| Description:
|
Details
Peasant.1243
This is a dangerous memory resident parasitic virus. When an infected EXE file is executed, the virus searches for a command interpreter (COMMAND.COM) by using the string "COMSPEC=", and overwrites it. The virus stores the part of the code that is overwritten into the unused sectors of the hard drive, then the virus returns control to the host program.
When an infected COMMAND.COM is executed, the virus reads its original code from the hard drive sectors, hooks INT 21h and returns control to COMMAND.COM. Then the virus writes itself to the end of EXE files that are accessed.
On Mondays, it disables the DOS functions SetDir, RemoveDir and ChangeDir; and when the files are deleted, it "hides" them with corresponding attributes, upon writing to files, the virus appends to them with the string:
"""NoImportRICE!"""
It displays the same string while terminating the programs. The virus also contains the text string:
(c)KoRea-PeaSant |
