Virus Name: Lythyum
V Status: Rare
Discovered: January, 1993
Symptoms: .COM file growth; hidden file in disk root directory
Origin: United States
Eff Length: 502 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, ViruScan, Sweep, AVTK, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
LProt, NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, NAV/N,
Removal Instructions: Delete infected programs
The Lythyum virus was submitted in January, 1993, and is from the
United States. Lythyum is a non-resident, direct action infector
of .COM programs, including COMMAND.COM. It was written by a
member of the Virulent Graffiti virus writing group.
When a program infected with they Lythyum virus is executed, the
Lythyum virus will infect one .COM program located in the current
directory. Infected programs will have a file length increase of
502 bytes with the virus being located at the end of the file. The
program's date and time in the DOS disk directory listing will not
be altered. The following text strings are encrypted within the
Lythyum virus' code in infected programs:
"lythyum, the attitude adjuster, ViRuLeNT GRaFFiTi"
Once the virus has infected all of the .COM files in the current
directory, it will create a hidden file, LYTHYUM.HI!, in the current
drive's root directory when the next infected program is executed.
The hidden file will contain the first text string indicated above.
Known variant(s) of Lythyum are:
Lythyum-B: Functionally similar to the Lythyum virus described
above, Lythyum-B is a very minor variant.
Origin: United States January, 1993.