Los-693 Virus

 Virus Name:  Los-693 
 V Status:    Rare 
 Discovered:  February, 1993 
 Symptoms:    .COM file growth; file date/time changes; Master Boot Sector 
              altered; decrease in total system & available free memory 
 Origin:      USSR 
 Eff Length:  693 Bytes 
 Type Code:   PRhC - Parasitic Resident .COM Infector 
 Detection Method:  F-Prot, NAV, ViruScan, Sweep, AVTK, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Los-693 virus was submitted in February, 1993, and is from 
       the USSR.  Los-693 is a memory resident infector of .COM programs, 
       but not COMMAND.COM.  It will also alter the system hard disk's 
       master boot sector (partition table sector) but not actually place 
       a copy of the virus there. 
       When the first Los-693 infected program is executed, the Los-693 
       virus will become memory resident at the top of system memory but 
       below the 640K DOS boundary, as well as alter the system hard 
       disk's master boot sector.  Total system and available free memory, 
       as indicated by the DOS CHKDSK program, will have decreased by 768 
       to 784 bytes.  Interrupt 21 will be hooked by the virus in memory. 
       Once the Los-693 virus is memory resident, it will infect .COM 
       programs other than COMMAND.COM when they are executed.  Infected 
       programs will have a file length increase of 693 bytes with the 
       virus being located at the end of the file.  The program's date and 
       time in the DOS disk directory listing will have been updated to the 
       current system date and time when infection occurred.  The following 
       text strings are visible within the viral code in all Los-693 
       infected programs: 
       The "Lz" string ocurs at the very end of all infected files.  It is 
       unknown what Los-693 does besides replicate. 

Show viruses from discovered during that infect .

Main Page