Linc Famil
Details
Linc Family
These are harmless memory resident parasitic viruses. “Linc.228,318″ are encrypted viruses.
They use different ways to install itself into the system memory. “Linc.196,228″ copy themselves to the Interrupt Vectors Table, “Linc.307″ allocates the memory by using DOS functions and patches the MCB fields, “Linc.318″ stays memory resident by using Keep call (INT 27h).
Then they hook INT 21h and infect COM files that are executed. “Linc.196,228,307″ write themselves to the end, and “Linc.318″ writes itself to the beginning of the file.
The viruses contain the text strings:
“Linc.196″: Winter
“Linc.228″: Autumn
“Linc.307″: ‘The Waxwork Crew’ proudly release their first virus ‘aardvark’
“Linc.318″: [Sleeping]
Related Posts