1452 Virus


 Virus Name:  1452 
 Aliases:    
 V Status:    Rare 
 Discovery:   November, 1991 
 Symptoms:    .COM file growth; unexpected error messages 
 Origin:      Unknown 
 Eff Length:  1,452 - 1,465 Bytes 
 Type Code:   PRCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, Sweep, F-Prot, NAV, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, NAV/N, 
                    IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The 1452 virus was received in November, 1991.  Its origin or point 
       of original isolation is unknown.  This virus is a memory resident 
       direct action infector of .COM programs, including COMMAND.COM. 
 
       The first time a program infected with 1452 is executed, the virus 
       will infect all .COM programs located in the C: drive root directory. 
       The virus, however, does not become memory resident at this time. 
       Later, when the system is rebooted from the C: drive, the virus will 
       become memory resident as part of the command interpretor. 
 
       Infected programs will have a file length increase of 1,452 to 1,465 
       bytes with the virus being located at the end of the infected file. 
       There are no text strings visible within the viral code in the 
       infected files. 
 
       Systems infected with 1452 may experience unexpected errors when 
       attempting to execute programs which require command line input. 
       For example, execution of the DOS EDLIN program with the virus 
       memory resident will result in the error message "Invalid drive or 
       file name", and the program will be terminated. 
 
       It is unknown what 1452 does besides replicate and disrupt system 
       operation. 
 
       See:   Antimon 

Show viruses from discovered during that infect .

Main Page