                                             
 Virus Name:  Wonderful
 Aliases:   
 V Status:    Rare
 Discovered:  January, 1992
 Symptoms:    .COM file growth; unexpected access to C: drive
 Origin:      Unknown
 Eff Length:  1,338 - 2,602 Bytes
 Type Code:   PNC - Parasitic Non-Resident .COM Infector
 Detection Method:  ViruScan, AVTK, CPAV, Novi, Sweep, UTScan, VirexPC,
                    Gobbler2, VBuster, AllSafe, ViruSafe, F-Prot, Trend,
                    NAV 2.1+, Iris, VNet, Panda, VET, Detect+, IBMAV,
                    Vi-Spy, NShld, LProt, CPAV/N, Sweep/N
 Removal Instructions:  Delete infected files

 General Comments:
       The Wonderful virus was received in January, 1992.  Its origin or
       point of original isolation is unknown.  Wonderful is a non-
       resident, direct action infect of .COM files other than COMMAND.COM.
       It is a member of the Burger family of viruses, and is based
       specifically on the VirDem virus.

       When a program infected with Wonderful is executed, the virus will
       search the C: drive directory structure to locate the first
       uninfected .COM file which is not named COMMAND.COM.  Once this
       file is found, the virus will infect it.

       Wonderful infected programs will normally have a file length
       increase of 1,336 bytes.  However, if the .COM file's original
       length was less than 1,280 bytes, the infected file's length will
       become 2,616 bytes.  Therefore, file length increases can be
       anywhere from 1,336 bytes to 2,614 bytes.  In any case, the virus
       will be located at the beginning of the infected file.  There will
       be no change to the file's date and time in the DOS disk directory
       listing.

       The following text strings can be found within the viral code in
       Wonderful infected files:

               "*.com *"
               "? ????????exe"
               "????????com"
               "*.*"
               "\V 4V2 A"
               "KILLER"
               "SOMETHING WONDERFUL"
               "HAS HAPPENED !!!"

       It is unknown if Wonderful does anything besides replicate.


       See:   Burger    VirDem    VirDem-1542

