salieri.174
Webroot Antivirus: The best protection against viruses, spyware data theft and hackers.
Description:
Details
Salieri.1745
It is a very dangerous memory resident parasitic virus. It hooks INT 17h, 21h and writes itself to the end of .COM and EXE files that are accessed. The virus separates the files for the programs and the data files by the file name extension (.COM) and MZ stamp at the beginning of EXE files. While infecting a file the virus checks the file name and does not infect the files:
SCAN.EXE CLEAN.EXE RAWCOPY.EXE TNTVIRUS.EXE MSAV.EXE VSHIELD.EXE
DETECTOR.EXE
Depending on the system timer and the data that are printed the virus exchanges the symbols according to the string:
AUEIOUVBvbCKckGJgjMNmnYIiyZSzsXSxsaeiou1736942508,.;:+-*/?\/
The odd symbols are replaces with the next ones, the even symbols are replaced with the previous ones ('A' <-> 'U', 'E' <-> 'I', e.t.c.).
Depending on the system timer the virus also hooks INT 13h and disables writing to the disk (except the period when the virus is infecting a file). That may corrupt the data and halt the computer.
The virus also contains the text string:
Programado en Sevilla por Salieri
Copyright @2006 salieri.174