VCL Virus
Virus Name: VCL
Aliases: Code Zero
V Status: Rare
Discovery: May, 1992
Symptoms: .COM file growth; message
Origin: United States
Eff Length: 576 Bytes
Type Code: PNCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, NAV, AVTK, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, NAV/N,
LProt, Innoc 4.0+
Removal Instructions: Delete infected files
General Comments:
The Code Zero, or the original VCL created, virus was received in
May, 1992. It originated in the United States or Canada. Code Zero
is a non-resident, direct action infector of .COM programs, including
COMMAND.COM. The viruses listed below under variants were also
created by a version of Nowhere Man's V.C.L., a program whose
purpose is to simplify the task of writing viruses.
When a program infected with the Code Zero virus is executed, the
Code Zero virus will search the current directory to locate an
uninfected .COM program to infect. If it finds an uninfected .COM
program, it will then infect it, and the host program will
continue execution. If the Code Zero virus does not find an
uninfected program, it will display the following message:
"** CODE ZERO **"
Programs infected with the Code Zero virus will have a file length
increase of 576 bytes. The virus will be located at the end of the
infected file. The program's date and time in the DOS disk
directory listing will not have been altered. Four text strings
can be found in the viral code in infected programs:
"*.* *.COM"
"** CODE ZERO **"
"Code Zero Virus"
"1992 Nowhere Man/[NukE]"
Other known viruses created with VCL are:
Angel: Angel is a VCL generated virus received in February, 1994.
It is a non-resident, direct action infector of .COM
programs, including COMMAND.COM. Angel infects one .COM
file located in the current directory each time an infected
program is executed. Infected programs will have a file
length increase of 1,681 bytes with the virus being located
at the end of the file. The file's date and time in the DOS
disk directory listing will not be altered. The following
text strings are encrypted within the Angel viral code:
"*.* *.COM"
"COMMAND.COM"
"CHKLIST.MS"
"Your computer was infected with ANGEL"
"virus!"
"Don't be afraid it's harmless!"
"Today is 21st of february, my birthday!"
"Be young, be crazy, be nice, be ANGEL!"
"HI! Don't forget: ANGEL is watching you!"
File allocation table (FAT) corruption may occur on infected
disks. After all of the .COM programs are infected, the
virus will display the following message:
"HI! Don't forget: ANGEL is watching you!"
On February 21st of any year, the virus will display the
following message in graphic characters when an infected
program is executed:
"Your computer was infected with ANGEL virus!
Don't be afraid it's harmless!
Today is 21st of february, my birthday!
Be young, be crazy, be nice, be ANGEL!"
Origin: Unknown February, 1994.
Arwen3: Arwen3 is a VCL generated virus which was received in
April, 1993. It infects one .COM file in the current
directory each time an infected program is executed.
Infected programs will have a file length increase of 722
bytes with the virus being located at the end of the file.
The file's date and time in the DOS disk directory listing
will not be altered. The following text strings are
encrypted within the Arwen3 viral code:
"Arwen3 is a fat sow"
"*.COM"
"[VCL]"
System hangs sometimes occur when infected programs are
executed.
Origin: Unknown April, 1993.
B-52: B-52 is a VCL generated virus which also contains code
generated by the PS-MPC virus generation program. B-52 is
a non-resident, direct action infector of .COM programs,
including COMMAND.COM. It infects two .COM programs each
time an infected program is executed. Infected programs
have a file length increase of 3,808 bytes with the virus
being located at the end of the file. The program's date
and time in the DOS disk directory listing will not be
altered. Many text strings can be found within the viral
code in all infected programs, including:
".. *.* *.COM"
"c:\dos\*.com"
"AT&FL0M0DT911"
"[MPC] Call 911"
"*.exe *.com .. *.exe"
"Abort, Retry, Ignore, Fail?"
"Fail on INT 24"
"I'm hungry! Insert PIZZA & BEER in to drive A: and"
"Strike any key when ready..."
"Impotence error reading user's dick"
"Program too big to fit in memory"
"Cannot load COMMAND, system halted"
"I'm sorry, Dave.... but I'm afraid I can't do that!"
"[vcl]
Origin: Unknown March, 1993.
Beva 32: Beva 32 is a VCL generated virus which was received in
February, 1993. It infects one .COM file in the current
directory, or one directory up in the directory structure,
each time an infected program is executed. Infected
programs will have a file length increase of 562 bytes with
the virus being located at the end of the file. The file's
date and time in the DOS disk directory listing will not
be altered. The Beva 32 virus activates on the 22nd day of
any month, at which time it will attempt to display the
following message:
"Whats wrong with my computer, you ask?
Well I do believe it has been"
"infected. Have a nice day!"
The above text is encrypted within the virus, as are the
following text strings:
"[VCL/BEv]"
".. *.COM"
Origin: Oregon, United States February, 1993.
