PPSP Virus


 Virus Name:  PPSP   
 Aliases:     PPSP.1526 
 V Status:    Rare 
 Discovered:  December, 1994 
 Symptoms:    .COM file growth; 
              decrease in total system and available free memory 
 Origin:      Unknown 
 Eff Length:  1,528 - 1,541 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  AVTK, ViruScan, Sweep, NAV, NAVDX, VAlert, 
                    ChAV, 
                    AVTK/N, Sweep/N, NShld, Innoc, NAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The PPSP or PPSP.1526 virus was received in November, 1994.  Its 
       origin or point of isolation is unknown.  PPSP is a memory resident 
       fast infector of .COM files, including COMMAND.COM. 
 
       When the first PPSP infected program is executed, this virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary, not moving interrupt 12's return.  Total system 
       and available free memory, as indicated by the DOS CHKDSK program, 
       will have decreased by 2,048 bytes.  Interrupts are directly hooked 
       by the virus in memory and memory mapping utilities will not indicate 
       any interrupts hooked by the virus. 
 
       Once the PPSP virus is memory resident, it will infect .COM programs, 
       including COMMAND.COM, when they are executed or a DOS DIR command 
       is performed.  It does not, however, infect programs located in 
       subdirectories.  Infected programs will have a file length increase 
       of 1,528 to 1,541 bytes with the virus being located at the end of the 
       file.  The program's date and time in the DOS disk directory listing 
       will not be altered.  The following text strings are visible within 
       the viral code in all PPSP infected files: 
 
               "*.COM *" 
               "COMMAND.COM" 
               "PP" 
               "SP" 
 
       The "PP" text string will start in the second byte of all infected 
       files.  The "SP" text string will begin in the tenth byte. 
  

Show viruses from discovered during that infect .

Main Page