Details
Hafen.781

These are not dangerous nonmemory resident parasitic viruses. They search for .EXE files of the subdirectory tree, and write themselves to the end of the file.
“Hafen.1640,1641,1689″ contain the decrypted body of “Ambulance” virus, and infect .COM files with this sample (drop the virus). “Hafen.809″ decrypts and displays the message:
Hafenstraße bleibt !

“Hafen.781″ decrypts and prints to the printer the message:
Kilroy was here - (C) 1991, VDV.

“Hafen.818″ creates the files with the random names, these files contain the text:
Hafenstraße bleibt !

“Hafen.1191″ manifests itself with a moving picture:

Related Posts

This entry was posted on Thursday, October 30th, 2008 at 9:15 am and is filed under Virus Threats.