Beva 33: Beva 33 is a VCL generated virus which was received in
February, 1993. It infects one .COM file in the current
directory, or one directory up in the directory structure,
each time an infected program is executed. Infected
programs will have a file length increase of 519 bytes with
the virus being located at the end of the file. The file's
date and time in the DOS disk directory listing will not
be altered. The Beva 33 virus activates on January 1st of
any year, at which time it will attempt to display the
following message:
"Happy New Years, Eat my viril infected hardware!"
The above text is encrypted within the virus, as are the
following text strings:
"[VCL/BEv]"
".. *.COM"
"-=BEv#A33=-"
Origin: Oregon, United States February, 1993.
Beva 96: Beva 96 is a VCL generated virus which was received in
February, 1993. It infects one .COM file in the current
directory, or one directory up in the directory structure,
each time an infected program is executed. Infected
programs will have a file length increase of 516 bytes with
the virus being located at the end of the file. The file's
date and time in the DOS disk directory listing will not
be altered. The Beva 96 virus activates on July 4th of any
year, at which time it will attempt to display the following
message:
"Happy 4th! Hope you enjoy your messed up computer!"
"-=BEv#A96=-"
The above text is encrypted within the virus, as are the
following text strings:
"[VCL/BEv]"
".. *.COM"
Origin: Oregon, United States February, 1993.
BigTime: BigTime is a VCL generated virus which was received in
March, 1993. It infects several .COM files in the current
directory each time an infected program is executed.
Infected programs will have a file length increase of 676
bytes with the virus being located at the end of the file.
The file's date and time in the DOS disk directory listing
will not be altered. The following text strings are
encrypted within the viral code:
".. *.* *.COM"
"[VCL] VIRUSES!! HACKERS!!"
"Who ya gonna call???Not McAfee Associates!!!
"They Suck BIGTIME!!! [DJ]"
System hangs may frequently occur when infected programs
are executed.
Origin: Unknown March, 1993.
CD Player: CD Player is a VCL generated virus which was received
in June, 1993. It infects all of the .COM and .EXE files
in the current directory when an infected program is
executed. A sound similar to the sound made by a "scratch"
on a record is emitted on the system speaker, and the system
is rebooted. Infected programs will have the virus 610
bytes of the host program overwritten by the CD Player
viral code. The program's date and time in the DOS disk
directory listing will not be altered.
Origin: Unknown June, 1993.
Chicken Pox: Chicken Pox is a VCL generated virus which was
received in January, 1993. It infects three .COM files in
the current directory, or along the system path, when an
infected program is executed. Infected programs will
increase in size by 604 bytes with the virus being located
at the end of the file. The program's date and time in the
DOS disk directory listing will not be altered. System
hangs frequently occur when infected programs are executed,
as well as write protect errors when the user attempts to
execute infected programs from write-protected diskettes.
Origin: Unknown January, 1993.
Code Zero-652: A 652 byte variant of the Code Zero virus
described above. It was created by Nowhere Man by
recompiling the Code Zero virus described above with VCL
version 1.0. This variant infects one .COM file each
time an infected program is executed. Infected programs
will have a file length increase of 652 bytes with the
virus being located at the end of the infected file. The
file's date and time in the DOS disk directory listing
will not be altered. The following text strings are
encrypted within the virus and are not visible in
replicated samples:
"*.* *.COM"
"** CODE ZERO **"
"[VCL] [Code Zero] Nowhere Man, [NuKE] '92"
Once all of the .COM programs in the current directory
have become infected, execution of the next infected
program will result in a display of the following
message:
"** CODE ZERO"
Systems infected by the Code Zero-652 virus may
experience their keyboard becoming locked out after an
an infected program is executed.
Origin: United States July, 1992.
Cops-1: Cops-1 is a VCL generated virus which was received in
April, 1993. It infects four .COM files in the current or
higher level directory each time an infected program is
executed. Infected programs will have a file length
increase of 1,083 bytes with the virus being located at the
end of the file. The file's date and time in the DOS disk
directory listing will not be altered. The following text
strings are encrypted the Cops-1 viral code:
".. *.COM"
"Your Computer has been one of the many"
"to be tortured by the CoPs-1 virus, one"
"of the many to come. Made by CoPs in 1993."
"I guess today really isn't a lucky"
"day for you, because you have been"
"hit with the CoPs-1 virus."
"It has been a year since this virus has been"
"released, and the CoPs-1 virus is still going"
"strong. This Virus Was Made By CoPs"
"in 1993.Your Computer Has Been Honored"
"By Being Able To Witness TheWrath of The"
"Infamous CoPs-1 Virus. Made By CoPs in 1993."
Rapid beeping and a system hang may occur whenever an
infected program is executed.
Origin: Unknown April, 1993.
Crasher: Crasher is a VCL generated virus received in June, 1993.
It infects five .COM files in the current or a higher level
directory each time an infected program is executed.
Infected programs will have a file length increase of 594
bytes with the virus being located at the end of the file.
