Virus Name: VCM
V Status: New
Discovered: February, 1995
Symptoms: .COM file growth; file date/time changes; system hangs
Eff Length: 493 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, F-Prot, AVTK, Sweep, VAlert, IBMAV,
NAV, NAVDX, PCScan, ChAV,
Sweep/N, AVTK/N, NShld, IBMAV/N, NAV/N, NProt, LProt,
Removal Instructions: Delete infected files
The VCM virus was received in February, 1995. Its origin or point
of isolation is unknown. VCM is a non-resident, direct action
infector of .COM files, including COMMAND.COM.
When a program infected with the VCM virus is executed, this virus
will infect all of the .COM files located in the current directory.
If COMMAND.COM is in this directory, it will be infected by the
virus. A system hang will then occur.
Programs infected with the VCM virus will have a file length increase
of 493 bytes with the virus being located at the end of the file.
The program's date and time in the DOS disk directory listing will
also have been altered. The file date will be altered so that the
month is "8", the date will end with a "0" (such as 00 or 10), and
the year will end with a "0" (such as 80 or 90). The file time will
be set to "12:34a". The following text strings are visible within
the viral code:
"*.com *.* V.C.M"
This virus may be related to the Ash virus.