|Place of Origin||Sophia, Bulgaria|
|File Type(s)||.com, .exe|
|Infection Length||1040-1279 bytes|
On the first time a file infected with Anthrax is executed, the virus writes itself to the hard disk partition table as well as the last few sectors of the hard disk. For this initial infection, it will not infect any files or become memory resident.
When the hard disk is booted, the virus then becomes memory resident. When a file is executed, the virus infects a file closest to the root of the hard disk. When the newly infected file is executed, it will infect another .com or .exe file, again, starting from the root of the hard drive and searching for uninfected files. If the infected file is located on a floppy drive, it may or may not infect a file.
The V2100 virus will resurrect an infection of Anthrax if Anthrax has been removed. When it finds the copy of Anthrax on the last few sectors, it places it on the partition table.
There are three text strings in the file: "(c)Damage, Inc.", "ANTHRAX" and "Софиа 1990". The last one is "Sofia", the capital of Bulgaria and home of Dark Avenger.
Andrzej Kadlof, Virus Information Bank; Matthias Jaenichen, University Hamburg, Virus Test Center. Computer Virus Catalog 1.2: Anthrax Virus. 1992.07.25
Patricia Hoffman. 40Hex, Volume 1, 40Hex Issue 3, Anthrax. 1991.10