The file's date and time in the DOS disk directory listing
will not be altered. The following text strings are
encrypted within the Crasher viral code:
".. *.* *.COM"
"CRASHER"
Origin: Unknown April, 1993.
Dial: Dial is a VCL generated virus which was received in
March, 1993. It infects four .COM files in the current
directory each time an infected program is executed.
Infected programs will have a file length increase of 599
bytes with the virus being located at the end of the file.
The file's date and time in the DOS disk directory listing
will not be altered. The following text strings are
visible within the viral code in all infected programs:
".. *.* *.COM"
"AT&FM0L0DT9008201110" (Note: occurs 4 times)
"[VCL]"
The text string above starting with "AT" is a command
string to dial the included phone number on Hayes compatible
modems. Area Code 900 phone numbers typically carry a
per minute connection fee, and the owner of the above phone
number doesn't have a connection to this virus.
Origin: North America March, 1993.
Diarrhea: Diarrhea is a VCL generated virus which was received
in September, 1992. It infects one .COM file in the current
directory, or along the system path, when an infected program
is executed. Infected programs will increase in size by 931
bytes with the virus being located at the end of the file.
Diarrhea activates on Fridays when execution of an infected
program results in the display of the message
"EAT MY DIARRHEA!" in graphic characters made of ASCII line
characters, with the following text below in normal text
characters: "--GG Allin & The Texas Nazi". If ANSI.SYS is
loaded, the first message will be in red, with the second line
being in yellow.
Origin: United States September, 1992.
Diarrhea6: Diarrhea6 is a later version of Diarrhea. It adds
1,221 bytes to the .COM programs it infects. Like the original
virus it activates on Fridays. In the case of Diarrhea6, it
will trojanize an .EXE program in the current directory when an
infected program is executed, overwriting the first 596 bytes.
When the trojanized .EXE program is then executed, it will
display the message from the Diarrhea virus, though a flashing
border has been added to the display which will be bright blue
if ANSI.SYS is loaded.
Origin: United States September, 1992.
Diarrhea6 Trojan: The trojan dropped by the Diarrhea6 virus on
Fridays when a Diarrhea6 infected .COM program is executed.
.EXE programs trojanized by the virus will have the first 596
bytes overwritten with a small program to produce the
display message for the virus.
Origin: United States September, 1992.
Diogenes: Diogenes is based on the Diarrhea virus described
above, and has been specifically coded to avoid detection by
anti-viral utilities which can detect some VCL generated
viruses. It adds 846 bytes to the .COM programs it infects.
Diogenes activates on the 31st of any month, at which time it
will overwrite the first 718 sectors of the C: drive with the
following text strings:
"DIOGENES 2.0 has visited you hard drive....."
"This has been another fine product of the Lehigh Valley."
"Watch (out) for future 'upgrades'."
"The world's deceit has raped my soul. We melt the plastic
people down, then we melt their plastic town....."
These messages are not visible within the viral code in
infected programs as they are encrypted.
Origin: United States October, 1992.
DM 92 Bios: DM 92 Bios is a VCL generated virus which was
received in November, 1992. DM 92 Bios infects two programs
in the current directory, with preference to .EXE files, each
time an infected program is executed. Infected programs will
have the first 457 bytes overwritten by the viral code,
permanently corrupting them. The following text strings are
encrypted within the viral code:
".. *.* *.COM *.EXE"
"DM-92 BIOS Virus"
Origin: Unknown November, 1992.
Dome: Dome is a VCL generated virus which was isolated in
Canada in August, 1992. It overwrites the first 546 bytes
of .EXE programs, as well as COMMAND.COM. It contains the
text strings:
"*.* *.EXE"
"Divide overflow"
"*.COM [VCL] DOME"
Origin: Canada August, 1992.
Dome2: A variant of Dome, also generated by VCL. This variant
overwrites two .COM or .EXE programs each time an infected
program is executed. It may also overwrite the hidden
system files and .BAT files, and alter the disk boot sector.
Unlike Dome, this variant overwrites the entire host program.
No text strings are visible in infected programs as they
are encrypted.
Origin: Canada August, 1992.
Dome3: Another Dome variant, this one creates 433 byte
companion .COM files for the .EXE programs located in the
current directory. The companion .COM files are hidden,
and contain the following text strings:
"Divide overflow"
"*.* [VCL] DOME3"
"*.* *.EXE"
Origin: Canada August, 1992.
Dome4: Another minor variant of the Dome variant, this one has
one byte which differs. In addition to infecting .EXE
programs by overwriting the host program, it will also
corrupt .COM programs. Executing one of the corrupted .COM
programs will give unpredictable results, including
unexpected system reboots.
Origin: Unknown October, 1992.
Donatello: Donatello is a 827 byte virus created with VCL 1.0.
This virus infects three .COM programs when it is executed.
Infected programs will have a file length increase of 827
bytes with the virus being located at the end of the file.
