Details
Arianna.3076

This is a parasitic encrypted and stealth virus. While executing an infected file it infects the MBR of the hard drive. While loading from infected MBR it hooks INT 1Ch, waits for DOS loading, then hooks INT 13h for stealth algorithm while accessing to infected MBR, and INT 21h to infect the files. It writes themselves to the end of EXE and COM files that are accessed. When an infected file is opened, the virus disinfect it.
Sometimes the viruses manifest themselves with a video effect and erase the original MBR sector (not first hard drive sector, but the sector containing the original MBR that was saved while infecting a disk). The viruses contain the text strings:
Improved ARIANNA , waiting for ADVANCED 386
Bari @1995 by AV(ANTI)-VIRUS SYSTEM

Related Posts

This entry was posted on Friday, June 30th, 2006 at 8:00 am and is filed under Virus Threats.