1024 Print Screen Virus
Virus Name: 1024 Print Screen
V Status: Rare
Discovery: May, 1991
Symptoms: .COM file growth; file date/time changes; Print Screen key
failure; decrease in available free memory
Eff Length: 1,024 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The 1024 Print Screen virus was received in May, 1991. Its origin,
and its point of isolation, are unknown. This virus is a memory
resident infector of .COM files.
The first time a program infected with 1024 Print Screen is
executed, the virus will install itself memory resident at the top
of system memory but below the 640K DOS boundary. Available free
memory, as measured by the DOS CHKDSK program, will decrease by
2,048 bytes. Total system memory will not change. Interrupts 05
and 21 will be hooked by the virus. COMMAND.COM will also be
infected at this time.
After 1024 Print Screen is memory resident, it will infect .COM
programs over 1K in size when they are executed or opened for any
reason. Infected .COM programs will increase in size by 1,024
bytes with the virus being located at the beginning of the file.
Programs infected with 1024 Print Screen will also have their file
date and time in the disk directory altered to the system date and
time of infection.
When 1024 Print Screen is memory resident, it will interfer with
the functioning of the Print Screen key. Pressing the Print
Screen key will result in a display of the system's CMOS
configuration instead of printing the contents of the display.