Virus:DOS/SSR.gen

Virus:DOS/SSR.gen is a generic and heuristic detection for the polymorphic decryptor used by Virus:DOS/SSR.

 

This virus encrypts its code using a polymorphic engine that is also used in virus family DOS/SSR, such as the variant Virus:DOS/SSR_V2.A. The virus intercepts several DOS interrupt handlers to infect files being accessed, may destroy data stored on the local hard disk and may halt the infected computer.

Virus:DOS/SSR.gen tries to modify the DOS INT 21h handler to intercept file system calls to infect files having .COM and .EXE file extensions when they are being executed, accessed or enumerated.

 

Virus:DOS/SSR.gen infects files by attaching a mutated version of itself to the end of the host file and also modifies certain properties of the file to initiate the virus code before running the host file.

 

Virus:DOS/SSR.gen tries to modify DOS interrupt handler table to intercept INT 1Ch so that it counts the time since it run and trigger the following behavior depends on the time.

The virus modifies the VGA dot mode between 8 pixels per character and 9 per character periodically.

After infecting a file, the virus draws an image in ASCII art on screen, awaits a key press, then overwrites one sector of the local C drive. The virus then halts the computer.

 

Virus:DOS/SSR.gen attempts to delete files with the following file extensions when they are being enumerated: