Print Screen Virus
Virus Name: Print Screen
Aliases: EB 21, 8290, PRTSC Virus
V Status: Common
Discovered: November, 1989
Symptoms: BSC; hard disk access slowdown
Origin: Bombay, India
Eff Length: N/A
Type Code: BR - Resident Boot Sector Infector
Detection Method: ViruScan, F-Prot, NAV, Sweep, AVTK,
IBMAV, NAVDX, VAlert, PCScan, ChAV
Removal Instructions: M-Disk, NAV, or DOS SYS command
The Print Screen virus was isolated in Bombay, India in November,
1989 by Neville Bulsara. It is the first virus to have originated
in India. There are two versions of Print Screen, the later
version having had some bugs fixed.
When a system is booted from a Print Screen infected diskette or
hard drive, the virus will install itself memory resident in the
top of memory. The virus then adjusts the amount of memory DOS
thinks is installed. Infected systems will show that total system
memory is 2K less than is installed. On floppy disks, the original
boot sector of the diskette will be copied to sector 11.
After becoming memory resident, the virus will infect any hard disk
or floppy diskette which is accessed by the system.
Infected system users will notice that hard disk accesses done for
any reason will be much slower than expected. In some cases,
listing the root directory will show apparently garbage entries in
it. These entries are actually part of the virus's code.
The first version of the Print Screen virus is buggy, and as such
it doesn't actually accomplish anything having to do with printing
This virus appears to have been based on the Ping Pong virus, and
some anti-viral programs will identify it as such.
Known variant(s) of Print Screen are:
Print Screen-2: Print Screen-2 is the later, bug fixed version of
the Print Screen virus. This version will attempt
to perform a screen print or dump to the system's
printer after every 255 disk I/Os have occurred.