| Description:
|
Details
Fowl.3072
It is a dangerous memory resident multipartite virus. While executing an infected file or while loading from an infected floppy disk the virus infects the active boot sector of the hard drive. The virus stays memory resident only while loading from infected disk (hard drive or floppy disk). The virus hooks INT 9, waits for DOS loading, and hooks INT 28h. Then the virus waits for the end of DOS installation procedure, allocates the block of conventional memory, copies itself into there and hooks INT 13h, 21h. Then the virus writes itself to the end of EXE files that are executed and infects boot sectors of the floppy disks that are accessed. Depending of the system date the virus erases the hard drive sectors. |
