2153 Virus

Virus Name: 2153 Aliases: V Status: Rare Discovery: July, 1992 Symptoms: .COM & .EXE file growth; TSR Origin: Unknown Eff Length: 2,153 - 2,217 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAV, NAVDX, VAlert, ChAV, NShld, Sweep/N, AVTK/N, IBMAV/N, Innoc, NAV/N Removal Instructions: Delete infected files General Comments: The 2153 virus was submitted in July, 1992. Its origin or point of isolation is unknown. This virus is a memory resident infector of .COM and .EXE programs. It does not infect COMMAND.COM. The first time a program infected with the 2153 virus is executed, the 2153 virus will install itself memory resident as a low system memory TSR of 2,672 bytes. Interrupt 22 will be hooked by the virus in memory. Once the 2153 virus is memory resident, it will infect .COM and .EXE programs when they are executed. Infected .COM programs will have a file length increase of 2,153 to 2,168 bytes. Infected .EXE programs will have a file length increase of 2,203 to 2,217 bytes. In both cases the virus will be located at the end of the file. The infected program's date and time in the DOS disk directory listing will not be altered. It is unknown what 2153 does besides replicate.