Details
MTZ.1907

This is a benign memory resident parasitic polymorphic and stealth virus. Being executed it checks DOS version and installs itself as memory resident under DOS 5.0 or above. If there is free block of upper memory, this virus copies itself into UMB. This virus infects files on FindFirst/FindNext DOS calls. On opening an infected file the virus disinfects it.
The virus hooks INT 3, 15h, 21h. Interrupt 3 used as decryption routine, INT 15h handler calls trigger routine, INT 21h handler calls infection routine. This virus writes itself to the end of COM files. On warm reset (Alt-Ctrl-Del) it displays the message:
Y.K.K. - (c) M T Z - Italy!
Good Luck Today

Related Posts

This entry was posted on Saturday, September 29th, 2007 at 3:50 pm and is filed under Virus Threats.