Europe-92 Virus

 Virus Name:  Europe-92 
 Aliases:     E-92, Dutch 424, Europe-92B, Europe-1992 
 V Status:    Rare 
 Discovered:  August, 1991 
 Symptoms:    .COM growth; TSR; system hangs; boot failure; display message; 
              "Invalid drive specification" message; beeping 
 Origin:      Europe 
 Eff Length:  421 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, Sweep, AVTK, F-Prot, ChAV, 
                    NAV, IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Europe-92 virus was received in August, 1991, from Europe. 
       This virus is a memory resident infector of .COM programs, including 
       When the first Europe-92 infected program is executed, Europe-92 
       will install itself memory resident as a low system memory TSR of 
       420 bytes.  Interrupt 21 will be hooked by the virus. 
       After becoming memory resident, Europe-92 will infect .COM programs, 
       including COMMAND.COM, when they are executed.  Infected programs 
       will increase in size by 421 bytes with the virus being located at 
       the end of the infected files.   The process of infecting the 
       program the user was attempting to execute will occassionally result 
       in a system hang once the infection process is complete. 
       Execution of some programs infected with Europe-92 will result in 
       a system hang.  Other programs which are expecting command line 
       input may display the message "Invalid drive specification" and 
       terminate their execution.  Some infected programs will continue 
       to function normally. 
       In the year 1992, Europe-92 activates.  In 1992, when the first 
       infected program is executed the virus will repeatedly issue the 
       following message accompanied by beeping, scrolling the screen: 
               "Europe/92 4EVER!" 
       This message is encrypted within the virus, and cannot be viewed 
       in infected files. 
       Known variant(s) of Europe-92 are: 
       Europe-92B: Also known as Dutch 424, this variant is three bytes 
                   longer than the Europe-92 virus described above. 

Show viruses from discovered during that infect .

Main Page