Charlie Virus

 Virus Name:  Charlie 
 Aliases:     Charlie.1536 
 V Status:    New 
 Discovery:   July, 1995 
 Symptoms:    .COM & .EXE growth; 
              decrease in total system & available free memory 
 Origin:      Unknown 
 Eff Length:  1,536 Bytes 
 Type Code:   PRtAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method: VAlert, AVTK, NAV, NAVDX, ViruScan, IBMAV, 
                   F-Prot, ChAV, PCScan, 
                   AVTK/N, NAV/N, IBMAV/N, NShld, Innoc 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Charlie virus was received in July, 1995.  Its origin or point 
       of isolation is unknown.  Charlie is a memory resident fast 
       infector of .COM and .EXE files, including COMMAND.COM.  It 
       employs a stealth technique of disinfecting files when they are 
       opened for other than execution. 
       When the first Charlie infected program is executed, the Charlie 
       virus will become memory resident at the top of system memory but 
       below the 640K DOS boundary, moving interrupt 12's return.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will have decreased by 2,048 bytes.  Interrupt 21 will be 
       hooked by the virus in memory. 
       Once the Charlie virus is memory resident, it will infect .COM and 
       .EXE files, including COMMAND.COM, when they are executed or opened. 
       Infected files will have a file length increase of 1,536 bytes with 
       the virus being located at the end of the file.  The program's date 
       and time in the DOS disk directory listing will not be altered. 
       The following text string is visible within the viral code: 
       Additionally, the following text string may be either encrypted or 
       This virus will disinfect previously infected files when they are 
       read into memory on open, such as to view with a utility or to run 
       an anti-viral scanner. 

Show viruses from discovered during that infect .

Main Page