Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Civil_Defence

This is a family of multi-partite EXE infectors. Upon executing an infected file the first to be attacked is the hard disk MBR. Its contents are moved to side 0, cylinder 0, sector 2 by the virus in case that there is only one logical disk. If there are more logical disks the MBR contents are moved to the first extended partition and the virus encrypts the data. It means that when the virus is removed unprofessionally, or when system is loaded from a clean system diskette, the computer knows only about the first logical disk. After the MBR was infected the file with the virus is disinfected. Some time after the infection the virus starts to replicate by infecting EXE files on floppy diskettes. After the infection the virus changes the value of seconds at the time of the last modification to 54. The virus contains coded Russian texts and sometimes it plays music.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.