| Description:
|
Details
Win32.Spit.a
This is a benign non-memory resident parasitic Windows virus. It searches for PE EXE files in the current directory, then moves file data and code down by 2000h bytes (8Kb), and writes its code to the file top. While moving original file data, the virus encrypts it. To return control to the host program, the virus creates a temporary EXE file, disinfects the host file to there, and executes it.
The virus also searches for RAR archives and adds an infected dropper into them. To do this, the virus parses RAR internal formats and adds a new record with infected README32.EXE file in it.
On April 5th, the virus displays the message:
Virus Report rev2.1 SPIT.Win32 is a Bumblebee Win32 Virus
Feel the power of Spain and die by the SpiT! |
