Charlie Virus

Virus Name: Charlie Aliases: Charlie.1536 V Status: New Discovery: July, 1995 Symptoms: .COM & .EXE growth; decrease in total system & available free memory Origin: Unknown Eff Length: 1,536 Bytes Type Code: PRtAK - Parasitic Resident .COM & .EXE Infector Detection Method: VAlert, AVTK, NAV, NAVDX, ViruScan, IBMAV, F-Prot, ChAV, PCScan, AVTK/N, NAV/N, IBMAV/N, NShld, Innoc Removal Instructions: Delete infected files General Comments: The Charlie virus was received in July, 1995. Its origin or point of isolation is unknown. Charlie is a memory resident fast infector of .COM and .EXE files, including COMMAND.COM. It employs a stealth technique of disinfecting files when they are opened for other than execution. When the first Charlie infected program is executed, the Charlie virus will become memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,048 bytes. Interrupt 21 will be hooked by the virus in memory. Once the Charlie virus is memory resident, it will infect .COM and .EXE files, including COMMAND.COM, when they are executed or opened. Infected files will have a file length increase of 1,536 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code: "1992." Additionally, the following text string may be either encrypted or unencrypted: "charlie" This virus will disinfect previously infected files when they are read into memory on open, such as to view with a utility or to run an anti-viral scanner.