CSL Virus

Virus Name: CSL Aliases: MicroElephant V6 V Status: Rare Discovered: November, 1991 Symptoms: .COM file growth; "Bad Command or file name" message when programs exist Origin: Eastern Europe Eff Length: 457 Bytes Type Code: PRtCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, NAV, NAVDX, IBMAV, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The CSL, or MicroElephant, virus was submitted in November, 1991. This virus is a memory resident infector of .COM programs, including COMMAND.COM. When the first CSL infected program is executed, the virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Interrupt 12's return will have been moved, however there will appear to be no change in total system and available free memory as indicated by the DOS CHKDSK program. After CSL has become memory resident, it will infect .COM programs when they are executed. If COMMAND.COM is executed, it will also become infected. CSL infected programs will have a file length increase of 457 bytes with the virus being located at the end of the infected file. The program's date and time in a DOS disk directory listing will not be altered. The following text string can be found within the viral code in infected programs: "Microelephant V6 by CSL" Systems infected with CSL may experience the message "Bad Command or file name", and a return to the DOS prompt, when the user attempts to execute .EXE programs over approximately 64K in size. The .EXE programs themselves have not been altered, but it is the virus in memory returning the message. CSL doesn't do anything besides replicate and interfer with .EXE program execution. Known variant(s) of CSL are: CSL Beta: CSL Beta, or MicroElephant Beta, is functionally similar to the CSL virus described above, CSL Beta adds 381 bytes to the .COM programs it infects. This variant will not restore the host program's file date/time in the DOS disk directory when it infects programs, so a file date/time change will be noted. It contains the following text string: "26.07.91.Pre-released Microelephant by CSL". Origin: Unknown January, 1992. CSL V4: CSL V4, or MicroElephant V4, is similar to the CSL virus described above, CSL V4 adds 517 to the .COM programs it infects. The program's date and time in the DOS disk directory will not have been altered. The following two text strings are contained within the viral code in infected programs: "Microelephant V4" and "by CSL". Origin: Unknown January, 1992. CSL V5: CSL V5, or MicroElephant V5, is similar to the CSL described above, CSL V5 also adds 457 bytes to the .COM programs it infects. It contains the following text string within its viral code in infected programs: "Microelephant V5 by CSL". Origin: Unknown January, 1992.