| Description:
|
Details
Lemena.3544
It is not a dangerous memory resident parasitic polymorphic virus. It copies itself to the video memory at address BC00:0000, hooks INT 22h (Terminate call), returns control to host program, waits for termination and hooks INT 21h. To hook INT 21h the virus patches the DOS kernel. The virus then writes itself to the end of COM and EXE files that are executed, opened or accessed by Get/Set File Attributes DOS call.
To hide itself in the system memory the virus uses a quite complex way. When any program is executed, the virus allocates a block of XMS memory, moves its code to there, then copies its INT 22h handler to DOS kernel (the virus looks for a cave in there). The virus then releases INT 21h, hooks INT 22h, erases its TSR copy in the video memory and releases control. As a result, when any program (including anti-viruses) are active, there are no virus code in the DOS memory. The main part of virus code (encrypted) is placed in the XMS memory, and INT 22h handler is "waiting" for the Terminate call to restore "status quo" (move virus code from XMS to the video memory and to re-hook INT 21h).
The virus also uses anti-debugging tricks as well as on-the-fly encryption: the virus decrypts its subroutines before calling them, and encrypts after return from subroutine.
The virus does not infect anti-virus programs -V.EXE, ADINF, AIDSTEST, AVP, CPAV, and so on according to the string (two letters per name):
-VADAIAVCPDRF-FIGUIMIVMSNAPCSCSPSSSVTBTOV-VAVSWE
The virus deletes the anti-virus databases: ANTI-VIR.DAT, AVP.CRC, CHKLIST.CPS, CHKLIST.MS, CHKLIST.TAV, CRC.SVS, FILES.VVL FINGERP.VVF IM.PRM IVB.INI, IVB.NTZ, MSAV.CHK, SMARTCHK.CPS, AV.CRC, BOOT.CPS, BOOT.MS, BOOT.NTZ, BOOT.TAV, IV.INI, PART.NTZ
According to its random counter the virus displays the texts:
LEMENA'97
BOKEPH'97
The virus also contains the text strings:
TBDRVXXX
[LEMENA'97] by Bokeph from Batavia, Indonesia
[MENA] |
