| Description:
|
Details
Win95.Luna.2636
This is a dangerous memory resident polymorphic parasitic Windows virus. It replicates under Win95/98 only, and infects PE EXE files (Windows executables) that are opened or executed. While infecting, the virus increases the size of the last file section, and writes itself there. The virus does not infect the following anti-virus files:
AV*.*, DR*.*, F-*.*, AN*.*, CE*.*, PI*.*, TB*.*.
The virus contains the following text string:
Win9x.Luna Coded by Bumblebee
To stay memory resident, the virus allocates a block of Windows memory, copies itself there, and stays as a part of the Windows kernel. To gain control, the virus scans the KERNEL32.DLL exported funcitons, and hooks the CreateFileA calls. As a result, the virus gains access when files are opened and executed.
The virus has bugs, and in some cases, corrupts files while infecting them. On the 15th of odd months (January, March, May,all November) the virus changes the register of letters in all opened files: converts lowercase <-> uppercase. Upon the next file opening, the virus converts letters back, and so on. |
