Hungarian 482 Virus

Virus Name: Hungarian 482 Aliases: V Status: Rare Discovered: June, 1991 Symptoms: .COM file growth; TSR; no change in total system and available memory Origin: Hungary Eff Length: 482 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: Sweep, AVTK, ViruScan, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Hungarian 482 virus was isolated in Hungary in June, 1991 by Dr. Szegedi Imre. This virus is a memory resident infector of .COM programs, including COMMAND.COM. The first time a program infected with Hungarian 482 is executed, the virus will install itself as a low system memory TSR, hooking interrupt 21. Unlike with most viruses which use TSRs for memory residency, the DOS CHKDSK program will report no change in total system memory or available free memory. However, interrupt 12's return will have been moved. The TSR is in low available system memory, and the virus will prevent its TSR from being overwritten. After Hungarian 482 is memory resident, it will infect .COM programs, other than very small ones, as they are executed. If COMMAND.COM is executed, it will become infected. Infected .COM programs will increase in size by 482 bytes with the virus being located at the end of the infected file. There will be no change in the file date and time in the disk directory. Due to a bug in the Hungarian 482 code, it is possible that .EXE programs may become infected, though this will happen very rarely. Hungarian 482 does not do anything besides replicate. See: Zu1