| Description:
|
Details
Arianna.2864
This is a memory resident multipartite, encrypted and stealth virus. While executing an infected file it infects the MBR of the hard drive. While loading from infected MBR it hooks INT 1Ch, waits for DOS loading, then hooks INT 13h for stealth algorithm while accessing to infected MBR, and INT 21h to infects the files. It writes itself to the end of EXE files that are accessed. When an infected file is opened, the virus disinfects it.
Sometimes the viruses manifest themselves with a video effect and erase the original MBR sector (not first hard drive sector, but the sector containing the original MBR that was saved while infecting a disk). The viruses contain the text strings:
"ARIANNA VIRUS"HAS DONE A RECOVERABLE DAMAGE
GOOD LUCK FRIEND !!
+--------------------------------------------+
| ARIANNA is changing your computer activity |
| If you wish no damage do not turn it off |
| ThanX for diffusion ! |
+--------------------------------------------+
Coded in Bari thanX 2 DOS UNDOCUMENTED |
