HLLP Virus
Virus Name: HLLP
Aliases:
V Status: New
Discovered: April, 1997
Symptoms: .COM and/or .EXE growth; file date/time changes;
programs fail to function properly
Origin: Unknown
Eff Length: Varies (see below)
Type Code: PNAK - Parasitic Non-Resident .COM and/or .EXE Infector
Detection Method: AVTK, ViruScan, NAV, NAVDX,
AVTK/N, NAV/N
Removal Instructions: Delete infected files
General Comments:
HLLP is a category of viruses which were written in the Pascal
programming language. They may be parasitic or overwriting, and
may infect .COM files, .EXE files, or both types of files. In
many cases, the programs fail to function properly once infected
by the virus.
Known HLLP viruses include:
HLLP.3990: The HLLP.3990 virus was received in April, 1997. It
is a non-resident, direct action infector of .COM and .EXE files.
When an infected program is executed, this virus will infect up
to four .COM or .EXE files located in the current directory.
Infected programs will have a file length increase of 3,990 bytes.
The file's date and time in the DOS disk directory listing will
not be altered. The following text strings are encrypted within
the viral code:
"*.* .COM .ASM"
"COMMAND.COM"
"Smokie4 virus (c) by N5 school BISHKEK"
Origin: Unknown April, 1997.
HLLP.4170: The HLLP.4170 virus was received in April, 1997. It
is a non-resident, direct action infector of .EXE and .COM files.
When an infected program is executed, this virus will infect three
.EXE or .COM files located in the current directory. Infected
programs will have a file length increase of 4,170 bytes. The
file's date and time in the DOS disk directory listing will not be
altered. The following text strings are encrypted within the
viral code:
"*.*"
"*.COM"
".BAS"
"COMMAND.COM"
".EXE"
"Portions Copyright (c) 1983,90 Borland"
"Smokie4 virus (c) by N5 school BISHKEK"
Origin: Unknown April, 1997.
HLLP.4536: The HLLP.4536 virus was received in April, 1997. It
is a non-resident, direct action infector of .EXE files. When
an infected program is executed, this virus will infect four or
five .EXE files located in a subdirectory on the C: drive. It
does not infect programs located in the root directory. Infected
programs will have a file length increase of 4,536 bytes. The
file's date and time in the DOS disk directory listing will not
be altered. The following text strings are encrypted within the
viral code:
"*.EXE"
"C:\"
All infected .EXE files display "Memory allocation error" when
executed.
Origin: Unknown April, 1997.
HLLP.4665: The HLLP.4665 virus was received in April, 1997. It
is a non-resident, direct action infector of .EXE and .COM files.
When an infected program is executed, this virus will infect three
.EXE or .COM files located in the current directory. Infected
programs will have a file length increase of 4,665 bytes. The
file's date and time in the DOS disk directory listing will have
been updated to the current system date and time when infection
occurred. The following text strings are encrypted within the
viral code:
"main.exe"
"temp.exe"
"*.exe"
"temp.exe"
"*.com"
"Portions Copyright (c) 1983,92 Borland"
This virus creates a file main.exe in the current drive's root
directory. If the user attempts to execute this file, the file
will be reduced in size to 0 bytes. It may also be deleted when
an infected program is executed.
Origin: Unknown April, 1997.
HLLP.9535: The HLLP.9535 virus was received in April, 1997. It
is a non-resident, direct action infector of .EXE files. When
an infected program is executed, this virus will infect one .EXE
file located in the C: drive root directory. It does not infect
programs located in subdirectories. Infected programs will have
a file length increase of 9,535 bytes. The file's date and time
in the DOS disk directory listing will have been updated to the
current system date and time when infection occured. The
following text strings are encrypted within the viral code:
"SWAP.$$$"
"Portions Copyright (c) 1983,92 Borland"
"*.ex"
"KLA/LCN"
"KVirus"
"1.0"
Origin: Unknown April, 1997.