| Description:
|
Details
Croatia.1349
These are a very dangerous memory resident parasitic viruses. They hook INT 21h, 28h and write themselves to the end of .COM files that are executed. When infected files are opened or loaded for debugging, the viruses disinfect them, and infect again when the file is closed. While disinfecting the viruses create the temporary file ("Croatia.1349" - E, "Croatia.1535" - LARGE2.COM), copy the disinfected copy of the source file, and rename that file to the original name.
Depending on the system time and date the viruses decrypt the text string "Croatia" and overwrite the disk sectors with this string ("Croatia.1535" reads from the sectors instead of writing). |
