1024 Print Screen Virus

Virus Name: 1024 Print Screen Aliases: 1024PSCR V Status: Rare Discovery: May, 1991 Symptoms: .COM file growth; file date/time changes; Print Screen key failure; decrease in available free memory Origin: Unknown Eff Length: 1,024 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The 1024 Print Screen virus was received in May, 1991. Its origin, and its point of isolation, are unknown. This virus is a memory resident infector of .COM files. The first time a program infected with 1024 Print Screen is executed, the virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Available free memory, as measured by the DOS CHKDSK program, will decrease by 2,048 bytes. Total system memory will not change. Interrupts 05 and 21 will be hooked by the virus. COMMAND.COM will also be infected at this time. After 1024 Print Screen is memory resident, it will infect .COM programs over 1K in size when they are executed or opened for any reason. Infected .COM programs will increase in size by 1,024 bytes with the virus being located at the beginning of the file. Programs infected with 1024 Print Screen will also have their file date and time in the disk directory altered to the system date and time of infection. When 1024 Print Screen is memory resident, it will interfer with the functioning of the Print Screen key. Pressing the Print Screen key will result in a display of the system's CMOS configuration instead of printing the contents of the display.