LZ Virus


 Virus Name:  LZ 
 Aliases:     Noon Beep 
 V Status:    Rare 
 Discovered:  January, 1992 
 Symptoms:    .COM files created 
 Origin:      The Netherlands 
 Eff Length:  5,085 - 8,847 Bytes 
 Type Code:   SNA - Spawning Non-Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, AVTK, NAV, NAVDX, IBMAV, PCScan, 
                    Sweep, ChAV, 
                    Sweep/N, Innoc, AVTK/N, NShld, NProt, IBMAV/N, NAV/N, 
                    LProt 
 Removal Instructions:  Delete infected programs 
 
 General Comments: 
       The LZ virus was submitted in January, 1992.  It is from The 
       Netherlands.  LZ is a non-resident spawing virus which infects 
       .EXE programs, though the .EXE program itself it not have been 
       altered. 
 
       When a program infected with LZ is infected, the LZ virus will 
       search the current directory for .EXE programs.  For each .EXE 
       program it encounters, the virus will check to see if there is 
       a corresponding .COM file with the same base file name.  If there 
       is not, the virus will create one.  The created .COM file will 
       contain the viral code, and be 5,085 to 8,847 bytes in length. 
       The file's date and time will be identical to the original .EXE 
       file's date and time in the DOS disk directory listing. 
 
       The LZ virus spreads by the user executing a .EXE program via 
       executing the program's base file name.  Since DOS will execute 
       a .COM file before a .EXE program, the virus code in the .COM 
       file will be executed.  Once the virus has completed execution, it 
       will then load and execute the corresponding .EXE program. 
 
       This virus' viral code is LZEXE'd, and the .COM files created by 
       the virus will contain the text strings typically contained in 
       LZEXE'd programs. 
 
       LZ-2: Isolated in The Netherlands in June, 1992, LZ-2 is a 
             later version of the LZ virus described above.  It will 
             infect up to three .EXE programs located in the current 
             drive's root directory whenever an infected program is 
             executed.  The corresponding .COM programs will be 
             approximately 5,106 to 9,141 bytes in length and have the 
             same file date/time in the DOS disk directory listing as 
             the original, unaltered, .EXE program. 
             Origin:  The Netherlands  June, 1992. 

Show viruses from discovered during that infect .

Main Page