Win95.Iced.141
Details
Win95.Iced.1412
This is a benign non memory-resident Win95/98 encrypted parasitic virus. It infects Windows PE EXE files and writes itself to the end of the file. While infecting it increases the size of last file section, writes its body to there and modifies necessary PE header field.
When and infected program starts, the virus takes control and runs its infection routine. To get access to Windows functions the virus scans Windows kernel exported functions by a standard method used by Windows viruses. It then searches for EXE files in current, Windows and Windows system directories and infects first four not infected PE EXE files in each directory.
This virus does not manifest itself in any way. It contains the text:
[Win32.Aztec v1.00]
Copyright (c) 1999 by Billy Belcebu/iKX
Related Posts