Virus Database

Already.71

Description Already.71

The 71-bytes ALREADY.COM program that caused virus alert message by AVP is not real computer virus. Tt was written as a utility to prevent duplicate program execution and was distributed as a part of some software. This utility just checks the current date and compares it with stored data. If the date is the same (i.e. this program was ALREADY executed today), it returns errorlevel 1. Otherwise it resets those data and returns errorlevel 0. That allows to use this progr
The reason to detect this program as a computer virus is a bug in it. This program does not just update stored data, but completely overwrites the ALREADY.COM file. Moreover, it overwrites it not in the directory where ALREADY.COM is placed, but creates a copy in the current directory. As a result, if this program is in PATH, running it can spread it on the local disks and network - this utility becomes a worm creating its copies everywhere it is run. That is why AVP detects this program as "Already.71" virus.

Check other viruses! Be aware! Use Antiviral Software

Pan family

Description Pan family

These are not dangerous nonmemory resident encrypted parasitic viruses. They search for .COM files, then write themselves to the end of the file. The "Pan.1000" virus leaves a memory resident program that hooks INT 8 and plays a tune.

Pande.1520

Description Pande.1520

It is a dangerous memory resident parasitic stealth virus. It writes itself to the end of COM and EXE files that are accessed. While installing memory resident the virus scans DOS kernel, patches it, hooks INT 21h and leaves its copy in UMB memory, if it is available. If several anti-viruses (F-PROT, TBAV) or utilities (ARJ, RAR, LHA, PKZIP, CHKDISK) are run, the virus disables its stealth routines. The virus has a bug and may halt the system.
The virus contains the text strings:
pandemonium by retch
17/04/96
F-TBARRALHPKCH

Home