VCL Virus


 Virus Name:  VCL 
 Aliases:     Code Zero 
 V Status:    Rare 
 Discovery:   May, 1992 
 Symptoms:    .COM file growth; message 
 Origin:      United States 
 Eff Length:  576 Bytes 
 Type Code:   PNCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, NAV, AVTK, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, NAV/N, 
                    LProt, Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Code Zero, or the original VCL created, virus was received in 
       May, 1992.  It originated in the United States or Canada.  Code Zero 
       is a non-resident, direct action infector of .COM programs, including 
       COMMAND.COM.  The viruses listed below under variants were also 
       created by a version of Nowhere Man's V.C.L., a program whose 
       purpose is to simplify the task of writing viruses. 
 
       When a program infected with the Code Zero virus is executed, the 
       Code Zero virus will search the current directory to locate an 
       uninfected .COM program to infect.  If it finds an uninfected .COM 
       program, it will then infect it, and the host program will 
       continue execution.  If the Code Zero virus does not find an 
       uninfected program, it will display the following message: 
 
               "** CODE ZERO **" 
 
       Programs infected with the Code Zero virus will have a file length 
       increase of 576 bytes.  The virus will be located at the end of the 
       infected file.  The program's date and time in the DOS disk 
       directory listing will not have been altered.  Four text strings 
       can be found in the viral code in infected programs: 
 
               "*.* *.COM" 
               "** CODE ZERO **" 
               "Code Zero Virus" 
               "1992 Nowhere Man/[NukE]" 
 
       Other known viruses created with VCL are: 
       Angel: Angel is a VCL generated virus received in February, 1994. 
                It is a non-resident, direct action infector of .COM 
                programs, including COMMAND.COM.  Angel infects one .COM 
                file located in the current directory each time an infected 
                program is executed.  Infected programs will have a file 
                length increase of 1,681 bytes with the virus being located 
                at the end of the file.  The file's date and time in the DOS 
                disk directory listing will not be altered.  The following 
                text strings are encrypted within the Angel viral code: 
                "*.* *.COM" 
                "COMMAND.COM" 
                "CHKLIST.MS" 
                "Your computer was infected with ANGEL" 
                "virus!" 
                "Don't be afraid it's harmless!" 
                "Today is 21st of february, my birthday!" 
                "Be young, be crazy, be nice, be ANGEL!" 
                "HI! Don't forget: ANGEL is watching you!" 
                File allocation table (FAT) corruption may occur on infected 
                disks.  After all of the .COM programs are infected, the 
                virus will display the following message: 
                "HI! Don't forget: ANGEL is watching you!" 
                On February 21st of any year, the virus will display the 
                following message in graphic characters when an infected 
                program is executed: 
                "Your computer was infected with ANGEL virus! 
                 Don't be afraid it's harmless! 
                 Today is 21st of february, my birthday! 
                 Be young, be crazy, be nice, be ANGEL!" 
                Origin:  Unknown  February, 1994. 
       Arwen3: Arwen3 is a VCL generated virus which was received in 
                April, 1993.  It infects one .COM file in the current 
                directory each time an infected program is executed. 
                Infected programs will have a file length increase of 722 
                bytes with the virus being located at the end of the file. 
                The file's date and time in the DOS disk directory listing 
                will not be altered.  The following text strings are 
                encrypted within the Arwen3 viral code: 
                "Arwen3 is a fat sow" 
                "*.COM" 
                "[VCL]" 
                System hangs sometimes occur when infected programs are 
                executed. 
                Origin:  Unknown  April, 1993. 
       B-52: B-52 is a VCL generated virus which also contains code 
                generated by the PS-MPC virus generation program.  B-52 is 
                a non-resident, direct action infector of .COM programs, 
                including COMMAND.COM.  It infects two .COM programs each 
                time an infected program is executed.  Infected programs 
                have a file length increase of 3,808 bytes with the virus 
                being located at the end of the file.  The program's date 
                and time in the DOS disk directory listing will not be 
                altered.  Many text strings can be found within the viral 
                code in all infected programs, including: 
                ".. *.* *.COM" 
                "c:\dos\*.com" 
                "AT&FL0M0DT911" 
                "[MPC] Call 911" 
                "*.exe *.com .. *.exe" 
                "Abort, Retry, Ignore, Fail?" 
                "Fail on INT 24" 
                "I'm hungry! Insert PIZZA & BEER in to drive A: and" 
                "Strike any key when ready..." 
                "Impotence error reading user's dick" 
                "Program too big to fit in memory" 
                "Cannot load COMMAND, system halted" 
                "I'm sorry, Dave.... but I'm afraid I can't do that!" 
                "[vcl] 
                Origin:  Unknown  March, 1993. 
       Beva 32: Beva 32 is a VCL generated virus which was received in 
                February, 1993.  It infects one .COM file in the current 
                directory, or one directory up in the directory structure, 
                each time an infected program is executed.  Infected 
                programs will have a file length increase of 562 bytes with 
                the virus being located at the end of the file.  The file's 
                date and time in the DOS disk directory listing will not 
                be altered.  The Beva 32 virus activates on the 22nd day of 
                any month, at which time it will attempt to display the 
                following message: 
                "Whats wrong with my computer, you ask? 
                 Well I do believe it has been" 
                "infected. Have a nice day!" 
                The above text is encrypted within the virus, as are the 
                following text strings: 
                "[VCL/BEv]" 
                ".. *.COM" 
                Origin:  Oregon, United States  February, 1993. 
