| Description:
|
Details
WoodGoblin.2413
It is a very dangerous memory resident polymorphic parasitic virus. It traces and hooks INT 21h, leaves its TSR copy in UMB and then writes itself to the end of EXE files that are accessed by FindFirst/Next ASCII DOS functions. While infecting a file the virus encrypt 10 blocks in the file at random selected offsets. The virus checks the file name and does not infect the files
AI*.EXE, AD*.EXE, WE*.EXE, VD*.EXE, VS*.EXE, MS*.EXE, HI*.EXE, DR*.EXE
While writing to the disk files (INT 21h, AH=40h) the virus depending on the system timer erases random selected disk sector. The virus contains the text strings:
AIADWEVDVSMSHIDR
WG03 Copyright (C) 1995-1996 by WoodGoblin |
