Virus.DOS.Necropolis

Class Virus
Platform DOS
Description

Technical Details


This is a dangerous memory resident stealth parasitic virus. It
traces INT 13h, 21h, hooks INT 21h and then writes itself to the beginning
of COM files and to the middle of EXE files (between the header of EXE file
and the module body) when these files are accessed:


COM file EXE file
+——-+ +——-+ +——–+ +——–+
� �–+ �Virus � �Header � �Header �
�- – – -� � +——-� +——–� +——–�
� � � � � � �–+ �Virus �
� � � � � �- – – – � � +——–�
+——-+ � �- – – -� +——–+ � �- – – – �
+->� � +->� �
+——-+ +——–+

This virus uses the algorithm of the “Beast” virus: it writes a part of
the file being saved to the free sectors of the last cluster of the file,
and the file length does not grow.