HLLC Virus

Virus Name: HLLC Aliases: HLLC.4658 V Status: New Discovered: June, 1997 Symptoms: hidden companion .COM files created Origin: Unknown Eff Length: 4,658 Bytes Type Code: SNE - Companion Or Spawning .EXE Infector Detection Method: AVTK, ViruScan, NAVDX, NAV, AVTK/N, NAV/N Removal Instructions: Delete infected hidden .COM files General Comments: The HLLC or HLLC.4658 virus was received in June, 1997. Its origin or point of isolation is unknown. This virus was written in a high-level languange, hence its name. HLLC.4658 is a non-resident, direct action companion virus. When a program infected by this virus is executed, this virus will infect all of the .EXE files located in the current directory and the C:\DOS directory. It infects files by creating a companion .COM file with the same base file name, having a .COM extension. These companion files will be 4,658 bytes in length. They are not visible in the DOS disk directory as the read only and hidden attributes are set. The file's date and time will be set to the system date and time when infection occurred. The following text strings are visible within all infected .COM files: "KRAD Virus! by Metabolis/VLAD.." "lame but it works!:)" Known variant(s) of HLLC are: HLLC.4000: Also received in June, 1997, this is a 4,000 byte companion virus also written in a high level language. It infects one .EXE file in the current directory when an infected program is executed by renaming the .EXE file being infected so that the file extension is .OVL. Once the rename has occurred, the virus then writes a copy of itself with the program being infected's base file name with the .EXE extension. The file's date and time in the DOS disk directory listing will be 1-02-80 6:37:28am for the .EXE file, while the .OVL file will have the program's original date and time. The following message may also be displayed on the system monitor: "Virus RIDER, Let's go on riding! I beg your pardon, your infected file cannot be executed..." This text is partially encrypted within the viral code. Once all of the .EXE files in a directory have become infected, .EXE programs will once again function properly. Origin: Unknown June, 1997.