| Description:
|
Details
Haifa.2352
These are very dangerous memory resident parasitic polymorphic viruses. They copy themselves to the system memory at address 9000:0000 or 8AA0:0000 and do not fix MCB list, that might halt PC. Then they hook INT 21h and write themselves to the end of .COM and .EXE files. Sometimes they print the screen (by INT 5 call), or halt the computer.
On May, 7th they display the message:
KIRYAT MOZKIN!!!
LOCAL PROCESS INDUS¿Uvs¿UurrrS DONE BY:
SIBEL ,TEACHES
HOW TO MANAGE SHEEP?
Thanks for using Turbo Anti Virus.
PLEASE JMP FE00:0
This virus writes to BAK files:
What is backup for anyway???
BackUp is usually unneccessary!
End..
and to DOC and TXT files:
What's 455260 MI COUNTACH 5000 CC???
Instead of reading this junk, think about it!
It also contains the texts:
DES of USA Y
COMSPEC=
the Great
They write to the .ASM and .PAS files a small source code:
.model small
.code
s: mov ax,310h
xor cx,cx
mov dx,80h
int 13h
end s
It also displays:
OOPS! Hope I didn't ruin anything!!!
Well, nobody reads those stupied DOCS anyway!
COMSPEC=HAIFA VIRUS V1.01
WRITTEN BY Y.S.
GUEST STARS: T.S. & I.F.
MADE IN ISRAEL
I AM TIRED. PLEASE WAKE ME UP ON TUE 12.4.3456
PRESS RESET TO CONTINUEall
and contains the text:
CONST VIRUS='HAIFA'; |
