NCU LI Virus
Virus Name: NCU LI
V Status: Rare
Discovered: October, 1992
Symptoms: .EXE file growth; file date/time changes; decrease in total
system & available free memory; Parity Error Message; system
Eff Length: 1,694 - 1,704 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, NProt, AVTK/N, LProt, NAV/N, IBMAV/N,
Removal Instructions: Delete infected files
The NCU LI virus was received in October, 1992. Its origin or point
of isolation are unknown, though it may be from the United States.
NCU LI is a memory resident infector of .EXE programs.
The first time a program infected with the NCU LI virus is executed,
this virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. Total system and available
free memory, as indicated by the DOS CHKDSK program, will have
decreased by 1,888 bytes. Interrupt 21 will be hooked by the virus.
Once memory resident, the NCU LI virus will infect .EXE programs when
they are executed. Infected programs will have a file length
increase of 1,694 to 1,704 bytes with the virus being located at the
end of the file. The program's date and time in the DOS disk
directory listing will have been updated to the current system date
and time when infection occurred. The following text string can be
found in the viral code in all infected programs:
Systems infected with the NCU LI virus will experience the system's
video mode being switched to 40 column mode, and the following text
message being displayed:
"PARITY ERROR ADDR (HEX) = ( 02C14H) SYSTEM HALTED"
When this message occurs, the system will be hung. The message is
not visible in infected programs as it is encrypted.