| Description:
|
Details
Niko.3477
It is a very dangerous memory resident parasitic virus. It traces and hooks INT 21h, hooks INT 3 (debugger), then it stays memory resident and writes itself to the end of COM and EXE files that are executed or opened. The virus if stuffed with anti-debugging tricks that cover more than 50% of the virus code.
Depending on the system timer the virus corrupts the data that is saved on disk (DOS call Write INT 21h, AH=40h). While creating a .AS* or .DB* file the virus depending on the system time corrupts it or creates a subdirectory with the same name. When any file is executed or opened, the virus calculates the CRC sum of its code, and the CRC is not correct, the virus "shakes" the screen, decrypts and displays the message and halts the computer. The message is:
FUCK YOU
Under debugger or depending on the system time the virus also calls the same effect but displays another message:
No viruses
The virus also contains the encrypted text strings in Russian and:
Oct(123,123,126) by one of student |
