Summary

This virus is quite common in South America, but isolated reports have been received from Northern Europe as well.

Additional Details

PHX stays resident in memory and infects COM and EXE programs when they are executed.

When PHX is infecting a file, it calls it by a name that has the "!" character appended to the end of the name, ie. FILE.EXE is called by the name FILE.EXE!, which works as well. This is done in order to by-pass some behaviour blockers that monitor access to files with executable extensions.

PHX alters one field in CMOS memory, and might cause CMOS corruption. The virus will also sometimes corrupt disk writes. This happens only when several conditions are met. These conditions include that an environment variable beginning with "PHX" is present, a certain INT call is made from within a certain type of program code and that an IN to port 03E4h returns anything else except the value FFh.

The activation routines are directed against applications written by a specific person and company.