| Description:
|
Details
Win32.Mystery.2560
This is a memory resident parasitic Win32 virus. It replicates under Win32: stays in the system memory and infects PE EXE files that are run. While infecting, the virus writes itself to the file Fixup section if there is enough size. As a result, the file length does not grow while infecting. The virus infection routine has a bug and infected files in some cases cause a standard Windows message about an error in the application.
At midnight, the virus opens and closes the CD drive and displays the following message:
Mystery by Prudentor
You are infected with Mystery! ;-)
Nothing will be killed, keep cool.
To stay memory resident, the virus, upon first start, infects the EXPLORER.EXE file. The virus obtains its name by searching the active EXPLORER process in the system memory. The virus then terminates EXPLORER.EXE (to allow writing to the file), infects it and re-runs. As a result, the virus stays in the system memory as a component of Explorer, i.e., until Windows is shut down.
Then the virus operates in the background, looks for active processes, stores their file names and infects these files when the corresponding application exits (the file is not locked for writing then). |
