Win32.HLLC.Sulpex
Details
Win32.HLLC.Sulpex.b
This version of the Sulpex virus behaves as Win32.HLLC.Sulpex.a, but also sets the Internet Explorer start page to wmrb2000.pisem.net.
Related Posts
Leave a Reply
Win32.HLLC.Sulpex
Details
Win32.HLLC.Sulpex.a
Suplex is a dangerous resident companion Win32 virus.
The virus itself is a Windows PE EXE file about 230 KB in length, written in Delphi and compressed by UPX.
Sulpex searches recursively for all files on disks A: to Z: (except files in the Windows directory) and then infects the files that have the .EXE extension and encrypts all other files.
While infecting the virus copies the original file with the same filename prefixed with “prm” (for example, “prmCALC.exe”), and overwrites the original file with itself.
The virus encrypts the first 4000 bytes of all files that do not have .EXE extension. When there are more than 1000 encrypted files it writes a text file that has a name starting with the word “warning” to the Windows desktop. This file contains strings written in Russian.
Related Posts