Hungarian 482 Virus

 Virus Name:  Hungarian 482 
 V Status:    Rare 
 Discovered:  June, 1991 
 Symptoms:    .COM file growth; TSR; no change in total system and 
              available memory 
 Origin:      Hungary 
 Eff Length:  482 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM Infector 
 Detection Method:  Sweep, AVTK, ViruScan, F-Prot, ChAV, 
                    NAV, IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Hungarian 482 virus was isolated in Hungary in June, 1991 by 
       Dr. Szegedi Imre.  This virus is a memory resident infector of 
       .COM programs, including COMMAND.COM. 
       The first time a program infected with Hungarian 482 is executed, 
       the virus will install itself as a low system memory TSR, hooking 
       interrupt 21.  Unlike with most viruses which use TSRs for memory 
       residency, the DOS CHKDSK program will report no change in total 
       system memory or available free memory.  However, interrupt 12's 
       return will have been moved.  The TSR is in low available system 
       memory, and the virus will prevent its TSR from being overwritten. 
       After Hungarian 482 is memory resident, it will infect .COM 
       programs, other than very small ones, as they are executed.  If 
       COMMAND.COM is executed, it will become infected.  Infected .COM 
       programs will increase in size by 482 bytes with the virus being 
       located at the end of the infected file.  There will be no change 
       in the file date and time in the disk directory. 
       Due to a bug in the Hungarian 482 code, it is possible that .EXE 
       programs may become infected, though this will happen very rarely. 
       Hungarian 482 does not do anything besides replicate.      
       See:   Zu1 

Show viruses from discovered during that infect .

Main Page