       Beva 33: Beva 33 is a VCL generated virus which was received in 
                February, 1993.  It infects one .COM file in the current 
                directory, or one directory up in the directory structure, 
                each time an infected program is executed.  Infected 
                programs will have a file length increase of 519 bytes with 
                the virus being located at the end of the file.  The file's 
                date and time in the DOS disk directory listing will not 
                be altered.  The Beva 33 virus activates on January 1st of 
                any year, at which time it will attempt to display the 
                following message: 
                "Happy New Years, Eat my viril infected hardware!" 
                The above text is encrypted within the virus, as are the 
                following text strings: 
                "[VCL/BEv]" 
                ".. *.COM" 
                "-=BEv#A33=-" 
                Origin:  Oregon, United States  February, 1993. 
       Beva 96: Beva 96 is a VCL generated virus which was received in 
                February, 1993.  It infects one .COM file in the current 
                directory, or one directory up in the directory structure, 
                each time an infected program is executed.  Infected 
                programs will have a file length increase of 516 bytes with 
                the virus being located at the end of the file.  The file's 
                date and time in the DOS disk directory listing will not 
                be altered.  The Beva 96 virus activates on July 4th of any 
                year, at which time it will attempt to display the following 
                message: 
                "Happy 4th! Hope you enjoy your messed up computer!" 
                "-=BEv#A96=-" 
                The above text is encrypted within the virus, as are the 
                following text strings: 
                "[VCL/BEv]" 
                ".. *.COM" 
                Origin:  Oregon, United States  February, 1993. 
       BigTime: BigTime is a VCL generated virus which was received in 
                March, 1993.  It infects several .COM files in the current 
                directory each time an infected program is executed. 
                Infected programs will have a file length increase of 676 
                bytes with the virus being located at the end of the file. 
                The file's date and time in the DOS disk directory listing 
                will not be altered.  The following text strings are 
                encrypted within the viral code: 
                ".. *.* *.COM" 
                "[VCL] VIRUSES!!  HACKERS!!" 
                "Who ya gonna call???Not McAfee Associates!!! 
                "They Suck BIGTIME!!!   [DJ]" 
                System hangs may frequently occur when infected programs 
                are executed. 
                Origin:  Unknown  March, 1993. 
       CD Player: CD Player is a VCL generated virus which was received 
                in June, 1993.  It infects all of the .COM and .EXE files 
                in the current directory when an infected program is 
                executed.  A sound similar to the sound made by a "scratch" 
                on a record is emitted on the system speaker, and the system 
                is rebooted.  Infected programs will have the virus 610 
                bytes of the host program overwritten by the CD Player 
                viral code.  The program's date and time in the DOS disk 
                directory listing will not be altered. 
                Origin:  Unknown  June, 1993. 
       Chicken Pox: Chicken Pox is a VCL generated virus which was 
                received in January, 1993.  It infects three .COM files in 
                the current directory, or along the system path, when an 
                infected program is executed.  Infected programs will 
                increase in size by 604 bytes with the virus being located 
                at the end of the file.  The program's date and time in the 
                DOS disk directory listing will not be altered.  System 
                hangs frequently occur when infected programs are executed, 
                as well as write protect errors when the user attempts to 
                execute infected programs from write-protected diskettes. 
                Origin:  Unknown  January, 1993. 
       Code Zero-652: A 652 byte variant of the Code Zero virus 
                described above.  It was created by Nowhere Man by 
                recompiling the Code Zero virus described above with VCL 
                version 1.0.  This variant infects one .COM file each 
                time an infected program is executed.  Infected programs 
                will have a file length increase of 652 bytes with the 
                virus being located at the end of the infected file.  The 
                file's date and time in the DOS disk directory listing 
                will not be altered.  The following text strings are 
                encrypted within the virus and are not visible in 
                replicated samples: 
                "*.* *.COM" 
                "** CODE ZERO **" 
                "[VCL] [Code Zero] Nowhere Man, [NuKE] '92" 
                Once all of the .COM programs in the current directory 
                have become infected, execution of the next infected 
                program will result in a display of the following 
                message: 
                "** CODE ZERO" 
                Systems infected by the Code Zero-652 virus may 
                experience their keyboard becoming locked out after an 
                an infected program is executed. 
                Origin:  United States  July, 1992. 
       Cops-1: Cops-1 is a VCL generated virus which was received in 
                April, 1993.  It infects four .COM files in the current or 
                higher level directory each time an infected program is 
                executed.  Infected programs will have a file length 
                increase of 1,083 bytes with the virus being located at the 
                end of the file.  The file's date and time in the DOS disk 
                directory listing will not be altered.  The following text 
                strings are encrypted the Cops-1 viral code: 
                ".. *.COM" 
                "Your Computer has been one of the many" 
                "to be tortured by the CoPs-1 virus, one" 
                "of the many to come. Made by CoPs in 1993." 
                "I guess today really isn't a lucky" 
                "day for you, because you have been" 
                "hit with the CoPs-1 virus." 
                "It has been a year since this virus has been" 
                "released, and the CoPs-1 virus is still going" 
                "strong. This Virus Was Made By CoPs" 
                "in 1993.Your Computer Has Been Honored" 
                "By Being Able To Witness TheWrath of The" 
                "Infamous CoPs-1 Virus. Made By CoPs in 1993." 
                Rapid beeping and a system hang may occur whenever an 
                infected program is executed. 
                Origin:  Unknown  April, 1993. 
       Crasher: Crasher is a VCL generated virus received in June, 1993. 
                It infects five .COM files in the current or a higher level 
                directory each time an infected program is executed. 
                Infected programs will have a file length increase of 594 
                bytes with the virus being located at the end of the file. 
