Europe-92 Virus

Virus Name: Europe-92 Aliases: E-92, Dutch 424, Europe-92B, Europe-1992 V Status: Rare Discovered: August, 1991 Symptoms: .COM growth; TSR; system hangs; boot failure; display message; "Invalid drive specification" message; beeping Origin: Europe Eff Length: 421 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Europe-92 virus was received in August, 1991, from Europe. This virus is a memory resident infector of .COM programs, including COMMAND.COM. When the first Europe-92 infected program is executed, Europe-92 will install itself memory resident as a low system memory TSR of 420 bytes. Interrupt 21 will be hooked by the virus. After becoming memory resident, Europe-92 will infect .COM programs, including COMMAND.COM, when they are executed. Infected programs will increase in size by 421 bytes with the virus being located at the end of the infected files. The process of infecting the program the user was attempting to execute will occassionally result in a system hang once the infection process is complete. Execution of some programs infected with Europe-92 will result in a system hang. Other programs which are expecting command line input may display the message "Invalid drive specification" and terminate their execution. Some infected programs will continue to function normally. In the year 1992, Europe-92 activates. In 1992, when the first infected program is executed the virus will repeatedly issue the following message accompanied by beeping, scrolling the screen: "Europe/92 4EVER!" This message is encrypted within the virus, and cannot be viewed in infected files. Known variant(s) of Europe-92 are: Europe-92B: Also known as Dutch 424, this variant is three bytes longer than the Europe-92 virus described above.