Selected viruses, spyware, and other threats: sorted alphabetically
RMS2.1472 |
This is a simple, encrypted, resident EXE infector. When an infected file is executed the virus checks the system date. If that is set to December 1st, 1997, and another condition is fulfilled, the following text is displayed, and the virus waits for a keystroke.
Hello !
I'm RMS2 virus. I was born in Slovakia about one year ago.
Don't be worry, I won't format your hdd ... :-)
Press any key to continue.
Kurt lives ... somewhere in time.
Zrdavim virusovy radar.
In the last sentence (meaning “greetings to virus radar”) there is a spelling mistake, most probably done not on purpose. The virus ensures that the infected file is executed, and stays resident in memory. When files longer than 2000 bytes are executed or opened the virus attacks them. When doing so it avoids files AVG, CLEAN, GUARD, NOD, SCAN, TB, TOOLKIT, FINDVIRU, and VSAN.
© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.
