SillyC Virus


 Virus Name:  SillyC 
 Aliases:     SillyC.144 
 V Status:    New 
 Discovered:  July, 1995 
 Symptoms:    .COM file growth; file date/time changes 
 Origin:      Unknown 
 Eff Length:  144 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  F-Prot, AVTK, VAlert, NAV, NAVDX, Sweep, ViruScan, 
                    IBMAV, PCScan, ChAV, 
                    AVTK/N, Sweep/N, NShld, NAV/N, IBMAV/N, NProt, Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The SillyC or SillyC.144 virus was received in July, 1995, accompanied 
       by several variants of this virus.  They are non-resident, direct 
       action .COM infectors.  They don't appear to do anything besides 
       replicate. 
 
       When a SillyC infected program is executed, this virus will infect 
       all of the .COM files located in the current directory, including 
       COMMAND.COM.  Infected .COM files will have a file length increase 
       of 144 bytes with the virus being located at the end of the file. 
       The program's date and time in the DOS disk directory listing will 
       have been updated to the current system date and time when infection 
       occurred.  The following text string is visible within the viral code 
       in all infected files: 
 
           "*.com" 
 
       Additionally, a "V" can be found in the fourth byte of all infected 
       files. 
 
       Known variant(s) of SillyC are: 
       SillyC.106: Received in January, 1996, this is a 106 byte 
           variant of the SillyC virus which infects one file located in 
           the current directory, regardless of file extension, when an 
           infected program is executed.  Infected files may be of any 
           type, but will be infected as though they are a .COM file.  These 
           files will have a file length increase of 106 bytes with the 
           virus being located at the end of the file.  The program's date 
           and time in the DOS disk directory listing will have been updated 
           to the current system date and time when infection occurred. 
           The following text string is visible within the viral code: 
           "*.*" 
           Origin:  Unknown  January, 1996. 
       SillyC.113: Received in January, 1996, this is a 113 byte 
           variant of the SillyC virus which infects one file located in 
           the current directory, regardless of file extension, when an 
           infected program is executed.  Infected files may be of any 
           type, but will be infected as though they are a .COM file.  These 
           files will have a file length increase of 113 bytes with the 
           virus being located at the end of the file.  The program's date 
           and time in the DOS disk directory listing will have been updated 
           to the current system date and time when infection occurred. 
           The following text string is visible within the viral code: 
           "*.*" 
           Origin:  Unknown  January, 1996. 
       SillyC.122: Received in July, 1995, this is a 122 byte 
           variant of the SillyC virus which infects all of the .COM 
           files in the current directory when an infected program is 
           executed.  Infected files will have a file length increase of 
           122 bytes with the virus being located at the beginning of the 
           file.  The program's date and time in the DOS disk directory 
           listing will have been updated to the current system date and 
           time when infection occurred.  The following text string is 
           visible within the viral code: 
           "*.COM" 
           Origin:  Unknown  July, 1995. 
       SillyC.155: Also received in July, 1995, this is a 155 byte 
           variant which infects one .COM file located in the current 
           directory when an infected file is executed.  Infected files 
           will have a file length increase of 155 to 171 bytes as this 
           variant first pads the host file's length so that it will be 
           a multiple of 16, then adds 155 bytes of viral code.  The virus 
           will be located at the end of the file.  The program's date and 
           time in the DOS disk directory listing will have been updated 
           to the current system date and time when infection occurred. 
           The following text string is visible within the viral code: 
           "*.c* 
           A dollar sign ("$") can be found in the fourth byte of all 
           infected files.  System hangs frequently occur when infected 
           programs are executed. 
           Origin:  Unknown  July, 1995. 
       SillyC.162.B: Received in January, 1996, this is a 162 byte 
           variant of the SillyC virus.  It infects the first .COM file 
           in the current directory when an infected file is executed. 
           This variant will reinfect the files if they were previously 
           infected.  Programs infected with SillyC.162.B will have a file 
           length increase of 162 bytes for each infection on the file with 
           the virus being located at the end of the file.  The program's 
           date and time in the DOS disk directory listing will have been 
           updated to the current system date and time when infection 
           occurred.  The following text string is visible within the 
           viral code: 
           "*.COM" 
