| Description:
|
Details
Win95.Iced.1617
This is a benign non memory-resident Win95/98 encrypted parasitic virus. It infects Windows PE EXE files and writes itself to the end of the file. While infecting it increases the size of last file section, writes its body to there and modifies necessary PE header field.
When and infected program starts, the virus takes control and runs its infection routine. To get access to Windows functions the virus scans Windows kernel exported functions by a standard method used by Windows viruses. It then searches for EXE files in current, Windows and Windows system directories and infects first four not infected PE EXE files in each directory.
This is an encrypted virus. It searches for anti-virus data files and deletes them: ANTI-VIR.DAT, CHKLIST.DAT, CHKLIST.TAV CHKLIST.MS, CHKLIST.CPS, AVP.CRC, IVB.NTZ, SMARTCHK.MS, SMARTCHK.CPS. It contains the "copyright" text:
[Iced Earth by Billy Belcebu/DDT] |
