Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


PHX


Aliases:


PHX

Malware
Virus
W32

Summary

This virus is quite common in South America, but isolated reports have been received from Northern Europe as well.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

PHX stays resident in memory and infects COM and EXE programs when they are executed.

When PHX is infecting a file, it calls it by a name that has the "!" character appended to the end of the name, ie. FILE.EXE is called by the name FILE.EXE!, which works as well. This is done in order to by-pass some behaviour blockers that monitor access to files with executable extensions.

PHX alters one field in CMOS memory, and might cause CMOS corruption. The virus will also sometimes corrupt disk writes. This happens only when several conditions are met. These conditions include that an environment variable beginning with "PHX" is present, a certain INT call is made from within a certain type of program code and that an IN to port 03E4h returns anything else except the value FFh.

The activation routines are directed against applications written by a specific person and company.







Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.