| Description:
|
Details
Hero.394
These are not dangerous memory resident parasitic viruses. They copy themselves to the Interrupt Vectors Table at the address 0000:0200, hook INT 21h, and write themselves to the end of the files that are executed.
"Hero.394" infects only EXE files, "Hero.506" infects both EXE and COM files. As a read/write buffer these viruses use video memory.
While setting Interrupt Vector (INT 21h, AH=25h) with a number greater than 7Fh, "Hero.506" disinfects itself in the memory.
On the 1st of any month these viruses decrypts and display the following messages in Russian: "GLORY TO HEROES!" or "The author of the virus is a cretin" depending on the version of the virus. |
