| Description:
|
Details
Invol Family
These are dangerous memory resident parasitic viruses. They infect EXE and SYS files. These viruses are polymorphic in the EXE files.
When an infected EXE file is executed, the virus opens the C:CONFIG.SYS file, looks for the first SYS file which is pointed by the "DEVICE=" string, and infects it. If there are not such SYS files, the virus in some cases creates the dummy VANSI.SYS file and places the command DEVICE=VANSI.SYS to the beginning of CONFIG.SYS file.
When the computer boots from the 'infected' CONFIG.SYS, the virus stays resident as a system driver, hooks INT 21h and writes itself to the end of EXE files that are executed.
These infectors contain the text strings:
c:config.sys EVICE C:vansi.sys device=vansi.sys vansi
On the 19th of any month they erase the FAT of C: drive, and display the message:
You have helped spread this virus.
This has been a message from your friendly
neighborhood infection service.
Thank you for your involuntary cooperation. |