                The file's date and time in the DOS disk directory listing 
                will not be altered.  The following text strings are 
                encrypted within the Crasher viral code: 
                ".. *.* *.COM" 
                "CRASHER" 
                Origin:  Unknown  April, 1993. 
       Dial: Dial is a VCL generated virus which was received in 
                March, 1993.  It infects four .COM files in the current 
                directory each time an infected program is executed. 
                Infected programs will have a file length increase of 599 
                bytes with the virus being located at the end of the file. 
                The file's date and time in the DOS disk directory listing 
                will not be altered.  The following text strings are 
                visible within the viral code in all infected programs: 
                ".. *.* *.COM" 
                "AT&FM0L0DT9008201110"      (Note: occurs 4 times) 
                "[VCL]" 
                The text string above starting with "AT" is a command 
                string to dial the included phone number on Hayes compatible 
                modems.  Area Code 900 phone numbers typically carry a 
                per minute connection fee, and the owner of the above phone 
                number doesn't have a connection to this virus. 
                Origin:  North America  March, 1993. 
       Diarrhea: Diarrhea is a VCL generated virus which was received 
             in September, 1992.  It infects one .COM file in the current 
             directory, or along the system path, when an infected program 
             is executed.  Infected programs will increase in size by 931 
             bytes with the virus being located at the end of the file. 
             Diarrhea activates on Fridays when execution of an infected 
             program results in the display of the message 
             "EAT MY DIARRHEA!" in graphic characters made of ASCII line 
             characters, with the following text below in normal text 
             characters: "--GG Allin & The Texas Nazi".  If ANSI.SYS is 
             loaded, the first message will be in red, with the second line 
             being in yellow. 
             Origin:  United States  September, 1992. 
       Diarrhea6: Diarrhea6 is a later version of Diarrhea.  It adds 
             1,221 bytes to the .COM programs it infects.  Like the original 
             virus it activates on Fridays.  In the case of Diarrhea6, it 
             will trojanize an .EXE program in the current directory when an 
             infected program is executed, overwriting the first 596 bytes. 
             When the trojanized .EXE program is then executed, it will 
             display the message from the Diarrhea virus, though a flashing 
             border has been added to the display which will be bright blue 
             if ANSI.SYS is loaded. 
             Origin:  United States  September, 1992. 
       Diarrhea6 Trojan: The trojan dropped by the Diarrhea6 virus on 
             Fridays when a Diarrhea6 infected .COM program is executed. 
             .EXE programs trojanized by the virus will have the first 596 
             bytes overwritten with a small program to produce the 
             display message for the virus. 
             Origin:  United States  September, 1992. 
       Diogenes: Diogenes is based on the Diarrhea virus described 
             above, and has been specifically coded to avoid detection by 
             anti-viral utilities which can detect some VCL generated 
             viruses.  It adds 846 bytes to the .COM programs it infects. 
             Diogenes activates on the 31st of any month, at which time it 
             will overwrite the first 718 sectors of the C: drive with the 
             following text strings: 
             "DIOGENES 2.0 has visited you hard drive....." 
             "This has been another fine product of the Lehigh Valley." 
             "Watch (out) for future 'upgrades'." 
             "The world's deceit has raped my soul.  We melt the plastic 
              people down, then we melt their plastic town....." 
             These messages are not visible within the viral code in 
             infected programs as they are encrypted. 
             Origin:  United States  October, 1992. 
       DM 92 Bios: DM 92 Bios is a VCL generated virus which was 
             received in November, 1992.  DM 92 Bios infects two programs 
             in the current directory, with preference to .EXE files, each 
             time an infected program is executed.  Infected programs will 
             have the first 457 bytes overwritten by the viral code, 
             permanently corrupting them.  The following text strings are 
             encrypted within the viral code: 
             ".. *.* *.COM *.EXE" 
             "DM-92 BIOS Virus" 
             Origin:  Unknown  November, 1992. 
       Dome: Dome is a VCL generated virus which was isolated in 
             Canada in August, 1992.  It overwrites the first 546 bytes 
             of .EXE programs, as well as COMMAND.COM.  It contains the 
             text strings: 
             "*.* *.EXE" 
             "Divide overflow" 
             "*.COM [VCL] DOME" 
             Origin:  Canada  August, 1992. 
       Dome2: A variant of Dome, also generated by VCL.  This variant 
             overwrites two .COM or .EXE programs each time an infected 
             program is executed.  It may also overwrite the hidden 
             system files and .BAT files, and alter the disk boot sector. 
             Unlike Dome, this variant overwrites the entire host program. 
             No text strings are visible in infected programs as they 
             are encrypted. 
             Origin:  Canada  August, 1992. 
       Dome3: Another Dome variant, this one creates 433 byte 
             companion .COM files for the .EXE programs located in the 
             current directory.  The companion .COM files are hidden, 
             and contain the following text strings: 
             "Divide overflow" 
             "*.* [VCL] DOME3" 
             "*.* *.EXE" 
             Origin:  Canada  August, 1992. 
       Dome4: Another minor variant of the Dome variant, this one has 
              one byte which differs.  In addition to infecting .EXE 
              programs by overwriting the host program, it will also 
              corrupt .COM programs.  Executing one of the corrupted .COM 
              programs will give unpredictable results, including 
              unexpected system reboots. 
              Origin:  Unknown  October, 1992. 
       Donatello: Donatello is a 827 byte virus created with VCL 1.0. 
                This virus infects three .COM programs when it is executed. 
                Infected programs will have a file length increase of 827 
                bytes with the virus being located at the end of the file. 
