Sorlec Virus

Virus Name: Sorlec Aliases: Sorlec 3 V Status: Rare Discovered: February, 1993 Symptoms: .COM &.EXE file growth; system hangs; decrease in total system & available free memory Origin: Unknown Eff Length: 597 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: AVTK, F-Prot, ViruScan, Sweep, NAV, IBMAV, PCScan, NAVDX, VAlert, ChAV, NShld, AVTK/N, Sweep/N, NAV/N, IBMAV/N, LProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Sorlec, or Sorlec 3, virus was submitted in February, 1993. Its origin or point of isolation is unknown. Sorlec is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. When a program infected with the Sorlec virus is executed, the Sorlec virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Interrupt 21 will have been hooked by the virus in memory. Once the Sorlec virus is memory resident, it will infect .COM and .EXE programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 597 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code in all Sorlec infected programs: "CLtV" "Sorlec 3 - Virus Detonaton!" System hangs frequently occur on system infected with the Sorlec virus. Known variant(s) of Sorlec are: Sorlec 4: Received in February, 1993, Sorlec 4 is a later version of the Sorlec virus described above. This variant's size in memory is 10,240 bytes, hooking interrupt 21. It infects .EXE programs when they are executed, adding 553 bytes to the file's length. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the viral code: "MSDOS.SYS" "Sorlec 4" Origin: Unknown February, 1993. Sorlec 5: Also received in February, 1993, Sorlec 5 is a non- resident version of the Sorlec virus. It infects all of the .EXE files in the current directory when an infected program is executed. Infected programs will have a file length increase of 535 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is encrypted within the viral code: "Sorlec 5 *.EXE .." Origin: Unknown February, 1993. Sorlec 6: Received in November, 1993, Sorlec 6 is a non-resident version of the Sorlec virus. It infects all of the .COM and .EXE files in the current directory when an infected program is executed. Infected programs will have a file length increase of 565 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is encrypted within the viral code: "..1... ... 1 *.EXE *.COM .." Infected programs will usually not function properly, resulting in a system hang. Origin: Unknown November, 1993.