| Description:
|
Details
Sister.902
It is not a dangerous nonmemory resident encrypted parasitic virus. It searches for EXE files, then writes itself to the end of the file. To locate EXE files the virus scans current and parent directories, then WINDOWSCOMMAND directory, looks for *.EXE and *.OVL files there and infects them. The virus also looks for the EDIT.COM file - it is not "true" COM file, but has EXE binary format starting from DOS 7 (Windows95). The virus checks file names and does not infect files: F-*, AV*, DR*, SC*, IV*, TB*, FI*, FV* (F-PROT, AVP, DRWEB, SCAN, etc).
The virus deletes the anti-virus data files: ANTI-VIR.DAT, IVB.NTZ. It also tries to delete CHKLIST.* data files, but fails because of a bug.
Depending on the system timer the virus manifests itself with a video effect and display the text:
Sisters
3 close friends
The virus also contains the text strings:
[Sisters]
Techno Phunk/Ti |
