1260 Virus

Virus Name: 1260 Aliases: V2P1, Chameleon V Status: Research Discovery: January, 1990 Symptoms: .COM file growth Origin: Minnesota, United States Eff Length: 1,260 Bytes Type Code: PNC - Parasitic Encrypting Non-Resident .COM Infector Detection Method: F-Prot, AVTK, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ViruScan, ChAV, NShld, LProt, Sweep/N, Innoc, AVTK/N, NAV/N, NProt, IBMAV/N Removal Instructions: F-Prot, or delete infected files General Comments: The 1260 virus was first isolated in January, 1990. This virus does not install itself resident in memory, but is it extremely virulent at infecting .COM files. Infected files will have their length increased by 1,260 bytes, and the resulting file will be encrypted. The encryption key changes with each infection. The 1260 virus is derived from the original Vienna virus, though it is highly modified. This virus was developed as a research virus by Mark Washburn, who wished to show the anti-viral community why identification string scanners do not work in all cases. The encryption used in 1260 is one of many possible cases of the encryption which may occur with Washburn's later research virus, V2P2. See: Vienna Casper V2P2 V2P6