Virus Name: 2623
V Status: Rare
Discovery: May, 1992
Symptoms: .EXE file growth; decrease in total system & available free
Eff Length: 2,623 - 2,633 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, Innoc, AVTK/N, LProt, IBMAV/N, NAV/N
Removal Instructions: Delete infected files
The 2623 virus was received in May, 1992. Its origin and point of
isolation are unknown. The 2623 virus is a memory resident infector
of .EXE programs.
The first time a program infected with the 2623 virus is executed,
this virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. Total system and available
free memory, as indicated by the DOS CHKDSK program, will have
decreased by 2,864 bytes. Interrupts 21, 22, and 2F will be hooked
by the virus. Interrupt 12's return will not have been moved. Also
at this time, the 2623 virus will infect a randomly selected .EXE
program located in the current directory.
Once the 2623 virus is memory resident, it will intermittently
infect one .EXE program located in the current directory when any
program is executed. Programs infected with the 2623 virus will
have a file length increase of 2,623 to 2,633 bytes with the virus
being located at the end of the infected file. The program's
date and time in the DOS disk directory listing will not have been
altered. There are no text strings visible within the viral code
in 2623 infected programs.
It is unknown what the 2623 virus does besides replicate.