Lahyani is a encrypted, DOS COM resident file infector.


When a Lahyani-infected file it's run, Lahyani will allocate 1 KB of space in memory, and it will run in TSR mode. The malware will infect every COM file that's run by the user and that's not infected. 

The malware patches the string in the COMMAND.COM file "Bad command or file name" to the string "[Lahyani is ALIVE]  name".

Lahyani checks for the current day. If the current day is 11, the virus will display the string, sets the current day, month and year to December 12, 1996 and shortly after will reset the system:

Abnormal program termination.
Please consult your vendor's manual page 68 
paragraph 6,9 to find out the source 
of the problem.

If the current day is 14, the malware will change randomly the background color, will hang the system while displaying this string:

Although two days ago,
You my dear I warned;
Stil you didn't listen
And thought it was nothing.
Now Lahyani, under the shining sun
Shall proceed and make you run.
Said the poet.

The malware is not harmful.



Community content is available under CC-BY-SA unless otherwise noted.