| Description:
|
Details
Win32.Yerg.9412
This is a relatively harmless, non-memory, resident, parasitic, encrypted Win32 virus. It searches for Win32 EXE applications (PE EXE files) with .EXE and .SCR file name extensions, then infects them.
Upon being run from the A: drive (floppy disk), the virus looks for victim files in the Windows system directory and in all parent directories.
Upon being run from any other drive, the virus looks for files in the current directory and in all parent directories, then on the A: drive.
While infecting, the virus writes itself to the end of the file.
Payload
On the 18th of any month, the virus displays the following message box:
The virus then changes the mouse cursor image (by dropping the new image to the UFO.ANI file and loading the cursor from there - the new image is UFO-like), and then opens the Web page "http://www.abduct.com" that is dedicated to UFOs.
The virus code also contains the following text strings:
YERG
I LOVE YOU DEE
FORGIVE ME DEE
you make me so happy!
if you see this Dee online in the desc i love you
Cell [MATRiX] |
