5Lo Virus

Virus Name: 5Lo Aliases: V Status: Rare Discovery: January, 1993 Symptoms: .EXE file growth; file date/time changes; decrease in total system & available free memory Origin: Poland Eff Length: 1,030 - 1,040 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: AVTK, F-Prot, IBMAV, Sweep, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, Innoc, NShld, AVTK/N, NAV/N, IBMAV/N, NProt, LProt Removal Instructions: Delete infected files General Comments: The 5Lo virus was submitted in January, 1993, and is originally from Poland. 5Lo is a memory resident infector of .EXE programs. When the first 5Lo infected program is executed, the 5Lo virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupt 21. Once memory resident, it will infect .EXE programs when they are executed. 5Lo infected programs will have a file length increase of 1,030 to 1,040 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time. The following text strings can be found within the viral code in all 5Lo infected programs: "92.05.24.5lo.2.23MZ" "????????EXE"