|
|
Win95.Mad.2736. Viruses Information
| Name: |
Win95.Mad.2736. |
| Category: |
Viruses |
| Description:
|
Details
Win95.Mad.2736.a
It is not a dangerous nonmemory resident encrypted parasitic virus written in Russia. It infects the Windows95 executable files (PE EXE files). It is the first known Windows95 virus that encrypts its code. The virus has no side effects - it does neither halt the system nor causes system error messages.
When an infected file is executed, the virus searches for PE EXE files in current and parent directories, then writes itself to the end of the file. While infecting a file the virus does no create new section, but increases the size of last one, modifies section characteristics, writes its code to there and changes Entry Point address.
Depending on the system time the virus displays the MessageBox:
Multiplatform Advanced Destroyer
Hello user your computer is infected by MAD virus
Welcome to my first virus for Windoze95all
Distribution & Copyright by Black Angel 1997
The virus also contains the text strings:
GetProcAddress GetModuleHandleA KERNEL32 USER32 MessageBoxA FindFirstFileA
CreateFileA CloseHandle ReadFile WriteFile SetFilePointer FindNextFileA
GetLocalTime SetCurrentDirectoryA GetCurrentDirectoryA
*.eXe
[MAD for Win95] version 1.0 BETA! (c)Black Angel`97 |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Nostardamus.3072.
Immune.53
Gambler.28
Flower.88
GeldWash.181
Leproso.122
Trojan-Dropper.Win32.VB.i
Laufwer
Tibet.142
VBS.TripleSi
|
|
