Virus Name: 500
V Status: Rare
Discovery: July, 1992
Symptoms: .COM file growth; program hangs
Eff Length: 500 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot,
IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, LProt, Innoc, NProt, IBMAV/N,
Removal Instructions: Delete infected files
The 500 virus was submitted in August, 1992. This virus is a
memory resident infector of .COM programs, including COMMAND.COM.
When the first 500 infected program is executed, this virus will
install itself memory resident in available free system memory.
Since the virus does not reserve the memory it occupies, and doesn't
keep other programs from overwriting it in memory, infected systems
may experience frequent system hangs.
Once the 500 virus is memory resident, it will infect .COM programs,
including COMMAND.COM, when they are executed. Infected programs
will have a file length increase of 500 bytes with the virus being
located at the beginning of the infected program. The file's date
and time in the DOS disk directory listing will not be altered.
The 500 virus cannot determine when it has previously infected a
program, so reinfection of files may occur. Each reinfection of a
program will result in an additional 500 bytes being added to the