| Description:
|
Details
Roohi.2048
This is a relatively harmless memory resident parasitic virus. The virus stays memory resident only under DOS 5.0 or higher, in another case it displays:
Incorrect DOS version
and terminates the execution of the host program.
While installing, the virus hooks INT 21h, and intercepts ChDir DOS functions. While selecting a new subdirectory, the virus searches for all EXE files except SCAN.EXE, CLEAN.EXE, FINDVIRU.EXE, and writes itself into the file middle between the EXE header and the module body. The virus has a bug, and fails to infect files on the hard drive.
On the 13th of any month, the virus displays the following message and halts a PC:
Roohi v2.0
This is Power of Iran - 1995
Roohi Virus Found, By Seyed Roohollah Marashi |
