LowerCase Virus

 Virus Name:  LowerCase 
 Aliases:     LowerCase-B, LCV 
 V Status:    Rare 
 Discovered:  September, 1991 
 Symptoms:    .COM file growth; changes IBM to ibm in infected files 
 Origin:      Unknown 
 Eff Length:  864 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  Sweep, AVTK, IBMAV, F-Prot, VAlert, 
                    NAV, ViruScan, NAVDX, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected programs 
 General Comments: 
       The LowerCase virus was received in September, 1991.  Its origin 
       is unknown.  LowerCase is a non-resident, direct action infector 
       of .COM files, including COMMAND.COM. 
       When a program infected with LowerCase is executed, LowerCase will 
       search the current drive and directory for an uninfected .COM file 
       to infect.  If it finds an uninfected .COM file before it encounters 
       a .COM file of less than 864 bytes in length, it will infect it. 
       LowerCase will stop searching the directory when a .COM file of less 
       than 864 bytes is encountered, not further infecting .COM files in 
       the directory. 
       LowerCase infected programs will increase in size by 864 bytes.  The 
       virus will be located at the beginning of the infected program.  If 
       the infected program originally contained the text string "IBM", the 
       virus will have changed it to "ibm" when the program was infected. 
       LowerCase doesn't contain any activation mechanism. 
       Known variant(s) of LowerCase are: 
       LowerCase-B: Functionally equivalent to the original LowerCase 
                    virus, this variant has seven bytes within its code 
                    which differ. 
                    Origin:  Unknown  November, 1991 

Show viruses from discovered during that infect .

Main Page