nax.140
Webroot Antivirus: The best protection against viruses, spyware data theft and hackers.
Description:
Details
Nax.1402
It is not a dangerous memory resident encrypted parasitic virus. It hooks INT 9, 21h, 4Bh and writes itself to the end of COM and EXE files that are executed. INT 4Bh is used for "Are you here?" call when the virus installs itself memory resident. By hooking INT 9 (keyboard) the virus depending on its counters replaces the keystrokes:
\ <-> /
: <-> ;
< <-> >
( <-> )
[ <-> ]
, <-> .
9 <-> 0
F5, F6 -> F8
F8 -> F6
Copyright @2006 nax.140