| Description:
|
Details
Devices.2000
It is a harmless memory resident parasitic polymorphic virus. It writes itself to beginning of SYS and to the end of EXE files. While executing an infected EXE file the virus opens the C:CONFIG.SYS file, scans it for the names of device drivers, infects them and returns to the host program. While infecting a SYS file the virus creates the temporary file DEVICES.$$$, writes its code to that file, appends the code of the SYS file, then deletes the SYS file and renames DEVICES.$$$ to the original name of infected SYS file.
While loading an infected SYS file the virus installs itself into the system memory as device driver, hooks INT 1Ch, waits for some time, then hooks INT 21h and while accessing to floppy disks searches and infects EXE files.
The virus contains the text strings:
XMSXXXX0
:devices.$$$ config.sys *.exe |