           Origin:  Unknown  January, 1996. 
       SillyC.166.A: Also received in July, 1995, this is a 166 byte 
           variant of the SillyC virus.  It infects the first four (4) .COM 
           files in the current directory when an infected file is executed. 
           This variant will reinfect the files if they were previously 
           infected.  Programs infected with SillyC.166.A will have a file 
           length increase of 166 bytes for each infection on the file with 
           the virus being located at the end of the file.  The program's 
           date and time in the DOS disk directory listing will have been 
           updated to the current system date and time when infection 
           occurred.  The following text strings are visible within the 
           viral code: 
           "t%ZR" 
           "ZRRR" 
           "*.com RR" 
           Origin:  Unknown  July, 1995. 
       SillyC.179: Received in January, 1996, this is a 179 byte 
           variant which infects one .COM file located in the current 
           directory when an infected program is executed.  It does not 
           reinfect previously infected files.  Programs infected with this 
           variant will have a file length increase of 179 bytes with the 
           virus being located at the end of the file.  The program's date 
           and time in the DOS disk directory listing will have been updated 
           to the current system date and time when infection occurred.  The 
           following text string is visible within the viral code: 
           "*.COM" 
           Origin:  Unknown  January, 1996. 
       SillyC.190.A: Also received in July, 1995, this is a 190 byte 
           variant of the SillyC virus.  It infects the first .COM file 
           in the current directory when an infected file is executed. 
           This variant will reinfect the files if they were previously 
           infected.  Programs infected with SillyC.190.A will have a file 
           length increase of 190 bytes for each infection on the file with 
           the virus being located at the end of the file.  The program's 
           date and time in the DOS disk directory listing will have been 
           updated to the current system date and time when infection 
           occurred.  The following text strings are visible within the 
           viral code: 
           "*.COM" 
           "Required system component" 
           System hangs and/or beeping may occur when infected programs are 
           executed. 
           Origin:  Unknown  July, 1995. 
       SillyC.190.B: Also received in July, 1995, this is a 190 byte 
           variant which infects one .COM file located in the current 
           directory when an infected program is executed.  It does not 
           reinfect previously infected files.  Programs infected with this 
           variant will have a file length increase of 190 bytes with the 
           virus being located at the end of the file.  The program's date 
           and time in the DOS disk directory listing will have been updated 
           to the current system date and time when infection occurred.  The 
           following text string is visible within the viral code: 
           "*.COM" 
           Origin:  Unknown  July, 1995. 
       SillyC.207.B: Also received in July, 1995, this is a 207 byte 
           variant of the SillyC virus.  It infects the first three .COM 
           files in the current directory when an infected file is executed. 
           This variant will reinfect the files if they were previously 
           infected.  Programs infected with SillyC.207.B will have a file 
           length increase of 207 bytes for each infection on the file with 
           the virus being located at the end of the file.  The program's 
           date and time in the DOS disk directory listing will have been 
           updated to the current system date and time when infection 
           occurred.  The following text strings are visible within the 
           viral code: 
           "*.COM .." 
           "Devastator/PHOBIA Lame virus #3" 
           System hangs and/or beeping may occur when infected programs are 
           executed. 
           Origin:  Unknown  July, 1995. 
       SillyC.264: Also received in July, 1995, this is a 264 byte 
           variant which infects all of the .COM files located in the 
           current directory when an infected program is executed.  It does 
           not reinfect previously infected files.  Programs infected with 
           this variant will have a file length increase of 264 bytes with 
           the virus being located at the end of the file.  The program's 
           date and time in the DOS disk directory listing will not be 
           altered.  The following text string is visible within the viral 
           code: 
           "*.com" 
           Origin:  Unknown  July, 1995. 
       SillyC.292: Also received in July, 1995, this is a 292 byte 
           variant which infects all of the .COM files located in the 
           current directory when an infected program is executed.  It does 
           not reinfect previously infected files.  Programs infected with 
           this variant will have a file length increase of 292 bytes with 
           the virus being located at the end of the file.  The program's 
           date and time in the DOS disk directory listing will not be 