                The program's date and time in the DOS disk directory 
                listing will not be altered.  The following text strings 
                are encrypted within the viral code, and as such are not 
                visible in infected files: 
                "Cowabunga, dudes!  It's Donatello!" 
                "(Hey, John, can I be on Nightline too?)" 
                "[VCL] [Donatello] Nowhere Man, [NuKE] '92" 
                "Hey, Donatello, be like Mike!" 
                "*.COM" 
                System hangs may occur when infected programs are executed, 
                and the first two text strings above displayed as a message. 
                On some systems, a "Divide overflow" error will occur when 
                infected programs are executed, and no files will be 
                infected. 
                Origin:  United States  July, 1992. 
       E-Coli: Received in April, 1993, E-Coli is a 706 byte companion 
                or spawning virus.  When an infected program is executed, 
                this virus will infect one .EXE file in the current 
                directory by creating a 706 byte hidden .COM file with the 
                same base file name.  The hidden .COM file will have the 
                Read-Only, System and Hidden attributes set, and the system 
                date and time when infection occurred.  The following text 
                strings are encrypted within the E-Coli viral code: 
                "[VCL] This virus is for corporate" 
                "America for poisoning the peopl" 
                ".. *.* *.EXE" 
                Replicated samples will not infect other files unless the 
                file attributes are reset by the user. 
                Origin:  Unknown  April, 1993. 
       Earth Day: Earth Day is a 797 byte virus created with VCL 1.0. 
                This virus infects one .COM file each time an infected 
                program is executed.  Infected programs will have a file 
                length increase of 797 bytes with the virus being located 
                at the end of the infected file.  The file's date and time 
                in the DOS disk directory listing will not be altered. 
                The following text strings are encrypted within the virus 
                and are not visible in replicated samples: 
                "*.* *.COM" 
                "Happy Earth Day!!!" 
                "In the spirit of Earth Day, this VIRUS has recycled 
                 your hard disk." 
                "[VCL] [Code Zero] Nowhere Man, [NuKE] '92" 
                Systems infected by the Earth Day virus may experience 
                their keyboard becoming locked out after an infected 
                program is executed.  "Divide overflow" errors may 
                frequently occur when infected programs are executed.  The 
                virus contains code to display the message indicated above 
                and overwrite the system hard disk. 
                Origin:  United States  July, 1992. 
       Earthquake: Received in January, 1993, Earthquake is a 1,145 byte 
             companion or spawning virus.  When an infected program is 
             executed, this virus will infect one .EXE file in the current 
             directory by creating a 1,145 byte hidden .COM file with the 
             same base file name.  The hidden .COM file will have the 
             Read-Only and Hidden attributes set, and the system date and 
             time when infection occurred.  The following text strings are 
             encrypted within the Earthquake viral code: 
             ".. *.* *.EXE" 
             "* * * Earthquake Warning! * * *" 
             "Head for the hills!" 
             "Take cover!!!" 
             "Whew!  We Made It!" 
             "-=[VCL/BEv]=-" 
             System hangs will frequently occur on infected systems. 
             Origin:  Unknown  January, 1993. 
       Family: Family is a VCL generated virus which was received in 
                March, 1993.  It infects two .COM files in the current 
                directory each time an infected program is executed. 
                Infected programs will have a file length increase of 663 
                bytes with the virus being located at the end of the file. 
                The file's date and time in the DOS disk directory listing 
                will not be altered.  The following text strings are 
                visible within the viral code in all infected programs: 
                ".. *.* *.COM" 
                "Another failure of Traditional Family Values!  Oh no!" 
                "[VCL]" 
                The second text string above may be displayed as a message 
                in flashing text when an infected program is executed. 
                Origin:  Unknown  March, 1993. 
       Garfield: Garfield is a VCL generated virus which was received in 
                July, 1993.  It infects one .COM file in the current 
                directory each time an infected program is executed. 
                Infected programs will have a file length increase of 515 
                bytes with the virus being located at the end of the file. 
                The file's date and time in the DOS disk directory listing 
                will not be altered.  The following text strings are 
                visible within the viral code in all infected programs: 
                ".. *.* *.COM" 
                "You got da Garfield Virus, Have a nice MONDAY[HAL]" 
                Origin:  Unknown  July, 1993. 
       Handler: Handler is a VCL generated virus which was received in 
                April, 1993.  It infects three .COM files in the current 
                directory each time an infected program is executed. 
                Infected programs will have a file length increase of 420 
                bytes with the virus being located at the end of the file. 
                The file's date and time in the DOS disk directory listing 
                will not be altered.  The following text strings are 
                encrypted within the viral code in all infected programs: 
                "*.COM" 
                "[VCL] beep beepHandler is a fag!" 
                Origin:  Unknown  April, 1993. 
       Heevahava: Heevahava is a VCL generated virus which was isolated 
                in the United States in September, 1992.  It infects two 
                .EXE programs in the current directory each time an 
                infected program is executed by creating companion files. 
                The companion files created by the Heevahava virus will 
                be 514 bytes long and have the read only, system, and 
                hidden attributes set.  The base file name will correspond 
                to an .EXE program in the directory, and the file's date 
                will be the system date when the companion file was created. 
                The following text can be found in the Heevahava virus 
                hidden companion files: 
                "Only heeva-hava's get stuck with THE HEEVAHAVA virus!" 
                "HEEVA[VCL]" 
                "*.* *.EXE" 
                Origin:  United States  September, 1992. 
