Polish 529 Virus

Virus Name: Polish 529 Aliases: 529, P529, Piter, Piter2 V Status: Rare Discovered: September, 1990 Symptoms: .COM growth; TSR Origin: Poland Eff Length: 529 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Polish 529 virus was isolated in September, 1990 in Poland. This virus is a memory resident infector of .COM files. It will infect COMMAND.COM if it is executed with the virus in memory. The first time a program infected with the Polish 529 virus is executed, the virus will install itself memory resident as a low system memory TSR of 1,664 bytes. Interrupt 21 will be hooked by the virus. Once the virus is memory resident, any .COM file over approximately 1600 bytes in length will be infected by the virus. Infected .COM files will show a file length increase of 529 bytes and have the virus's code located at the beginning of the file. This virus does not appear to do anything but replicate. Known variant(s) of Polish 529 are: Polish 529B: Based on the Polish 529 virus described above, the major difference with this variant is that its memory resident TSR is 1,648 bytes in size. Origin: Unknown July, 1992.