Virus Name: Europe-92
Aliases: E-92, Dutch 424, Europe-92B, Europe-1992
V Status: Rare
Discovered: August, 1991
Symptoms: .COM growth; TSR; system hangs; boot failure; display message;
"Invalid drive specification" message; beeping
Eff Length: 421 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, Sweep, AVTK, F-Prot, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Europe-92 virus was received in August, 1991, from Europe.
This virus is a memory resident infector of .COM programs, including
When the first Europe-92 infected program is executed, Europe-92
will install itself memory resident as a low system memory TSR of
420 bytes. Interrupt 21 will be hooked by the virus.
After becoming memory resident, Europe-92 will infect .COM programs,
including COMMAND.COM, when they are executed. Infected programs
will increase in size by 421 bytes with the virus being located at
the end of the infected files. The process of infecting the
program the user was attempting to execute will occassionally result
in a system hang once the infection process is complete.
Execution of some programs infected with Europe-92 will result in
a system hang. Other programs which are expecting command line
input may display the message "Invalid drive specification" and
terminate their execution. Some infected programs will continue
to function normally.
In the year 1992, Europe-92 activates. In 1992, when the first
infected program is executed the virus will repeatedly issue the
following message accompanied by beeping, scrolling the screen:
This message is encrypted within the virus, and cannot be viewed
in infected files.
Known variant(s) of Europe-92 are:
Europe-92B: Also known as Dutch 424, this variant is three bytes
longer than the Europe-92 virus described above.