Big-2000 Virus

Virus Name: Big-2000 Aliases: V-1391 V Status: Rare Discovery: March, 1993 Symptoms: .EXE file growth; file date/time change; TSR Origin: Unknown Eff Length: 2,000 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: Sweep, AVTK, ViruScan, F-Prot, NAV, NAVDX, VAlert, ChAV, Sweep/N, NShld, AVTK/N, NAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Big-2000, or V-1391, virus was submitted in March, 1993. Its origin or point of isolation is unknown. Big-2000 is a memory resident infector of large .EXE files. When the first Big-2000 infected program is executed, the Big-2000 virus will become memory resident as a low system memory TSR of 2,848 bytes, hooking interrupts 01 and 18. Once the Big-2000 virus is memory resident, it will infect .EXE files larger than approximately 60K in size, when they are executed. Infected programs will have a file length increase of 2,000 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. No text strings are visible within the viral code in Big-2000 infected programs. It is unknown what Big-2000 does besides replicate.