500 Virus

Virus Name: 500 Aliases: Int86 V Status: Rare Discovery: July, 1992 Symptoms: .COM file growth; program hangs Origin: Unknown Eff Length: 500 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, LProt, Innoc, NProt, IBMAV/N, AVTK/N, NAV/N Removal Instructions: Delete infected files General Comments: The 500 virus was submitted in August, 1992. This virus is a memory resident infector of .COM programs, including COMMAND.COM. When the first 500 infected program is executed, this virus will install itself memory resident in available free system memory. Since the virus does not reserve the memory it occupies, and doesn't keep other programs from overwriting it in memory, infected systems may experience frequent system hangs. Once the 500 virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 500 bytes with the virus being located at the beginning of the infected program. The file's date and time in the DOS disk directory listing will not be altered. The 500 virus cannot determine when it has previously infected a program, so reinfection of files may occur. Each reinfection of a program will result in an additional 500 bytes being added to the program.