| Description:
|
Details
Daemaen.2041.a
This is a memory resident encrypted multipartite virus. It writes itself at the end of COM, EXE and SYS files, the files SC*.*, CL*.*. VS*.*, F-*.* are not infected. On execution of infected program this virus tries to infect MBR sector of hard drive, it saves the original MBR sector and its body at the 9/10/11/12 physical sectors of hard drive and then writes new infected MBR. This virus hooks INT 13h and infects boot sectors of floppy disks also, the original boot sector and the virus body are stored at the last sectors of floppy. The virus hooks INT 21h also, it hits the files on accessing to them. This virus looks like a harmless ones but during one of experiments one of the samples erased the FAT of test computer. It contains the internal text strings:
[DäeMåên] by TäLöN-{{NûK_}
Hugs to Sara Gordon
Hey John! If this is bad, wait for [VCL20]!
For Dudley
[VCL20ß]/TäLöN_ï
COMEXEBINOVLSYS |
