|
|
W95.Gar Viruses Information
| Name: |
W95.Gar |
| Category: |
Viruses |
| Description:
|
Details
W95.Gara
This is a dangerous Windows9x memory resident parasitic virus. It writes itself to the end of Windows executable files ("Portable Executable" - PE EXE files). When an infected program is executed, it gets control and installs itself into Windows memory: by using a trick it jumps from the application level to Windows kernel, hooks file access Windows functions (IFS API) and stays in the system memory as a VxD driver.
The virus intercepts file opening, filters PE EXE files and infects them. While infecting it increases the size of last file section, writes its code to there and modifies necessary PE header fields.
There are several virus variants known. They contains the "copyright" strings:
"Gara.842": Alpha by ULTRAS[MATRiX]
"Gara.917": [Garaipena by Billy Belcebu/DDT]
Gara.852
This virus does not manifest itself in any way.
Gara.917
This virus is dangerous one. On 31st of a month the virus tries to overwrite a block of system memory (VxD drivers area). On some system it will halt the computer, on other Windows will display an error in driver, on some of them the virus will erase video memory data. |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 72 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
ByXute.105
VirDem.1336.
CCBB.222
DM.67
Tu28.53
Chim
Coup.2052.
BWME.Diease.98
Devil.94
Supervisor famil
|
|
