VSUMX 9304 Copyright (c) 1990-93 by Patricia M. Hoffman. All rights reserved. Patricia M. Hoffman Telephone: (408) 988-3773 3333 Bowers Avenue Suite 130 Fax: (408) 988-2438 Santa Clara, CA 95054, USA BBS: (408) 244-0813 above action activates activation added additional after aliases alias allSafe allocation altered anti-Pascal anti-viral anything appear approximately april attempting attempts august available based becomes become beginning being below besides boundary bulgaria bytes cHKDSK cOMMAND.COM cPAV/N certification changed changes change characters command common contains contain corruption current dark Avenger date/time december decreased decrease delete described detect+ detection Method directory direct discovered discovery diskettes diskette displayed display drive drVirus eff Length encrypted errors error europe executed execute execution experience f-Prot family february file's files first following found functionally general Comments gobbler2 growth hangs hooked iBMAV including increase indicated infected infecting infection infector infects infect information install interrupts interrupt isolated isolation itself january jerusalem keyboard known lProt length listing located master memory messages message nShld naughty Hacker netherlands non-Resident non-resident november occassionally occurred occur october opened originally original origin other overwrite overwriting overwritten panda parasitic partition point previously program's programs program properly received removal Instructions replicate resident result return screen sectors sector september similar stealth stoned strings string submitted sweep/N sweep symptoms systems system table their there these though total trend uTScan uninfected united States unknown updated v Status vBuster vi-Spy variant(s) variants variant version vienna violator viral virexPC viron viruSafe viruScan virus Name virus visible which COLORS=1f,1e,0f,1b,1e,1d,0f,,1f,1f,1f,1f,1f,1f,1e,11,1f,1e,11,18,0f,,,, DISABLECOPY=1 (C)=HyperText VSUM Copyright (c) 1990-93 by Patricia M. Hoffman (408)988-3773 THINSCROLLBAR=1 _CA=Copyright (c) 1990-93 by Patricia M. Hoffman. _CB=All rights reserved. _CD=Patricia M. Hoffman Telephone: (408) 988-3773 _CE=3333 Bowers Avenue Suite 130 Fax: (408) 988-2438 _CF=Santa Clara, CA 95054, USA BBS: (408) 244-0813 _BA=fff5,ffee,45,05, F1:Help _BB=0002,ffc4,00,00,F2:Menu _BC=ffec,ffe1,53,03,F4:Srch _BD=ffed,ffe7,50,03,F5:Print _BE=ffe5,ffe8,4f,04,F7:Color _BF=ffee,ffef,57,06,F8:Viewed _BG=fffb,002d,2d,02,<<- _BH=fffa,002b,2b,00,+>> _BI=fffe,ffd3,58,05,F10:Exit _BJ=fffc,ffd0,42,06,ESC:GoBack _BK=ffe9,ffc0,00,00,F6:Credits _BL=ffef,ffbd,00,00,F9:Files _BM=fff9,ffc3,00,00,F3:Index _BN=ffea,ffa9,00,00,SearchAgain _MA=0000,0000,56,00,VSUM Sections _MB=03e8,0000,57,02,A Word From Patricia... _MC=0469,0000,55,0c,Licensing VSUM _MD=046c,0000,41,00,Authorized VSUM Agents _ME=03ef,0000,43,00,Certification Data and Info _MF=0458,0000,52,05,VSUM Revision History _MG=ffff,0000,00,00,- _MH=0003,0000,49,06,Virus Index by VSUM Virus Name _MI=03eb,0000,4e,07,Common Name Cross-Reference _MJ=0408,0000,54,06,Viral Type Cross-Reference _MK=03ed,0000,4c,00,Length Cross-Reference _ML=0410,0000,4f,00,Origin Cross-Reference _MM=0441,0000,50,0b,Relationship Charts _MN=0404,0000,44,12,Virus Activiation Dates _MO=ffff,0000,00,00,- _MP=03ee,0000,53,0b,Common Virus List _MQ=043c,0000,45,06,Virus Entry Fields _MR=0405,0000,4d,00,McAfee Scan-IDs FZPAPN Hyper Patricia M. Hoffman's ySummary List (tmi The Reference for all MS-DOS H y p e r T e x t may not be used in a business, corporation, organization, government, or agent en ment out a negotiated site license. Copyright (c) -93 by Patricia M. Hoffman. All rights reserved. 3 Bowers Ave Suite 130, Santa Clara, CA 95054 Tel: (408)988-3773 PZPAPN Alpha Index 5 @ b H c 5 P i 5 X l x v Alphabetic Index 5Lo 10 Past 3 302 337 500 572 646 834 923 1008 1024 Print 1024 SBC 1067 1210 1226 1241 1244 1260 1308 1385 1392 1452 1575 1605 1661 1689 1720 1804 1835 1840 1963 2153 2559 2560 2623 3040 3445- 4096 5120 7808 A&A Adolf Hitler Adolph African 109 Agena AIDS II AirCop Akuku Alabama Alameda Albania Albanian Alex-368 Alexander Alfa All Sys 9 Alpha-743 Ambulance Car Andre Angarsk Animus Anna Anthrax Antimon Anti-D Anti-DAF Anti-Tel Anto Aragon Aragorn ARCV 330 ARCV Friends ARCV Xmas ARCV-670 ARCV-n Argentina Armagedon Arriba Ash Ashar ASP-472 Astra AT144 Atas Atas II Attack Attention! Attention-629 Aussie Dir Aussie Parasite Australian Australian 403 Australian Azusa Back Bad Boy Bad-389 Badsec Bandit Baobab Barcelona Barrotes Basilisk Beast-N-Black Bebe Beeper Beer Best Wishes Beta Beware BFD Big Joke Big-2000 Bios Bit Addict Black Monday Black Wizard Blinker Bljec Blood Bloody! Bomber Boojum %Killer Bow Boys Brain Brainy Brazilian Bug Breeze Bryansk Burghofer Butt Stink Cadkill Cannabis Cansu Capitall Cara Carfield Carioca Cascade Casino Casper Casteggio Catman Caz CB-1530 CCCP-510 CD Cerburus Chad Chang Changu Mangu Chaos Chaser CheckSum Cheeba Chemmy Chemnitz China CHR-869 Christmas Tree Cinderella Civil War Clonewar Close CLS-853 Cmdr Bomber Coffeeshop-1568 Commy Como Copyright Cossiga Costeau CPSU-2535 CPW Cracker Jack Crash Crazy Eddie Crazy Imp Creeper Crew-2480 Criminal Crusher Curse CV4 Cyber CyberTech Dad Dada Damage DAME Dark End Dark Lord Datacrime DataLock Davis Day10 dBASE Deicide Demolition Demon Viper Den Zuk Dest Destructor V4.00 Devil's Dance Dewdz Digger Dima Dir Dir-2 Discom KKiller Dismember Do-Nothing Doctor Qumak 2 DoDo Doom II DOS3 DOSHunter Dot Killer Drop Dutch 555 Dutch Ear Edcl Egg-1000 Eight Tunes Einstein Eliza Emmie End Of Enemy Enigma Enola Evil Evil Empire Exebug Experiments Experiments-416 Exunt Father Father Christmas Feist Fellowship Fich Fichv-896 =11-537 Filler Fingers Finnish-709 Fish Fish Fisher Flash Flex Flip Flower FoneSex Forger FORM- Freddy ew-692 Frere Jacques Friday 13th Friends Frodo Soft Frogs Fu Manchu Funeral Fungus Geek Gergana Ghostballs Gingerbread Man Gliss Globe Gnose GoldGeld Gorlovka Gosia Got-You Gotcha Grapje Green Joker Gremlin Grither Groen Links Groove Growing Block Grunt-1 Guillon Guppy Ha Hacktic Hafenstrass Hafenstrass 2 Haifa Hallo-496 Halloechen Halloween Hamster Happy Happy New Year lDays Hary Anto Hell Hellween Hero Hero-394 HH&H Hi HiDos Highlander Hitchcock Holocaust Hominy Horror Horse Hungarian Hungarian 482 Hybryd Hydra Hymn Ice 9 Icelandic Idle Ieronim IKV 528 Incom Infinity Interceptor Internal Intruder