Polish 529 Virus

 Virus Name:  Polish 529 
 Aliases:     529, P529, Piter, Piter2 
 V Status:    Rare 
 Discovered:  September, 1990 
 Symptoms:    .COM growth; TSR 
 Origin:      Poland 
 Eff Length:  529 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, NAV, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Polish 529 virus was isolated in September, 1990 in Poland. 
       This virus is a memory resident infector of .COM files.  It will 
       infect COMMAND.COM if it is executed with the virus in memory. 
       The first time a program infected with the Polish 529 virus is 
       executed, the virus will install itself memory resident as a low 
       system memory TSR of 1,664 bytes.  Interrupt 21 will be hooked by 
       the virus. 
       Once the virus is memory resident, any .COM file over approximately 
       1600 bytes in length will be infected by the virus.  Infected .COM 
       files will show a file length increase of 529 bytes and have the 
       virus's code located at the beginning of the file. 
       This virus does not appear to do anything but replicate. 
       Known variant(s) of Polish 529 are: 
       Polish 529B: Based on the Polish 529 virus described above, the 
                    major difference with this variant is that its memory 
                    resident TSR is 1,648 bytes in size. 
                    Origin:  Unknown  July, 1992. 

Show viruses from discovered during that infect .

Main Page