2623 Virus

Virus Name: 2623 Aliases: V Status: Rare Discovery: May, 1992 Symptoms: .EXE file growth; decrease in total system & available free memory Origin: Unknown Eff Length: 2,623 - 2,633 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The 2623 virus was received in May, 1992. Its origin and point of isolation are unknown. The 2623 virus is a memory resident infector of .EXE programs. The first time a program infected with the 2623 virus is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,864 bytes. Interrupts 21, 22, and 2F will be hooked by the virus. Interrupt 12's return will not have been moved. Also at this time, the 2623 virus will infect a randomly selected .EXE program located in the current directory. Once the 2623 virus is memory resident, it will intermittently infect one .EXE program located in the current directory when any program is executed. Programs infected with the 2623 virus will have a file length increase of 2,623 to 2,633 bytes with the virus being located at the end of the infected file. The program's date and time in the DOS disk directory listing will not have been altered. There are no text strings visible within the viral code in 2623 infected programs. It is unknown what the 2623 virus does besides replicate.