Win32.HLLC.Winatch
Description Win32.HLLC.Winatch
p>Win32.HLLC.Winatch is a non-memory resident companion Win32 virus. The virus itself is a Windows PE EXE file about 565Kb in length, written in the WinBatch language.
The virus searches for .EXE files (all types of .EXE files) in the current directory and moves them to the Windows TEMP "JmbHgfR" subdirectory (%WinDir%TEMPJmbHgfR) and overwrites original files with copies. To return control to host program the virus runs copies from the "TEMPJmbHgfR" directory.
This virus also copies itself to the Windows directory by the name "Lisezmoi.exe" and registers this file in the system registry auto-run key:
HKCRexefileshellopencommand = %WinDir%Lisezmoi.exe %1 %*
Check other viruses! Be aware! Use Antiviral Software
Shake
Description Shake
This is a very dangerous memory resident parasitic virus. It hooks INT 21h. On GetDiskSpace DOS calls (INT 21, ah=36h) the virus searches for .COM files of the current directory, then writes itself to the end of the file. In infected files it sets the time to 60 sec. The virus hooks and does not restore INT 24h. When an infected program is executed, the virus with the probability of 1/16 displays:
Shake well before use
Shaker.373
Description Shaker.373
This is a relatively harmless memory resident parasitic infector. It copies itself into the interrupt vector table, and hooks INT 1Ch and 21h. Then it infects COM or EXE files that are executed. Sometimes it 'shakes' the screen.
|