necropoli
Webroot Antivirus: The best protection against viruses, spyware data theft and hackers.
Description:
Details
Necropolis
This is a dangerous memory resident stealth parasitic virus. It traces INT 13h, 21h, hooks INT 21h and then writes itself to the beginning of COM files and to the middle of EXE files (between the header of EXE file and the module body) when these files are accessed:
COM file EXE file
+-------+ +-------+ +--------+ +--------+
--+ Virus Header Header
- - - - +------- +-------- +--------
--+ Virus
- - - - +--------
+-------+ - - - - +--------+ - - - -
+-> +->
+-------+ +--------+
This virus uses the algorithm of the "Beast" virus: it writes a part of the file being saved to the free sectors of the last cluster of the file, and the file length does not grow.
Copyright @2006 necropoli