Hungarian Virus
Virus Name: Hungarian
Aliases:
V Status: Rare
Discovered: January, 1992
Symptoms: .COM & .EXE growth; decrease in total system & available free
memory
Origin: Hungary
Eff Length: 695 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, AVTK, Sweep, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N,
NAV/N, IBMAV/N
Removal Instructions: Delete infected files
General Comments:
The Hungarian virus was isolated in Hungary in January, 1992. This
virus is a memory resident infector of .COM and .EXE programs,
including COMMAND.COM.
When the first Hungarian infected program is executed on a system,
the Hungarian virus will install itself memory resident at the top
of system memory but below the 640K DOS boundary. Interrupt 12's
return will not have been moved. Total system and available free
memory, as indicated by the DOS CHKDSK program, will have decreased
by 1,024 bytes. The virus is actually 1,008 bytes in size in
memory, and can be easily seen with memory mapping utilities.
Interrupt 21 will be hooked.
Once the Hungarian virus is memory resident, it will infect .COM
and .EXE programs, including COMMAND.COM, when they are executed.
Infected programs will have a file length increase of 695 bytes
with the virus being located at the end of the infected file. The
program's date and time in the DOS disk directory listing will not
have been altered.
It is unknown if the Hungarian virus does anything besides replicate.
Known variant(s) of Hungarian are:
Gyorgyi: A 749 byte variant of the Hungarian virus, Gyorgyi
infects .COM and .EXE programs when they are executed.
Infected programs will have a file length increase of 749
bytes with the virus being located at the end of the
file. The program's date and time in the DOS disk directory
listing will not be altered. The following text string can
be found near the end of all Gyorgyi infected programs:
"I LOVE GY”RGYI"
Origin: Hungary May, 1992.
Hungarian-B: Functionally equivalent to the Hungarian virus
described above, this variant has three bytes which
differ.
Origin: Hungary January, 1992.