fantom.95
Webroot Antivirus: The best protection against viruses, spyware data theft and hackers.
Description:
Details
Fantom.954
It is a harmless memory resident multipartite virus. It writes itself to the MBR of the hard drive and to the end of EXE files. It is encrypted in files. While accessing to infected MBR the virus calls its stealth routine.
When an infected file is executed, the virus infects the MBR and returns to the host program. While loading from infected MBR the virus hooks INT 8, waits for some time (to pass DOS loading process), then hooks INT 13h and INT 21h. The INT 13h handler contains only stealth routine. INT 21h handler intercepts file execution and calls infection routine. This handler also contains semi-stealth routine that is called on FindFirst/Next DOS calls.
The virus contains the text string:
FANTOM vir. 2.0 -(c)Szczecinek- Dla Malgorzaty P.
Copyright @2006 fantom.95