saratov.179
Webroot Antivirus: The best protection against viruses, spyware data theft and hackers.
Description:
Details
Saratov.1790
It is not a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of .COM and EXE files that are executed or opened. The virus corrupts the CHKLIST.MS file, if is exists, while infecting a file the virus checks the file name, and does not infect the files from the list (three symbols per name):
EVRWD.800COMDRWANTAIDWEBWINKRNSCACLEPT.
The virus also scans the screen buffer for "Web" string, and terminates infection if that string is found.
Depending on the system timer the virus displays the message:
Thanks for using Saratov software.
The virus intercepts the execution of the programs with "/c vir" argument and may have to display the message followed by virus' "generation" number, but fails. The message is:
The File Corrector v2.0. Made in Saratov. Serial #
Copyright @2006 saratov.179