Polish 529 Virus
Virus Name: Polish 529
Aliases: 529, P529, Piter, Piter2
V Status: Rare
Discovered: September, 1990
Symptoms: .COM growth; TSR
Eff Length: 529 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Polish 529 virus was isolated in September, 1990 in Poland.
This virus is a memory resident infector of .COM files. It will
infect COMMAND.COM if it is executed with the virus in memory.
The first time a program infected with the Polish 529 virus is
executed, the virus will install itself memory resident as a low
system memory TSR of 1,664 bytes. Interrupt 21 will be hooked by
Once the virus is memory resident, any .COM file over approximately
1600 bytes in length will be infected by the virus. Infected .COM
files will show a file length increase of 529 bytes and have the
virus's code located at the beginning of the file.
This virus does not appear to do anything but replicate.
Known variant(s) of Polish 529 are:
Polish 529B: Based on the Polish 529 virus described above, the
major difference with this variant is that its memory
resident TSR is 1,648 bytes in size.
Origin: Unknown July, 1992.