| Description:
|
Details
Lazarus.2222
It is a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or opened. It does not infects the COMMAND.COM and several anti-virus programs. When it is run for the first time, it infects the files, if they exist:
C:DOSFORMAT.COM
C:WINDOWSCOMMANDFORMAT.COM
C:WIN95COMMANDFORMAT.COM
The virus deletes anti-virus data files:
ANTI-VIR.DAT, CHKLIST.CPS, CHKLIST.MS, QHCHK.INF
While infecting the virus sets the writing to write-protected disk error handler (INT 24h) to incorrect address, that may crash the system.
On June 2nd the virus displays a message to the center of the screen and waits for a keystroke. The message looks as follows:
++ +---+ +---+ +---+ +---+ ++ + +---+
|| |+--| +---+ |+--| |+--+ || | +---+
+---+ ++ + +---+ ++ + ++ + +---+ +---+
-= LaZaRuS.2222 (c) The Shaitan/[MenACE] =-
The virus also contains the text strings:
Quick Heal? HA HA HA!
Interestingall Huh, Kishin F.?
Greetz to all members of [MenACE]: Hitech Redneck, Cyborg,
The Snake, AaronsGWC & The Shaitan!' |
