Memphis.98.MMS

Classification

Category :

Malware

Type :

-

Aliases :

Memphis.98.MMS

Summary

This is a hoax about a non-existant new virus for Windows 98. Ignore it.

Removal

Again, do not distribute this hoax further.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Below is an example of the hoax:

As you know, the world of computers is becoming more complex every minute
with new technologies arising all of the time.
Unfortunately, some of
this technology can be used against us.
According to McAfee Associates
and Symantec officials, there has been a new virus that has been
discovered.

According to them, the current virus detection and removal software
that they sell CANNOT detect this virus on systems running Windows 98.
This is due to Windows 98's new memory management system features.

According to McAfee Associates, this virus was written in the Assembly
language, and loads itself in to the system's upper memory.
Because of a
flaw in the Windows 98 Memory Management System, MMS, this virus can load
itself into a part of the upper memory block which cannot be accessed or
scanned by either McAfee ViruScan, or Symantec's Norton Anti-Virus.
Other virus protection utilities have not reported such errors, and have
not been tested either.

Microsoft is aware of this error and is currently working on a patch.
Unfortunately, users with Windows 98 already installed have no choice but
to continue running the OS and can only hope that this virus does not
attack their system.

It is believed that a person with access to Microsoft's source code may
have written this virus, or leaked out the source code to somebody else,
who wrote the virus.

The characteristics of the Memphis.98.MMS are not full known, but
certain characteristics are.
OS: Windows 98 (4.10.1998)
Memory Resistant: Yes
Polymorphic: Yes
Repairable: No
Encrypted: No
Infects: Floppy\Boot records
All EXE files that are ran while virus is
in memory
Origin: Unknown
Virus Size: Unknown
Actions: The Memphis.98.MMS virus performs
several actions while active, including:
Slow disk I/O, spontaneous rebooting and
monitor "flickering".
Also, you may receive a
Windows error which says:
"Error in MMS.
Please reboot and retry.
If this error
continues to occur, please contact
Micros0ft, and report the
Memphis.98.M MS error.
Thank you,
and enjoy Windows98."
Extras: You may notice the zero, 0,
instead of an o in Micros0ft, which
indicates that this is a malicious program.

The origin of the virus is unknown, but is believed to be written in
the western United States, because that was where the first bunch of
virus activity were reported.
One of the most mysterious characteristics
of this virus is that it does not affect any Microsoft applications, such
as MS Visual C++, VB, J++, Office97, Flight Sim, Frontpage97, Internet
Explorer, and any other Microsoft product.

It is believed that there may be more variations of the virus.Please send an email to VirusWatch@juno.com if you detect any strange
virus like activity or any more information about virus.
Also, please
email if you suspect that there is a new virus that people do not know
of.
 -VirusWatch