| Description:
|
Details
SI.509
It is a dangerous memory resident parasitic virus. It hooks INT 1Ch, 21h, intercepts DOS calls Create/Remove/Change Directory, Create/Open File and on these calls search for .COM files in the current directory, then writes itself to the end of the file.
To detect its TSR copy the virus writes ID-word "SI" to the BIOS data area at the address 0:0472 (Warm boot flag). At 10:00 the virus reboots the computer. The virus contains the text:
*.COM |
