Year 1992 Virus

Virus Name: Year 1992 Aliases: 1992 V Status: Rare Discovered: December, 1991 Symptoms: .COM & .EXE growth; decrease in total system & available free memory; hard disk corruption Origin: Unknown Eff Length: 1,731 - 1,746 Bytes Type Code: PRhA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, Sweep, F-Prot, AVTK, NAVDX, NAV, IBMAV, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Year 1992 virus was received in December, 1991. Year 1992 is a memory resident infector of .COM and .EXE programs. It is destructive when it activates in 1992. The first time a program infected with Year 1992 is executed, the virus will become memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,016 bytes. Interrupt 12's return will not have been moved. Year 1992 will have hooked interrupt 21. Once Year 1992 is memory resident, it will infect .COM and .EXE programs when they are executed. Infected files will have a file length increase of 1,731 to 1,746 bytes with the virus being located at the end of the infected program. The file's date and time in the DOS disk directory listing will not have been altered. Year 1992 is an encrypted virus, and no text strings will be visible within the viral code in infected files. Year 1992 activates when the virus becomes memory resident if the year of the system date is 1992. Upon activation, it will overwrite the system hard disk, starting at side 0, cylinder 0, sector 1. The first sector of each track will contain the beginning of the unencrypted virus. The following text string will be able to be found in the first sector of each track: "-- E.U.P.M. 1991 --" The system hard disk will be unrecoverable if the system is not powered down immediately as the master boot sector (partition table), boot sector, root directory, and file allocation tables will be quickly overwritten.