LowerCase Virus

Virus Name: LowerCase Aliases: LowerCase-B, LCV V Status: Rare Discovered: September, 1991 Symptoms: .COM file growth; changes IBM to ibm in infected files Origin: Unknown Eff Length: 864 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: Sweep, AVTK, IBMAV, F-Prot, VAlert, NAV, ViruScan, NAVDX, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected programs General Comments: The LowerCase virus was received in September, 1991. Its origin is unknown. LowerCase is a non-resident, direct action infector of .COM files, including COMMAND.COM. When a program infected with LowerCase is executed, LowerCase will search the current drive and directory for an uninfected .COM file to infect. If it finds an uninfected .COM file before it encounters a .COM file of less than 864 bytes in length, it will infect it. LowerCase will stop searching the directory when a .COM file of less than 864 bytes is encountered, not further infecting .COM files in the directory. LowerCase infected programs will increase in size by 864 bytes. The virus will be located at the beginning of the infected program. If the infected program originally contained the text string "IBM", the virus will have changed it to "ibm" when the program was infected. LowerCase doesn't contain any activation mechanism. Known variant(s) of LowerCase are: LowerCase-B: Functionally equivalent to the original LowerCase virus, this variant has seven bytes within its code which differ. Origin: Unknown November, 1991