|
|
PMB Viruses Information
| Name: |
PMB |
| Category: |
Viruses |
| Description:
|
Details
PMBS
It's a dangerous memory resident boot virus. On loading from infected disk it copies itself into extended memory, switches the PC into protect mode and run virtual V86 machine. The DOS and applications will be executed under that virtual PC. It hooks all interrupts (from 0 till FFh) and checks the critical situation. On critical situation on reading the floppy it infects it (the MBR of hard drive is infected on loading from infected floppy). On other critical situation it displays one of the messages and hangs the computer up:
Unimplemented Interrupt:
Offending instructions:
General Protection Fault:
Offending instructions:
Offending CS:IP:
This virus contains the internal string "PMBSVIRS" also. PMBS is a stealth virus. It checks the ports input/output (by using protect mode 386 features) and corrects the data which is for output on reading infected MBR.
This virus contains several errors, including the error of principle. The programmer's bug is the infection of the floppy. The virus saves on floppy the part of itself only, not all code. The virus consist of two parts of code - the code which is executed in real mode (on loading and on infection then the virus jumps to V86 mode), and the code of protected mode. The virus doesn't save the code which is executed in protected mode. The second generation of the virus will hang up.
The problem of principle is using of infected i386 as i86 only. The virus can't let switch i386 in protected mode again. So, EMS386, QEMM386, MS-WINDOWS e.t.c. will not work. Moreover, the DOS command MEM will hang up infected PC. It's because this program checks extended memory also, and the virus stops it. |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 72 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Aij
Macro.Word.TwoLine
Nazgul Famil
Macro.Word97.Chang
Int_FF.102
Macro.Word.Hor
Win32.Be
Cannabis_II.102
AntiMouse.72
I-Worm.Nimd
|
|
