Virus Name: CLME
V Status: New
Discovery: February, 1995
Symptoms: .EXE file growth; file date/time seconds = "30"
Eff Length: 1,978 - 2,030 Bytes (Approx)
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert,
Sweep/N, NProt, AVTK/N, IBMAV/N, NShld, NAV/N, Innoc
Removal Instructions: Delete infected files
The CLME virus was received in February, 1995. Its origin or point
of isolation is unknown. CLME is a non-resident, direct action
infector of .EXE files.
When a program infected with the CLME virus is executed, this virus
will infect one .EXE file located in the current directory. Infected
programs will have a file length increase of approximately 1,978 to
2,030 bytes with the virus being located at the end of the file. The
program's date and time in the DOS disk directory listing will not
appear to be altered, though the seconds field will have been set to
"32". The following text strings are encrypted within the
"Written by Crazy Lord (Ming)...Using CLME v0.61"
This virus appears to be at least slightly polymorphic. It is
unknown what it may do besides replicate.