LZ Virus

Virus Name: LZ Aliases: Noon Beep V Status: Rare Discovered: January, 1992 Symptoms: .COM files created Origin: The Netherlands Eff Length: 5,085 - 8,847 Bytes Type Code: SNA - Spawning Non-Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, AVTK, NAV, NAVDX, IBMAV, PCScan, Sweep, ChAV, Sweep/N, Innoc, AVTK/N, NShld, NProt, IBMAV/N, NAV/N, LProt Removal Instructions: Delete infected programs General Comments: The LZ virus was submitted in January, 1992. It is from The Netherlands. LZ is a non-resident spawing virus which infects .EXE programs, though the .EXE program itself it not have been altered. When a program infected with LZ is infected, the LZ virus will search the current directory for .EXE programs. For each .EXE program it encounters, the virus will check to see if there is a corresponding .COM file with the same base file name. If there is not, the virus will create one. The created .COM file will contain the viral code, and be 5,085 to 8,847 bytes in length. The file's date and time will be identical to the original .EXE file's date and time in the DOS disk directory listing. The LZ virus spreads by the user executing a .EXE program via executing the program's base file name. Since DOS will execute a .COM file before a .EXE program, the virus code in the .COM file will be executed. Once the virus has completed execution, it will then load and execute the corresponding .EXE program. This virus' viral code is LZEXE'd, and the .COM files created by the virus will contain the text strings typically contained in LZEXE'd programs. LZ-2: Isolated in The Netherlands in June, 1992, LZ-2 is a later version of the LZ virus described above. It will infect up to three .EXE programs located in the current drive's root directory whenever an infected program is executed. The corresponding .COM programs will be approximately 5,106 to 9,141 bytes in length and have the same file date/time in the DOS disk directory listing as the original, unaltered, .EXE program. Origin: The Netherlands June, 1992.