| Description:
|
Details
GranGrave.1150
It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are accessed. When DOS functions GetDiskSpace or DeleteFCB (AH=13h,36h) are called, the virus search for EXE files of the current directory, and infects them. The virus checks the name of the file, and does not infect the file if its name contains "V" or "S" symbols, or begins with: "CL", "HW", "TB", "F-", "WC", or "TK".
Depending on the system timer the virus displays the message:
Burglar/H
The virus also contains the text strings:
AT THE GRAVE OF GRANDMAall
CLHWTBF-WCTK
*.* |
