MPS II-754 Virus

Virus Name: MPS II-754 Aliases: MPS-OPC II V Status: Rare Discovered: January, 1994 Symptoms: .COM & .EXE growth; file date/time change; TSR Origin: Unknown Eff Length: 754 - 770 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: Sweep, F-Prot, IBMAV, AVTK, ViruScan, VAlert, NAV, NAVDX, ChAV, Sweep/N, AVTK/N, NProt, NShld, IBMAV/N, Innoc, NAV/N Removal Instructions: Delete infected files General Comments: The MPS II-754 virus was submitted in January, 1994. Its origin is unknown, though it is likely to be from Poland, like the other MPS viruses. MPS II-754 is a memory resident infector of .COM and .EXE programs, but not COMMAND.COM. The first time a program infected with MPS II-754 is executed, this virus will install itself memory resident as a low system memory TSR of 1,072 bytes. Interrupts 21 and 24 will be hooked by the virus in memory. Once memory resident, it will infect .COM and .EXE programs when they are executed. Very small .EXE programs, however, will not be infected, but will have had 2 to 16 bytes adds to their file length. MPS II-754 infected programs will have a file size increase of 754 to 770 bytes with the virus being located at the end of the infected program. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time. No text strings are visible within the viral code in MPS II-754 infected programs. See: MPS 1.1 MPS 3.1 MPS 3.2 MPS 4.01