Invader Invol Ionkin Iper Iranian Iraqui Warrior Italian 803 Itavir Japanese Christmas Jeff Jerk 11-30 Joanna JoJo JoJo 2 Joker Joker 2 Joker-1602 Joshi Joshua Junior JW2 Kalah Karin Kemerovo Keydrop Keypress Kiev 483 Kiev 2049 Kiwi-550 Klaeren KLF-356 Kode4 Korea Krivmous Kthulhu Kuku-448 Label Lancs Larry Lazy Leech Legalize Lehigh Liberty Liberty-2 Liberty-1172 Lippi-286 Lisbon Little Br Little Girl Little Pieces Little-139 Loa Duong LockUp Loki Lokjaw Lord-933 Los-693 LoveChild-2710 LowerCase Lozinsky LPT Off Luca-309 Lucifer Lurve LV 1.2 Lycee Lythyum LZRQ M.I.R. Macedonia Magnitogorsk 2048 Malaga Malaise Malign Malmsey Maltese Amoeba Mannequin Manola Manta Marauder Mardi Bros Marl Matura Mayak Medical Meditation Mexican Mud MG MGTU Michelangelo Micro 128 Microbes Micropox Miky Milena MiniMax Minimite Ministry Minsk Ghost Mirror Mix1 Mix2 Moctezumas Revenge Monkey Mono Month 4-6 Monxla Monxla B More-649 Mosquito MPS 1.1 MPS 3.1 MPS 3.2 MPS 4.01 MShark MSTU Mugshot Mule Multi 1.1 Multi-123 Multi-Face Mummy Munich Murphy MusicBug Mutant Mutation Nazgul NaziPhobia NCU LI Necro Fear Necro Shadow Newcom Nina Nines Ninja No Frills NoBock NoInt Nomenklatura Not-586 NPox NR-481 NTKC Null Set Null-178 Nygus Ohio Oi Dudley Ontario Ontario 730 Ontario III Oropax Otto6 Outland Oxana Pa Parasite Paris Parity Parity Particle Man Path Pathhunt Patient Pay Rise PC Flu PC Flu-2 PCBB Pegg-833 Pentagon Penza Perfume Phantom Phoenix Phoenix 2000 PhoenixD Piazzolla Pila Ping Pong Pisello Pitch Piter-1228 Pixel Pixie Plastique Plastique-B Play Tetris Plovdiv 1.1 Plovdiv 1.3 Plumbum Plutto Poem Pogue Pojer Polimer Polish 217 Polish 529 Polish 583 Polish Polish-376 Possessed Pregnant Press Prime Print Problem Protecto Proud PS-MPC Puke-393 PV-81 QMU Quake Queens Quiet Quick Quirk R-10 R-11 Radyum Rage RAM Random Rattle RaubKopie Reaper Red Diavolyata RefRef Reklama Relzfu Reset Revenge Attacker RIP-699 Rocko Rosen RPVS RSP-1876 RTL4 Ryazan Rybka Sad Saddam Sadist Sandwich Saturday The 14TH Scott's Valley Scream Scroll Scythe SeaCat Search-1000 Self Semtex Sentinel Serena Seventh Son Shadow Shake Shaker Shaman Shield Shifter Shirley Sicilian Mob Signs Silence Silly Silly Silly-365 Simple Simulati Sinep Siskin Sistor Skater Skew-469 Skull Slayer Slime Slovak Slow Small ARCV Small Small-178 Smiley Socha Solano 2000 thing Sorlec Sorry Soupy Spanish Spanish Fools Spanz Sparse Spyer Squawk Squeaker Squisher Staf Stahl Stanco StarDot 600 StarDot 789 StarDot 801 Stasi Sticky StinkFoot Stone`90 Striker #1 Stupid-1355 Suicidal Sunday Sunday-2 Suriv 1.01 Suriv 2.01 Suriv 3.00 Suriv 4.02 Surrender SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 Sverdlov SVir Swap Swedish Boys Swedish Disaster Swiss 143 Swiss Phoenix Sylvia SysLock Tabulero Tack Taiwan Taiwan 3 Taiwan 4 Talentless Tankard Tao Cheng Tatou TB1 TechnoRat Telecom Ten Tequila Terminator Terminator-2294 Terminator-3549 Tester Thimble Timid Timor TMTM Tobacco Todor Tokyo Tolbuhin Tomato Tony Tony Tormentor Tormentor-205 Totoro TPE TPWorm Traceback Traceback 3029 Traceback II Traveller Tremor Troi Tu-482 Tula Tumen Turbo Twin-351 Typo Typo UFA-1201 Ultimation UnExe Unk Urfydus Uruguay Uruk-hai V-3n V270x V388 V483 V651 V800 V801 V82 V1024 