Details
Win32.Cafet

This is a very dangerous non-memory resident parasitic Win32 virus. It searches for PE EXE files with .EXE and .SCR extensions in current and Windows system directories, then writes itself to the end of the file.
The virus deletes anti-virus data files:
ANTI-VIR.DAT
CHKLIST.TAV
CHKLIST.MS
AVP.CRC
IVB.NTZ
On the 12th of each month, the virus displays the following message box:
VIRUS CEFET-RJ
FORA F.H.C.
MAIS VERBAS PARA NOSSAS ESCOLAS
MADE IN BRAZIL - 1999
FEITO POR: N.B.K.
then creates and, depending on the system timer, spawns the D.BAT DOS batch file with “deltree” instruction in there.

Related Posts

This entry was posted on Tuesday, July 1st, 2008 at 7:50 am and is filed under Virus Threats.