Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically


Changsa is a resident multi-partite COM and EXE infector. When an infected file is executed the virus attacks the hard disk’s MBR. After that it will install itself memory resident and hooks the interrupts INT 8, INT 13h and INT 21h. The virus attacks programs when they are executed. It avoids files containing 'CO', 'co', 'IB', 'ib' in their names. It differentiates between COM and EXE files by the extension last letter, what is not a very reliable method. The virus contains the following texts in its body:

Welcome ! Auto-Copy Deluxe R3.00 (C) Copyright 1991. Mr. YaQi Changsha China No one can Beyond me !

and the following text at its end:

New Century of Computer Now!

On May 4th the virus instead of infecting files deletes them.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.