| Description:
|
Details
Abola.2420
This is a very dangerous memory resident parasitic virus. It writes itself to the end of EXE and to the beginning of COM files that are terminated (on INT 22h call). The virus stays memory resident only if the XMS driver is installed. While copying its resident code, the virus patches the XMS driver, hooks INT 2Fh and leaves its code in Upper Memory.
The virus utilizes a rather unusual way of accessing the files - during INT 2Fh calls, the virus scans memory blocks and patches INT 22h (Terminate) address in programs' PSP. When these programs are terminated, the virus will infect them.
On Tuesdays, the virus overwrites the disk sectors with the string:
AbolaAbolaAbolaAbolaAbola |