The program's date and time in the DOS disk directory
listing will not be altered. The following text strings
are encrypted within the viral code, and as such are not
visible in infected files:
"Cowabunga, dudes! It's Donatello!"
"(Hey, John, can I be on Nightline too?)"
"[VCL] [Donatello] Nowhere Man, [NuKE] '92"
"Hey, Donatello, be like Mike!"
"*.COM"
System hangs may occur when infected programs are executed,
and the first two text strings above displayed as a message.
On some systems, a "Divide overflow" error will occur when
infected programs are executed, and no files will be
infected.
Origin: United States July, 1992.
E-Coli: Received in April, 1993, E-Coli is a 706 byte companion
or spawning virus. When an infected program is executed,
this virus will infect one .EXE file in the current
directory by creating a 706 byte hidden .COM file with the
same base file name. The hidden .COM file will have the
Read-Only, System and Hidden attributes set, and the system
date and time when infection occurred. The following text
strings are encrypted within the E-Coli viral code:
"[VCL] This virus is for corporate"
"America for poisoning the peopl"
".. *.* *.EXE"
Replicated samples will not infect other files unless the
file attributes are reset by the user.
Origin: Unknown April, 1993.
Earth Day: Earth Day is a 797 byte virus created with VCL 1.0.
This virus infects one .COM file each time an infected
program is executed. Infected programs will have a file
length increase of 797 bytes with the virus being located
at the end of the infected file. The file's date and time
in the DOS disk directory listing will not be altered.
The following text strings are encrypted within the virus
and are not visible in replicated samples:
"*.* *.COM"
"Happy Earth Day!!!"
"In the spirit of Earth Day, this VIRUS has recycled
your hard disk."
"[VCL] [Code Zero] Nowhere Man, [NuKE] '92"
Systems infected by the Earth Day virus may experience
their keyboard becoming locked out after an infected
program is executed. "Divide overflow" errors may
frequently occur when infected programs are executed. The
virus contains code to display the message indicated above
and overwrite the system hard disk.
Origin: United States July, 1992.
Earthquake: Received in January, 1993, Earthquake is a 1,145 byte
companion or spawning virus. When an infected program is
executed, this virus will infect one .EXE file in the current
directory by creating a 1,145 byte hidden .COM file with the
same base file name. The hidden .COM file will have the
Read-Only and Hidden attributes set, and the system date and
time when infection occurred. The following text strings are
encrypted within the Earthquake viral code:
".. *.* *.EXE"
"* * * Earthquake Warning! * * *"
"Head for the hills!"
"Take cover!!!"
"Whew! We Made It!"
"-=[VCL/BEv]=-"
System hangs will frequently occur on infected systems.
Origin: Unknown January, 1993.
Family: Family is a VCL generated virus which was received in
March, 1993. It infects two .COM files in the current
directory each time an infected program is executed.
Infected programs will have a file length increase of 663
bytes with the virus being located at the end of the file.
The file's date and time in the DOS disk directory listing
will not be altered. The following text strings are
visible within the viral code in all infected programs:
".. *.* *.COM"
"Another failure of Traditional Family Values! Oh no!"
"[VCL]"
The second text string above may be displayed as a message
in flashing text when an infected program is executed.
Origin: Unknown March, 1993.
Garfield: Garfield is a VCL generated virus which was received in
July, 1993. It infects one .COM file in the current
directory each time an infected program is executed.
Infected programs will have a file length increase of 515
bytes with the virus being located at the end of the file.
The file's date and time in the DOS disk directory listing
will not be altered. The following text strings are
visible within the viral code in all infected programs:
".. *.* *.COM"
"You got da Garfield Virus, Have a nice MONDAY[HAL]"
Origin: Unknown July, 1993.
Handler: Handler is a VCL generated virus which was received in
April, 1993. It infects three .COM files in the current
directory each time an infected program is executed.
Infected programs will have a file length increase of 420
bytes with the virus being located at the end of the file.
The file's date and time in the DOS disk directory listing
will not be altered. The following text strings are
encrypted within the viral code in all infected programs:
"*.COM"
"[VCL] beep beepHandler is a fag!"
Origin: Unknown April, 1993.
Heevahava: Heevahava is a VCL generated virus which was isolated
in the United States in September, 1992. It infects two
.EXE programs in the current directory each time an
infected program is executed by creating companion files.
The companion files created by the Heevahava virus will
be 514 bytes long and have the read only, system, and
hidden attributes set. The base file name will correspond
to an .EXE program in the directory, and the file's date
will be the system date when the companion file was created.
The following text can be found in the Heevahava virus
hidden companion files:
"Only heeva-hava's get stuck with THE HEEVAHAVA virus!"
"HEEVA[VCL]"
"*.* *.EXE"
Origin: United States September, 1992.
