Virus Name: LowerCase
Aliases: LowerCase-B, LCV
V Status: Rare
Discovered: September, 1991
Symptoms: .COM file growth; changes IBM to ibm in infected files
Eff Length: 864 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: Sweep, AVTK, IBMAV, F-Prot, VAlert,
NAV, ViruScan, NAVDX, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected programs
The LowerCase virus was received in September, 1991. Its origin
is unknown. LowerCase is a non-resident, direct action infector
of .COM files, including COMMAND.COM.
When a program infected with LowerCase is executed, LowerCase will
search the current drive and directory for an uninfected .COM file
to infect. If it finds an uninfected .COM file before it encounters
a .COM file of less than 864 bytes in length, it will infect it.
LowerCase will stop searching the directory when a .COM file of less
than 864 bytes is encountered, not further infecting .COM files in
LowerCase infected programs will increase in size by 864 bytes. The
virus will be located at the beginning of the infected program. If
the infected program originally contained the text string "IBM", the
virus will have changed it to "ibm" when the program was infected.
LowerCase doesn't contain any activation mechanism.
Known variant(s) of LowerCase are:
LowerCase-B: Functionally equivalent to the original LowerCase
virus, this variant has seven bytes within its code
Origin: Unknown November, 1991