CLS-853 Virus


 Virus Name:  CLS-853 
 Aliases:     CLS 
 V Status:    Rare 
 Discovery:   December, 1992 
 Symptoms:    .COM & .EXE growth; decrease in total system & available free 
              memory; unexpected screen clears 
 Origin:      Unknown 
 Eff Length:  853 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  IBMAV, Sweep, AVTK, F-Prot, ViruScan, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, NShld, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, 
                    LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The CLS-853 virus was submitted in December, 1992.  CLS-853 is a 
       memory resident infector of .COM and .EXE programs, including 
       COMMAND.COM. 
 
       When the first CLS-853 infected program is executed, the CLS-853 
       virus will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary.  It will have hooked 
       interrupts 08, 13, and 21.  Interrupt 12's return will not be 
       moved.  Total system and available free memory, as indicated by 
       the DOS CHKDSK program, will have decreased by 1,120 bytes. 
 
       Once the CLS-853 virus is memory resident, it will infect .COM 
       and .EXE programs when they are executed.  Infected programs will 
       have a file length increase of 853 bytes with the virus being 
       located at the end of the file.  The program's date and time in 
       the DOS disk directory listing will not be altered.  No text strings 
       are visible within the viral code. 
 
       Systems infected with the CLS-853 virus may experience the system 
       display being cleared unexpectedly when the virus is memory resident. 
       The virus' name, "CLS", refers to this symptom of the virus. 

Show viruses from discovered during that infect .

Main Page