Name         : LZ

     Aliases      : No Aliases

     Type/Size    : Link/400

     Clones       : No Clones 

     Symptoms     : No Symptoms

     Discovered   : 14-07-91

     Way to infect: Link infection

     Rating       : Less Dangerous

     Kickstarts   : 1.3

     Removal      : Use good Viruskiller.

     Comments     : The LZ-Virus patches the GlobVec6 (Write) vector
                    from the dos.library. Now Imagine you`re saving a
                    programm. (E.G. You are packing it and save it on
                    DH0:). Now, the virus checks if the 1. CodeHunk is 
                    longer as 1000 bytes. If it is greater than 1000
                    bytes, the virus searches for RTS or JMP -XY(a6) and
                    insert a BRA. That means (FOR NON-ASSEMBLERS!) the
                    virus inserts a jump to make sure that the virus will
                    be activated if you are starting the infected file.
                    ( -> See FileGhost ).

                    The virus doesn`t infect 2.0 systems or higher  =:-)
                    That`s because of the GlobalTabel-PATCH.

A.D 08-94