V-Silence Famil
Details
V-Silence Family
These are dangerous memory resident polymorphic parasitic viruses. Being executed the viruses disinfect the host file, execute it and then infect again. Then the viruses hook INT 21h and write themselves to the beginning of EXE-files that are executed or closed. While opening the infected file the viruses disinfect it. The viruses do not disinfect the file if one of the archive utilities is executing: ARJ.EXE, PKZIP.EXE, AIN.EXE, RAR.EXE, or UC.EXE.
While infecting the viruses encrypt the beginning of the file, save that data to the file end, and then overwrite the file beginning with the virus copy. While disinfection the viruses read the data from the end of the file, decrypt and write it to the file beginning.
The viruses have the bugs, and in some cases they corrupt the files while infecting them.
The viruses delete the files:
C:\WIN\SOL.EXE
C:\WINDOWS\SOL.EXE
C:\WIN\WIN.COM
C:\WINDOWS\WIN.COM
The viruses do not affect the files if the file name begins with one of the strings, or if the file is placed in the subdirectory with such name. The strings are:
“V-Silence.4096″:
WIN EXCE MSO ACAD MICROG COREL CD PM PAG
“V-Silence.5120″:
WIN EXCE RumS MSO ACAD MICROG COREL CD PM DOS
The viruses also contain the internal text strings:
“V-Silence.4096″:
1113 Sofia, Acad G.Bontchev str. bl.8 room 104, EUGENE NIKOLOV,
eugene@virbus.bg
Virtual Silenceall written by The Kid,Burgas,Bulgaria 30 December 1995.
Greets to Fridrik Skulason.Without the technical analysis of some viruses
in his F-PROT I would have never written this virus.
Question to Eugene Nikolov:You are the Dark Avenger,aren’t you? MtE
“V-Silence.5120″:
1113 Sofia, Acad G.Bontchev str. bl.8 room 104, EUGENE NIKOLOV,
eugene@virbus.bg
This is The Virtual Silence virus(LL Cool J alias)…written by The
Kid,Burgas,Bulgaria January’96.
You heard of the new album “Mr.Smith” from LL Cool J,no?It’s the best thing
I’ve ever heard…especially this cool tune “Hey Lover” featuring Boyz II
Men.Go buy the album,you won’t regret.
Once a marine,always a marine.
“It does not take a genius to write a virus - any average(!?) assembly
language programmer can easily(?) do it.”.Oh,God,forgive them…they don’t
know what they are talking about.”After all,being a virus-researcher is a
risky job with various side effects - mental disorder for example…You
must be grateful at least a bit to us.We are the guys who make your money.
MtE
Related Posts