Los-693 Virus

Virus Name: Los-693 Aliases: V Status: Rare Discovered: February, 1993 Symptoms: .COM file growth; file date/time changes; Master Boot Sector altered; decrease in total system & available free memory Origin: USSR Eff Length: 693 Bytes Type Code: PRhC - Parasitic Resident .COM Infector Detection Method: F-Prot, NAV, ViruScan, Sweep, AVTK, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Los-693 virus was submitted in February, 1993, and is from the USSR. Los-693 is a memory resident infector of .COM programs, but not COMMAND.COM. It will also alter the system hard disk's master boot sector (partition table sector) but not actually place a copy of the virus there. When the first Los-693 infected program is executed, the Los-693 virus will become memory resident at the top of system memory but below the 640K DOS boundary, as well as alter the system hard disk's master boot sector. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 768 to 784 bytes. Interrupt 21 will be hooked by the virus in memory. Once the Los-693 virus is memory resident, it will infect .COM programs other than COMMAND.COM when they are executed. Infected programs will have a file length increase of 693 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings are visible within the viral code in all Los-693 infected programs: "Lz" "593?" The "Lz" string ocurs at the very end of all infected files. It is unknown what Los-693 does besides replicate.