Telemate dating invalidating query cache entries table mysql

First, it checks whether the file begins with the command INT 20h After this, the virus examines the fourth byte in the file.

If it is 1 (ASCII 1 is a smiling face), the virus assumes it has already infected the file and refrains from reinfecting it.

ZIP, contains a LHA-packed self-extracting package named VESA. The package contains VESA drivers for different video cards, including the files 37VESA. In some cases the virus damages a file while trying to infect it.

The program had been infected with a slightly modified version of Butterfly - only the text the virus contains had been changed.

The original virus contains the text "Goddamn Butterflies" at the end of its code.

If the file's fourth byte is not 1, the virus judges the file to be uninfected and promptly remedies the situation.

Although the virus usually leaves its victim's modification date unchanged, it contains a bug which in some cases causes the date and time of infected files to show the time of infection.

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site. When an infected program is executed, the virus infects up to four COM files in the default directory. The virus places its code in the end of contaminated files.

The distribution package of Telemate v4.11, TM411- 4. Although the virus is will not infect files protected with the Read-only attribute, it will infect hidden and system files.As files which begin with this command will not do anything except exit to DOS, they are often used by researchers.When a virus infects such a simple file, the actual viruscode is easy to study.That is because Butterfly only infects files in the current directory.Most users install auxiliary programs such as LIST somewhere along the hard disk's path to make them easily accessible.For some reason, probably simple forgetfulness on the part of the writer, this modification was never switched off, and the virus still infects such files regardless of the test.

Tags: , ,