Chill | |
---|---|
Type | File virus |
Creator | |
Date Discovered | 1994.06.03 |
Place of Origin | |
Source Language | |
Platform | DOS |
File Type(s) | .com |
Infection Length | 544 bytes |
Reported Costs |
Chill also known as Chill Touch is a DOS virus from 1994. It was found "pre-installed" on a number of games for download on an Internet forum.
Behavior
When the Chill virus is executed, it installs itself in memory. It immediately infects COMMAND.COM. It infects .com files when they are executed, opened or copied, appending its 544 bytes.
It contains the message "Chill Touch . You can't touch these phantoms". This text is encrypted with a simple cipher. It is simple enough that the hex numbers "C7 09 8B F7 AC 34 ? AA E2" (the question mark is a wild card byte) can be used to identify it. The virus appears to have been created with the intention of delivering some kind of payload, but this appears to have been disabled.
Effects
Chill was found in some games on the ZiffNet forum. Forty people who downloaded the games between the 3rd and 14th of June were likely the first to be infected with the virus. ZiffNet along with CompuServe tried to contact the people who downloaded the infected games. The games affected were:
- Animated Clock (ACLOCK.ZIP)
- John's Animated Computer Game (AJOHN.ZIP)
- Animated Alphabet (ALPHA.ZIP)
- Animated Memory Game (AMEM.ZIP)
- BAT Commander (BATCMD.ZIP)
- Big Red Self-Test (BRTEST.ZIP)
- Dungeon, v9.0 (DUNGN.ZIP)
- SHEZ, v10.0 (SHEZ.ZIP)
- Stealth, v5.0 (STLTH.ZIP)
Sources
Virus-L Digest, Volume 7 : Issue 47, Chill Touch and Junkie Viruses. 1994.07.01
Allan L. Van Lehn (Editor). CIAC, CIAC Notes. 1994.07.06