| Description:
|
Details
DiskFiller
This is a very dangerous stealth virus that hits Boot-sectors of floppy disks and the MBR of hard disks during access. This virus formats an additional track on the floppy disk (the 40th on 360K size and 80th on 1.2M) and then puts its code there. After that, the virus mounts its head part into the boot sector of the floppy, its original contents is practically unchanged. On a hard disk infection, the virus places its body just after the MBR. Inside the MBR, it changes the active boot sector address only and sets this address to the sector containing the beginning of the virus code.
When COMMAND.COM is started, the virus moves itself into the low address memory area. According to the system time it encrypts and displays the message: Haha,vírus van a gépben!! Ez egy eddig még nem közismert vírus. De hamarosan az lesz. A neve egyszerüen töltögetö Ezt a nevét onnan kapta, hogy feltöltögeti a FAT-táblát kölönbözö alakzatokkal. Ez már meg is történt !!!
and then "draws" in the FAT sectors the following picture:
****** ******
* ** *
* * * ** * * *
* ** *
* **** ** **** *
* * * *
**** ****
The virus also contains the string "command.com", hooks INT 13h,1Ch,21h. |
