MPS 4.01 Virus

Virus Name: MPS 4.01 Aliases: MPS-OPC 4.01, MPC V Status: Rare Discovered: January, 1992 Symptoms: .EXE file growth; file date/time change; TSR Origin: Unknown Eff Length: 684 - 698 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: AVTK, Sweep, ViruScan, F-Prot, ChAV, IBMAV, NAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, LProt, Innoc, NProt, IBMAV/N, AVTK/N, NAV/N Removal Instructions: Delete infected files General Comments: The MPS 4.01 virus was submitted in January, 1992. Its origin is unknown, though it is likely to be from Poland, like the other MPS viruses. MPS 4.01 is a memory resident infector of .EXE programs. The first time a program infected with MPS 4.01 is executed, this virus will install itself memory resident as a low system memory TSR of 992 bytes. Interrupt 21 will be hooked by MPS 4.01 in memory. Once MPS 4.01 is memory resident, it will infect .EXE programs when they are executed. Very small .EXE programs, however, will not be infected, but will have had 2 to 14 bytes adds to their file length. MPS 4.01 infected programs will have a file size increase of 684 - 698 bytes with the virus being located at the end of the infected program. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time. Infected programs will contain the following text string: "MPS-OPC v4.01" MPS 4.01 doesn't appear to do anything besides replicate. See: MPS 1.1 MPS 3.1 MPS 3.2 MPS II-754