Zp Virus

Virus Name: Zp Aliases: V Status: New Discovered: February, 1995 Symptoms: .EXE file growth; .EXE programs fail to function; decrease in total available memory; beeping; system hangs Origin: Unknown Eff Length: 507 - 519 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: F-Prot, AVTK, IBMAV, Sweep, ChAV, ViruScan, NAVDX, VAlert, NAV, IBMAV/N, AVTK/N, Sweep/N, NShld, NAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Zp virus was received in February, 1995. Its origin or point of isolation is unknown. Zp is a memory resident infector of .EXE files. It interfers with the functioning of .EXE files, returning the system user to the DOS prompt when program execution is attempted. When the first Zp infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Total available memory will have decreased by approximately 560 bytes. Interrupt 21 will be hooked by the virus in memory. Once the Zp virus is memory resident, it will infect .EXE files when they are executed or opened. Beeping may be emitted on the system speaking and a system hang may also occur. Programs infected with the Zp virus will have a file length increase of 507 to 519 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code.