| Description:
|
Details
Gexa.2324
It is not a dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of COM and EXE files (except COMMAND.COM) that are accessed. When the AIDSTEST anti-virus is executed, the virus displays a message in Russian. The virus uses anti-debugging tricks and halts Pentium computers. The virus also hooks INT 9 (keyboard) and checks input strings. In case of "gexa" the virus stuffs the text into keyboard buffer "- i am here!", in case of "yalta" it stuffs the text "- nice town..!". |