       Kinison: An 806 byte virus created with VCL version 1.0.  This 
                virus infects one .COM file each time an infected program 
                is executed.  Infected programs will have a file length 
                increase of 806 bytes with the virus being located at the 
                end of the infected file.  The file's date and time in the 
                DOS disk directory listing will not be altered.  The 
                following text strings are encrypted within the virus and 
                are not visible in replicated samples: 
                "*.* *.COM" 
                "DIE BITCH!!!!! AHHHHHHHH!!!!!!!" 
                "[VCL] This *VIRUS* is dedicated to the memory of Sam 
                 Kinsion, 1954-1992 [Kinison]" 
                "Nowhere Man, [NuKE] '92" 
                Systems infected by the Kinison virus may experience 
                their keyboard becoming locked out after an infected 
                program is executed.  "Divide overflow" errors may 
                frequently occur when infected programs are executed. 
                Kinison activates on any Friday the 11th, at which time 
                it will display its message and trash the system hard 
                disk. 
                Origin:  United States  July, 1992. 
       Kinnison-734: Kinnison-734 is a variant of the Kinison virus 
                described above.  This variant is two bytes longer, 
                and contains the following text strings: 
                "*.* *.COM" 
                "DIE BITCH!!!!! AHHHHHHHH!!!!!!!" 
                "[VCL] Dedicated to the memory of" 
                "Sam Kinnison 1954-1992" 
                "[Kinnison Nowhere Man, [NuKE] '92" 
                Origin:  Canada  August, 1992. 
       McYellow: McYellow is a VCL generated virus received in May, 
                1993.  It infects three .COM files or one .EXE file located 
                in the current directory each time an infected program is 
                executed.  It then displays the following message in yellow 
                blocked graphic characters on the system display: 
                " MCAFEE 
                 IS A FAG" 
                On non-VGA systems, the display may just appear to have 
                been cleared.  Infected programs will have the first 1,297 
                bytes of the host program overwritten by the viral code. 
                The file's date and time in the DOS disk directory listing 
                will not be altered.  The following text strings are visible 
                within the viral code in all infected programs: 
                "*.EXE *.COM" 
                Origin:  Unknown  May, 1993. 
       Miles: Received in June, 1993, Miles is a 480 byte companion 
                or spawning virus.  When an infected program is executed, 
                this virus will infect one .EXE file in the current 
                directory by creating a 480 byte hidden .COM file with the 
                same base file name.  The hidden .COM file will have the 
                Read-Only, System and Hidden attributes set, and the system 
                date and time when infection occurred.  The following text 
                strings are visible within the Miles viral code: 
                ".. *.* *.EXE" 
                "... miles to go before I sleep." 
                On the 3rd day of any month, execution of infected files 
                will result in the virus displaying the second text line 
                above as a message on the system display.  Replicated samples 
                will not infect other files, or display the message on the 
                3rd, unless the file attributes are reset by the user. 
                Origin:  Unknown  June, 1993. 
       Pearl Harbor: A 930 byte virus created with VCL.  This virus 
                infects one .EXE file smaller than 64K each time an 
                infected program is executed.  Unlike other VCL viruses, 
                Pearl Harbor is a spawning or companion virus, so no 
                changes will occur to the infected .EXE programs.  Instead, 
                a 930 byte .COM file is created with the same base file 
                name as the .EXE program being infected.  The 930 byte 
                .COM file will have attributes of read-only, system, and 
                hidden, so it is not visible in the DOS disk directory 
                listing.  The file date and time on the hidden .COM file 
                will be the system date and time when infection occurred. 
                The following text strings are encrypted within the virus 
                and are not visible in replicated samples: 
                "December 7th, 1941 -- A day that will live in infamy..." 
                "*** REMEMBER PEARL HARBOR ***" 
                "C:\*.* [VCL]" 
                "Dedicated to the memories of the brave American men and 
                 women who gave their lives at [Pearl Harbor]." 
                "Nowhere Man, [NuKE] '92" 
                Pearl Harbor activates on December 7th, at which time it 
                will display the following message when an infected 
                program is executed, as well as attempt to write to 
                device PRN or LPT1: 
                "December 7th, 1941 -- A day that will live in infamy..." 
                "                                                       " 
                "*** REMEMBER PEARL HARBOR ***" 
                This virus also contains code to corrupt files located in 
                the C: drive root directory, but it may not actually be 
                executed. 
                Origin:  United States  July, 1992. 
       Pro-Choice: Pro-Choice is a VCL generated virus received in 
                April, 1993.  It infects five .COM files in the current 
                directory each time an infected program is executed. 
                Infected programs will have a file length increase of 1,569 
                bytes with the virus being located at the end of the file. 
                The file's date and time in the DOS disk directory listing 
                will not be altered.  The following text strings are 
                encrypted within the viral code in all infected programs: 
                ".. *.* *.COM" 
                "Hello, all fascist narrow-minded jerks!! 
                 This one's for you" 
                "The phc Virus has infected your system!!!" 
                "HAHAHAHAHAHAHAHA!" 
                "I hope this makes you think twice about restricting a 
                 person's freedom of" 
                "choice and limiting his/her decision about aborting a 
                 baby. I also hope that" 
                "this demonstrates that fucking up someone's life in the 
                 name of an unborn" 
                "child is OK. Not. Have a wonderful day." 
                "And may corrupted programming reign!! Long live Jim Shorts" 
                "[VCL] Pro-Choice Virus" 
                System hangs may occur when infected programs are executed, 
                as well as the second text string above may be displayed 
                as a message. 
                Origin:  Unknown  April, 1993. 
       Red Team: Red Team is a VCL generated virus which was received in 
                June, 1993.  It infects four .COM files in the current 
                directory each time an infected program is executed. 
