Lancs Virus

Virus Name: Lancs Aliases: Lancspoly, Lancs-5476 V Status: Rare Discovered: June, 1992 Symptoms: .COM files created; long disk accesses when infected programs executed Origin: England Eff Length: 5,476 Bytes Type Code: SNCE - Spawning Non-Resident .COM Infector Detection Method: AVTK, Sweep, ViruScan, IBMAV, F-Prot, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, AVTK/N, NAV/N, NProt, IBMAV/N, LProt Removal Instructions: Delete companion .COM files General Comments: The Lancs, Lancspoly, or Lancs-5476, virus was received in June, 1992. It is originally from England. Lancs is one of a group of three closely related non-resident spawning or companion viruses. All three of the viruses replicate in an LZEXE packed format. When a program which is infected with the Lancs virus is executed, the Lancs virus will search the current directory to determine if a .COM program exists with the same base file name for each .EXE file in the current directory. If the companion file does not exist, the virus will create one. The newly created companion .COM files will have a file length of 5,476 bytes. The file date and time in the DOS disk directory which is the same as the file date and time for the corresponding .EXE file. The user's .EXE file will not have been altered. The Lancs virus always is packed using LZEXE in the companion .COM files. The following text string occurs within the virus but is not visible within the files due to the compressed format: 'HAVE A "HAPPY MONDAY" LANCSPOLY SUCKERS.' 'POP WILL EAT ITSELF' Systems infected with the Lancs virus may experience memory allocation errors and have the system halted with the following message being displayed: "Cannot load COMMAND, system halted". Known variant(s) of Lancs are: Lancs-5882: Functionally similar to Lancs, this variant's companion .COM files are 5,882 bytes in length. Origin: Unknown June, 1992 Lancs-7376: Functionally similar to Lancs, this variant's companion .COM files are 7,376 bytes in length. Origin: Unknown June, 1992