| Description:
|
Details
Win32.Benny.3219.a
This is a direct action (non-memory resident) parasitic Win32 virus. It searches for PE EXE files in the Windows, Windows system and current directories, then writes itself to the end of the file. The virus has bugs and in many cases corrupts files while infecting them. The virus checks file names and does not infect the files: RUNDLL32.EXE, TD32.EXE, TLINK32.EXE, TASM32.EXE.
While infecting, the virus increases the size of last file section, writes itself to there and modifies the necessary PE header fields including the program start-up address.
The virus contains the "copyright" string:
Win32.Benny (c) 1999 by Benny |
