Win95_Caw

Classification

Malware

-

-

Win95.Caw

Summary

Caw is a dangerous memory resident Win95/98 virus. When an infected program is run the virus gets control, switches itself from application level (Ring3) to Windows kernel (Ring0), allocates a block of Windows memory, hooks file access functions (IFS API) and stays memory resident as a system VxD driver. The virus then intercepts file opening function and writes itself to the end of PE EXE files that are opened. While infecting a file the virus increases last file section and writes itself to there.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

The virus has a bug and in some cases corrupts files while infecting them. When such files are run they cause a standard Windows message about error in application to appear.

The virus has two dangerous payloads. 1s: on 7th of July on each file opening the virus erases 16 sectors at random position on the drive C:.

If current minutes are equal to 0 the virus deletes the files that are being opened: WINWORD.EXE, and files with extensions:

BMP JPG DOC WRI BAS SAV PDF RTF TXT

The second payload can be 'customized': if there is the file called 'C:\AW' the virus gets file names and extensions from this file, and deletes them.

Date Created: -

Date Last Modified: -