| Description:
|
Details
BAT.Sys
This is a harmless batch virus just 602 bytes of length. It uses "worm" technology to spread: on floppy disks the virus replaces the AUTOEXEC.BAT file and is automatically executed when the system is loaded from such disk, on hard drive the virus replaces SYS.COM file and is executed when DOS is transferred on a new disk.
On loading from infected floppy disk the virus looks for C:WINDOWSCOMMANDSYS.COM file, renames it to SYS.OLD in the same directory, sets Hidden attribute for this file and copies itself to the SYS.BAT file to the same directory.
As a result when a users runs SYS command the virus takes control. The virus then temporary renames SYS.OLD to SYS.COM, executes it, renames it back to SYS.OLD and copies itself to the AUTOEXEC.BAT file on destination disk. |
