Crew-2480 Virus

Virus Name: Crew-2480 Aliases: 2480, V2480 V Status: Rare Discovery: February, 1991 Symptoms: .COM growth; file date/time changes; system hangs; system reboots; graphic display Origin: Finland Eff Length: 2,480 bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Crew-2480 virus was submitted in February, 1991. It was isolated in Finland. This virus is a non-memory resident infector of .COM programs over 10K in size. It will infect COMMAND.COM. When a program infected with the Crew-2480 virus is executed, the virus may infect one .COM file over 10K in size if the system date's month is January through May. When COMMAND.COM is infected by the virus, the system will reboot. Infected .COM programs will increase in size by 2,480 bytes with the virus being located at the end of the infected program. The file's date and time in the disk directory will have been updated to the system date and time when infection occurred. Besides the symptoms indicated above which occur when files are infected, systems with a Crew-2480 infection may also experience system hangs when the user attempts to execute infected programs. Later execution of the same program may be successful. During the months of June through December, Crew-2480 does not replicate. When an infected program is executed during this period, the virus may display a formatted message making reference to the "European Cracking Crew". Known variant(s) of Crew are: Crew-2480 B: Based on the original Crew-2480 virus, this variant does not display the graphic, though it is present within the virus. Instead, a system hang will occur upon activation when the first infected program is executed. Origin: Unknown January, 1992. Crew-2480 C: Based on the original Crew-2480 virus, this is another minor variant. Origin: Unknown October, 1992.