Selected viruses, spyware, and other threats: sorted alphabetically

These are parasitic semi-stealth COM and EXE infectors, relatives of the virus EMM:Level_3. They use the same polymorphic library EMM in which several modifications were done. In spite of the fact that solution to the problem of generation of non-functional decrytptors on processors Intel 486 is known {it was published together with the source text of the virus in the underground magazine 40Hex} the author of the virus did not implement that modification. The virus does not infect programs SCAN, VSHIELD, CLEAN, FINDVIRU, GUARD, VIVERIFY, TB*, AVP, VIRSTOP, NOD, HIEW, ICE, AVG, F-PROT, CHKDSK, DRWEB and TD. When any of these programs is executed LucyV.B and LucyV.C display red text.

LucyV.A
This is obviously a developmental version 5086 bytes long. Except of attacking files it has no other manifestation.

LucyV.B
This version is 5505 bytes long. It contains an English-Slovak text:

Hi do you know that LucyV, and AndreaP are the best girls? Sorry, nic lepsie ma teraz nenapadlo :-). Press any key to reset.
(Meaning: … Sorry, nothing better came to my mind…)

LucyV.C
It is 5286 bytes long. In this version the author cancelled some of his modifications of the mutation library. He most probably understood that they are not an improvement. Text in the virus body is changed to:

Hi, do you know that AndreaP is actually better then LucyV? Takze ak sa vam chce tak to meno zmente. :-). PS. Pochadzam[e] (ja i ona) z GJH. (mozno) Press any key to reset.

(Meaning: … So if you want to you can change that name. We come from GJH. (perhaps)...
GJH is abbreviation standing for ”Gymnázium Jura Hronca” in Bratislava (Slovak republic), a high school specialised in informatics.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.