Virus Name: ASP-472
V Status: Rare
Discovery: November, 1991
Symptoms: .COM & .EXE growth; Interrupt 21 hooked in free memory
Origin: Eastern Europe
Eff Length: 472 Bytes
Type Code: PRfAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected programs
The ASP-472 virus was received in November, 1991. Its origin is
unknown. ASP-472 is a memory resident infector of .COM and .EXE
programs, including COMMAND.COM.
The first time a program infected with ASP-472 is executed, the
ASP-472 virus will install itself memory resident in available
free memory, hooking interrupt 21. There will be no change in
total system and available free memory as measured by the DOS
Once ASP-472 has become memory resident, it will infect .COM and
.EXE programs when they are executed or opened for any reason.
Infected programs increase in size by 472 bytes with the virus
being located at the end of the infected file. The file's date
and time in the DOS disk directory listing will not have been
altered. Infected programs can be easily identified as they will
end with the three character text string "ASP".
ASP-472 doesn't do anything besides replicate.