ASP-472 Virus

Virus Name: ASP-472 Aliases: V Status: Rare Discovery: November, 1991 Symptoms: .COM & .EXE growth; Interrupt 21 hooked in free memory Origin: Eastern Europe Eff Length: 472 Bytes Type Code: PRfAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected programs General Comments: The ASP-472 virus was received in November, 1991. Its origin is unknown. ASP-472 is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. The first time a program infected with ASP-472 is executed, the ASP-472 virus will install itself memory resident in available free memory, hooking interrupt 21. There will be no change in total system and available free memory as measured by the DOS CHKDSK program. Once ASP-472 has become memory resident, it will infect .COM and .EXE programs when they are executed or opened for any reason. Infected programs increase in size by 472 bytes with the virus being located at the end of the infected file. The file's date and time in the DOS disk directory listing will not have been altered. Infected programs can be easily identified as they will end with the three character text string "ASP". ASP-472 doesn't do anything besides replicate.