Kinison: An 806 byte virus created with VCL version 1.0. This
virus infects one .COM file each time an infected program
is executed. Infected programs will have a file length
increase of 806 bytes with the virus being located at the
end of the infected file. The file's date and time in the
DOS disk directory listing will not be altered. The
following text strings are encrypted within the virus and
are not visible in replicated samples:
"*.* *.COM"
"DIE BITCH!!!!! AHHHHHHHH!!!!!!!"
"[VCL] This *VIRUS* is dedicated to the memory of Sam
Kinsion, 1954-1992 [Kinison]"
"Nowhere Man, [NuKE] '92"
Systems infected by the Kinison virus may experience
their keyboard becoming locked out after an infected
program is executed. "Divide overflow" errors may
frequently occur when infected programs are executed.
Kinison activates on any Friday the 11th, at which time
it will display its message and trash the system hard
disk.
Origin: United States July, 1992.
Kinnison-734: Kinnison-734 is a variant of the Kinison virus
described above. This variant is two bytes longer,
and contains the following text strings:
"*.* *.COM"
"DIE BITCH!!!!! AHHHHHHHH!!!!!!!"
"[VCL] Dedicated to the memory of"
"Sam Kinnison 1954-1992"
"[Kinnison Nowhere Man, [NuKE] '92"
Origin: Canada August, 1992.
McYellow: McYellow is a VCL generated virus received in May,
1993. It infects three .COM files or one .EXE file located
in the current directory each time an infected program is
executed. It then displays the following message in yellow
blocked graphic characters on the system display:
" MCAFEE
IS A FAG"
On non-VGA systems, the display may just appear to have
been cleared. Infected programs will have the first 1,297
bytes of the host program overwritten by the viral code.
The file's date and time in the DOS disk directory listing
will not be altered. The following text strings are visible
within the viral code in all infected programs:
"*.EXE *.COM"
Origin: Unknown May, 1993.
Miles: Received in June, 1993, Miles is a 480 byte companion
or spawning virus. When an infected program is executed,
this virus will infect one .EXE file in the current
directory by creating a 480 byte hidden .COM file with the
same base file name. The hidden .COM file will have the
Read-Only, System and Hidden attributes set, and the system
date and time when infection occurred. The following text
strings are visible within the Miles viral code:
".. *.* *.EXE"
"... miles to go before I sleep."
On the 3rd day of any month, execution of infected files
will result in the virus displaying the second text line
above as a message on the system display. Replicated samples
will not infect other files, or display the message on the
3rd, unless the file attributes are reset by the user.
Origin: Unknown June, 1993.
Pearl Harbor: A 930 byte virus created with VCL. This virus
infects one .EXE file smaller than 64K each time an
infected program is executed. Unlike other VCL viruses,
Pearl Harbor is a spawning or companion virus, so no
changes will occur to the infected .EXE programs. Instead,
a 930 byte .COM file is created with the same base file
name as the .EXE program being infected. The 930 byte
.COM file will have attributes of read-only, system, and
hidden, so it is not visible in the DOS disk directory
listing. The file date and time on the hidden .COM file
will be the system date and time when infection occurred.
The following text strings are encrypted within the virus
and are not visible in replicated samples:
"December 7th, 1941 -- A day that will live in infamy..."
"*** REMEMBER PEARL HARBOR ***"
"C:\*.* [VCL]"
"Dedicated to the memories of the brave American men and
women who gave their lives at [Pearl Harbor]."
"Nowhere Man, [NuKE] '92"
Pearl Harbor activates on December 7th, at which time it
will display the following message when an infected
program is executed, as well as attempt to write to
device PRN or LPT1:
"December 7th, 1941 -- A day that will live in infamy..."
" "
"*** REMEMBER PEARL HARBOR ***"
This virus also contains code to corrupt files located in
the C: drive root directory, but it may not actually be
executed.
Origin: United States July, 1992.
Pro-Choice: Pro-Choice is a VCL generated virus received in
April, 1993. It infects five .COM files in the current
directory each time an infected program is executed.
Infected programs will have a file length increase of 1,569
bytes with the virus being located at the end of the file.
The file's date and time in the DOS disk directory listing
will not be altered. The following text strings are
encrypted within the viral code in all infected programs:
".. *.* *.COM"
"Hello, all fascist narrow-minded jerks!!
This one's for you"
"The pçé‡h™Œcî Virus has infected your system!!!"
"HAHAHAHAHAHAHAHA!"
"I hope this makes you think twice about restricting a
person's freedom of"
"choice and limiting his/her decision about aborting a
baby. I also hope that"
"this demonstrates that fucking up someone's life in the
name of an unborn"
"child is OK. Not. Have a wonderful day."
"And may corrupted programming reign!! Long live Jim Shorts"
"[VCL] Pro-Choice Virus"
System hangs may occur when infected programs are executed,
as well as the second text string above may be displayed
as a message.
Origin: Unknown April, 1993.
