| Description:
|
Details
Before.2915
It is not a dangerous memory resident parasitic virus. The virus was written in Assembler and its actual code is 1164 bytes, but after that virus author compressed it with AIN executable files compressor, and result virus code (compressed actual virus code and decompression routine) grows up to 2915 bytes.
The virus hooks INT 21h and writes itself to the beginning of COM and EXE files that are executed. The virus does not infect the files: CO*, WI*, EM*, SH*, GD* (COMMAND, WIN, EMM386, all). Depending on the system time and video mode the virus disables executing files (does not allow to start games?). The virus contains the text strings:
COWIEMSHGD
BEFORE.CE.1136 (C) PC Soft Club |
