Laufwerk Virus

Virus Name: Laufwerk Aliases: V Status: Viron Discovered: August, 1993 Symptoms: .EXE files overwritten; .EXE file corruption; .EXE programs fail to function properly; file date/time change Origin: Unknown Eff Length: 7,040 Bytes Overwriting Type Code: ONE - Overwriting Non-Resident .EXE Infector Detection Method: AVTK, Sweep, NAV, ViruScan, F-Prot, IBMAV, NAVDX, VAlert, ChAV, PCScan, Sweep/N, NAV/N, NShld, AVTK/N, NProt, IBMAV/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Laufwerk virus was submitted in August, 1993. Its origin or point of isolation is unknown. Laufwerk is a non-resident, direct action overwritting virus which infects .EXE programs. It corrupts the programs it infects. When a program infected with the Laufwerk virus is executed, this virus will infect one .EXE program located on the system hard disk, and the B: diskette drive. The newly infected .EXE program will have the first 7,040 bytes overwritten by the Laufwerk viral code. Programs which were originally larger than 7,040 bytes will become 7,040 bytes. Programs which were originally smaller than 7,040 bytes will become 7,040 bytes in length upon infection. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings can be found within the Laufwerk viral code in all infected programs: ".exe" "Laufwerk:"