Coda.128
Details
Coda.1289
It is not a dangerous memory resident parasitic virus. It writes itself to the end of .COM and .EXE files. When an infected file is executed, the virus searches for COMSPEC= string, infects command processor (COMMAND.COM) and returns to the host program. When an infected COMMAND.COM is executed, the virus hooks INT 16h, 21h and infects the files that are opened.
The virus detects its TSR copy by “Are you here?” call INT 21h AX=C0DEh, the memory resident copy returns DAh in AL register. This is the only reason to name that virus.
By hooking INT 16h the virus disables ESC and ‘~’ (’`') keys.
Related Posts