Hungarian 482 Virus
Virus Name: Hungarian 482
V Status: Rare
Discovered: June, 1991
Symptoms: .COM file growth; TSR; no change in total system and
Eff Length: 482 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: Sweep, AVTK, ViruScan, F-Prot, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The Hungarian 482 virus was isolated in Hungary in June, 1991 by
Dr. Szegedi Imre. This virus is a memory resident infector of
.COM programs, including COMMAND.COM.
The first time a program infected with Hungarian 482 is executed,
the virus will install itself as a low system memory TSR, hooking
interrupt 21. Unlike with most viruses which use TSRs for memory
residency, the DOS CHKDSK program will report no change in total
system memory or available free memory. However, interrupt 12's
return will have been moved. The TSR is in low available system
memory, and the virus will prevent its TSR from being overwritten.
After Hungarian 482 is memory resident, it will infect .COM
programs, other than very small ones, as they are executed. If
COMMAND.COM is executed, it will become infected. Infected .COM
programs will increase in size by 482 bytes with the virus being
located at the end of the infected file. There will be no change
in the file date and time in the disk directory.
Due to a bug in the Hungarian 482 code, it is possible that .EXE
programs may become infected, though this will happen very rarely.
Hungarian 482 does not do anything besides replicate.