Red Team: Red Team is a VCL generated virus which was received in
June, 1993. It infects four .COM files in the current
directory each time an infected program is executed.
Infected programs will have a file length increase of 716
bytes with the virus being located at the end of the file.
The file's date and time in the DOS disk directory listing
will not be altered. The following text strings are
encrypted within the viral code:
".. *.* *.COM"
"Now YOU are a part of the Red Team!"
"by Dark in 93"
Red Team activates on Wednesdays, when it will display the
last two text strings above as a message accompanied by a
scraping sound and a system hang.
Origin: Unknown June, 1993.
VCL.279: VCL.279 is a VCL generated virus received in May,
1995. It infects two .EXE files in the current directory when
an infected program is executed by creating a 279 byte companion
.COM file. The companion .COM files, which contain the viral
code, will have the read only, system, and hidden attributes set
and the current system date and time when infection occurred.
The following text strings are visible within the viral code:
"*.EXE"
"[VCL_MUT] The Pleasure 2 VirusEver have the pleasure?"
"By eMpIrE-X"
Origin: Unknown May, 1995.
VCL.288: VCL.288 is a VCL generated virus received in May, 1995.
It infects two or three .EXE files in the current directory when
an infected program is executed by overwriting the first 288
bytes of the host program. The file's date and time in the DOS
disk directory listing will not be altered. The following text
strings are visible within the viral code:
"*.EXE"
"[VCL_MUT] The Pleasure 3 VirusEver have the pleasure?"
"By eMpIrE-X"
Origin: Unknown May, 1995.
VCL.302: VCL.302 is a VCL generated virus received in May, 1995.
It infects three .COM or .EXE files in the current directory
when an infected program is executed by overwriting the first
302 bytes of the host program. The file's date and time in the
DOS disk directory listing will not be altered. The following
text strings are visible within the viral code:
"*.COM *.EXE"
"[VCL_MUT] The Pleasure 4 VirusEver have the pleasure?"
"By eMpIrE-X"
Origin: Unknown May, 1995.
VCL.316: VCL.316 is a VCL generated virus received in May, 1995.
It infects three .EXE files in the current directory when
an infected program is executed by creating a 316 byte companion
.COM file. The companion .COM files, which contain the viral
code, will have the read only, system, and hidden attributes set
and the current system date and time when infection occurred.
The following text strings are visible within the viral code:
".. *.EXE"
"[VCL_MUT] The Pleasure 6 VirusEver have the pleasure?"
"By eMpIrE-X"
System hangs may occur when infected programs are executed.
Origin: Unknown May, 1995.
VCL.457: VCL.457 is a VCL generated virus which was received in
May, 1995. It is very similar to the DM 92 Bios virus also
generated using VCL. VCL.457 infects two .COM or .EXE programs
in the current directory, with preference to .COM files, each
time an infected program is executed. Infected programs will
have the first 457 bytes overwritten by the viral code,
permanently corrupting them. The following text strings are
encrypted within the viral code:
".. *.* *.COM *.EXE"
"Mad Satan Virus."
Origin: Unknown May, 1995.
VCL.512: VCL.512 is a VCL generated virus received in May, 1995.
VCL.512 infects three .COM files in the current directory when
an infected program is executed. Infected files will have a
file length increase of 512 bytes with the virus being located
at the end of the file. The program's date and time in the DOS
disk directory listing will not be altered. The following text
strings are visible within the viral code:
".. *.* *.COM"
"[VCL_MUT] This is a Pleasure VirusPlease have the
PleasureVirus by eMpIrE-X"
Origin: Unknown May, 1995.
VCL.551: VCL.551 is a VCL generated virus received in July, 1994.
VCL.551 infects two .COM files in the current directory when an
infected program is executed. Infected files will have a file
length increase of 551 bytes with the virus being located at the
end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text
strings are encrypted within the viral code:
"*.*"
"*.COM"
Origin: Unknown July, 1994.
VCL.587: VCL.587 is a VCL generated virus received in July, 1994.
VCL.587 infects three .EXE files in the current directory when an
infected program is executed by creating a 587 byte companion
.COM file. The companion .COM files, which contain the viral
code, will have the read only, system, and hidden attributes set
and the current system date and time when infection occurred.
The following text strings are visible within the viral code:
"*.*"
"*.EXE"
"Well, nobody is going to give a damn when they found your dead,
limp,body in the river next week with a knife through your
heart. They just laugh and say..."
"Good, I hated anyways."
"[VCL]"
"FAKE DARK AVENGER!!!(c) BeePoP / [PuKe] WaReZ 1992"
The third, fourth, and fifth text strings above may be displayed
as a message on the system monitor, accompanied by a system hang,
when an infected program is executed.
Origin: Unknown July, 1994.
