Year 1992 Virus

 Virus Name:  Year 1992 
 Aliases:     1992 
 V Status:    Rare 
 Discovered:  December, 1991 
 Symptoms:    .COM & .EXE growth; decrease in total system & available free 
              memory; hard disk corruption 
 Origin:      Unknown 
 Eff Length:  1,731 - 1,746 Bytes 
 Type Code:   PRhA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, Sweep, F-Prot, AVTK, NAVDX, 
                    NAV, IBMAV, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, NProt, AVTK/N, NAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Year 1992 virus was received in December, 1991.  Year 1992 is 
       a memory resident infector of .COM and .EXE programs.  It is 
       destructive when it activates in 1992. 
       The first time a program infected with Year 1992 is executed, the 
       virus will become memory resident at the top of system memory but 
       below the 640K DOS boundary.  Total system and available free 
       memory, as indicated by the DOS CHKDSK program, will have decreased 
       by 2,016 bytes.  Interrupt 12's return will not have been moved. 
       Year 1992 will have hooked interrupt 21. 
       Once Year 1992 is memory resident, it will infect .COM and .EXE 
       programs when they are executed.  Infected files will have a 
       file length increase of 1,731 to 1,746 bytes with the virus being 
       located at the end of the infected program.  The file's date 
       and time in the DOS disk directory listing will not have been 
       altered.  Year 1992 is an encrypted virus, and no text strings 
       will be visible within the viral code in infected files. 
       Year 1992 activates when the virus becomes memory resident if the 
       year of the system date is 1992.  Upon activation, it will overwrite 
       the system hard disk, starting at side 0, cylinder 0, sector 1. 
       The first sector of each track will contain the beginning of the 
       unencrypted virus.  The following text string will be able to 
       be found in the first sector of each track: 
               "-- E.U.P.M. 1991 --" 
       The system hard disk will be unrecoverable if the system is not 
       powered down immediately as the master boot sector (partition table), 
       boot sector, root directory, and file allocation tables will be 
       quickly overwritten. 

Show viruses from discovered during that infect .

Main Page