Win32.Hortiga
Description Win32.Hortiga
This is a non-memory resident parasitic Win32 virus. It searches for PE EXE files (Windows executable), and then writes itself to the end of the file. To reserve a place for its code, the virus creates a new section with the ".|Zan" name at the end of the file.
The virus has "anonymous IP" ability. This means that a hacker may use an infected machine as a "proxy server" sending packets with an infected machine's IP address:
IP1 IP2 IP3
Hacker's machine -----> Infected machine -----> Target machine
A hacker connects to an infected machine via its IP address (IP1) and forces an infected machine to forward packets to a Target machine, and then an infected machine's IP address (IP2) is used. So, a hacker hides its IP address.
The virus installs its "anonymous" component as a stand-alone program with the SERVER.EXE name. This program is created in the Windows system directory and registered in the auto-start registry key:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
h0rtiga Server = "Windirserver.exe"
where "Windir" is the Windows system folder.
The virus contains the text string:
(c) 2000. Win9x.h0rtiga v1.0 Server activated - http://mareasvivas.cjb.net
Coded by |Zan - izan@galaxycorp.com / izan@deepzone.org
Who are you???
This string is used as an ID-text to connect a hacker's machine with the server on infected machine.
Check other viruses! Be aware! Use Antiviral Software
ATB.1522.a
Description ATB.1522.a
It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. Depending on its counter the virus displays the message:
Welcom jion in A block troop of Computer
This virus made by ATB(1991/4)
Atenfor.2515
Description Atenfor.2515
This is a harmless, non-memory resident encrypted parasitic virus. It searches for COM files in the current directory, then writes itself to the beginning of the file. The virus encrypts the original bytes of the file. The virus contains the text strings:
FROmAaWTOCHie2
Happy ending??SoMEtIMEs.lOVE.JuST.aiN'T.EnOuGH!
ATENFOR.91
(C)AtenFOR.91.STMIK.BUDI.LUHUR.1993.INDONESIA
atenfor.com
|