Lucifer Virus

Virus Name: Lucifer Aliases: V Status: Rare Discovered: May, 1991 Symptoms: .COM file growth; file time may disappear; decrease in total system and available free memory Origin: Italy Eff Length: 1,086 Bytes Type Code: PRtCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected programs General Comments: The Lucifer virus was submitted in May, 1991. It is from Italy. Lucifer is a memory resident infector of .COM files, including COMMAND.COM. When the first program infected with Lucifer is executed, the virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Interrupt 12's return is not moved. The DOS CHKDSK program will report total system and available free memory is 1,136 bytes less than expected by the user. Interrupts 08 and 21 will be hooked by the virus. After Lucifer is memory resident, it will infect .COM files over approximately 2K in length when they are executed. If COMMAND.COM is executed, it will become infected. Infected .COM programs will increase in size by 1,086 bytes, though the virus hides the file length increase if it is memory resident. While most programs will not have their date and time in the disk directory altered, if the program's original file time was 12:00a, the time will disappear when the file is infected and Lucifer is memory resident. Lucifer will be located at the end of infected programs. The Lucifer virus contains two text strings which can be found in infected programs, the last of which occurs at the very end of the file: "Lucifer (C) by C.J." "C.J." It is unknown if Lucifer does anything besides replicate. See: Alfa Damage V1024