| Infosys | |
|---|---|
| Type | Worm |
| Creator | |
| Date Discovered | ~ 1995 |
| Place of Origin | |
| Source Language | |
| Platform | DOS |
| File Type(s) | .com |
| Infection Length | 2,259 bytes |
| Reported Costs | |
Infosys, also going by the name Info, is a rare example of a DOS worm. It plays a Friday the 13th joke on the user, causing the screen to malfunction.
Behavior
Infosys arrives as the file INFO.COM. When executed, Infosys will display the text "Reading System Information… Computer type: IBM PC". After that, it identifies the type of computer it is on and displays the message "Checking HDD controller… SCSI controller type:".
It copies itself to the directories listed in the environment path variable as Info.com. Infosys searches for .BAT files and adds the following code to the beginning:
if not exist info.com goto noinfo
info> nul
: Noinfo
On any Friday the 13th, it will cause the screen to go blank. Commands will still be processed, but nothing will show up on the screen.
Variants
The Infosys family produced a small number of variants.
Infosys.2191
The file name of this variant is INFOSYS.COM. It has some problems working in Novell DOS and DR DOS, apparently only working well under MS DOS. It displays the additional line: "InfoSystem version1.01".
Infosys.2142
This version corrects the error in the previous one. It also contains the text:
- * - INFOSYSTEM - * -
version 1.04
(C) 1995 by Ziff Co.
Other Facts
Infosys appears to be in some way related to a family of viruses known as Nutcracker.
Infosys is also the name of an Indian IT firm that is often in trouble for visa fraud and unethical use of the H-1B and B-1 visas in the United States of America.
Sources
Michael Newton. The Encyclopedia of High-Tech Crime and Crime Fighting. pp. 340-341. New York, Checkmark Books. 2004
VMag, Issue 3, Антивирусная программа - полифаг Desinfector. 1999.01.01
Описания вирусов. pg. 72
Kaspersky Labs Japan. Viruslist, Worm.DOS.Info.
Sophos, InfoSys-2133.