| Description:
|
Details
Hippie.a
It is a harmless memory resident stealth boot virus. While loading from an infected disk it hooks INT 1Ch, 2Fh, waits for DOS loading process, hooks INT 13h and releases INT 1Ch. Then the virus infects the disks that are accessed. While loading from any infected disk the virus also infects the MBR of the hard drive. While infecting the MBR the virus uses direct calls to the hard drive ports.
Before installing memory resident the virus reserves a block of the system memory by decreasing the RamSize word at the address 0000:0413. When DOS loads itself into the memory, the virus restores RamSize and stays in the memory as a DOS block.
The virus contains the text strings:
DrW-4
RPL
Dr White - Sweden 1996
Hippie Virus - Written in MalmoallB01F |
