CarryOn.386
Description CarryOn.386
This is a dangerous nonmemory resident parasitic virus. It searches for COM files, then writes itself to the end of the file.
Starting from September, 22nd the virus reboots the computer.
The virus also contains the text strings:
*.com
Inch High
Check other viruses! Be aware! Use Antiviral Software
Int12
Description Int12
It is a harmless memory resident boot virus. The virus infects the boot sector of floppy disks and first boot sector of the C: drive. While infecting a boot sector the virus searches for the string "non-system disk" (any-cased) in there, and replaces the following texts with the virus installation code (40 bytes). Then the virus writes its main code to the last sector on the disk.
While loading from an infected disk the virus installation code reads the main virus code and jumps to there. Then the virus hooks INT 12h, waits for DOS loading process, then hooks INT 13h and infects the disk boot sectors that are accessed.
The virus contains the encrypted text strings:
LOVE
non-system disk
Int12.818
Description Int12.818
It is a harmless nonmemory resident parasitic virus. It searches for .EXE files and writes itself to the end of the file. Then the virus writes the data of random length to the end of the file, so the file length grows by random value when infected.
The virus gets the address of INT 12h, stores it and sets the INT 21h handles to INT 12h address. While infecting this virus calls to INT 12h instead of INT 21h.
|