Virus Name: LZ
Aliases: Noon Beep
V Status: Rare
Discovered: January, 1992
Symptoms: .COM files created
Origin: The Netherlands
Eff Length: 5,085 - 8,847 Bytes
Type Code: SNA - Spawning Non-Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, AVTK, NAV, NAVDX, IBMAV, PCScan,
Sweep/N, Innoc, AVTK/N, NShld, NProt, IBMAV/N, NAV/N,
Removal Instructions: Delete infected programs
The LZ virus was submitted in January, 1992. It is from The
Netherlands. LZ is a non-resident spawing virus which infects
.EXE programs, though the .EXE program itself it not have been
When a program infected with LZ is infected, the LZ virus will
search the current directory for .EXE programs. For each .EXE
program it encounters, the virus will check to see if there is
a corresponding .COM file with the same base file name. If there
is not, the virus will create one. The created .COM file will
contain the viral code, and be 5,085 to 8,847 bytes in length.
The file's date and time will be identical to the original .EXE
file's date and time in the DOS disk directory listing.
The LZ virus spreads by the user executing a .EXE program via
executing the program's base file name. Since DOS will execute
a .COM file before a .EXE program, the virus code in the .COM
file will be executed. Once the virus has completed execution, it
will then load and execute the corresponding .EXE program.
This virus' viral code is LZEXE'd, and the .COM files created by
the virus will contain the text strings typically contained in
LZ-2: Isolated in The Netherlands in June, 1992, LZ-2 is a
later version of the LZ virus described above. It will
infect up to three .EXE programs located in the current
drive's root directory whenever an infected program is
executed. The corresponding .COM programs will be
approximately 5,106 to 9,141 bytes in length and have the
same file date/time in the DOS disk directory listing as
the original, unaltered, .EXE program.
Origin: The Netherlands June, 1992.