                Infected programs will have a file length increase of 716 
                bytes with the virus being located at the end of the file. 
                The file's date and time in the DOS disk directory listing 
                will not be altered.  The following text strings are 
                encrypted within the viral code: 
                ".. *.* *.COM" 
                "Now YOU are a part of the Red Team!" 
                "by Dark in 93" 
                Red Team activates on Wednesdays, when it will display the 
                last two text strings above as a message accompanied by a 
                scraping sound and a system hang. 
                Origin:  Unknown  June, 1993. 
       VCL.279: VCL.279 is a VCL generated virus received in May, 
             1995.  It infects two .EXE files in the current directory when 
             an infected program is executed by creating a 279 byte companion 
             .COM file.  The companion .COM files, which contain the viral 
             code, will have the read only, system, and hidden attributes set 
             and the current system date and time when infection occurred. 
             The following text strings are visible within the viral code: 
             "*.EXE" 
             "[VCL_MUT] The Pleasure 2 VirusEver have the pleasure?" 
             "By eMpIrE-X" 
             Origin:  Unknown  May, 1995. 
       VCL.288: VCL.288 is a VCL generated virus received in May, 1995. 
             It infects two or three .EXE files in the current directory when 
             an infected program is executed by overwriting the first 288 
             bytes of the host program.  The file's date and time in the DOS 
             disk directory listing will not be altered.  The following text 
             strings are visible within the viral code: 
             "*.EXE" 
             "[VCL_MUT] The Pleasure 3 VirusEver have the pleasure?" 
             "By eMpIrE-X" 
             Origin:  Unknown  May, 1995. 
       VCL.302: VCL.302 is a VCL generated virus received in May, 1995. 
             It infects three .COM or .EXE files in the current directory 
             when an infected program is executed by overwriting the first 
             302 bytes of the host program.  The file's date and time in the 
             DOS disk directory listing will not be altered.  The following 
             text strings are visible within the viral code: 
             "*.COM *.EXE" 
             "[VCL_MUT] The Pleasure 4 VirusEver have the pleasure?" 
             "By eMpIrE-X" 
             Origin:  Unknown  May, 1995. 
       VCL.316: VCL.316 is a VCL generated virus received in May, 1995. 
             It infects three .EXE files in the current directory when 
             an infected program is executed by creating a 316 byte companion 
             .COM file.  The companion .COM files, which contain the viral 
             code, will have the read only, system, and hidden attributes set 
             and the current system date and time when infection occurred. 
             The following text strings are visible within the viral code: 
             ".. *.EXE" 
             "[VCL_MUT] The Pleasure 6 VirusEver have the pleasure?" 
             "By eMpIrE-X" 
             System hangs may occur when infected programs are executed. 
             Origin:  Unknown  May, 1995. 
       VCL.457: VCL.457 is a VCL generated virus which was received in 
             May, 1995.  It is very similar to the DM 92 Bios virus also 
             generated using VCL.  VCL.457 infects two .COM or .EXE programs 
             in the current directory, with preference to .COM files, each 
             time an infected program is executed.  Infected programs will 
             have the first 457 bytes overwritten by the viral code, 
             permanently corrupting them.  The following text strings are 
             encrypted within the viral code: 
             ".. *.* *.COM *.EXE" 
             "Mad Satan Virus." 
             Origin:  Unknown  May, 1995. 
       VCL.512: VCL.512 is a VCL generated virus received in May, 1995. 
             VCL.512 infects three .COM files in the current directory when 
             an infected program is executed.  Infected files will have a 
             file length increase of 512 bytes with the virus being located 
             at the end of the file.  The program's date and time in the DOS 
             disk directory listing will not be altered.  The following text 
             strings are visible within the viral code: 
             ".. *.* *.COM" 
             "[VCL_MUT] This is a Pleasure VirusPlease have the 
              PleasureVirus by eMpIrE-X" 
             Origin:  Unknown  May, 1995. 
       VCL.551: VCL.551 is a VCL generated virus received in July, 1994. 
             VCL.551 infects two .COM files in the current directory when an 
             infected program is executed.  Infected files will have a file 
             length increase of 551 bytes with the virus being located at the 
             end of the file.  The program's date and time in the DOS disk 
             directory listing will not be altered.  The following text 
             strings are encrypted within the viral code: 
             "*.*" 
             "*.COM" 
             Origin:  Unknown  July, 1994. 
       VCL.587: VCL.587 is a VCL generated virus received in July, 1994. 
             VCL.587 infects three .EXE files in the current directory when an 
             infected program is executed by creating a 587 byte companion 
             .COM file.  The companion .COM files, which contain the viral 
             code, will have the read only, system, and hidden attributes set 
             and the current system date and time when infection occurred. 
             The following text strings are visible within the viral code: 
             "*.*" 
             "*.EXE" 
             "Well, nobody is going to give a damn when they found your dead, 
              limp,body in the river next week with a knife through your 
              heart.  They just laugh and say..." 
             "Good, I hated anyways." 
             "[VCL]" 
             "FAKE DARK AVENGER!!!(c) BeePoP / [PuKe] WaReZ 1992" 
             The third, fourth, and fifth text strings above may be displayed 
             as a message on the system monitor, accompanied by a system hang, 
             when an infected program is executed. 
             Origin:  Unknown  July, 1994. 
       VCL.848: VCL.848 is a VCL generated virus received in January, 
             1996. It infects three .COM files in the current directory 
             when an infected program is executed.  Infected files will 
             have a file length increase of 848 bytes with the virus being 
             located at the end of the file.  The program's date and time 
             in the DOS disk directory listing will not be altered.  The 
             following text strings are encrypted within the viral code: 
             "*.*" 
             "*.COM" 
             "Happy birthday SkyIron !" 
