Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
ABC (computer virus)
open-in-new
<p>ABC, discovered in October 1992, is a memory-resident, file-infecting <a href="/facts/Computer_virus/IyTC1usq">computer virus</a> which infects <a href="/facts/EXE/xgRXf4rt">EXE</a> files and may alter both <a href="/facts/COM_file/3SXSyIxa">COM</a> and <a href="/facts/EXE/xgRXf4rt">EXE</a> files. ABC activates on the <a href="/facts/Friday_the_13th/XDI6BvjF">13th day</a> of every month. </p><p>Upon infection, ABC becomes memory-resident at the top of system memory but below the 640<a href="/facts/Kilobyte/jIe6t4yv">K</a> DOS boundary and <a href="/facts/Hooking/FJlTwAmd">hooks</a> <a href="/facts/Interrupt/Mm6C4rpc">interrupts</a> 16 and 1C. The copy of <a href="/facts/Command.com/06Sz5wle">command.com</a> pointed to by the <a href="/facts/COMSPEC/xT4KTKTr">COMSPEC</a> <a href="/facts/Environment_variable/WxkrJQpP">environment variable</a> may also be altered. ABC infects/alters COM and EXE files as they are executed. </p><p>After infection, total system memory, as measured by the DOS <a href="/facts/CHKDSK/ac8yljw2">CHKDSK</a> program, will not be altered, but available free memory will have decreased by approximately 8,960 <a href="/facts/Byte/BNHUp9Qq">bytes</a>. Altered, but not infected, COM or EXE files will have 4 to 30 bytes added to their length. Infected EXE files (COM files are never infected) have a file length increase of 2,952 to 2,972 bytes, and ABC is located at the end of the infected EXE. An altered/infected file's date and time in the DOS disk directory listing may have been updated to the current system date and time when the file was altered/infected. </p><p>No text strings are visible within the viral code in infected EXE files, but the following text strings are encrypted within the initial copy of the ABC virus: </p> ABC_FFEA Minsk 8.01.92 ABC <p>ABC causes keystrokes on the compromised machine to be repeated. It seems double-letter combinations trigger this behavior, e.g. "book" becomes "boook [<i><a href="/facts/Sic/qB9MUUWF">sic</a></i>]". System hangs may also occur when some programs are executed, a likely side effect of ABC-induced corruption. </p><p>The ABC virus is not to be confused with the ABC keylogger trojan, written in 2004 by Jan ten Hove. </p>