Kaspersky Threats

Class

Platform

Description

Technical Details

It is not a dangerous memory resident parasitic virus. It traces INT 21h,
then hooks INT 9, 1Ch and 21h and writes itself to the end of COM and EXE
files, while infecting EXE files the virus converts them to COM format. At
the end of the infected files there is the text string:



JOKER-01

This virus is a combination of different viruses: “Cascade” –
infecting the system memory, “VACSINA” – infecting EXE files,
“Yankee” – handling INT 21h, and of the program-joke “FACE.COM”
that is the origin of the virus’ video-effects. As a result, this virus has
fairly large size – about 30 Kb.

When any file is infected, the virus sets INT 9 (keyboard) and starts its
internal counter. The counter decrements its value by 1 on every keystroke.
When that counter reaches zero, a funny face appears on the screen.

Class	Virus
Platform	DOS
Description	Technical Details It is not a dangerous memory resident parasitic virus. It traces INT 21h, then hooks INT 9, 1Ch and 21h and writes itself to the end of COM and EXE files, while infecting EXE files the virus converts them to COM format. At the end of the infected files there is the text string: JOKER-01 This virus is a combination of different viruses: “Cascade” – infecting the system memory, “VACSINA” – infecting EXE files, “Yankee” – handling INT 21h, and of the program-joke “FACE.COM” that is the origin of the virus’ video-effects. As a result, this virus has fairly large size – about 30 Kb. When any file is infected, the virus sets INT 9 (keyboard) and starts its internal counter. The counter decrements its value by 1 on every keystroke. When that counter reaches zero, a funny face appears on the screen.

Virus.DOS.Joker01

Technical Details