Returns Virus

Virus Name: Returns Aliases: V Status: Rare Discovery: April, 1992 Symptoms: .EXE file growth Origin: United States Eff Length: 512 Bytes Type Code: PRfE - Parasitic Resident .EXE Infector Detection Method: F-Prot, AVTK, Sweep, IBMAV, PCScan, ViruScan, VAlert, NAV, NAVDX, ChAV, NShld, Sweep/N, NProt, AVTK/N, IBMAV/N, Innoc, LProt, NAV/N Removal Instructions: Delete infected files General Comments: The Returns virus was discovered in the United States on April 15, 1992. Returns is a memory resident infector of .EXE programs. When the first program infected with the Returns virus is executed, this virus will install itself memory resident in available free memory and in memory on the video card if it is available. Interrupt 21 is directly hooked by the virus in the interrupt area. Once Returns is memory resident, it will infect .EXE programs when they are executed. Infected programs will have a file length increase of 512 bytes with the virus being located at the end of the infected file. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the Returns virus in infected files. It is unknown what Returns does besides replicate.