| Alias: | Virus-Construction-Set V1.1a |
| Strain: | VCS Virus Strain |
| detected when: | JAN 1992 |
| where: | Bulletin Board, Hamburg, Germany |
| Classification: | Clone of VCS V1.0 Virus Program Virus, direct action; overwr |
| Length: | Increased File Length: 1077 bytes |
Preconditions | |
| Operating System(s): | MS/PC-DOS |
| Version/Release: | |
| Computer model(s): | All IBM PC compatibles with CPU > 8088. |
| Caroname: | VCS |
Attributes | |
| Easy identification: | Files containing C390h at offset 03h regarded as infected (self identification). |
Type of Infection: | same as VCS V1.0 |
| Infection Technique: | |
| Infection Trigger: | same as VCS V1.0 |
| Storage Media affected: | |
| Interrupts hooked: | --- |
| Stealth: | |
| Tunneling/Selfprot: | |
| Oligo/Polymorphism: | |
| Encoding Method: | |
| Damage: | same as VCS V1.0 |
| Damage Trigger: | |
| Particularities: | Particularities/Generating as VCS 1.0, generated by Virus Construction Set Version 1.0 |
| Similarities: | |
Agents | |
| Countermeasures: | Searchstring at offset 00h of virus: E8 14 00 8A A4 2F 05 8D BC 20 01 B9 0F 04 89 FE - ditto - successful. Skulason's F-PROT V2.04 detects as VCS variant. McAfee's Scan version 93 as Manta Tode's NTI-VCS.EXE is an antivirus that only looks for VCS viruses, and if requested will restore the file. |
| Standard means: | Notice file length. Use ReadOnly attribute. |
Acknowledgements | |
| Location: | Virus Test Center, University Hamburg, Germany |
| Classification by: | Stefan Tode |
| Documentation by: | Stefan Tode |
| Date: | 21-July-1992 |
| Information Source: | |
(c) 1996 Virus-Test-Center, University of Hamburg