PrintMonster Virus

Virus Name: PrintMonster Aliases: V Status: Rare Discovery: June, 1993 Symptoms: .COM file growth; system hangs decrease in total system & available free memory Origin: Unknown Eff Length: 853 Bytes Type Code: PRtCK - Parasitic Resident .COM Infector Detection Method: F-Prot, AVTK, IBMAV, Sweep, ViruScan, NAVDX, NAV, VAlert, PCScan, ChAV, Sweep/N, AVTK/N, NShld, NProt, IBMAV/N, Innoc, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The PrintMonster virus was submitted in June, 1993. Its origin or point of isolation is unknown. PrintMonster is a memory resident infector of .COM programs, including COMMAND.COM. When the first PrintMonster infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,024 bytes. Interrupt 17 will be hooked by PrintMonster in memory. The PrintMonster virus infects all .COM programs located in the current directory when an infected program is executed. Infected programs will have a file length increase of 853 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code in all PrintMonster infected programs: "PrintMonster30" "????????COM" Systems infected with the PrintMonster virus may experience system hangs when infected programs are executed.