Lancs Virus

 Virus Name:  Lancs 
 Aliases:     Lancspoly, Lancs-5476 
 V Status:    Rare 
 Discovered:  June, 1992 
 Symptoms:    .COM files created; long disk accesses when infected programs 
 Origin:      England 
 Eff Length:  5,476 Bytes 
 Type Code:   SNCE - Spawning Non-Resident .COM Infector 
 Detection Method:  AVTK, Sweep, ViruScan, IBMAV, F-Prot, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, Innoc, AVTK/N, NAV/N, NProt, IBMAV/N, 
 Removal Instructions:  Delete companion .COM files 
 General Comments: 
       The Lancs, Lancspoly, or Lancs-5476, virus was received in June, 
       1992.  It is originally from England.  Lancs is one of a group of 
       three closely related non-resident spawning or companion viruses. 
       All three of the viruses replicate in an LZEXE packed format. 
       When a program which is infected with the Lancs virus is executed, 
       the Lancs virus will search the current directory to determine if 
       a .COM program exists with the same base file name for each .EXE 
       file in the current directory.  If the companion file does not 
       exist, the virus will create one.  The newly created companion .COM 
       files will have a file length of 5,476 bytes.  The file date and 
       time in the DOS disk directory which is the same as the file date 
       and time for the corresponding .EXE file.  The user's .EXE file 
       will not have been altered. 
       The Lancs virus always is packed using LZEXE in the companion .COM 
       files.  The following text string occurs within the virus but is 
       not visible within the files due to the compressed format: 
               'POP WILL EAT ITSELF' 
       Systems infected with the Lancs virus may experience memory 
       allocation errors and have the system halted with the following 
       message being displayed: "Cannot load COMMAND, system halted". 
       Known variant(s) of Lancs are: 
       Lancs-5882: Functionally similar to Lancs, this variant's 
                   companion .COM files are 5,882 bytes in length. 
                   Origin: Unknown  June, 1992 
       Lancs-7376: Functionally similar to Lancs, this variant's 
                   companion .COM files are 7,376 bytes in length. 
                   Origin: Unknown  June, 1992 

Show viruses from discovered during that infect .

Main Page