Dutch 555 Virus

Virus Name: Dutch 555 Aliases: 555, Quit-1992 V Status: Common Discovered: November, 1990 Symptoms: .COM & .EXE growth; decrease in system and available memory; file date/time change Origin: Netherlands Eff Length: 555 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Dutch 555 virus was received in February 1991 from Righard Zwienenberg of the Netherlands. This virus was accidentally released into the public domain by its author in November, 1990. It is a memory resident infector of .COM and .EXE files, including COMMAND.COM. The first time a program infected with the Dutch 555 virus is executed, the virus will install itself memory resident at the top of system memory, but below the 640K DOS boundary. The interrupt 12 return is not moved, though the DOS CHKDSK program will show a decrease in total system and available free memory of 560 bytes. Interrupt 21 will be hooked by the virus. Once the Dutch 555 virus is memory resident, it will infect .COM and .EXE files, including COMMAND.COM, as they are executed. Infected files will increase in size by 555 bytes, with the virus being located at the end of the infected file. The file's date and time in the DOS disk directory will have been updated to the current system date and time when infection occurred. This virus does not do anything besides replicate. Known variant(s) of Dutch 555 are: Dutch 555-B: Functionally equivalent to the original virus, this variant has four bytes which differ from the original. Origin: Unknown December, 1991.