Win64.Rugrat.a
Description Win64.Rugrat.a
THe very first Win64 virus searches for and infects PE files.
Rugrat adds its code to the bottom of the infected file.
Rugrat does not infect files protected by SFC.
This virus was written by the same coder as Win32.Chiton. The infection method is the same.
Rugrat.a contains errors.
Contains the following text:
Shrug - roy g biv
06/05/04
*4U2NV*
Check other viruses! Be aware! Use Antiviral Software
Mirror.4130
Description Mirror.4130
It is a harmless memory resident parasitic stealth polymorphic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are accessed. It contains the text strings:
[ Mirror: Bit Addict / TridenT ]
COMSPEC=
The virus uses very unusual way of infection. It realizes the "anti-stealth" technique, that virus is "reverse" one. While accessing to not infected files with any DOS command they appears as infected, but the virus does not infect them on disk. The virus substitutes the original body and length of not infected files with their infected form. While viewing by any editor these files are visible as containing the virus code, but these files are not infected in real. DIR command reports increased file lengths. The way to infect the files is to copy them to not COM/EXE extensions, or pack with any packer such as ZIP or ARJ.
Misis.a
Description Misis.a
This is a memory-resident harmless boot virus. It hits the MBR of hard drive on booting from the infected floppy, and the floppy Boot-sectors on reading/writing the disk sectors. It hooks INT 13h. Sometimes it displays the messages in Russian.
|