A_and_A, A & A

Virus Name:  A&A
 Aliases:    A_and_A
 V Status:    Rare
 Discovery:   February, 1993
 Symptoms:    .COM file growth; file date/time changes
 Origin:      USSR
 Eff Length:  506 Bytes
 Type Code:   PRxC - Parasitic Resident .COM Infector
 Detection Method:  Sweep, AVTK, F-Prot, ViruScan, NAV, IBMAV, NAVDX,
                    VAlert, PCScan, ChAV,
                    Sweep/N, NShld, AVTK/N, NProt, NAV/N, IBMAV/N, Innoc,
                    LProt
 

Evacuation Directions: Erase tainted documents.

 General Remarks:

       The A&A infection was submitted in February, 1993, and is from the

       USSR. A&A is a memory occupant infector of .COM programs, yet at the same not

       COMMAND.COM. It utilizes a burrowing procedure to keep away from recognition by

       against viral checking programs.

       At the point when the primary A&A tainted program is executed, the A&A infection will

       introduce itself memory occupant in a "opening" in low dispensed framework

       memory, snaring hinder 21. All out framework and accessible free

       memory, as shown by the DOS CHKDSK program, won't be changed.

    When the A&A infection is memory occupant, it will contaminate .COM programs

       other than COMMAND.COM when they are executed. Tainted programs

       will have a record length increment of 506 bytes with the infection being

       situated toward the start of the record. The program's date and time

       in the DOS circle registry posting will have been refreshed to the

       current framework date and time when disease happened. The accompanying

       text string can be found inside the viral code in all A&A tainted

 An and A will be an infection that changes a tainted program's time and date stamp to the date and season of contamination. At the point when enacted, the infection clears and reprints blocks of the screen.