             "From me to me !" 
             "Viva Croatia !" 
             "I'm harmless virus" 
             "Please don't kill me..." 
             "26.07.197x => D day to remember..." 
             "When I opened mylittle eyes and" 
             "Said " Kmeeee "..." 
             "Thank you Mother Nature..." 
             "Osk'95...Croatia" 
             Origin:  Unknown  January, 1996. 
       VCL.Angel.436: VCL.Angel.436 is a VCL generated virus received in 
             July, 1994.  It infects one .COM file in the current directory 
             when an infected program is executed.  Infected files will have 
             a file length increase of 436 bytes with the virus being located 
             at the end of the file.  The program's date and time in the DOS 
             disk directory listing will not be altered.  The following text 
             strings are visible within the viral code: 
             "*.COM" 
             "Angel X v.1.1" 
             "(c)1993 Laboratorio Luz de Luna y Angel X" 
             "Lima - Per" 
             "MUERA FUJIMORI !!!" 
             It may display the second thru fifth lines of text above as a 
             message, accompanied by a system hang, when an infected program 
             is executed. 
             Origin:  Peru  July, 1994. 
       VCL.Blue Moon: VCL.Blue Moon is a VCL generated virus received in 
             July, 1994.  It infects up to four .COM files in the current 
             directory when an infected program is executed.  Infected files 
             will have a file length increase of 932 bytes with the virus 
             being located at the end of the file.  The program's date and 
             time in the DOS disk directory listing will not be altered. 
             The following text strings are encrypted within the viral code: 
             "THe =BLue Moon= Will Rise.." 
             "*.COM" 
             The first text string above may be displayed when infected 
             programs are executed. 
             Origin:  Unknown  July, 1994. 
       VCL.Elena: VCL.Elena is a VCL generated virus received in July, 
             1994.  It infects one .COM file in the current directory when an 
             infected program is executed.  Infected files will have a file 
             length increase of 730 bytes with the virus being located at the 
             end of the file.  The program's date and time in the DOS disk 
             directory listing will not be altered.  The following text 
             strings are visible within the viral code: 
             "Elena M." 
             "Tnx2NMan.." 
             "*.*" 
             "Hey Jack! please contact me, I'm in your city! What? 
              This is a simple virus? Don't worry... it's only a demo!" 
             "*.COM" 
             Origin:  Unknown  July, 1994. 
       VCL.Noble: VCL.Noble is a VCL generated virus received in August, 
             1994.  VCL.Noble infects all of the .COM files located in the 
             current directory when an infected program is executed. 
             Infected files will have a file length increase of 531 bytes 
             with the virus being located at the beginning of the file.  The 
             program's date and time in the DOS disk directory listing will 
             not be altered.  The following text strings are visible within 
             the viral code in all infected files: 
             ".. *.* *.COM" 
             "NOBLE VIRUSHappy B-Day!" 
             Origin:  Unknown  August, 1994. 
       VCL.Olympic: VCL.Olympic is a VCL generated virus received in 
             July, 1994.  It infects up to five .COM files in the current 
             directory when an infected program is executed.  Infected files 
             will have a file length increase of 1,440 bytes with the virus 
             being located at the end of the file.  The program's date and 
             time in the DOS disk directory listing will not be altered.  The 
             following text strings are contained in the viral code, however 
             all are encrypted with the exception of the last text string 
             indicated below: 
             "*.*" 
             "*.COM" 
             "Haakon And Kristin Blew It Up Again..." 
             "This Time They Have Been Fucking Around With The Olympic 
              Computers, And Managed" 
             "To Infect A Lot Of Your Computers With A Little Tiny 
              Destructive Virus..." 
             "Now, Antonio, You Can't Let Them Runaway With This, 
              Punish The Little Bastards!" 
             "Olympic Aid(s) '94 (c) The Penetrator" 
             Origin:  Unknown  July, 1994. 
       VCL.Poisoning: VCL.Poisoning is a VCL generated virus received in 
             May, 1995.  It infects one .EXE file in the current directory 
             when an infected program is executed by creating a 706 byte 
             companion .COM file.  The companion .COM files, which contain 
             the viral code, will have the read only, system, and hidden 
             attributes set and the current system date and time when 
             infection occurred.  No text strings are visible visible 
             within the viral code. 
             Origin:  Unknown  May, 1995. 
       VCL.Reptoid: VCL.Reptoid is a VCL generated virus received in 
             July, 1994.  It infects up to two .COM files in the current 
             directory when an infected program is executed.  Infected files 
             will have a file length increase of 2,536 bytes with the virus 
             being located at the end of the file.  The program's date and 
             time in the DOS disk directory listing will not be altered.  The 
             following text strings are encrypted within the viral code: 
             ".. *.* *.COM" 
             "Live!  From Zeta Reticuli..." 
             "_Attack of the Reptoids_Starring Earl Gray as 
              *The Lizard's Assistant*" 
             Once all of the .COM files in the current directory have become 
             infected, execution of an infected program will result in the 
             virus displaying a rapid and short-viewed graphic of a reptoid, 
             or sort of a face.  The screen is then cleared and the program 
             proceeds to execute. 
             Origin:  Unknown  July, 1994. 
       VCL.Westward: VCL.Westward is a VCL generated virus received in 
             May, 1995.  It infects up to two .COM files in the current 
             directory when an infected program is executed.  Infected files 
             will have a file length increase of 657 bytes with the virus 
             being located at the end of the file.  The program's date and 
             time in the DOS disk directory listing will not be altered.  The 
             following text strings are visible within the viral code: 
             ".. *.* *.COM" 
             "****  Here is a welcome to you for the New Year of 1993  ****" 
             "Please stand by for more graphics.  Loading..." 