V2000 V2100 V2P2 V2P6 Vacsina VComm VCS VFSI VHP2 Victor Vindicator Violetta Violite Viperize VirDem VirDem-792 VirDem-1542 Vivaldi VMem Voronezh Voronezh-370 Voronezh-Chemist Vote Vriest VVF 3.4 VX-163 W13 Walker Warning Warrior Wave Weak Were Here Westwood Whale Wharps Wild Thing 2 Windmill WinVir Wisconsin Witch Wolfman Wonderful WordSwap World Peace Worm-16850 Worm-17690 WXYC X-2 Xpeh Xuxa Yafo YAM-3599 Yankee Doodle Yankee 2 Yap Year Youth Zaphod Zaragosa Zero Bug ZeroHunt Zherkov ZK900 Zoid ZZ s and Research 382 Recovery 422 4870 Acid AIDS Amstrad Argentina-102 Bad Brain Banana Blaze Blood Lust Budo Burger Busted Darth Vader Define DisDev Druid Explode Fat Fratricide Groove OW Green Peace Gyro Harakiri Hastings Hellraiser House I-B Itti Kamikazi Leprosy Madismo Mindless MindRiot Mini-45 Nowhere Man Number One Ondra Pascal-4260 Pascal-5220 Pirate Polish-45 Possum Psychogenius Repent Seneca-B Shhs Silver Dollar Simple Minds Skism Small-38 T-1000 TalkingHeads Toxic Twin Peaks Tyst V-1n Viper Wonder WWT Yukon PZPAPN MAIN MENU WEL ,E TO A word fPatricia... Using Index Cross-Reference Relationship Chart Revision History Licensing Appendices Exit PZPAPN Index PZPAPN 10 Past 3 5Lo 99% 302 310 334 337 382 Recovery 405 408 422 439 500 512 557 572 595 621 646 66A 702 834 889 914 923 981 1008 1024 Print 1024 SBC 1067 1210 1226 1241 1244 1253 1260 1308 1385 1392 1452 1575 1605 1661 1689 1720 1804 1835 1840 1963 2153 2559 2560 2623 3040 3445- 4096 4870 5120 7808 PZPAPN A&A ABC Acid Ada Adolf Hitler Adolph African 109 Agena AIDS AIDS II Aircop Akuku Alabama Alameda Albania Albanian Alex-368 Alexander Alfa All Sys 9 Alpha-743 Ambulance Car Amstrad Andre Angarsk Animus Anna Ant Anthrax Anti-D Anti-DAF Anti-Tel Antimon Anto Aragon Aragorn ARCV 330 ARCV Friends ARCV Xmas ARCV-670 ARCV-n Arf Argentina Argentina-102 Armagedon Arriba Ash Ashar ASP-472 Astra AT144 Atas Atas II Attack Attention! Attention-629 Aussie Dir Aussie Parasite Australian Australian 403 Australian Azusa PZPAPN Back Bad Boy Bad Brain Bad-389 Badsec Banana Bandit Baobab Barcelona Barrotes Basilisk Beast-N-Black Bebe Beeper Beer Best Wishes Beta Beware BFD Big Joke Big-2000 Bios Bit Addict Black Monday Black Wizard Blaze Blinker Bljec Blood Blood Lust Bloody! Bob Bomber Boojum %Killer Bow Boys Brain Brainy Brazilian Bug Breeze Bryansk Budo Burger Burghofer Busted Butt Stink PZPAPN Cadkill Cannabis Cansu Capitall Cara Carfield Carioca Cascade Casino Casper Casteggio Catman Caz CB-1530 CCCP-510 Cerburus Chad Chang Changu Mangu Chaos Chaser CHCC CheckSum Cheeba Chemmy Chemnitz China CHR-869 Christmas Tree Cinderella Civil War Clonewar Close CLS-853 Cmdr Bomber Coffeeshop-1568 Commy Como Copyright Cossiga Costeau CPSU-2535 CPW Cracker Jack Crash Crazy Eddie Crazy Imp Creeper Crew-2480 CRF Criminal Crusher CSL Curse CV4 Cyber CyberTech PZPAPN Dad Dada Damage DAME Dark End Dark Lord Darth Vader Datacrime DataLock Davis Day10 dBASE Define Deicide Demolition Demon Viper Den Zuk Dest Destructor V4.00 Devil's Dance Dewdz Digger Dima Dir Dir-2 Discom DisDev KKiller Dismember Do-Nothing Doctor Qumak 2 DoDo Doom II DOS3 DOSHunter Dot Killer Drop Druid Dutch 555 Dutch PZPAPN Ear ECU Edcl EDV Egg-1000 Eight Tunes Einstein EkoT Eliza Emf