VLamix Virus

 Virus Name:  VLamix 
 Aliases:     VLamix-1 
 V Status:    New 
 Discovered:  September, 1994 
 Symptoms:    .EXE file growth; B: drive may be overwritten; 
              decrease in total system & available free memory; 
              interfers with functionality of CPAV and MSAV 
 Origin:      Belgium 
 Eff Length:  1,091 - 1,106 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  AVTK, IBMAV, ViruScan, Sweep, F-Prot, NAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, IBMAV/N, AVTK/N, NShld, NProt, NAV/N, LProt, 
                    Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The VLamix virus was isolated in Belgium in September, 1994, where 
       it is reported to be "in the wild".  It is a memory resident fast 
       infector of .EXE programs. 
       When the first VLamix infected program is executed, this virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary, not moving interrupt 12's return.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will have decreased by 1,136 bytes.  Interrupts 10 and 21 
       will be hooked by the virus in memory. 
       Once memory resident, this virus will infect .EXE programs when they 
       are executed, opened, or copied.  Infected programs will have a file 
       length increase of 1,091 to 1,106 bytes with the virus being located 
       at the end of the file.  The program's date and time in the DOS disk 
       directory listing will not be altered.  The following text strings 
       are encrypted within the viral code: 
               "smartc*.cps chklist.*" 
               "-=* DIE_LAMER *=-" 
               "CHKLIST ???" 
       This virus is unable to determine when it has previously infected a 
       file, so it will reinfect .EXE programs.  Each reinfection of an 
       .EXE file will add an additional 1,104 bytes to the file's length. 
       The VLamix virus contains code to overwrite the diskette in the B: 
       diskette drive when the second text string above is displayed on 
       the system monitor.  It also interfers with the functionality of 
       Central Point Anti-Virus and Microsoft Anti-Virus by deleting the 
       program's data files which have a base file name of SMARTC* and 

Show viruses from discovered during that infect .

Main Page