Aliases

Virus.Win32.Parite.a (Kaspersky Lab) is also known as: Win32.Parite.a (Kaspersky Lab), W32/Pate.a (McAfee),   W32.Spybot.Worm (Symantec),   Win32.Parite.1 (Doctor Web),   W32/Parite-A (Sophos),   Win32/HLLW.SpyBot (RAV),   PE_PARITE.A (Trend Micro),   W32/Parite (H+BEDV),   W32/Spybot.IA (FRISK),   Win32:SpyBot-GEN (ALWIL),   Win32/Parite (Grisoft),   Win32.Parite.A (SOFTWIN),   Trojan.Spybot.gen-3 (ClamAV),   W32/Spybot.BE.worm (Panda),   Win32/Parite.A (Eset)

Description added	Nov 02 2001
Behavior	Virus

Technical details

The virus consists of a dropper, which is witten in assembler, and the virus part itself, written in Borland C++.

When an infected file is launched, the control flow is passed to the virus dropper, which writes the virus to a temporary file and executes its infection procedure.

The virus searches for Win32 EXE PE files with .scr and .exe extensions on all logical drives of computer, and also in shared resources of local network, and infects them.

The virus doesn't manifest itselfs presence in any way.

The structure of infected file looks like this:

Host file
Virus
dropper - drops "main" to TEMP dir and executes it.
main - searches for files and infects them, e.t.c.