Reaper (DOS Virus)Edit
Reaper exists in memory. It's a file infecting virus. It infects .COM and .EXE files, except COMMAND.COM and the A drive.
Upon infection, the Reaper virus becomes memory resident at the top of system memory but below the 640K DOS boundary. It hooks interrupt 21. Interrupt 12's return is not moved.
Once the Reaper virus is memory resident, it infects .COM and .EXE files, as they are copied or opened for some reason other than execution.
The following text strings are found within the viral code in all Reaper infected files:
"(c) 92, Apache Warrior, ARCV Pres."
"[ReaperMan] Apache Warrior"
It's not able to tell if the file has been infected or not, so every time a file is opened, an additional 1,072 bytes of data are added.
The only way to get infected is by using infected floppy diskettes, downloads through an online service, or networks.
Reaper originates in England. It was first detected 10/1/1992.