            
 Virus Name:  Casper
 Aliases:     Chameleon
 V Status:    Rare
 Discovery:   August, 1990
 Symptoms:    .COM file growth; April 1st disk corruption (see below)
 Origin:
 Eff Length:  1,200 bytes
 Type Code:   PNCK - Parasitic Non-Resident Encrypting .COM Infector
 Detection Method:  ViruScan, NAV, IBM Scan, AVTK, F-Prot, Novi, Sweep,
                    UTScan, CPAV, VirexPC, Gobbler2, VBuster, AllSafe,
                    ViruSafe, Iris, VNet, Panda, VET, Detect+, IBMAV,
                    Vi-Spy, NShld, CPAV/N, Sweep/N, LProt 1.53S+
 Removal Instructions:  NAV, or delete infected files

 General Comments:
       The Casper virus was isolated in August, 1990 by Fridrik Skulason of
       Iceland.  The origin of this virus is unknown at this time.  Casper
       is a non-resident generic infector of .COM files, including
       COMMAND.COM.

       When a program infected with the Casper virus is executed, the virus
       will attempt to infect one .COM program located in the current drive
       and directory.  Infected files will increase in length by 1,200
       bytes, with the virus's code being located at the end of the .COM
       file.

       The Casper virus contains the following message, though this message
       cannot be seen in infected programs as Casper uses a complex self-
       encryption mechanism:

             "Hi! I'm Casper The Virus, And On April 1st I'm Gonna
              Fuck Up Your Hard Disk REAL BAD! In Fact It Might Just
              Be Impossible To Recover! How's That Grab Ya! <GRIN>"

       On April 1st, when an infected program is executed, this virus will
       overwrite the first track of the drive where the infected program
       was executed from.  Later attempts to access the drive will result
       in "Sector not found" errors occurring.

       The Casper virus is based on the Vienna virus.  Unlike Vienna, it is
       self-encrypting.  Th hooked.

       Once the Casteggio virus is memory resident, it will infect .COM and
       .EXE programs when they are executed.  Infected programs will have a
       file length increase of 2,881 to 2,900 bytes with the virus being
       located at the end of the file.  The program's date and time in the
       DOS disk directory listing will not be altered.  No text strings are
       visible within the viral code in infected programs.

       It is unknown what Casteggio does besides replicate.
























