5Lo Virus

 Virus Name:  5Lo 
 V Status:    Rare 
 Discovery:   January, 1993 
 Symptoms:    .EXE file growth; file date/time changes; decrease in total 
              system & available free memory 
 Origin:      Poland 
 Eff Length:  1,030 - 1,040 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  AVTK, F-Prot, IBMAV, Sweep, ViruScan, NAV, NAVDX, 
                    VAlert, PCScan, ChAV, 
                    Sweep/N, Innoc, NShld, AVTK/N, NAV/N, IBMAV/N, NProt, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The 5Lo virus was submitted in January, 1993, and is originally 
       from Poland.  5Lo is a memory resident infector of .EXE programs. 
       When the first 5Lo infected program is executed, the 5Lo virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary, hooking interrupt 21.  Once memory resident, 
       it will infect .EXE programs when they are executed. 
       5Lo infected programs will have a file length increase of 1,030 to 
       1,040 bytes with the virus being located at the end of the file.  The 
       program's date and time in the DOS disk directory listing will have 
       been updated to the current system date and time.  The following text 
       strings can be found within the viral code in all 5Lo infected 

Show viruses from discovered during that infect .

Main Page