Emmie End Of Enemy Enigma Enola ETC Exebug Experiments Experiments-416 Explode Exunt Evil Evil Empire PZPAPN Fat Father Father Christmas FCB Feist Fellowship FGT Fich Fichv-896 Fil =11-537 Filler Fingers Finnish-709 Fish Fish Fisher Flash Flex Flip Flower FoneSex Forger FORM- Fratricide Freddy ew-692 Frere Jacques Friday 13th Friends Frodo Soft Frogs Fu Manchu Funeral Fungus PZPAPN Geek Generic Generic Gergana Ghostballs Gingerbread Man Gliss Globe Gnose GoldGeld Gorlovka Gosia Got-You Gotcha Grapje Green Joker Green Peace Gremlin Grither Groen Links Groove Groove OW Growing Block Grunt-1 Guillon Guppy Gyro PZPAPN Hacktic Hafenstrass Hafenstrass 2 Haifa Hallo-496 Halloechen Halloween Hamster Happy Happy New Year Harakiri lDays Hary Anto Hastings Hell Hellraiser Hellween Hero Hero-394 HH&H HiDos Highlander Hitchcock Holocaust Hominy Horror Horse House Hungarian Hungarian 482 Hybryd Hydra Hymn PZPAPN I-B Ice 9 Icelandic Idle Ieronim IKV 528 Ill Incom Infinity Interceptor Internal Intruder Invader Invol Ionkin Iper Iranian Iraqui Warrior Italian 803 Itavir Itti IVP PZPAPN Japanese Christmas Jeff Jerk 11-30 Joanna JoJo JoJo 2 Joker Joker 2 Joker-1602 Jos Joshi Joshua Junior JW2 PZPAPN Kalah Kamikazi Karin Kemerovo Keydrop Keypress Kiev 483 Kiev 2049 Kit Kiwi-550 Klaeren KLF-356 Kode4 Korea Krivmous Kthulhu Kuku-448 PZPAPN Label Lancs Larry Lazy LCT Leech Legalize Lehigh Leprosy Liberty Liberty-2 Liberty-1172 Lippi-286 Lisbon Little Br Little Girl Little Pieces Little-139 Loa Duong LockUp Loki Lokjaw Lord-933 Los-693 LoveChild-2710 LowerCase Lozinsky LPT Off Luca-309 Lucifer Lurve LV 1.2 Lycee Lythyum LZRQ PZPAPN M.I.R. Macedonia Madismo Magnitogorsk 2048 Malaga Malaise Malign Malmsey Maltese Amoeba Mannequin Manola Manta Marauder Mardi Bros Marl Matura Max Mayak Medical Meditation Mexican Mud MGTU Michelangelo Micro 128 Microbes Micropox Miky Milena Mindless MindRiot Mini-45 MiniMax Minimite Ministry Minsk Ghost Mirror Mix1 Mix2 Moctezumas Revenge Monkey Mono Month 4-6 Monxla Monxla B More-649 Mosquito MPS 1.1 MPS 3.1 MPS 3.2 MPS 4.01 Mr MShark MSJ MSTU Mugshot Mule Multi 1.1 Multi-123 Multi-Face Mummy Munich Murphy MusicBug Mutant Mutation MVF PZPAPN Nazgul NaziPhobia NCU LI Necro Fear Necro Shadow Newcom Nina Nines Ninja No Frills NoBock NoInt Nomenklatura Not-586 Nowhere Man NPox NR-481 NTKC Null Set Null-178 Number One Nygus PZPAPN Ohio Oi Dudley OMT Ondra Ontario Ontario 730 Ontario III Oropax Otto6 Outland Oxana PZPAPN Parasite Paris Parity Parity Particle Man Pascal-4260 Pascal-5220 Path Pathhunt Patient Pay Rise PC Flu PC Flu-2 PCBB PCV Pegg-833 Pentagon Penza Perfume Phantom Phoenix Phoenix 2000 PhoenixD Piazzolla Pif Pila Ping Pong Pirate Pisello Pitch Piter-1228 Pixel Pixie Plastique Plastique-B Play Tetris Plovdiv 1.1 Plovdiv 1.3 Plutto Plumbum Poem Pogue Pojer Polimer Polish 217 Polish 529 Polish 583 Polish Polish-45 Polish-376 Possessed Possum Pregnant Press Prime Print Problem Protecto Proud PS-MPC Psychogenius Puke-393 PV-81 PZPAPN QMU QP3 Quake Quiet Quick Quirk Queens PZPAPN R-10 R-11 Radyum Rage RAM Random Rattle RaubKopie Reaper Red Diavolyata RefRef Reklama Relzfu Repent Reset Revenge Attacker RIP-699 RNA Rocko Rosen RPVS RSP-1876 RTL4 Ryazan Rybka PZPAPN 