HTML.NoWarn.a
Description HTML.NoWarn.a
This a family of parasitic HTML infectors. They search for HTML files on the local drive and affect them. The original "NoWarn" virus was written by the same person that wrote the HTML.Internal virus and uses the same way to infect HTML files: the infection routine is a script written in Visual Basic, and the header of infected HTML file contains the reference for this script.
The virus activates its infection routine depending on the system random counter with probability 1/6, it then searches for HTM, HTML and HTT files in the current and parent directories and writes itself to the beginning of the file without any damage for the host file data.
The virus uses a trick to hide the ActiveX warning message: it tries to cover it with its own message window that "inform" the user:
Are you sure you want to view the contents of this HTML document?
This trick works correctly only if the Desktop area is set to 800x600 pixels, otherwise the virus message does not cower the ActiveX warning.
There are several virus versions known. After infecting HTML files they write the text to the browser status line:
"NoWarn.a": HTML.NoWarn v0.1 /1nternal
"NoWarn.b": HTML.NoWarn v0.11 /1nternal
"NoWarn.c": HTML.Guess you shouldn't done that!!! /SwedisHit ADOLF
Check other viruses! Be aware! Use Antiviral Software
SP
Description SP
It is not a dangerous memory resident stealth boot virus. It hooks INT 13h and writes itself to the MBR sector of the hard drive and boot sector of floppy disks that are accessed. The virus detects the already infected sectors by the ID-string "SP". The virus does not manifest itself in any way.
SP3
Description SP3
It is a very dangerous memory resident boot virus. It hooks INT 13h, 16h and writes itself to the boot sector of floppy disks and to the MBR of the hard drive. Because of an error the virus may corrupt data on floppy disks while infecting them. Depending on its counters that are increased on any keystroke (INT 16h) the virus disables writing to disks. That may corrupt disk files. The virus contains the text string: "SP3".
|