Year 1992 Virus
Virus Name: Year 1992
V Status: Rare
Discovered: December, 1991
Symptoms: .COM & .EXE growth; decrease in total system & available free
memory; hard disk corruption
Eff Length: 1,731 - 1,746 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, Sweep, F-Prot, AVTK, NAVDX,
NAV, IBMAV, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The Year 1992 virus was received in December, 1991. Year 1992 is
a memory resident infector of .COM and .EXE programs. It is
destructive when it activates in 1992.
The first time a program infected with Year 1992 is executed, the
virus will become memory resident at the top of system memory but
below the 640K DOS boundary. Total system and available free
memory, as indicated by the DOS CHKDSK program, will have decreased
by 2,016 bytes. Interrupt 12's return will not have been moved.
Year 1992 will have hooked interrupt 21.
Once Year 1992 is memory resident, it will infect .COM and .EXE
programs when they are executed. Infected files will have a
file length increase of 1,731 to 1,746 bytes with the virus being
located at the end of the infected program. The file's date
and time in the DOS disk directory listing will not have been
altered. Year 1992 is an encrypted virus, and no text strings
will be visible within the viral code in infected files.
Year 1992 activates when the virus becomes memory resident if the
year of the system date is 1992. Upon activation, it will overwrite
the system hard disk, starting at side 0, cylinder 0, sector 1.
The first sector of each track will contain the beginning of the
unencrypted virus. The following text string will be able to
be found in the first sector of each track:
"-- E.U.P.M. 1991 --"
The system hard disk will be unrecoverable if the system is not
powered down immediately as the master boot sector (partition table),
boot sector, root directory, and file allocation tables will be