| Description:
|
Details
Flip.2343
As an infected file is started, these viruses infect MBR of the hard disk. To do this, the viruses decrease the size of the logical drive and write the old MBR and their continuation onto the new free space. The viruses infect files (COM and EXE) when they are loaded. "Flip"s appear polymorphic inside files; they are encrypted, and the part used for decryption doesn't have a signature longer than two bytes.
On the 2nd of each month at 4 p.m., these viruses 'turn the screen over': change (up <-> down, right <-> left) places of characters on the screen and turn them over ('/' -> '' and so on).
The "Flip.2343" virus substitutes the following commands in files:
MOV DX,Data_1
MOV Data_2,DX
MOV DX,Data_3
MOV Data_4,DX
(you can find this command set in the subroutine of COMMAND.COM, which controls output to the screen of the DOS functions FindFirst and FindNext operation results) with the call of INT 9Fh. The virus controls the INT 9Fh calls and "shortens" the size of the files. These files must be recovered from their backup copies.
The viruses contain the text "OMICRON by PsychoBlast" and hook INT 10h, 1Ch, 21h, and 9Fh.
"Flip.Madrid" formats disk sectors and displays: "RAISTLIN I from Spain". It contains the internal string also: "MADRID a favor del consumo de costo!". |
