Virus Name: Burghofer
V Status: Rare
Discovery: June, 1991
Symptoms: .COM file growth; decrease in total system and available
Eff Length: 525 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Burghofer virus was isolated in June, 1991, in Switzerland.
Burghofer is a memory resident infector of .COM programs, including
When the first Burghofer infected program is executed, Burghofer
will install itself memory resident at the top of system memory
but below the 640K DOS boundary. Total system and available memory,
as measured by the DOS CHKDSK program, will decrease by 528 bytes.
Interrupt 21 will be hooked by the virus.
Once Burghofer is memory resident, it will infect .COM programs
when they are executed. If COMMAND.COM is executed, it will be
infected. Infected .COM programs increase in file size by 525
bytes, the virus will be located at the end of the infected file.
The file's date and time in the disk directory will not be
Programs infected with Burghofer will contain the text string
"GS/02" at the fourth thru eighth bytes of the file.
Burghofer doesn't do anything besides replicate.