Virus.Multi.Ekoterror

Class Virus
Platform Multi
Description

Technical Details


It’s a memory resident dangerous multipartite stealth virus. On execution
of infected file it writes itself into MBR of hard drive (it occupies the
sectors from 0/0/1 till 0/0/5 – track/head/sector) and returns the control
to the host program. On loading from infected sector it hooks INT 8, 13h,
then by using INT 8 it hooks INT 21h and writes itself at the beginning of
the .COM-files on their creating.


Sometimes it decrypts and types:


EkoTerror (C) 1991 ATK-toimisto P.Linkola Oy
Kovalevysi on poistettu käytöstä luonnonsuojelun nimessä.
Vihreässä yhteiskunnassa ei saa olla ydinsähköllä toimivia kovalevyjä.

and then hangs up the computer. It infects incorrectly some types of hard
drives, DOS hangs up on loading in these cases.