Virus Name: Returns
V Status: Rare
Discovery: April, 1992
Symptoms: .EXE file growth
Origin: United States
Eff Length: 512 Bytes
Type Code: PRfE - Parasitic Resident .EXE Infector
Detection Method: F-Prot, AVTK, Sweep, IBMAV, PCScan, ViruScan, VAlert,
NAV, NAVDX, ChAV,
NShld, Sweep/N, NProt, AVTK/N, IBMAV/N, Innoc, LProt,
Removal Instructions: Delete infected files
The Returns virus was discovered in the United States on April 15,
1992. Returns is a memory resident infector of .EXE programs.
When the first program infected with the Returns virus is
executed, this virus will install itself memory resident in
available free memory and in memory on the video card if it is
available. Interrupt 21 is directly hooked by the virus in the
Once Returns is memory resident, it will infect .EXE programs
when they are executed. Infected programs will have a file length
increase of 512 bytes with the virus being located at the end of
the infected file. The program's date and time in the DOS disk
directory listing will not be altered. No text strings are visible
within the Returns virus in infected files.
It is unknown what Returns does besides replicate.