INCA VIRUS

Information about the Inca virus:

This virus infects Windows 95 and Windows 98 Executable (EXE) files, Screen Saver (SCR) files, boot sector of 1.44 MB floppy disks and the compressed archives like LHA, LZH, PAK, ZIP, ARJ, RAR files. The virus stays in memory and it will infect all the above mentioned types of target objects when they are accessed. Inca virus is polymorphic and multi-partite.

When the infected program is run Inca virus creates a VXD (driver) file containing the virus code in the WINDOWS\SYSTEM directory and makes an entry in the SYSTEM.INI file to load the VXD. This file will be loaded when the computer is booted and the virus will stay in memory till the computer is shut down.

While the virus is active in memory it puts its dropper files in the COM format inside all the compressed archives and in the boot sector of floppy disks. It also tries to spread through mIRC.
Inca virus first appeared in December 1998 and it in the wild.


Other names of Inca virus:
This worm is also known as Win95/Inca, Fono and El Inca