5lo

---

title: "5lo" type: doc version: 1 created: 2026-02-28 author: "Wikipedia contributors" status: active scope: public tags: ["dos-file-viruses"] description: "Computer virus" topic_path: "general/dos-file-viruses" source: "https://en.wikipedia.org/wiki/5lo" license: "CC BY-SA 4.0" wikipedia_page_id: 0 wikipedia_revision_id: 0

::summary Computer virus ::

::data[format=table title="Infobox malware"]

Field	Value
classification	Virus
type	DOS
subtype	Resident EXE
isolation_date	October 1992
::

| classification = Virus | type = DOS | subtype = Resident EXE | isolation_date = October 1992

5lo is a computer virus that increases file size and does little more than replicate. Size: 1,032 bytes

Infection

5lo infects resident .EXE files only. When it infects a file, it increases the file size by about 1000-1100 bytes (though a typical value is 1032 bytes.) At the file's direct end, this message can be found (resulting in the virus's name):

::quote

92.05.24.5lo.2.23MZ ::

Other strings can be found in the virus's code:

::quote

????????.EXE and *.EXE ::

5lo stays resident. Whenever a .EXE file is run, 5lo will infect it (and another .EXE file). The virus also changes the file's timestamp to the date and time of infection. After these infections, a counter within the virus starts. However, this counter is never checked, so the virus doesn't activate. 5lo appends its code into infected files. It also changes the field 0Ch in the .EXE file's header to FFAAh. The virus identifies itself from memory by using the interrupt INT 21, AX=3521h which it has hooked. All the checks work correctly and the virus won't infect files multiple times and it installs itself to memory only once.

When 5lo is running in memory, it isn't discoverable by typing in MEM /C. This is because when the virus installs, it ties itself to the operating system. Free memory decreases by about 2 KB.

References

References

1. [http://www.f-secure.com/v-descs/5lo.shtml F-Secure Computer Virus Information Pages: 5lo]
2. "5Lo". Symantec.

::callout[type=info title="Wikipedia Source"] This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page. ::