Malicious Mobile Code

Windows Virus Examples

Windows viruses are as varying as their DOS predecessors, although because of the challenges of programming in a Windows environment, there are less of them currently. Windows environments afford virus writers who are willing to learn 32-bit programming a plethora of new ways to be malicious. Often, Windows viruses are part virus and part Trojan. Here are a few examples.

WinNT.Remote Explorer

Discovered on December 17, 1998, Remote Explorer was the first virus to load itself as a Windows NT service and the first to steal an administrator’s security rights to spread. Believed to have been released by a disgruntled employee, the Remote Explorer attacked MCI WorldCom’s global network. The virus is written in Microsoft Visual C++ and is quite large for a virus at 125KB and 50,000+ lines of code. Some experts estimated that it took a knowledgeable individual(s) over 200 hours to write.

When an infected executable is started on an NT machine and the current user has Administrator privileges, the virus installs itself in the \WinNT\SYSTEM32\DRIVERS folder as IE403R.SYS and runs itself as a NT system service. Running as a service, the virus gets loaded each time NT loads. Once installed, the EXE portion of the virus releases control (behaving more as a Trojan dropper). The registry will have a new key, HKLM\System\CurrentControlSet\Services\Remote Explorer, added to reflect the new service. If the current user is not an Administrator member, the service install will ...