Details
Cagliari family

These are very dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of .COM files that are executed. On May 1st they erase the FAT sectors on disks A, B, C, D and then display the message:
caGLiArI

The similar string is used by virus in its “Are you here?” call - while installing the virus calls INT 21h with AX=FFABh, the memory resident copy returns ‘CA’, ‘GL’, ‘IA’, ‘RI’ in registers AX,BX,CX,DX.

Related Posts

This entry was posted on Sunday, July 30th, 2006 at 10:00 pm and is filed under Virus Threats.