VCL.848: VCL.848 is a VCL generated virus received in January,
1996. It infects three .COM files in the current directory
when an infected program is executed. Infected files will
have a file length increase of 848 bytes with the virus being
located at the end of the file. The program's date and time
in the DOS disk directory listing will not be altered. The
following text strings are encrypted within the viral code:
"*.*"
"*.COM"
"Happy birthday SkyIron !"
"From me to me !"
"Viva Croatia !"
"I'm harmless virus"
"Please don't kill me..."
"26.07.197x => D day to remember..."
"When I opened mylittle eyes and"
"Said " Kmeeee "..."
"Thank you Mother Nature..."
"Osk'95...Croatia"
Origin: Unknown January, 1996.
VCL.Angel.436: VCL.Angel.436 is a VCL generated virus received in
July, 1994. It infects one .COM file in the current directory
when an infected program is executed. Infected files will have
a file length increase of 436 bytes with the virus being located
at the end of the file. The program's date and time in the DOS
disk directory listing will not be altered. The following text
strings are visible within the viral code:
"*.COM"
"Angel X v.1.1"
"(c)1993 Laboratorio Luz de Luna y Angel X"
"Lima - Per"
"MUERA FUJIMORI !!!"
It may display the second thru fifth lines of text above as a
message, accompanied by a system hang, when an infected program
is executed.
Origin: Peru July, 1994.
VCL.Blue Moon: VCL.Blue Moon is a VCL generated virus received in
July, 1994. It infects up to four .COM files in the current
directory when an infected program is executed. Infected files
will have a file length increase of 932 bytes with the virus
being located at the end of the file. The program's date and
time in the DOS disk directory listing will not be altered.
The following text strings are encrypted within the viral code:
"THe =BLue Moon= Will Rise.."
"*.COM"
The first text string above may be displayed when infected
programs are executed.
Origin: Unknown July, 1994.
VCL.Elena: VCL.Elena is a VCL generated virus received in July,
1994. It infects one .COM file in the current directory when an
infected program is executed. Infected files will have a file
length increase of 730 bytes with the virus being located at the
end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text
strings are visible within the viral code:
"Elena M."
"Tnx2NMan.."
"*.*"
"Hey Jack! please contact me, I'm in your city! What?
This is a simple virus? Don't worry... it's only a demo!"
"*.COM"
Origin: Unknown July, 1994.
VCL.Noble: VCL.Noble is a VCL generated virus received in August,
1994. VCL.Noble infects all of the .COM files located in the
current directory when an infected program is executed.
Infected files will have a file length increase of 531 bytes
with the virus being located at the beginning of the file. The
program's date and time in the DOS disk directory listing will
not be altered. The following text strings are visible within
the viral code in all infected files:
".. *.* *.COM"
"NOBLE VIRUSþHappy B-Day!"
Origin: Unknown August, 1994.
VCL.Olympic: VCL.Olympic is a VCL generated virus received in
July, 1994. It infects up to five .COM files in the current
directory when an infected program is executed. Infected files
will have a file length increase of 1,440 bytes with the virus
being located at the end of the file. The program's date and
time in the DOS disk directory listing will not be altered. The
following text strings are contained in the viral code, however
all are encrypted with the exception of the last text string
indicated below:
"*.*"
"*.COM"
"Haakon And Kristin Blew It Up Again..."
"This Time They Have Been Fucking Around With The Olympic
Computers, And Managed"
"To Infect A Lot Of Your Computers With A Little Tiny
Destructive Virus..."
"Now, Antonio, You Can't Let Them Runaway With This,
Punish The Little Bastards!"
"Olympic Aid(s) '94 (c) The Penetrator"
Origin: Unknown July, 1994.
VCL.Poisoning: VCL.Poisoning is a VCL generated virus received in
May, 1995. It infects one .EXE file in the current directory
when an infected program is executed by creating a 706 byte
companion .COM file. The companion .COM files, which contain
the viral code, will have the read only, system, and hidden
attributes set and the current system date and time when
infection occurred. No text strings are visible visible
within the viral code.
Origin: Unknown May, 1995.
VCL.Reptoid: VCL.Reptoid is a VCL generated virus received in
July, 1994. It infects up to two .COM files in the current
directory when an infected program is executed. Infected files
will have a file length increase of 2,536 bytes with the virus
being located at the end of the file. The program's date and
time in the DOS disk directory listing will not be altered. The
following text strings are encrypted within the viral code:
".. *.* *.COM"
"Live! From Zeta Reticuli..."
"_Attack of the Reptoids_Starring Earl Gray as
*The Lizard's Assistant*"
Once all of the .COM files in the current directory have become
infected, execution of an infected program will result in the
virus displaying a rapid and short-viewed graphic of a reptoid,
or sort of a face. The screen is then cleared and the program
proceeds to execute.
Origin: Unknown July, 1994.
VCL.Westward: VCL.Westward is a VCL generated virus received in
May, 1995. It infects up to two .COM files in the current
directory when an infected program is executed. Infected files
will have a file length increase of 657 bytes with the virus
being located at the end of the file. The program's date and
time in the DOS disk directory listing will not be altered. The
following text strings are visible within the viral code:
".. *.* *.COM"
"**** Here is a welcome to you for the New Year of 1993 ****"
"Please stand by for more graphics. Loading..."
