CLME Virus

Virus Name: CLME Aliases: CLME.1528 V Status: New Discovery: February, 1995 Symptoms: .EXE file growth; file date/time seconds = "30" Origin: Unknown Eff Length: 1,978 - 2,030 Bytes (Approx) Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert, ViruScan, PCScan, Sweep/N, NProt, AVTK/N, IBMAV/N, NShld, NAV/N, Innoc Removal Instructions: Delete infected files General Comments: The CLME virus was received in February, 1995. Its origin or point of isolation is unknown. CLME is a non-resident, direct action infector of .EXE files. When a program infected with the CLME virus is executed, this virus will infect one .EXE file located in the current directory. Infected programs will have a file length increase of approximately 1,978 to 2,030 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, though the seconds field will have been set to "32". The following text strings are encrypted within the viral code: "Written by Crazy Lord (Ming)...Using CLME v0.61" "*EMP" "\ *.exe" "????????EXE" "CLME V0.61" This virus appears to be at least slightly polymorphic. It is unknown what it may do besides replicate.