NCU LI Virus

 Virus Name:  NCU LI 
 V Status:    Rare 
 Discovered:  October, 1992 
 Symptoms:    .EXE file growth; file date/time changes; decrease in total 
              system & available free memory; Parity Error Message; system 
 Origin:      Unknown 
 Eff Length:  1,694 - 1,704 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, Sweep, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, NProt, AVTK/N, LProt, NAV/N, IBMAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The NCU LI virus was received in October, 1992.  Its origin or point 
       of isolation are unknown, though it may be from the United States. 
       NCU LI is a memory resident infector of .EXE programs. 
       The first time a program infected with the NCU LI virus is executed, 
       this virus will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary.  Total system and available 
       free memory, as indicated by the DOS CHKDSK program, will have 
       decreased by 1,888 bytes.  Interrupt 21 will be hooked by the virus. 
       Once memory resident, the NCU LI virus will infect .EXE programs when 
       they are executed.  Infected programs will have a file length 
       increase of 1,694 to 1,704 bytes with the virus being located at the 
       end of the file.  The program's date and time in the DOS disk 
       directory listing will have been updated to the current system date 
       and time when infection occurred.  The following text string can be 
       found in the viral code in all infected programs: 
               "NCU LI" 
       Systems infected with the NCU LI virus will experience the system's 
       video mode being switched to 40 column mode, and the following text 
       message being displayed: 
               "PARITY ERROR ADDR (HEX) = ( 02C14H) SYSTEM HALTED" 
       When this message occurs, the system will be hung.  The message is 
       not visible in infected programs as it is encrypted. 

Show viruses from discovered during that infect .

Main Page