NAME: Tai-Pan
ALIAS: Whisper
TYPE: Resident, EXE-files
SIZE: 438
ORIGIN: Sweden

Tai-Pan.438.A was first discovered in Sweden during the summer
1994. It has since spread to Europe, USA, Canada and also New Zealand.

Tai-Pan is quite a simple virus. It stays resident in memory
and infects nearly all executed EXE files. It will not
infect files that are larger than 64kB. Infected files grow
by 438 bytes. Tai-Pan does not do anything apart from
spreading itself, but it will make the infected machine
unstable.

Tai-Pan is also known as Whisper. This is due to the text it
contains `[Whisper presenterar Tai-Pan]'.


VARIANT: Tai-Pan.666
ALIAS: DOOM_II_Death, D2D
SIZE: 666

This minor variant was found from Belgium in November 1994.
After that it has been found in at least Scandinavia and Canada.

It contains the following text strings:

  DOOM2.EXE 
  Illegal DOOM II signature
  Your version of DOOM2.EXE matches the illegal RAZOR release of DOOM2
  Say bye-bye HD
  The programmer of DOOM II DEATH is in no way affiliated with ID software.
  ID software is in no way affiliated with DOOM II DEATH.

Despite the above text, Tai-Pan.666 never activates. It just spreads.


VARIANT: Tai-Pan.434
SIZE: 434

This is a minor variant of the original 438 byte version. It contains
the text "CoSmO".


VARIANT: Tai-Pan.513
ALIAS: Hooze
SIZE: 513

This variant got widespread during the Assembly'96 party in August 1996,
as it was attached to a version of a demo called STROKE.EXE.

This version is pretty much like the original Tai-Pan (it infects only
small EXE files), except it has an activation routine. On the 5th of August
the virus starts to rabidly flash the screen colors between black and
white (strobo-effect). This is done in the background.

The virus contains this text:

        [Hooze Virus 1.0 (Tai-Pan clone)]

[Analysis: Mikko Hypponen, Data Fellows Ltd's F-PROT Professional Support]
