| Description:
|
Details
SoFar.254
These are memory resident encrypted (except "SoFar.254") parasitic viruses. They copy themselves into Interrupt Vectors Table and DOS data area, hooks INT 21h, and write themselves to the end of the files that are executed.
"SoFar.254" infects only COM files. Other viruses infect both COM and EXE files. While selecting a new directory (ChDir command) or executing any file the viruses search for COM and EXE files and infect them.
"SoFar.841" deletes CHKLIST.MS file. On 29th of any month it erases the hard drive sectors and displays the message:
So Far,So Good,allSo What?
Other viruses contain the text strings:
"SoFar.254": Sh
"SoFar.973": Sh
(C) Shel,NSTU,1994,v3.1
*.exe *.com
"SoFar.988": Sh
Novosibirsk,NSTU,1994,(-) Shel,v3.1
*.exe *.com |
