Ah (computer virus)
Encyclopedia
Ah is a very buggy computer virus
which infects COM file
s including command.com
. Ah is based on the V1024 virus, and originated in Italy
in May 1991. When the first program infected with Ah is executed, Ah will install itself memory resident at the top of system memory, but below the 640K
DOS
boundary. After it is memory resident, Ah will infect .COM programs over 1K in length when they are executed. Infected programs will increase in size by 1,173 byte
s, though the file length increase will be hidden if Ah is resident. Their date and time in the DOS directory will appear to be unaltered, though if the program's original time was 12:00a, it will now be blank. The virus will be located at the beginning of infected programs. Total system and available free memory, as indicated by the DOS CHKDSK program, will decrease by 1,216 bytes. Interrupt
s 08 and 21 will be hooked by the virus. Systems infected with Ah will experience frequent system hang
s. These hangs occur when the user attempts to execute a .COM program which is infected with Ah. They may also occur when the virus attempts to infect an uninfected program. System hangs occur so frequently with Ah that the virus is very noticeable. The Ah virus activates on Tuesdays, at which time it will attempt to format the first few tracks of the system hard disk
.
The following text string is found in infected files:
Ah is believed to have been created by the same person as several other viruses from Italy, including Smack and Enigma. David Grant and the PCVRF had nothing to do with its creation.
Computer virus
A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...
which infects COM file
COM file
In many computer operating systems, a COM file is a type of executable file; the name is derived from the file name extension .COM. Originally, the term stood for "Command file", a text file containing commands to be issued to the operating system , on many of the Digital Equipment Corporation mini...
s including command.com
COMMAND.COM
COMMAND.COM is the filename of the default operating system shell for DOS operating systems and the default command line interpreter on Windows 95, Windows 98 and Windows Me...
. Ah is based on the V1024 virus, and originated in Italy
Italy
Italy , officially the Italian Republic languages]] under the European Charter for Regional or Minority Languages. In each of these, Italy's official name is as follows:;;;;;;;;), is a unitary parliamentary republic in South-Central Europe. To the north it borders France, Switzerland, Austria and...
in May 1991. When the first program infected with Ah is executed, Ah will install itself memory resident at the top of system memory, but below the 640K
Kibibyte
The kibibyte is a multiple of the unit byte for quantities of digital information. The binary prefix kibi means 1024; therefore, 1 kibibyte is . The unit symbol for the kibibyte is KiB. The unit was established by the International Electrotechnical Commission in 1999 and has been accepted for use...
DOS
DOS
DOS, short for "Disk Operating System", is an acronym for several closely related operating systems that dominated the IBM PC compatible market between 1981 and 1995, or until about 2000 if one includes the partially DOS-based Microsoft Windows versions 95, 98, and Millennium Edition.Related...
boundary. After it is memory resident, Ah will infect .COM programs over 1K in length when they are executed. Infected programs will increase in size by 1,173 byte
Byte
The byte is a unit of digital information in computing and telecommunications that most commonly consists of eight bits. Historically, a byte was the number of bits used to encode a single character of text in a computer and for this reason it is the basic addressable element in many computer...
s, though the file length increase will be hidden if Ah is resident. Their date and time in the DOS directory will appear to be unaltered, though if the program's original time was 12:00a, it will now be blank. The virus will be located at the beginning of infected programs. Total system and available free memory, as indicated by the DOS CHKDSK program, will decrease by 1,216 bytes. Interrupt
Interrupt
In computing, an interrupt is an asynchronous signal indicating the need for attention or a synchronous event in software indicating the need for a change in execution....
s 08 and 21 will be hooked by the virus. Systems infected with Ah will experience frequent system hang
Hang (computing)
In computing, a hang or freeze occurs when either a single computer program, or the whole system ceases to respond to inputs. In the most commonly encountered scenario, a workstation with a graphical user interface, all windows belonging to the frozen program become static, and though the mouse...
s. These hangs occur when the user attempts to execute a .COM program which is infected with Ah. They may also occur when the virus attempts to infect an uninfected program. System hangs occur so frequently with Ah that the virus is very noticeable. The Ah virus activates on Tuesdays, at which time it will attempt to format the first few tracks of the system hard disk
Hard disk
A hard disk drive is a non-volatile, random access digital magnetic data storage device. It features rotating rigid platters on a motor-driven spindle within a protective enclosure. Data is magnetically read from and written to the platter by read/write heads that float on a film of air above the...
.
The following text string is found in infected files:
- "(C) David Grant Virus Research 1991 PCVRF Disribuite this virus freely!!! ...ah...John...Fuck You!"
Ah is believed to have been created by the same person as several other viruses from Italy, including Smack and Enigma. David Grant and the PCVRF had nothing to do with its creation.
External links
- Computer Viruses (A), by Probert Encyclopedia
- Ah virus, by McAfee