Luca-309 Virus

Virus Name: Luca-309 Aliases: V Status: Rare Discovered: January, 1993 Symptoms: .COM file growth Origin: Unknown Eff Length: 309 Bytes Type Code: PRCK - Parasitic Resident .COM Infector Detection Method: AVTK, F-Prot, ViruScan, Sweep, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, AVTK/N, NAV/N, NProt, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected programs General Comments: The Luca-309 virus was submitted in January, 1993. Luca-309 is a memory resident, direct action .COM infector. It does infect COMMAND.COM. When the first Luca-309 infected program is executed, the Luca-309 virus will install itself memory resident in a "hole" in low allocated system memory, hooking interrupt 21. There will be no change to total system and available free memory as indicated by the DOS CHKDSK program. The virus will also infect one .COM program located in the current directory. Once memory resident, the Luca-309 virus will infect one .COM program located in the current directory each time an infected program is executed. Infected programs will have a file length increase of 309 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the Luca-309 viral code in all infected programs: "*.COM" It is unknown if Luca-309 does anything besides replicate.