Print Screen Virus

Virus Name: Print Screen Aliases: EB 21, 8290, PRTSC Virus V Status: Common Discovered: November, 1989 Symptoms: BSC; hard disk access slowdown Origin: Bombay, India Eff Length: N/A Type Code: BR - Resident Boot Sector Infector Detection Method: ViruScan, F-Prot, NAV, Sweep, AVTK, IBMAV, NAVDX, VAlert, PCScan, ChAV Removal Instructions: M-Disk, NAV, or DOS SYS command General Comments: The Print Screen virus was isolated in Bombay, India in November, 1989 by Neville Bulsara. It is the first virus to have originated in India. There are two versions of Print Screen, the later version having had some bugs fixed. When a system is booted from a Print Screen infected diskette or hard drive, the virus will install itself memory resident in the top of memory. The virus then adjusts the amount of memory DOS thinks is installed. Infected systems will show that total system memory is 2K less than is installed. On floppy disks, the original boot sector of the diskette will be copied to sector 11. After becoming memory resident, the virus will infect any hard disk or floppy diskette which is accessed by the system. Infected system users will notice that hard disk accesses done for any reason will be much slower than expected. In some cases, listing the root directory will show apparently garbage entries in it. These entries are actually part of the virus's code. The first version of the Print Screen virus is buggy, and as such it doesn't actually accomplish anything having to do with printing screens. This virus appears to have been based on the Ping Pong virus, and some anti-viral programs will identify it as such. Known variant(s) of Print Screen are: Print Screen-2: Print Screen-2 is the later, bug fixed version of the Print Screen virus. This version will attempt to perform a screen print or dump to the system's printer after every 255 disk I/Os have occurred.