Virus Name: Charlie
V Status: New
Discovery: July, 1995
Symptoms: .COM & .EXE growth;
decrease in total system & available free memory
Eff Length: 1,536 Bytes
Type Code: PRtAK - Parasitic Resident .COM & .EXE Infector
Detection Method: VAlert, AVTK, NAV, NAVDX, ViruScan, IBMAV,
F-Prot, ChAV, PCScan,
AVTK/N, NAV/N, IBMAV/N, NShld, Innoc
Removal Instructions: Delete infected files
The Charlie virus was received in July, 1995. Its origin or point
of isolation is unknown. Charlie is a memory resident fast
infector of .COM and .EXE files, including COMMAND.COM. It
employs a stealth technique of disinfecting files when they are
opened for other than execution.
When the first Charlie infected program is executed, the Charlie
virus will become memory resident at the top of system memory but
below the 640K DOS boundary, moving interrupt 12's return. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 2,048 bytes. Interrupt 21 will be
hooked by the virus in memory.
Once the Charlie virus is memory resident, it will infect .COM and
.EXE files, including COMMAND.COM, when they are executed or opened.
Infected files will have a file length increase of 1,536 bytes with
the virus being located at the end of the file. The program's date
and time in the DOS disk directory listing will not be altered.
The following text string is visible within the viral code:
Additionally, the following text string may be either encrypted or
This virus will disinfect previously infected files when they are
read into memory on open, such as to view with a utility or to run
an anti-viral scanner.