Iper Virus

Virus Name: Iper Aliases: V Status: Rare Discovered: November, 1992 Symptoms: .COM file growth Origin: Unknown Eff Length: 1,062 Bytes Type Code: PNCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Iper virus was received in November, 1992. Its origin or point of isolation is unknown. Iper is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Iper virus is executed, the Iper virus will infect one previously uninfected .COM file. This .COM file may be located in the C: drive DOS directory, the C: drive root drive, or on the current drive. Iper doesn't infect more than five .COM files in any given directory on the system hard disk, and no more than three .COM files on diskettes. Infected programs will have a file length increase of 1,062 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. Two text strings are visible within the viral code in infected programs: "????????COM" "IPER" The "IPER" text string appears very close to the end of the file. It is unknown what Iper does besides replicate.