Virus Name: CHCC
V Status: Rare
Discovery: December, 1992
Symptoms: .COM & .EXE growth
Eff Length: 2,664 - 2,678 Bytes
Type Code: PNAK - Parasitic Non-Resident .COM & .EXE Infector
Detection Method: AVTK, ViruScan, IBMAV, F-Prot, ChAV,
Sweep, NAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, AVTK/N, IBMAV/N, Innoc, NAV/N
Removal Instructions: Delete infected files
The CHCC virus was submitted in December, 1992. CHCC is a
non-resident, direct action infector of .COM and .EXE programs,
When a program infected with the CHCC virus is executed, the CHCC
virus will infect one .COM and one .EXE program located on the
C: drive. Infected programs will have a file length increase of
2,664 to 2,678 bytes with the virus being located at the end of the
file. The program's date and time in the DOS disk directory listing
will not be altered. The following text strings are visible within
the viral code in all CHCC infected programs:
The second text string is located very near the end of the file.
It is unknown what CHCC does besides replicate.
Known variant(s) of CHCC are:
CHCC.1428: Received in July, 1995, CHCC.1428 is a 1,428 byte
memory resident version of the CHCC virus described above. It
becomes memory resident at the top of system memory but below
the 640K DOS boundary, not moving interrupt 12's return.
Available free memory, as indicated by the DOS CHKDSK program
from DOS 5.0, will have decreased by 2,048 bytes. Interrupts
21 and 2F will be hooked by the virus. Once resident, this
variant will infect .COM and .EXE files when they are executed.
Infected files will have a file length increase of 1,428 to
1,442 bytes with the virus being located at the end of the file.
The program's date and time in the DOS disk directory listing
will haven been updated to the current system date and time
when infection occurred. The following text string is visible
within the viral code:
Origin: Unknown July, 1995.