Virus Name: Lucifer
V Status: Rare
Discovered: May, 1991
Symptoms: .COM file growth; file time may disappear; decrease in total
system and available free memory
Eff Length: 1,086 Bytes
Type Code: PRtCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected programs
The Lucifer virus was submitted in May, 1991. It is from Italy.
Lucifer is a memory resident infector of .COM files, including
When the first program infected with Lucifer is executed, the virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary. Interrupt 12's return is not moved.
The DOS CHKDSK program will report total system and available free
memory is 1,136 bytes less than expected by the user. Interrupts 08
and 21 will be hooked by the virus.
After Lucifer is memory resident, it will infect .COM files over
approximately 2K in length when they are executed. If COMMAND.COM
is executed, it will become infected. Infected .COM programs will
increase in size by 1,086 bytes, though the virus hides the file
length increase if it is memory resident. While most programs will
not have their date and time in the disk directory altered, if the
program's original file time was 12:00a, the time will disappear
when the file is infected and Lucifer is memory resident. Lucifer
will be located at the end of infected programs.
The Lucifer virus contains two text strings which can be found in
infected programs, the last of which occurs at the very end of the
"Lucifer (C) by C.J."
It is unknown if Lucifer does anything besides replicate.
See: Alfa Damage V1024