Virus Name: Lehigh
Aliases: Lehigh University
V Status: Common
Discovered: November, 1987
Symptoms: Corrupts boot sector & FAT, system hang
Origin: Pennsylvania, United States
Eff Length: N/A
Type Code: ORaKT - Overwriting Resident COMMAND.COM Infector
Detection Method: ViruScan, F-Prot, AVTK, NAV, IBMAV,
Sweep, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: MDisk & replace COMMAND.COM with clean copy, or
The Lehigh virus infects only the COMMAND.COM file on both floppies
and hard drives. The infection mechanism is to overwrite the
stack space. When a disk which contains an uninfected copy of
COMMAND.COM is accessed, that disk is then infected. A infection
count is kept in each copy of the virus, and after 4 infections,
the virus overwrites the boot sector and FATs.
A variation of the Lehigh virus, Lehigh-2, exists which maintains
its infection counter in RAM and corrupts the boot sector and FATs
after 10 infections.
Known variant(s) of Lehigh are:
Lehigh-2: Similar to Lehigh, but the infection counter is
maintained in RAM, and the corruption of the boot sector
and FATs occurs after 10 infections.
Lehigh-B: Similar to Lehigh, the virus has been modified to avoid
Lehigh-D: Another slight variant of Lehigh, the major difference
is that once the system is booted from a Lehigh infected
COMMAND.COM, .EXE programs will typically fail to execute,
resulting in a system hang.