Press Virus

Virus Name: Press Aliases: V Status: Rare Discovered: December, 1992 Symptoms: .EXE file growth; message displayed Origin: USSR Eff Length: 1,024 Bytes Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: AVTK, IBMAV, Sweep, F-Prot, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, Innoc, NProt, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Press virus was submitted in December, 1992. It is originally from the USSR. Press is a non-resident, direct action infector of .EXE programs. When a Press infected program is executed, the Press virus will infect one .EXE program located in the current directory. Infected programs will have a file length increase of 1,024 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all Press infected programs: "????????EXE" "*.EXE G" "Press any key" "\ IRUS S" The Press virus will occassionally display the following message when an infected program is executed: "Press any key" Known variant(s) of Press are: Press.B: Received in July, 1995, this is a minor variant of the press virus described above. Like the original virus, it adds 1,024 bytes to the .EXE files it infects. It does not contain any text strings. System hangs frequently occur when infected programs are executed. Origin: Unknown July, 1995.