Krueger.2271

Analysis

• This is a polymorphic virus that infects COM and DOS EXE files.


• When an infected file is executed, the virus stays resident in memory by hooking Interrupt 21h.


• The infection routine is triggered through various actions by the user, such as the following:
  
  • setting the current directory
  • creating a file
  • opening an existing file
  • deleting a file
  • getting/setting file attributes
  • renaming a file
  • executing a program


• It appends its code to target host files.


• The virus contains the following text strings:
  
  • Freddy KRueGer 2.1
  • Hi Fridrik!