Details
Muhamor.4608

It is a dangerous memory resident polymorphic double-encrypted parasitic virus. It hooks INT 12h, 21h and writes itself to the beginning of COM and to the middle of EXE files that are executed or opened. The virus has bugs and may corrupt EXE files while infecting them. The virus does not infect files with names: *WE?.*, *AN?.*, *38?.*.
Depending on its internal random counter the virus patches the standard Windows95 logos “Please wait while your computer shuts down” and “It’s now safe to turn off your computer” - it writes to the top of these logos an image of fly-agaric mushroom (”muhomor” in Russian).

The virus contains the text strings:
.E.C.e.cXEOMxeom
weANanaNAnWE38
Muhamor virus ver 1.1
Version 1.1
C:\WINDOWS\LOGOS.sys
C:\WINDOWS\LOGOW.sys

Related Posts

This entry was posted on Sunday, September 30th, 2007 at 11:50 am and is filed under Virus Threats.