Meta-2048 Virus

Virus Name: Meta-2048 Aliases: V Status: Rare Discovered: May, 1993 Symptoms: .COM & .EXE growth; DOS CHKDSK file allocation errors; decrease in total system & available free memory Origin: Unknown Eff Length: 2,048 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, IBMAV, AVTK, F-Prot, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, AVTK/N, LProt, IBMAV/N, Innoc, NAV/N Removal Instructions: Delete infected files General Comments: The Meta-2048 virus was submitted in May, 1993. Its origin or point of isolation is unknown. Meta-2048 is a memory resident infector of .COM and .EXE programs larger than 2K, including COMMAND.COM. When the first Meta-2048 infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupts 09, 1C, and 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 8,336 bytes. Interrupt 12's return will not be moved. Once the Meta-2048 virus is memory resident, it will infect .COM and .EXE programs larger than approximately 2K in size when they are executed. Infected programs will have a file length increase of 2,048 bytes. The virus will be located at the beginning of .COM programs, and the end of .EXE files. The file length increase will be hidden on files which were infected after the virus became memory resident, but not on those files which were infected before the virus became memory resident the last time. The infected file's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the Meta-2048 viral code: "Producte" "Mr. Watshira Sae-eu KMIT-NB Date 12/28/1990 BIOS" "BIOS" Systems infected with the Meta-2048 virus will find that the DOS CHKDSK program will return file allocation errors on some of the infected programs. The virus may also interfer with keyboard input.