Subscribe0 0
It is not a dangerous nonmemory resident companion virus. It searches for PE-EXE files (Win95/NT executable files), renames them with COM extension, then copies virus code with EXE extension. As a result of infection there are two files - original file with COM extension and companion file with EXE extension and with the virus body inside.
The virus infects no more than two files in the current directory. Then it executes its host file and returns control. If there are no host file, the virus shows Windows MessageBox and immediately closes it.
To do its work the virus uses standard Win95 routines exported from KERNEL32.DLL and USER32.DLL:
CopyFileA, ExitProcess, FindNextFileA, GetCommandLineA, WinExec, lstrcpyA, FindFirstFileA, MessageBoxAThe virus also contains the texts:
*.EXE .COM DeleteFileAThe last string is the name of standard Win95 routine, but it is never called.
Text added: Dec-23-1996
Hot Articles