Backdoor.Nethief
Description Backdoor.Nethief
The family of classic trojan horse for hidden remote control. This backdoors uses standard client-server technology and includes two parts - client and server, both are Windows executable files (PE EXE). The backdoor server is installed on victim computers, and the client controls them from remote station.
When the server is run it registered itself in system registry. Usually modificated following key:
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
Check other viruses! Be aware! Use Antiviral Software
Marzia.2048.WW.c
Description Marzia.2048.WW.c
This is a dangerous memory resident multipartite stealth virus. On execution of infected file it infects MBR of hard drive. Then it hooks INT 13h, 21h. On loading from infected sector it hooks INT 13h, waits for DOS loading and hooks INT 21h. On accessing to infected MBR (virus checks it by using INT 13h hooking) it substitutes it by not infected one. By hooking INT 21h the virus intercepts the files for infection.
On installation it traces INT 13h and hooks INT 1Ch. It writes itself at the end of COM and EXE files are executed or closed. On opening of the infected file this virus cures it.
Depending on current date the virus erases the hard drive sectors or call INT 24h.
It contains the internal text strings also:
WW20V
Marzia.2048.WW.e
Description Marzia.2048.WW.e
This is a dangerous memory resident multipartite stealth virus. On execution of infected file it infects MBR of hard drive. Then it hooks INT 13h, 21h. On loading from infected sector it hooks INT 13h, waits for DOS loading and hooks INT 21h. On accessing to infected MBR (virus checks it by using INT 13h hooking) it substitutes it by not infected one. By hooking INT 21h the virus intercepts the files for infection.
On installation it traces INT 13h and hooks INT 1Ch. It writes itself at the end of COM and EXE files are executed or closed. On opening of the infected file this virus cures it.
Depending on current date the virus erases the hard drive sectors or call INT 24h.
It contains the internal text strings also:
PISello tenere fuori dalla portata dei bambini.
WW20V
|