TrojanSpy.Win32.GreenScreen.099
Description TrojanSpy.Win32.GreenScreen.099
This is spy trojan that installs itself to the system, hides itself and then captures screen images and saves them to disk files in encrypted form. Thus it allows to a hacker to watch screen images.
The trojan itself is Windows PE EXE file, compressed by AsPack, written in Delphi. The trojan size is different and depends on trojan version.
While installing the trojans copies itself to Windows system directory with the SERVICES.EXE name and registers that file in system registry auto-run key:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun Services
It also writes "auto-run" command to SYSTEM.INI file to "shell=" instruction.
The captured screens are stored to SPCSPC*.* files in Windows system direcotry.
The trojan is written in China and has text strings in Chinese.
Check other viruses! Be aware! Use Antiviral Software
Crasher.659
Description Crasher.659
This is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the beginning of COM files that are opened. The virus contains the string:
(C) CRASHER X
On December 20th it erases C: drive sectors and displays the message:
Dear users !
Hapy new year !
*
/ / /_ * _*
Crawler.545
Description Crawler.545
These are harmless nonmemory resident encrypted parasitic viruses. They search for .COM files except COMMAND.COM, then write themselves to the end of the file. The viruses do not manifest themselves in any way, they contain the text strings:
Thank God for the bomb
Night Crawler <Phalcon/Skism>, 11/1995
PS*.COM
|