VCM Virus

Virus Name: VCM Aliases: VCM.493 V Status: New Discovered: February, 1995 Symptoms: .COM file growth; file date/time changes; system hangs Origin: Unknown Eff Length: 493 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, F-Prot, AVTK, Sweep, VAlert, IBMAV, NAV, NAVDX, PCScan, ChAV, Sweep/N, AVTK/N, NShld, IBMAV/N, NAV/N, NProt, LProt, Innoc Removal Instructions: Delete infected files General Comments: The VCM virus was received in February, 1995. Its origin or point of isolation is unknown. VCM is a non-resident, direct action infector of .COM files, including COMMAND.COM. When a program infected with the VCM virus is executed, this virus will infect all of the .COM files located in the current directory. If COMMAND.COM is in this directory, it will be infected by the virus. A system hang will then occur. Programs infected with the VCM virus will have a file length increase of 493 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will also have been altered. The file date will be altered so that the month is "8", the date will end with a "0" (such as 00 or 10), and the year will end with a "0" (such as 80 or 90). The file time will be set to "12:34a". The following text strings are visible within the viral code: "*.com *.* V.C.M" "????????COM" This virus may be related to the Ash virus. See: Ash