Selected viruses, spyware, and other threats: sorted alphabetically

Liberty.2857, Liberty.2867

This is a multi-partite, encrypted COM and EXE infector. It attacks files when they are executed. The virus installs itself to the end of EXE files but with COM files it uses a non-standard way of attacking: it puts aside a part of the code from the beginning of the file and writes a part of itself to that position. The rest of the virus together with the original program code is located to the end of the file. In the COM variant of the virus the following string can be seen:

- M Y S T I C - COPYRIGHT (C) 1989-2000, by SsAsMsUsEsL

In all attacked files the following text is present and visible:

Liberty

together with many times repeated text “MAGICMAGIC...”
When the diskettes boot sector is infected the virus may damage files because it uses the 41st side. That side was not used with 360K diskettes but with higher capacity diskettes it is located in the data area. There are more versions of the virus differing in minor details.

Liberty.SSSSS

This variant is 1172 bytes long and it attacks only COM files. The string “Liberty” at the very beginning of the file cannot stay unnoticed.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.