HLLS Virus

Virus Name: HLLS Aliases: V Status: Rare Discovered: February, 1994 Symptoms: .COM files created which correspond to .EXE files; Origin: Unknown Eff Length: 4,768 Bytes & More Type Code: PNS - Spawning or Companion Infector Detection Method: IBMAV, AVTK, Sweep, F-Prot, NAV, NAVDX, VAlert, ViruScan, PCScan, ChAV, Sweep/N, IBMAV/N, AVTK/N, NProt, Innoc, NAV/N, NShld, LProt Removal Instructions: Delete infected .COM files General Comments: HLLS is a category of viruses which includes spawning or companion viruses which are written in a high-level language, such as C, C++, or Pascal. Viruses in this category infect .EXE programs by creating a corresponding or companion .COM program which has the same base file name. As a result, when the user attempts to execute the .EXE program, DOS will execute the .COM virus code file instead. The companion .COM files created by HLLS viruses may be visible within the DOS directory, or not visible due to the settings of file attributes. The files may have the file date and time set to the system date and time when infection occurred, a specific date and time unique to the virus, or the file date and time of the corresponding .EXE file. Companion or spawning viruses can generally be disinfected by deleting the .COM files which contain the viral code. Known HLLS viruses include: HLLS.Linda Lou: Received in February, 1994, HLLS.Linda Lou is a non-resident, 4,768 spawning or companion virus. It infects up to three .EXE files located in the current directory when and infected program is executed. The companion .COM files created by HLLS.Linda Lou are at least 4,768 bytes in size, and are visible within the DOS disk directory listing. Their file date and time will match the file date and time on the corresponding .EXE file. The following text string can be found within HLLS.Linda Lou companion .COM files: "Boundary .exefirst om1993 X" Origin: Unknown February, 1994.