From: vaughan@computing-department.poly-south-west.ac.uk (Vaughan.Bell)
Newsgroups: comp.virus
Subject: Re: Lydia virus (PC)
Date: 9 Sep 92 14:23:56 GMT

I have disassembled and analysed a 643 byte Vienna variant I have
named Lydia.  This is NOT detected by any current virus scanners
correctly but is detected as a Vienna variant (or is usually detected
in some way). It is pretty harmless and poses very little threat. DONT
PANIC. Anyway here is my brief report..


                       A description of the Lydia Virus
                    A 643 byte variant of the Vienna virus

                                      by
                                 Vaughan Bell

                              162 Dunstone View
                                   Plymouth
                                    Devon
                                   PL9 8QL
                                UNITED KINDOM
                       Internet:- vaughan@uk.ac.plym.sc


    Overview

               The Lydia virus was given to me as a 643 byte variant of the
    Vienna virus. The Vienna virus one of the first viruses that emerged and
    has many variants. Possibly due to the publication of the source code in a
    book and a magazine.

         After a little investigation I noticed that the virus scanners I had
    did not detect the virus correctly, at all, or only as a 'Possible variant
    of the Vienna' virus. So it was disassembled and analysed and this brief
    report was written.

    Name: Lydia
    Effective length: 643 bytes
    Infection Method: Parisitic Non-resident .COM infector
    McAfee Code: PNCK
    Discovered: Early 1992
    Symptoms: .COM file growth
    Scan string : A68B4475241F3C1F74EF817C79CEFA77

    General Details

         The virus is a 'direct action' virus in that it does not reside in
    memory and infects one other .COM file in the current directory when an
    already infected program is executed. If there are no other .COM files in
    the directory or they are already infected the virus will infect .COM files
    in the current path.

         The Lydia virus does not use a specific value (usually 62 with Vienna
    variants) in the seconds field of the files timestamp to detect infection.

         This Vienna variant also does not have a payload, it does not delete
    the host file or reboot the computer. It seems to have been written with no
    intentional damage in mind but some .COM programs crash when executed. The
    virus also does not check the size of the file it is infecting so if the
    addition of the virus causes the size of the .COM program to be greater
    than 64k an 'Out of memory' will occur, rendering the program 
    un-executable.

        The are several text strings which appear in infected programs these
    are as shown below :

                       "Lydia 1.0 (C) 1992 by L'amore"
                               "ViRuS Lab USA"
                                   "*.SYS"
                                   "*.COM"
                                   "PATH="
                                "????????COM"

        The 'PATH=' string will immediately be followed by the name of the host
    program (in upper case characters), also the name of the host program (also
    in upper case charcters) will appear elsewhere. The name of the virus comes
    from the first text string. The '*.SYS' is not used by the virus and .SYS
    files are not infected. However, there seems to be some 'junk' in the code
    that would indicate that the virus was released unfinished or that this is
    a prototype or test version of a virus that hasn't been released.

        The code seems to have been written by someone who does not have a
    complete grasp of assembly language or at least of the architecture of the
    80x86 series of microprocessors, as some of the code is inefficient and
    could be optimized considerably to make the executable code shorter. I
    would imagine the virus is written by a 'beginner'.

        The virus poses no major threat as it can easily be detected and it
    does no intentional damage. The virus is not polymorphic or self-encrypting
    and does not use any stealth techniques. The most effective way to remove
    the virus is to replace infected files with clean copies.