| Description:
|
Details
Legion.3274
This is a benign non-memory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the end of the file. The virus does not infect files with names that begin with two-letter variants from the string: "COSODETSANIB-D-UWIPU" (COMMAND.COM, SO*.*, all).
If the date and month correspond in number(January 1, February 2, ...), the virus displays the following message:
ATTENTION !!! PERM RESEARCH CENTER
OF AUTO-TRANSFERRING SOFTWARE PRESENT:
+++ ++---++++---+++-+++-+++--++++-+ ++
||| |+-- || --++ ||| || |||| ++||
+++-++++---++++---+++-+++-+++--++++ +++ Version 5.00
(C) TEAM O'SHEEN DA 12-Feb-1997
PRESS TO EXECUTE PROGRAM |
