Virus Name: Big-2000
V Status: Rare
Discovery: March, 1993
Symptoms: .EXE file growth; file date/time change; TSR
Eff Length: 2,000 Bytes
Type Code: PRsE - Parasitic Resident .EXE Infector
Detection Method: Sweep, AVTK, ViruScan, F-Prot, NAV, NAVDX, VAlert,
Sweep/N, NShld, AVTK/N, NAV/N, Innoc
Removal Instructions: Delete infected files
The Big-2000, or V-1391, virus was submitted in March, 1993. Its
origin or point of isolation is unknown. Big-2000 is a memory
resident infector of large .EXE files.
When the first Big-2000 infected program is executed, the Big-2000
virus will become memory resident as a low system memory TSR of
2,848 bytes, hooking interrupts 01 and 18.
Once the Big-2000 virus is memory resident, it will infect .EXE
files larger than approximately 60K in size, when they are executed.
Infected programs will have a file length increase of 2,000 bytes
with the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will have been
updated to the current system date and time when infection occurred.
No text strings are visible within the viral code in Big-2000
It is unknown what Big-2000 does besides replicate.