BlackSun.237
Details
BlackSun.2372
It is a very dangerous memory resident encrypted parasitic stealth-virus. It traces and hooks INT 21h, then it writes itself to the end of COM- and EXE-files that are accessed. While opening an infected file the virus disinfects it, and then infects while closing.
While opening the file the virus also checks the file name and the contents of the file. If the file name is CHKLIST, or the file contains the string (any-cased):
DISKINFOSCOPE
the virus deletes the file.
Depending on the system time the virus converts the symbols on the screen - lovercased to uppercased, and uppercased to lovercased. The virus also contains the internal text string:
BlackSun v1.0 “Shaker”
Related Posts