Virus Name: 2559
V Status: Rare
Discovery: June, 1991
Symptoms: .EXE file growth; system hangs; unexpected disk access to
Eff Length: 2,559 - 2,933 bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, ChAV,
IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The 2559 virus was discovered in June, 1991. Information about its
origin is unavailable. 2559 is a non-resident direct action
infector of .EXE programs.
When a program infected with 2559 is executed, the virus will
search the current directory for a candidate .EXE program to infect.
If one is found, it will infect it. If not, it will search the B:
and C: drive directory structures for a candidate .EXE program, and
once found, that program will become infected.
.EXE programs infected with 2559 will have a file length increase
of 2,559 to 2,933 bytes. The virus will be located at the end
of infected files.
Symptoms of a 2559 infection are that some large .EXE programs will
fail to execute once they have become infected. This occurs due to
the virus having allocated a large amount of memory when the
host program is executed by the user. The memory isn't released
until the host program completes execution. System hangs may also