%%File: VIRS0802.TXT
%%Name/Aliases: Vienna 348
%%Platform: PC/MS-DOS
%%Type: Program., 
%%Disk Location: COM application.
%%Features: Memory resident; TSR.
%%Damage: Corrupts a program or overlay files., Interferes with a 
running application.
%%Size: 348
%%See Also: 
%%Notes: The time stampof an infected file is changed:  the seconds are 
set to 62 (= 2 * 1Fh).  When infected file is executed, .COM-files  in 
the current directory as well as in the  directories in the DOS-PATH are 
extended  by appending the viral code; no infection  if the filesize<10 
or filesize>64000 bytes.
 A selected .COM-file is infected by "random" IF (system seconds AND 7) 
<> 0 ELSE damaged!
 INT 24h diverted to own error-handler only  during virus-runtime to 
suppress  error-messages send out by DOS.
 A selected .COM-file is damaged permanently: Overwriting the first five 
bytes with a far jump to the HD-low-level-format- routine (XT only).
The virus ignores READ-ONLY and HIDDEN attributes;  A branch to the low 
level format routine on an XT when a program is run.   Bytes found in 
virus = EAh,06h,00h,00h,C8h;
text found: "*.COM",00h,"PATH=".
Seconds time stamp changed to 62