Main Menu
Home
Bookmark
Contact Us



 
Win16.Klon.1177 Viruses Information

Name: Win16.Klon.1177
Category: Viruses
Description: Details
Win16.Klon.11776

It is not a dangerous nonmemory resident parasitic Win16 virus.
The virus itself is Win16 executable file (NE EXE file) about 11-13Kb of length (depending on virus version). The virus is written in Turbo Pascal for Windows.
When the virus runs it looks for Win16 and Win32 EXE files (NE and PE) on available drives and infects them. While infecting the virus moves victim file body down, and writes its own code to the file beginning. To return control to host program the virus "disinfects" host file to temporary ".DLL" file and spawns it.
While processing the virus may also create its "droppers" (pure virus EXE code) in Windows system directory, the file names depend on virus version:
SYSTEM0.EXE, SYSTEM1.EXE, SYSTEM9.EXE ANTIA.EXE, ANTIB.EXE
Some of virus versions also register these files in WIN.INI file in auto-run section:
[windows]
run=
Depending on its "generation" and other conditions the viruses displays the message boxes:
klon!
Najemnik Virus Version 3.0
AntiAnti
One of virus versions looks for active anti-virus programs by searching for following strings:
viru
mks_
avp
antiviral
then moves this application window out of desktop and tries to terminate this application.
The viruses contains the text string:
"Klon.11776":
Idea:SaddamHusseinDiskValidator Amiga!
"Klon.12800,13056": AntiAntiVirus AAV AntiAntiVirus AAV



Top Viruses Visited Pages:
Baboo - 668 visits
Invader. - 531 visits
Firstling.199 - 258 visits
Macro.Excel.Hidemo - 239 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 231 visits
Spartak.110 - 230 visits
Worm.P2P.Harex. - 220 visits
Coito.64 - 219 visits
Small.58. - 209 visits
DDoS.Win32.Kozo - 191 visits

Random Viruses Pages:
Macro.Word97.Silicon
Quit.555.
Elite.19
Ugur.129
Macro.Word.Hor
Karina.85
Macro.Word97.Titasi
Trojan.VBS.Carewm
Macro.Word97.Op
Champaigne famil


 


2006-2008 spyware32.com - Privacy Policy