Virus.Win32.Xorala

Technical Details

Xorala is a harmless non-resident parasitic Win32 virus. It recursively searches for Win32 PE EXE files in the Windows directory and the Windows System directory. It infects files by adding a new section named XOR at the end of the last section of the host, and it appends the virus code to the host. The Xorala virus has an infection size of 2,048 bytes. Files infected once will not be infected a second time.

The Xorala virus contains the following strings in its code. These strings can also
be found in infected files:

-= XOR 2009 Valhalla =- Assembled 1997 .. Activated 07.2002 – devoted for peace and harmony in universe against war, racism, terrorism and cruel brutality .. remember .. life is the most important thing – not money .. it’s time for a revolution NOW ….