| Description:
|
Details
Win32.Slow.8192.a
It is a dangerous nonmemory resident parasitic Windows virus. It searches for PE EXE files (Windows executable files) in the C:, D: and E: drives directory trees and infects them. While infecting the virus compresses victim file with LZ-like method, overwrites the file with its code and appends to the end the victim compressed data. As a result of this way of infection the infected file size may be decreased. To return control back to the host file, the virus extracts it from infected body, unpacks, saves on disk and executes it.
The virus enumerates all active application and closes those of them that contain "AV" or "EB" sub-strings in the caption (AVP and DrWeb anti-virus programs). If AVP32 files are located, the virus overwrites the C:AUTOEXEC.BAT with two instructions that displays the text:
Wait: AVP is searching viruses nowall
and delete all files in the Windows directory.
The virus contains the text string:
[SMF.LZSLOW] |
