Virus Name: Charm
V Status: New
Discovery: July, 1995
Symptoms: .COM file growth; file date/time changes
Eff Length: 501 - 508 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, AVTK, VAlert, NAV, NAVDX, ViruScan, Sweep,
NShld, NAV/N, Sweep/N, AVTK/N, IBMAV/N, Innoc
Removal Instructions: Delete infected files
The Charm virus was received in July, 1995. Its origin or point of
isolation is unknown. Charm is a memory resident infector of .COM
files, including COMMAND.COM. It does not infect very small .COM
When the first Charm infected program is executed, this virus will
install itself in allocated system memory, hooking interrupt 21.
Total system and available free memory, as indicated by the DOS
CHKDSK program, will not be altered.
Once the Charm virus is memory resident, it will infect .COM files
when they are executed. Programs infected with the Charm virus
will have a file length increase of 501 to 508 bytes with the virus
being located at the end of the file. The program's date and time
in the DOS disk directory listing will have been updated to the
current system date and time when infection occurred. No text
strings are visible within the viral code.
It is unknown what the Charm virus may do besides replicate.