|
|
Win95.SGWW.217 Viruses Information
| Name: |
Win95.SGWW.217 |
| Category: |
Viruses |
| Description:
|
Details
Win95.SGWW.2175
This is silly Windows95 parasitic virus. It searches for PE EXE files in the current directory and writes itself to the end of the file. While infecting a file the virus increases size of last file section, writes itself to there and modifies entry point address. The virus has bugs and may corrupt files while infecting them.
To access Windows file access functions (see the list below) the virus scans KERNEL32 exports for GetProcAddress routine and then by using this address gets addresses of other routines. This method in virus does work under Windows9x only, and does not work under Windows NT.
The virus contains the text strings:
GetProcAddress
FindFirstFileA FindNextFileA GetFileAttributesA SetFileAttributesA
CreateFileA SetFilePointer ReadFile GetFileSize CreateFileMappingA
MapViewOfFile UnmapViewOfFile CloseHandle
-=[ONE V1.0b by JFK/SGWW]=- |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 72 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Macro.Word.Vivi.
Ionkin Famil
Slayer.263
TrojanDownloader.Win32.Ultimx.
FP.33
Graced.138
Video.10
I-Worm.MyLife.
Macro.Word97.One
RS
|
|
