Lucifer Virus

 Virus Name:  Lucifer 
 V Status:    Rare 
 Discovered:  May, 1991 
 Symptoms:    .COM file growth; file time may disappear; decrease in total 
              system and available free memory 
 Origin:      Italy 
 Eff Length:  1,086 Bytes 
 Type Code:   PRtCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, ChAV, 
                    NAV, IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected programs 
 General Comments: 
       The Lucifer virus was submitted in May, 1991.  It is from Italy. 
       Lucifer is a memory resident infector of .COM files, including 
       When the first program infected with Lucifer is executed, the virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary.  Interrupt 12's return is not moved. 
       The DOS CHKDSK program will report total system and available free 
       memory is 1,136 bytes less than expected by the user.  Interrupts 08 
       and 21 will be hooked by the virus. 
       After Lucifer is memory resident, it will infect .COM files over 
       approximately 2K in length when they are executed.  If COMMAND.COM 
       is executed, it will become infected.  Infected .COM programs will 
       increase in size by 1,086 bytes, though the virus hides the file 
       length increase if it is memory resident.  While most programs will 
       not have their date and time in the disk directory altered, if the 
       program's original file time was 12:00a, the time will disappear 
       when the file is infected and Lucifer is memory resident.  Lucifer 
       will be located at the end of infected programs. 
       The Lucifer virus contains two text strings which can be found in 
       infected programs, the last of which occurs at the very end of the 
               "Lucifer (C) by C.J." 
       It is unknown if Lucifer does anything besides replicate. 
       See:   Alfa   Damage   V1024 

Show viruses from discovered during that infect .

Main Page