             "[VCL] wESTwARD #001Happy New Year to all!" 
             The second and third text strings above are displayed as a 
             message when an infected program is executed. 
             Origin:  Unknown  May, 1995. 
       VCL-409: VCL-409 is a VCL generated virus received in February, 
             1994.  VCL-409 infects all of the .COM, .EXE, .ZIP, .DAT, .SYS, 
             and .OVL files located in the current directory when an 
             infected program is executed.  Infected files will have the 
             first 409 bytes overwritten by the viral code, permanently 
             corrupting them.  The following text strings are visible within 
             the viral code in all infected files: 
             ".. *.COM *.EXE *.ZIP *.DAT *.SYS *.OVL" 
             "Tempest -  Of Luxemburg Vaginal Discharged" 
             VCL-409 does not infect files smaller than 409 bytes in length. 
             Origin:  Sweden  February, 1994. 
       VCL-JP2: Received in January, 1994, VCL-JP2 is a 1,919 byte 
                companion or spawning virus.  When an infected program is 
                executed, this virus will infect one .EXE file in the current 
                directory by creating a 1,919 byte hidden .COM file with the 
                same base file name.  The hidden .COM file will have the 
                Read-Only, System and Hidden attributes set, and the system 
                date and time when infection occurred.  The following text 
                strings are encrypted within the VCL-JP2 viral code: 
                "[ MK / TridenT ]" 
                "[TPE 1.3]" 
                "[VCL] This" 
                "dicat to ?he fuckn homo" 
                "Spr" 
                "gf ?ield's R.A.T." 
                "LAMERS! Viru?" 
                "by J.P." 
                "Paul C" 
                "ag Davi" 
                Replicated samples will not infect other files unless the 
                file attributes are reset by the user. 
                Origin:  Unknown  January, 1994. 
       VCL-Windows: VCL-Windows is a VCL generated virus which was 
                received in June, 1993.  It infects all .COM and .EXE files 
                in the current directory when an infected program is 
                executed.  Infected programs will have have the first 873 
                bytes of the host file overwritten by the virus, so for 
                programs larger than 873 bytes in length, there will be no 
                increase in size.  Programs originally smaller than 873 
                bytes will become 873 bytes in size after infection.  The 
                file's date and time in the DOS disk directory listing will 
                not be altered.  The VCL-Windows virus displays the 
                following message accompanied by a scraping sound when an 
                infected program is executed, along with a system hang: 
                "This program requires Microsoft Windows." 
                The above text string is encrypted within the virus, as 
                are the following additional text strings: 
                "*.COM *.EXE" 
                "Hey Toto, I don't think were in 
                "WINDOZE any more!!" 
                "[VCL] BenderHead '93Windows Virus" 
                Origin:  Unknown  June, 1993. 
       Voco: A 745 byte overwriting virus, Voco infects several .COM or 
                .EXE files in the current directory when an infected 
                program is executed.  Infected programs will be permanently 
                corrupted as the virus overwrites the first 745 bytes of the 
                host program.  The host program's date and time in the DOS 
                disk directory listing will not be altered.  Voco doesn't 
                infect programs smaller than 745 bytes, so infected programs 
                will not increase in size.  The following text strings are 
                visible within the viral code in all Voco infected programs: 
                "*.COM *.EXE" 
                "PATH=" 
                "You Now Have The VoCo BBS Virus. This Virus Was Made By 
                 My Mother The Car." 
                "*.*" 
                "This virus is made for all theusers of Voco bbs. And for 
                 theentire country of volusia" 
                "mayyou all fucking rot in hell:" 
                Origin:  Unknown  January, 1993. 
       VCL-YD2: An 821 byte virus created with version 1.0 of VCL. 
                This virus infects one .COM file each time an infected 
                program is executed.  Infected programs will have a file 
                length increase of 821 bytes with the virus being located 
                at the end of the infected file.  The file's date and time 
                in the DOS disk directory listing will not be altered. 
                The following text strings are encrypted within the virus 
                and are not visible in replicated samples: 
                "*.COM" 
                "PATH=" 
                "[VCL] [Yankee Doodle 2] Nowhere Man, [NuKE] '92" 
                Infected systems may experience the song "Yankee Doodle" 
                between 5:00PM and 7:00PM when an infected program is 
                executed. 
                Origin:  United States  July, 1992. 
       VCL-YD2B: Based on the VCL-YD2 virus, this variant is one byte 
                longer, adding 822 bytes to the end of the .COM programs 
                it infects.  It has been altered to avoid detection by 
                some anti-viral utilities. 
                Origin:  United States  October, 1992. 
       ZipLoc: A 710 byte companion or spawning virus, ZipLoc infects 
             one .EXE program located in the current directory whenever an 
             infected program is executed.  The companion file will be 710 
             bytes in length, with the system, hidden, and read-only 
             attributes set.  The file's date and time will be the system 
             date and time when infection occurred.  No text strings are 
             visible within the viral code.  The ZipLoc virus will also 
             search the directory structure of the current drive for .ZIP 
             files, and corrupt the .ZIP files it encounters.  Once all of 
             the .EXE files have been infected by the creation of the 
             matching companion .COM files, the virus will display the 
             following message: 
             "System ZipLoc'd" 
             Origin:  Unknown  April, 1993. 
 
       See:   Nowhere Man 

Show viruses from discovered during that infect .

Main Page