Macro Virus Table - Defense Technical Information Center

PC
MS-DOS/PC-DOS Computer Viruses
On October the 21st the virus activates, and displays the following message:
Leandro and Kelly! GV-MG-BRAZIL
You have this virus since xx-xx-xx
The xx-xx-xx part contains the date when the virus first infected the machine.
The virus has no intentionally destructive payload, but it will sometimes corrupt floppies and hard
drives when storing the original boot sector to another part of the disk.
Name: Leapfrog
Aliases: Leapfrog, 516 Type: Program.
Disk Location: COM application.
EXE application.
Features: Corrupts a program or overlay files.
Damage: Corrupts a program
or overlay files.
Size: See Also:
Notes: Does not change the file entry point. (other viruses that are similar are Voronezh-1600
and Brainy)
Leapfrog modifies the instruction the initial JMP points to (for COM files)
v6-084: will not be noticed by the integrity checking of MSAV (DOS 6.0 antivirus) .
Name: Lehigh
Aliases: Lehigh, Lehigh-2, Lehigh-B Type: Program.
Disk Location: COMMAND.COM Features: Corrupts a program or overlay files.
Corrupts the file linkages or the FAT.
Damage: Corrupts a program
or overlay files.
Corrupts the file linkages or
the FAT.
Corrupts boot sector
Corrupts boot sector
Size: Overlays application, no See Also:
increase
555 bytes inserted in stack
area of COMMAND.COM.
Notes: Spreads between copies of COMMAND.COM. After spreading four or ten times, it
overwrites critical parts of a disk with random data. Displaying junk on the screen. Alters the
contents and the date of COMMAND.COM. Spread will be detected by any good modification
detector.
Name: Lemming.2160
Aliases: Lemming.2160, Keeper, Thunderbyte Killer Type: Program.
Disk Location: EXE application.
COM application.
Features:
Damage: Size: See Also:
Notes: The following text is in the virus body:
"The Rise and Fall of Thunderbyte-1994-Australia. You Will Never Trust
Anti-Virus Software Again!!
[LEMMING] ver .99ß".
230 CIAC Computer Virus Information Update May 21, 1998