1452 Virus

Virus Name: 1452 Aliases: V Status: Rare Discovery: November, 1991 Symptoms: .COM file growth; unexpected error messages Origin: Unknown Eff Length: 1,452 - 1,465 Bytes Type Code: PRCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The 1452 virus was received in November, 1991. Its origin or point of original isolation is unknown. This virus is a memory resident direct action infector of .COM programs, including COMMAND.COM. The first time a program infected with 1452 is executed, the virus will infect all .COM programs located in the C: drive root directory. The virus, however, does not become memory resident at this time. Later, when the system is rebooted from the C: drive, the virus will become memory resident as part of the command interpretor. Infected programs will have a file length increase of 1,452 to 1,465 bytes with the virus being located at the end of the infected file. There are no text strings visible within the viral code in the infected files. Systems infected with 1452 may experience unexpected errors when attempting to execute programs which require command line input. For example, execution of the DOS EDLIN program with the virus memory resident will result in the error message "Invalid drive or file name", and the program will be terminated. It is unknown what 1452 does besides replicate and disrupt system operation. See: Antimon