F-Secure: Be Sure
Main
F-Secure Logo - Be Sure
Select local site


Privacy Policy
Legal Notices
Contact Us

F-Secure Virus Descriptions : Rasek





NAME:Rasek
ALIAS:Coruna
TYPE:MBR COM/EXE-files
ORIGIN:Spain
REPAIR:Yes

This Spanish multi-partite virus infects COM and EXE files and the master boot sectors on hard drives.

Rasek stays resident in memory and infects all executed COM and EXE files. It doesn't infect very small files. The virus decreases the amount of free memory by 2 kilobytes.

There are three known variants:

Rasek.1489: - Length: 1489 bytes - Checks if already resident by calling INT 21/CAFE. If result is 

  CACA, the virus has been installed.
- Contains text "RaseK v2.1,from LA CORUNA(SPAIN).Mar93"

Rasek.1490: - Lenght: 1490 bytes - Checks if already resident by calling INT 13/DFDF. If result is 

  FDFD, the virus has been installed.
- Contains text "RaseK v2.0,from LA CORUNA(SPAIN).Mar93"

Rasek.1492: - Lenght: 1492 bytes - Checks if already resident by calling INT 21/CAFE. If result is 

  CACA, the virus has been installed.
- Contains text "¯RaseK(r) v3.1,from La Coruna(SPAIN).Ap93"

[Analysis: Mikko Hypponen, F-Secure]