Threat Description

PHX

Details

Aliases: PHX
Category: Malware
Type: Virus
Platform: W32

Summary



This virus is quite common in South America, but isolated reports have been received from Northern Europe as well.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



PHX stays resident in memory and infects COM and EXE programs when they are executed.

When PHX is infecting a file, it calls it by a name that has the "!" character appended to the end of the name, ie. FILE.EXE is called by the name FILE.EXE!, which works as well. This is done in order to by-pass some behaviour blockers that monitor access to files with executable extensions.

PHX alters one field in CMOS memory, and might cause CMOS corruption. The virus will also sometimes corrupt disk writes. This happens only when several conditions are met. These conditions include that an environment variable beginning with "PHX" is present, a certain INT call is made from within a certain type of program code and that an IN to port 03E4h returns anything else except the value FFh.

The activation routines are directed against applications written by a specific person and company.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More