Party.557.a
Description Party.557.a
This is a benign non memory-resident parasitic virus. It searches for COM files, then writes itself to the end of the file. On July 1st it displays the message:
This is Weeding Party 1.0 virus by Dark Judge in Tainan, Taiwan <R.O.C>
Check other viruses! Be aware! Use Antiviral Software
Psr.1000
Description Psr.1000
It is not a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or searched. The virus places a transition command (code E8 xxxx - CallVirus) directly into the host file entry point and does not modify the file header:
File: Infected file:
+--------------+ +--------------+
|Header | |Header |
|--------------| |--------------|
|Program code |<-entry point |Program code |>--+<-entry point
| | | | |
+--------------+ |--------------| |
|Virus body |<--+
+--------------+
The virus contains the text string:
[PSR.OMG.ROAKMNEEDS TBAYM ]
PSW-Worm
Description PSW-Worm
If you receive notification that a PSW-Worm has been detected, this means that the file that has been scanned is a stored password protected ZIP file (stored means that the file is effectively uncompressed) which contains a file with one of the extensions from the following list:
bat
cmd
com
exe
pif
scr
Such files are often detected in connection with several mail worms which have been spreading recently in password protected files. In such cases, the password will be shown in the message body. When scanning such messages, Kaspersky Anti-Virus searches for passwords and then scans the attached file using the password found.
If no password is included, or if the attached file is scanned separately from the message, then the message will be flagged as suspicious when scanned by Kaspersky Anti-Virus with the heuristic analyser enabled. The file will be flagged as being 'possibly infected by PSW-Worm', as such files are characteristics of a range of mail worms.
|