Virus Description - Inca virus

Inca virus

Name	Inca virus
Aliases	Win95/Inca, Fono , El Inca
Discovered on	December 1998 and it in the wild

Virus Information - Inca virus:

This virus infects Windows 95 and Windows 98 Executable (EXE) files, Screen Saver (SCR) files, boot sector of 1.44 MB floppy disks and the compressed archives like LHA, LZH, PAK, ZIP, ARJ, RAR files. The virus stays in memory and it will infect all the above mentioned types of target objects when they are accessed. Inca virus is polymorphic and multi-partite.

When the infected program is run Inca virus creates a VXD (driver) file containing the virus code in the WINDOWS\SYSTEM directory and makes an entry in the SYSTEM.INI file to load the VXD. This file will be loaded when the computer is booted and the virus will stay in memory till the computer is shut down.

While the virus is active in memory it puts its dropper files in the COM format inside all the compressed archives and in the boot sector of floppy disks. It also tries to spread through mIRC.