Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Winhlp/Demo

The first Win32 virus infecting HLP files. Upon opening the infected file the script processing is executed and the Help system executes the binary code which is a part of the virus. By that a Win32 application is created which the virus runs immediately. The virus searches through the file KERNEL32.DLL and gets addresses of some functions from it. Then it will use these addresses to infect all Help files in the active directory. The virus served probably just for verification of technology because before infecting files and after finishing it writes messages "Trying to infect" and "Script comes to end!"

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.