1840 Virus

Virus Name: 1840 Aliases: V Status: Rare Discovery: July, 1991 Symptoms: .COM & .EXE file growth; TSR; Write protect errors Origin: Unknown Eff Length: 1,838 - 1,891 Bytes Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The 1840 virus was isolated and submitted in July, 1991. Its point of isolation is unknown. 1840 is a memory resident infector of .COM and .EXE files, including COMMAND.COM. The first time a program infected with 1840 is executed, the virus will become memory resident as a low system memory TSR of 2,144 bytes. Interrupt 21 will be hooked by the virus in memory. Once memory resident, 1840 will infect programs as they are executed. If COMMAND.COM is executed, it will become infected. Infected programs increase in size by 1,838 to 1,891 bytes. The virus will be located at the end of the infected program. Two text strings occur within the virus which can be found in infected files: "NV71.EXE" "COMMAND" It is unknown if 1840 does anything besides replicate.