Win32.Dream.491
Details
Win32.Dream.4916
This is a relatively harmless per-process memory resident parasitic polymorphic Win32 virus. It stays as a thread of the host process and infects Windows EXE and Help files that are accessed. To intercept files accessed, the virus hooks the “CreateFileA” Windows function.
While infecting EXE and HLP files, the virus writes itself to the end of the file and modifies the necessary file-structure fields. To run as a Windows application from HLP files, the virus uses a trick that for the first time was used by the “WinHLP.Demo” virus.
The virus has bugs, and infected files in some cases are damaged by the virus. Upon being activated, they cause a standard Windows message to appear about an error in application.
The virus contains the following text strings:
Win32.Dream, (c)oded by Prizzy/29A
The greetz go to all 29A vx coderz
Related Posts