LCT Virus


 Virus Name:  LCT 
 Aliases:     LCT-599, LiquidCode 
 V Status:    Rare 
 Discovered:  March, 1993 
 Symptoms:    .COM file growth 
 Origin:      Unknown 
 Eff Length:  599 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  F-Prot, IBMAV, Sweep, AVTK, ChAV, 
                    ViruScan, NAV, NAVDX, VAlert, PCScan, 
                    Sweep/N, NShld, NProt, AVTK/N, IBMAV/N, NAV/N, Innoc, 
                    LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The LCT, LCT-599, or LiquidCode, virus was submitted in March, 1993. 
       Its origin or point of isolation is unknown.  LCT is a non-resident 
       direct action infector of .COM programs, including COMMAND.COM. 
 
       When a program infected with the LCT virus is executed, the LCT 
       virus will infect all of the .COM programs located in the current 
       directory.  Infected programs will have a file length increase of 
       599 bytes with the virus being located at the end of the file.  The 
       program's date and time in the DOS disk directory listing will not 
       be altered.  The following text strings are visible within the viral 
       code in all LCT infected programs: 
 
               "*.COM" 
               "????????COM" 
               " LiquidCode 92" 
 
       LCT doesn't appear to do anything besides replicate. 
 
       Known variant(s) of LCT are: 
       LCT-762: An earlier version of the LCT virus described above, 
                this variant also infects all of the .COM files located 
                in the current directory when an infected program is 
                executed.  Infected programs will have a file length 
                increase of 762 bytes with the virus being located at the 
                beginning of the file.  Unfortunately, LCT-762 cannot 
                determine when it has previously infected a file, so it 
                will proceed to repeatedly reinfect .COM files, adding 762 
                bytes with each reinfection.  An additional result of 
                file reinfection is that the virus will now be located at 
                both the beginning and the end of the file.  The file's date 
                and time in the DOS disk directory listing will be updated 
                to the current system date and time when the last file 
                infection occurred.  The following text strings are visible 
                within the viral code in all LCT-762 infected programs: 
                "LiquidCode" 
                "*.COM" 
                Origin:  Unknown  March, 1993.

Show viruses from discovered during that infect .

Main Page