"[VCL] wESTwARD #001Happy New Year to all!"
The second and third text strings above are displayed as a
message when an infected program is executed.
Origin: Unknown May, 1995.
VCL-409: VCL-409 is a VCL generated virus received in February,
1994. VCL-409 infects all of the .COM, .EXE, .ZIP, .DAT, .SYS,
and .OVL files located in the current directory when an
infected program is executed. Infected files will have the
first 409 bytes overwritten by the viral code, permanently
corrupting them. The following text strings are visible within
the viral code in all infected files:
".. *.COM *.EXE *.ZIP *.DAT *.SYS *.OVL"
"Tempest - â Of Luxemburg Vaginal Discharged"
VCL-409 does not infect files smaller than 409 bytes in length.
Origin: Sweden February, 1994.
VCL-JP2: Received in January, 1994, VCL-JP2 is a 1,919 byte
companion or spawning virus. When an infected program is
executed, this virus will infect one .EXE file in the current
directory by creating a 1,919 byte hidden .COM file with the
same base file name. The hidden .COM file will have the
Read-Only, System and Hidden attributes set, and the system
date and time when infection occurred. The following text
strings are encrypted within the VCL-JP2 viral code:
"[ MK / TridenT ]"
"[TPE 1.3]"
"[VCL] This"
"dicat to ?he fuckn homo"
"Spr"
"gf ?ield's R.A.T."
"LAMERS! Viru?"
"by J.P."
"Paul C"
"ag Davi"
Replicated samples will not infect other files unless the
file attributes are reset by the user.
Origin: Unknown January, 1994.
VCL-Windows: VCL-Windows is a VCL generated virus which was
received in June, 1993. It infects all .COM and .EXE files
in the current directory when an infected program is
executed. Infected programs will have have the first 873
bytes of the host file overwritten by the virus, so for
programs larger than 873 bytes in length, there will be no
increase in size. Programs originally smaller than 873
bytes will become 873 bytes in size after infection. The
file's date and time in the DOS disk directory listing will
not be altered. The VCL-Windows virus displays the
following message accompanied by a scraping sound when an
infected program is executed, along with a system hang:
"This program requires Microsoft Windows."
The above text string is encrypted within the virus, as
are the following additional text strings:
"*.COM *.EXE"
"Hey Toto, I don't think were in
"WINDOZE ëany more!!"
"[VCL] BenderHead '93Windows Virus"
Origin: Unknown June, 1993.
Voco: A 745 byte overwriting virus, Voco infects several .COM or
.EXE files in the current directory when an infected
program is executed. Infected programs will be permanently
corrupted as the virus overwrites the first 745 bytes of the
host program. The host program's date and time in the DOS
disk directory listing will not be altered. Voco doesn't
infect programs smaller than 745 bytes, so infected programs
will not increase in size. The following text strings are
visible within the viral code in all Voco infected programs:
"*.COM *.EXE"
"PATH="
"You Now Have The VoCo BBS Virus. This Virus Was Made By
My Mother The Car."
"*.*"
"This virus is made for all theusers of Voco bbs. And for
theentire country of volusia"
"mayyou all fucking rot in hell:"
Origin: Unknown January, 1993.
VCL-YD2: An 821 byte virus created with version 1.0 of VCL.
This virus infects one .COM file each time an infected
program is executed. Infected programs will have a file
length increase of 821 bytes with the virus being located
at the end of the infected file. The file's date and time
in the DOS disk directory listing will not be altered.
The following text strings are encrypted within the virus
and are not visible in replicated samples:
"*.COM"
"PATH="
"[VCL] [Yankee Doodle 2] Nowhere Man, [NuKE] '92"
Infected systems may experience the song "Yankee Doodle"
between 5:00PM and 7:00PM when an infected program is
executed.
Origin: United States July, 1992.
VCL-YD2B: Based on the VCL-YD2 virus, this variant is one byte
longer, adding 822 bytes to the end of the .COM programs
it infects. It has been altered to avoid detection by
some anti-viral utilities.
Origin: United States October, 1992.
ZipLoc: A 710 byte companion or spawning virus, ZipLoc infects
one .EXE program located in the current directory whenever an
infected program is executed. The companion file will be 710
bytes in length, with the system, hidden, and read-only
attributes set. The file's date and time will be the system
date and time when infection occurred. No text strings are
visible within the viral code. The ZipLoc virus will also
search the directory structure of the current drive for .ZIP
files, and corrupt the .ZIP files it encounters. Once all of
the .EXE files have been infected by the creation of the
matching companion .COM files, the virus will display the
following message:
"System ZipLoc'd"
Origin: Unknown April, 1993.
See: Nowhere Man