Virus Name: Crew-2480
Aliases: 2480, V2480
V Status: Rare
Discovery: February, 1991
Symptoms: .COM growth; file date/time changes; system hangs; system
reboots; graphic display
Eff Length: 2,480 bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Crew-2480 virus was submitted in February, 1991. It was
isolated in Finland. This virus is a non-memory resident
infector of .COM programs over 10K in size. It will infect
When a program infected with the Crew-2480 virus is executed, the
virus may infect one .COM file over 10K in size if the system date's
month is January through May. When COMMAND.COM is infected by the
virus, the system will reboot. Infected .COM programs will increase
in size by 2,480 bytes with the virus being located at the end of the
infected program. The file's date and time in the disk directory
will have been updated to the system date and time when infection
Besides the symptoms indicated above which occur when files are
infected, systems with a Crew-2480 infection may also experience
system hangs when the user attempts to execute infected programs.
Later execution of the same program may be successful.
During the months of June through December, Crew-2480 does not
replicate. When an infected program is executed during this period,
the virus may display a formatted message making reference to the
"European Cracking Crew".
Known variant(s) of Crew are:
Crew-2480 B: Based on the original Crew-2480 virus, this variant
does not display the graphic, though it is present
within the virus. Instead, a system hang will occur
upon activation when the first infected program is
Origin: Unknown January, 1992.
Crew-2480 C: Based on the original Crew-2480 virus, this is
another minor variant.
Origin: Unknown October, 1992.