| Description:
|
Details
Zombie.3592
This is a dangerous non memory-resident polymorphic parasitic virus. It searches for COM files, then writes itself to the end of the file. It does not infects files with the names:
COMMAND*.*,AIDS*.*,DRWEB*.*,WEB*.*,ADINF*.*,AVP*.*,EMM386*.*
As well as files that have length divisible by 100.
While infecting the virus appends to the end of file from 0 to 127 random bytes. The virus encrypts original bytes of file by random key. To restore original bytes the virus calculates this key, but fails in about 10% of cases.
The virus has a routine erasing CMOS memory and displaying a message, but this subroutine never takes control. This text message uses as a key and use to decrypt original host file bytes, but in some cases it is patched by the virus. |
