant in EXE files, but original 
datalock signatures are valid and can be used to identify this variant.   
For DATALOCK 2: C3 1E A1 2C 00 50 8C D8 48 8E D8 81 2E 03 00 80 00 40 8E 
D8  

v6-151: At least one anti-virus program can detect and remove DataLock 
(920.K1150 and 1740)