Dutch 555 Virus
Virus Name: Dutch 555
Aliases: 555, Quit-1992
V Status: Common
Discovered: November, 1990
Symptoms: .COM & .EXE growth; decrease in system and available memory;
file date/time change
Eff Length: 555 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Dutch 555 virus was received in February 1991 from Righard
Zwienenberg of the Netherlands. This virus was accidentally
released into the public domain by its author in November, 1990.
It is a memory resident infector of .COM and .EXE files, including
The first time a program infected with the Dutch 555 virus is
executed, the virus will install itself memory resident at the top
of system memory, but below the 640K DOS boundary. The interrupt 12
return is not moved, though the DOS CHKDSK program will show a
decrease in total system and available free memory of 560 bytes.
Interrupt 21 will be hooked by the virus.
Once the Dutch 555 virus is memory resident, it will infect .COM
and .EXE files, including COMMAND.COM, as they are executed.
Infected files will increase in size by 555 bytes, with the virus
being located at the end of the infected file. The file's date
and time in the DOS disk directory will have been updated to the
current system date and time when infection occurred.
This virus does not do anything besides replicate.
Known variant(s) of Dutch 555 are:
Dutch 555-B: Functionally equivalent to the original virus,
this variant has four bytes which differ from the
Origin: Unknown December, 1991.