| Description:
|
Details
Aga.3000
It is not a dangerous nonmemory resident encrypted parasitic virus. It searches for COM and EXE files, then writes itself to the middle of the file. The virus uses anti-debug tricks. In some cases the virus hooks INT 13h and disables writing to the disks, manifests itself by some video effect, displays and prints the messages. The virus contains the text string:
Hello! You're already doomed!
WARNING!
It's AGA-v2 from MONGOLIA!
The file size was changed
[Q]uit or continue?
Try againall
DiRVeRWiNA: B: D: TiMeHeLpCaLcPaUsEWrItESeTuPDiR A:DiR B:Md
wArNiNg!FoRmAt A:/sDeL AuTo*.*DeL CoNf*.*Md ClEarHDMd
FoRmAtItscantiaidsdrweb.lkitf-pradinshercpav$$mon_k_pURAA!!!
Don't think about it!!!!!
Real-time error at 0x9207.
(*AGAv2.1,super stealth virus from MONGOLIA,UB -*) |
