| Empire.Int_10.B - Virus Details
|
Empire.Int_10.B
Aliases:
Size: 1024 bytes
Frequency: 1
Characteristics:
- Infects MBR
- Infects diskette boot record
- Memory resident
- Full stealth
- Encrypted (code and data)
- Armored / anti-debug
- Uses tunneling
- Displays visual effects (other than message)
- Makes MBR inaccessible
Information:
Causes display movement on VGA and above systems. Triggered randomly six hours after bootup during December. The virus overwrites the partition table in the MBR and stores the original MBR encrypted. The infected drive will be invisible to DOS if the system is booted from an uninfected floppy. Using fdisk /mbr will render the drive unbootable.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
|
