CHCC Virus

Virus Name: CHCC Aliases: V Status: Rare Discovery: December, 1992 Symptoms: .COM & .EXE growth Origin: Unknown Eff Length: 2,664 - 2,678 Bytes Type Code: PNAK - Parasitic Non-Resident .COM & .EXE Infector Detection Method: AVTK, ViruScan, IBMAV, F-Prot, ChAV, Sweep, NAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, AVTK/N, IBMAV/N, Innoc, NAV/N Removal Instructions: Delete infected files General Comments: The CHCC virus was submitted in December, 1992. CHCC is a non-resident, direct action infector of .COM and .EXE programs, including COMMAND.COM. When a program infected with the CHCC virus is executed, the CHCC virus will infect one .COM and one .EXE program located on the C: drive. Infected programs will have a file length increase of 2,664 to 2,678 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all CHCC infected programs: "COMEXESYSBAT" "ChCC" The second text string is located very near the end of the file. It is unknown what CHCC does besides replicate. Known variant(s) of CHCC are: CHCC.1428: Received in July, 1995, CHCC.1428 is a 1,428 byte memory resident version of the CHCC virus described above. It becomes memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 2,048 bytes. Interrupts 21 and 2F will be hooked by the virus. Once resident, this variant will infect .COM and .EXE files when they are executed. Infected files will have a file length increase of 1,428 to 1,442 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will haven been updated to the current system date and time when infection occurred. The following text string is visible within the viral code: "COMMAND.COM" Origin: Unknown July, 1995.