Belgium-320 Virus

Virus Name: Belgium-320 Aliases: V Status: Rare Discovery: May, 1993 Symptoms: .COM file growth; system hangs; file date/time changes Origin: Belgium Eff Length: 320 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, AVTK, Sweep, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, NProt, AVTK/N, IBMAV/N, Innoc, NAV/N Removal Instructions: Delete infected files General Comments: The Belgium-320 virus was submitted in May, 1993, and is from Belgium. This virus is a memory resident infector of .COM programs, including COMMAND.COM. When the first Belgium-320 infected program is executed, this virus will install itself memory resident in a "hole" in allocated system memory, hooking interrupt 21. It will also access the system hard disk C: drive, though it won't infect anything on the hard disk at this time. Once the Belgium-320 virus is memory resident, it will infect .COM programs when they are executed. Infected programs will have a file length increase of 320 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text string is located very close to the end of all infected files: "COM" Unexpected system hangs may occur on infected systems when programs are executed.