Virus.DOS.Phx

Class Virus
Platform DOS
Description

Technical Details


These are very dangerous memory resident parasitic viruses. They hook INT
21h and write themselves to the end of COM and EXE files. Several of the
viruses contain the text “PHX”.


“Phx.823,1015” hook the INT 21h function Open (AX=3D02h) and check the code
of program which performs that call. The viruses compares that code with
the list of specified masks, and if that code is in the list, “Phx.823”
virus resets computer, “Phx.1015” corrupts the data while writing to
the files.


“Phx.965,1289,1336” in some cases change one byte of information while
writing to disk file.