| Description:
|
Details
Lunch.783
It is not a dangerous memory resident encrypted parasitic virus. It patches INT 21h handler - searches for specific code and overwrites it with call to INT 78h (with CD78 opcode), hooks INT 78h and intercepts execution of the file and GetDiskSpace (AH=36h) function. When GetDiskSpace function is executed, the virus searches for .COM-files and writes itself to the file beginning. When the programs are executed, the virus checks the system time and at 12:00 displays:
It is TIME FOR LUNCH, Budy! |
