Win95.Spawn.4096
Details
Win95.Spawn.4096.a
This is a companion Win95 virus. The virus itself is the EXE file for Win95 (PE EXE). It searches for .EXE files in the current directory (any .EXE files - DOS, Windows, Win95,all), renames it with .COM extension and writes itself to disk with the name of infected file and .EXE extension. In short, the virus saves the original file in .COM file and replaces it with its code.
After infecting four files the virus changes the ComputerName and the label of the current disk to “Murkry”. There also is a code that displays the MessageBox, but that code is never called:
Spawn95
Either 4 or all files in this directory
are infected!!!
‘Making computers more interesting
Through the creation of `tronic life’
Murkry/1997 Murkry
The virus also contains the strings:
KERNEL32.dll
USER32.dll
CopyFileA
ExitProcess
FindFirstFileA
CreateProcessA
GetCommandLineA
SetComputerNameA
SetVolumeLabelA
lstrcpyA
FindNextFileA
MessageBoxA
Related Posts