Virus Name: 1452
V Status: Rare
Discovery: November, 1991
Symptoms: .COM file growth; unexpected error messages
Eff Length: 1,452 - 1,465 Bytes
Type Code: PRCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The 1452 virus was received in November, 1991. Its origin or point
of original isolation is unknown. This virus is a memory resident
direct action infector of .COM programs, including COMMAND.COM.
The first time a program infected with 1452 is executed, the virus
will infect all .COM programs located in the C: drive root directory.
The virus, however, does not become memory resident at this time.
Later, when the system is rebooted from the C: drive, the virus will
become memory resident as part of the command interpretor.
Infected programs will have a file length increase of 1,452 to 1,465
bytes with the virus being located at the end of the infected file.
There are no text strings visible within the viral code in the
Systems infected with 1452 may experience unexpected errors when
attempting to execute programs which require command line input.
For example, execution of the DOS EDLIN program with the virus
memory resident will result in the error message "Invalid drive or
file name", and the program will be terminated.
It is unknown what 1452 does besides replicate and disrupt system