HLLC (High-Level Language Companion) is a category of viruses written in high level programming language, such as Pascal, C, C++ or Basic. These viruses do not overwrite any file, but they would create new files containing themselves so that the user might not notice.
HLLC viruses are not memory resident, once they have been run, they select a random file by capturing its filename, and then to place a file containing the virus. The users might not notice that it is a virus program and they might run them as usual.
For any two executables sharing the same filename in MS-DOS, if the user does not specify which file to run by typing the extension, the DOS executable always run first.
For example, there are both ABC.COM and ABC.EXE in the same directory, when the user types:
Then ABC.COM will run first.
The virus takes this advantage, so their target are EXE files instead of DOS executables. By dropping itself into a new DOS executable with the selected EXE file's name. When the user run that program, the virus would execute first, and then the host program.
Not every variant contains a payload.
There are 207 known variants under this category, here is a part of them:
- Virus.DOS.HLLC.8304 (Plane)
Index of HLLC virus, VX Heaven