| Description:
|
Details
Ocsana.692
This is a benign memory resident encrypted parasitic virus. When an infected file is executed, the virus hooks INT 21h and 28h, and stays memory resident. Then it intercepts the ChangeDir DOS call (AH=3Bh), sets its internal flag and upon the next INT 28h call, searches for .COM files, and infects them.
While infecting a file, the virus encrypts a file and shifts it down by 692 bytes, then writes itself to the beginning of the file.
On August 13, the virus decrypts and displays the following message:
Happy birthday, Ocsana! |