           altered.  The following text strings are visible within the 
           viral code: 
           "*.COM .." 
           "The Rabbit Virus By: Corrupt Of Death Row!!" 
           Origin:  Unknown  July, 1995. 
       SillyC.302: Also received in July, 1995, this is a 302 byte 
           variant which infects one .COM file located in the current 
           directory when an infected program is executed.  It does not 
           reinfect previously infected files.  Programs infected with this 
           variant will have a file length increase of 302 bytes with the 
           virus being located at the end of the file.  The program's date 
           and time in the DOS disk directory listing will have been updated 
           to the current system date and time when infection occurred.  The 
           following text string is visible within the viral code: 
           "*.com" 
           Origin:  Unknown  July, 1995. 
       SillyC.331: Also received in July, 1995, this is a 331 byte 
           variant which infects all of the .COM files located in the 
           current directory when an infected program is executed.  It does 
           not reinfect previously infected files.  Programs infected with 
           this variant will have a file length increase of 331 bytes with 
           the virus being located at the beginning of the file.  The 
           program's date and time in the DOS disk directory listing will 
           have been updated to the current system date and time when 
           infection occurred.  No text strings are visible within the viral 
           code. 
           Origin:  Unknown  July, 1995. 
       SillyC.343: Also received in July, 1995, this is a 343 byte 
           variant which infects all of the .COM files located in the 
           current directory when an infected program is executed.  It does 
           not reinfect previously infected files.  Programs infected with 
           this variant will have a file length increase of 343 bytes with 
           the virus being located at the end of the file.  The program's 
           date and time in the DOS disk directory listing will have been 
           updated to the current system date and time when infection 
           occurred.  No text strings are visible within the viral code. 
           Origin:  Unknown  July, 1995. 
       SillyC.468: Also received in July, 1995, this is a 468 byte 
           variant which infects all of the .COM files located in the 
           current directory when an infected program is executed.  It does 
           not reinfect previously infected files.  Programs infected with 
           this variant will have a file length increase of 468 bytes with 
           the virus being located at the end of the file.  The program's 
           date and time in the DOS disk directory listing will not be 
           altered.  The following text strings are visible within the 
           viral code: 
           "????????COM" 
           "*.COM" 
           "COMMAND.COM" 
           This variant does not infect COMMAND.COM. 
           Origin:  Unknown  July, 1995. 
       SillyC.563: Also received in July, 1995, this is a 563 byte 
           variant which infects one .COM file located in the current 
           directory when an infected program is executed.  It does not 
           reinfect previously infected files.  Programs infected with this 
           variant will have a file length increase of 563 bytes with the 
           virus being located at the end of the file.  The program's date 
           and time in the DOS disk directory listing will have been updated 
           to the current system date and time when infection occurred.  The 
           following text strings are visible within the viral code: 
           "*.GG" 
           "coGG" 
           "AL" 
           Origin:  Unknown  July, 1995. 
       SillyC.626: Also received in July, 1995, this is a 626 byte 
           variant of the SillyC virus.  It infects all of the .COM files 
           in the current directory when an infected file is executed. 
           This variant will reinfect previously infected files.  Programs 
           Programs infected with SillyC.626 will have a file length 
           increase of 626 bytes for each infection on the file with 
           the virus being located at the end of the file.  The program's 
           date and time in the DOS disk directory listing will not be 
           altered.  No text strings are visible within the viral code. 
           System hangs frequently occur when infected programs are 
           executed. 
           Origin:  Unknown  July, 1995. 
       SillyC.657: Also received in July, 1995, this is a 657 byte 
           variant which infects one .COM file located in the current 
           directory when an infected program is executed.  It does not 
           reinfect previously infected files.  Programs infected with this 
           variant will have a file length increase of 657 bytes with the 
           virus being located at the end of the file.  The program's date 
           and time in the DOS disk directory listing will have been updated 
           to the current system date and time when infection occurred.  No 
           text strings are visible within the viral code. 
           Origin:  Unknown  July, 1995. 

Show viruses from discovered during that infect .

Main Page