Burghofer Virus

Virus Name: Burghofer Aliases: V Status: Rare Discovery: June, 1991 Symptoms: .COM file growth; decrease in total system and available memory Origin: Switzerland Eff Length: 525 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Burghofer virus was isolated in June, 1991, in Switzerland. Burghofer is a memory resident infector of .COM programs, including COMMAND.COM. When the first Burghofer infected program is executed, Burghofer will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available memory, as measured by the DOS CHKDSK program, will decrease by 528 bytes. Interrupt 21 will be hooked by the virus. Once Burghofer is memory resident, it will infect .COM programs when they are executed. If COMMAND.COM is executed, it will be infected. Infected .COM programs increase in file size by 525 bytes, the virus will be located at the end of the infected file. The file's date and time in the disk directory will not be altered. Programs infected with Burghofer will contain the text string "GS/02" at the fourth thru eighth bytes of the file. Burghofer doesn't do anything besides replicate.