NCU LI Virus

Virus Name: NCU LI Aliases: V Status: Rare Discovered: October, 1992 Symptoms: .EXE file growth; file date/time changes; decrease in total system & available free memory; Parity Error Message; system hang Origin: Unknown Eff Length: 1,694 - 1,704 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, NProt, AVTK/N, LProt, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The NCU LI virus was received in October, 1992. Its origin or point of isolation are unknown, though it may be from the United States. NCU LI is a memory resident infector of .EXE programs. The first time a program infected with the NCU LI virus is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,888 bytes. Interrupt 21 will be hooked by the virus. Once memory resident, the NCU LI virus will infect .EXE programs when they are executed. Infected programs will have a file length increase of 1,694 to 1,704 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text string can be found in the viral code in all infected programs: "NCU LI" Systems infected with the NCU LI virus will experience the system's video mode being switched to 40 column mode, and the following text message being displayed: "PARITY ERROR ADDR (HEX) = ( 02C14H) SYSTEM HALTED" When this message occurs, the system will be hung. The message is not visible in infected programs as it is encrypted.