Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically


Alfons is a parasitic, resident COM and EXE infector. The effective length of its code is 1344 bytes. Calling of DOS services, being normally served by INT 21h, is redirected to INT 3, which is normally a break-point. Besides this the virus makes use of instructions specific for processors 386 and higher. This may confuse less perfect heuristics. The virus infects programs which are opened and writes itself at the beginning of COM type files and at the end of EXE type files respectively. It does not infect the “COMMAND.COM” file. In case that the number of the day ordered from Saturday {e.g. Monday is the second day} is equal with the date, and if you are a bit unlucky, the virus will write the message

Alfons ! Synchronizing drive C: (do not interrupt this operation !)

after a program is closed. And after that it will start to display the progress in percents accompanied with sounds of whining hard disk. When it reaches 100 percent the virus will write “Done.”. The beginning of the disk is overwritten by the string

Alfons !

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.