Threat Description

Rasek

Details

Aliases: Rasek, Coruna
Category: Malware
Type:
Platform: W32

Summary



This Spanish multi-partite virus infects COM and EXE files and the master boot sectors on hard drives.

Rasek stays resident in memory and infects all executed COM and EXE files. It doesn't infect very small files. The virus decreases the amount of free memory by 2 kilobytes.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



There are three known variants:

Rasek.1489: - Length: 1489 bytes - Checks if already resident by calling INT 21/CAFE. If result is

CACA, the virus has been installed.

- Contains text "RaseK v2.1,from LA CORUNA(SPAIN).Mar93"

Rasek.1490: - Lenght: 1490 bytes - Checks if already resident by calling INT 13/DFDF. If result is

FDFD, the virus has been installed.

- Contains text "RaseK v2.0,from LA CORUNA(SPAIN).Mar93"

Rasek.1492: - Lenght: 1492 bytes - Checks if already resident by calling INT 21/CAFE. If result is

CACA, the virus has been installed.

- Contains text "RaseK(r) v3.1,from La Coruna(SPAIN).Ap93"





Description Created: Mikko Hypponen, F-Secure


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More