VCS V1.1a Virus (21-July-1992)
Entry................. VCS V1.1a Virus
Alias(es)............. Virus-Construction-Set V1.1a
Strain................ VCS Virus Strain
Detected: when........ JAN 1992
          where....... Bulletin Board, Hamburg, Germany
Classification........ Clone of VCS V1.0 Virus
                       Program Virus, direct action; overwriting,
                          AUTOEXEC.BAT and CONFIG.SYS; encrypted.
Length of Virus....... Increased File Length: 1077 bytes
---------------------- Preconditions ---------------------------------
Operating System(s)... MS/PC-DOS
Computer models....... All IBM PC compatibles with CPU > 8088.
---------------------- Attributes ------------------------------------
Easy identification... Files containing C390h at offset 03h regarded
                       as infected (self identification).
Scan signature........ Searchstring at offset 00h (same as VCS V1.0):
                       E8 14 00 8A A4 2F 05 8D BC 20 01 B9 0F 04 89 FE
                       same as VCS V1.0
Type of infection..... same as VCS V1.0
Infection trigger..... same as VCS V1.0 
Interrupts hooked..... ---
Damage................ same as VCS V1.0
Particularities....... same as VCS V1.0
Particularities/Generating as VCS 1.0, generated by Virus Construction
                          Set Version 1.0
DisSimilarities....... Virus is similar to VCS V1.0 virus and uses the
                       same code, except the self identification
                       routine. Only the version number is changed, so
                       the following string can be found in VCS V1.1a:
                          "Virus Construction Set V1.1a"
---------------------- Agents ----------------------------------------
Countermeasures....... Searchstring at offset 00h of virus:
                       E8 14 00 8A A4 2F 05 8D BC 20 01 B9 0F 04 89 FE
 - ditto - successful. Skulason's F-PROT V2.04  detects as VCS variant.
                       McAfee's Scan version 93 as Manta
                       Tode's NTI-VCS.EXE is an antivirus that
                          only looks for VCS viruses, and if requested
                          will restore the file.
Standard Means........ Notice file length. Use ReadOnly attribute.
---------------------- Acknowledgements ------------------------------
Location.............. Virus Test Center, University Hamburg, Germany
Classification by..... Stefan Tode
Documentation by...... Stefan Tode
Date.................. 21-July-1992
Information source.... ---

.