Virus Name: 2153
V Status: Rare
Discovery: July, 1992
Symptoms: .COM & .EXE file growth; TSR
Eff Length: 2,153 - 2,217 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAV,
NAVDX, VAlert, ChAV,
NShld, Sweep/N, AVTK/N, IBMAV/N, Innoc, NAV/N
Removal Instructions: Delete infected files
The 2153 virus was submitted in July, 1992. Its origin or point of
isolation is unknown. This virus is a memory resident infector of
.COM and .EXE programs. It does not infect COMMAND.COM.
The first time a program infected with the 2153 virus is executed,
the 2153 virus will install itself memory resident as a low system
memory TSR of 2,672 bytes. Interrupt 22 will be hooked by the
virus in memory.
Once the 2153 virus is memory resident, it will infect .COM and
.EXE programs when they are executed. Infected .COM programs will
have a file length increase of 2,153 to 2,168 bytes. Infected
.EXE programs will have a file length increase of 2,203 to 2,217
bytes. In both cases the virus will be located at the end of the
file. The infected program's date and time in the DOS disk
directory listing will not be altered.
It is unknown what 2153 does besides replicate.