Virus Name: Vico
V Status: New
Discovered: January, 1995
Symptoms: .COM file growth; decrease in available free memory;
file date/time decade = "2"
Eff Length: 500 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, AVTK, Sweep, ViruScan, NAVDX, VAlert, NAV,
NProt, AVTK/N, Sweep/N, NShld, NAV/N, IBMAV/N, Innoc 4.0+
Removal Instructions: Delete infected files
The Vico virus was received in January, 1995. Its origin or point
of isolation is unknown. Vico is a memory resident infector of
.COM files, including COMMAND.COM.
When the first Vico infected program is executed, this virus will
install itself memory resident at the top of system memory but below
the 640K DOS boundary. Available free memory, as indicated by the
DOS CHKDSK program from DOS 5.0, will have decreased by approximately
512 bytes. Interrupts 15 and 21 will be hooked by the virus in
Once the Vico virus is memory resident, it will infect .COM files,
including COMMAND.COM, when they are executed. Infected .COM files
will have a file length increase of 500 bytes with the virus being
located at the end of the file. The program's date in the DOS disk
directory will have been set to "2" with the remainder of the date
and time being unaltered. The following text string is visible
within the viral code in all infected files:
"Hello! I`m Wirus VICO"
It is unknown what the Vico virus may do besides replicate.