|Place of Origin||United States|
|File type(s)||.exe, .sys|
|Infection Length||1,409 - 1,421, 2,832 bytes*|
Invol, also known as Involuntary was the first virus to infect .sys files on DOS. Files with a .sys extension contain system settings and functions on the DOS and Windows operaing systems. MSDOS.SYS, the DOS kernel and CONFIG.SYS, the primary configuration file are some examples of important .sys files.
When a file infected with Invol is executed, the virus becomes memory resident. It may be resident when the computer boots, as .sys files may be used while booting. It will take up 2,832 bytes in memory.
If it has been executed from an .exe file, the virus will begin looking for .sys files to infect. The virus then prepends itself to the first .sys file listed in the CONFIG.SYS file. It will add 2,832 bytes to the files it finds there.
When searching for .exe files to infect, it does not look for the .exe extension, but rather the characters "MZ" at the beginning of any .exe file. The virus appends its 1,409 to 1,421 byte body to them. The virus contains texts that are visible in the .sys files that will not be visible in the .exe, as the .exe files are encrypted.
On the 14th day of any month, Invol overwrites the first ten sectors of the first FAT on drive C:. It will also display the text:
You have helped spread this virus. This is a message from your friendly neighborhood infection service. Thank you for your involuntary cooperation.
There are few reported variants of the Invol virus. One was discovered in 1992 May. The only major difference is that it is smaller, weighing in at 2,720 bytes in a .sys file and 1,348 to 1,365 bytes in an .exe. the text inside the virus has been changed to "c:\config.sys EVICE C:\vansi.sys vansi".
Patricia Hoffman. Online VSUM, Invol Virus.
Tarkan Yetiser. VIRUS-L Digest, Volume 5 : Issue 145, Info on "Invol" virus. 1992.08.26
Fileinfo.com, .SYS File Extension.