00} k PT} Sad Saddam Sadist Sandwich Saturday The 14TH Scott's Valley Scream Scroll Scythe SeaCat Search-1000 Seneca-B Self Semtex Sentinel Serena Seventh Son Shadow Shake Shaker Shaman Shhs Shield Shifter Shirley Sicilian Mob Signs Silence Silly Silly Silly-365 Silver Dollar Simple Minds Simple Simulati Sinep Siskin Sistor Skater Skew-469 Skism Skull Slayer Slime Slovak Slow Small ARCV Small Small-38 Small-178 Smiley Socha Solano 2000 thing Sorlec Sorry Soupy Sov Spanish Spanish Fools Spanz Sparse Spyer Squawk Squeaker Squisher Staf Stahl Stanco StarDot 600 StarDot 789 StarDot 801 Stasi Sticky StinkFoot Stone`90 Striker #1 Stupid-1355 Suicidal Sunday Sunday-2 Suriv 1.01 Suriv 2.01 Suriv 3.00 Suriv 4.02 Surrender SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 Sverdlov SVir Swap Swedish Boys Swedish Disaster Swiss 143 Swiss Phoenix Sylvia SysLock PZPAPN T-1000 Tabulero Tack Taiwan Taiwan 3 Taiwan 4 Talentless TalkingHeads Tankard Tao Cheng Tatou TB1 TechnoRat Telecom Ten Terminator Terminator-2294 Terminator-3549 Tequila Tester Thimble Timid Timor TMTM Tobacco Todor Tokyo Tolbuhin Tomato Tony Tony Tormentor Tormentor-205 Tormentor-1072 Totoro Toxic TPE TPWorm Traceback Traceback 3029 Traceback II Traveller Tremor Troi TSoft Tu-482 Tula Tumen Turbo Twin Peaks Twin-351 Typo Typo Tyst PZPAPN UFA-1201 Ultimation UnExe Unk Urfydus Uruguay Uruk-hai PZPAPN V-1n V-3n V270x V388 V483 V651 V800 V801 V82 V1024 V2000 V2100 V2P2 V2P6 Vacsina VComm VCL VCS VFSI VHP VHP2 Victor Vindicator Violetta Violite Viper Viperize VirDem VirDem-792 VirDem-1542 Vivaldi VMem Voronezh Voronezh-370 Voronezh-Chemist Vote Vriest VVF 3.4 VX-163 PZPAPN W13 Walker Warning Warrior Wave Weak Were Here Westwood Whale Wharps Wild Thing 2 Windmill WinVir Wisconsin Witch Wit Wizard 3.0 Wolfman Wonder Wonderful WordSwap World Peace Worm-16850 Worm-17690 WWT WXYC PZPAPN X-2 Xpeh Xuxa PZPAPN Yafo YAM-3599 Yankee Doodle Yankee 2 Yap Year Youth Yukon PZPAPN Zaphod Zaragosa Zero Bug ZeroHunt Zherkov ZK900 ZMT Zoid Zu1 PZPAPN : 5Lo H: , 1993 Poland R: 1,030 - 1,040 4: PRhE - 6.04+, \2.07+, 2.45+, 2.48a+ The 5Lo , 1993, and is fPoland. 5Lo is a vof . b5Lo X, the 5Lo at the top of the &, hooking |21. 5Lo qof 1,030 to 1,040 at the end of the a. The =and in the DOS to the =and . The can be in the 4in all 5Lo "92.05.24.5lo.2.23MZ" PZPAPN 10 Past 3 : 10 Past 3 H: keypresses lware devices disabled or interference R: 748 4: PRaCK - .1.4+, 6.0+, 3.93+, V99+, 2.43a+, , NAV 2.1.2+, 25.10+, V99+, The 10 Past 3, or 748, was actually ~much earlier, in early . 10 Past 3 is a vof . The the 10 Past 3 in low , hooking {21 and 6B. , as measured by the DOS not be the 10 Past 3 , it qof 748 at the end of the a. The in the DOS not be . No in the The 10 Past 3 between 15:10 and 15:13 (3:00PM and 3:15PM) every day, at cause the "Ctrl" or "Shift" keys to be invokes enters a character on the . As a , the character input may not be the same as what the intended. ly, it either disables or interfers the functioning of the devices on the days of any month 1st day of any month - 10th day of any month - 16th day of any month - monitor/ 29th day of any month - On the 22nd day of any month, unexpected %s may of 10 Past 3 are: 10 Past 3-B: A 789 of the 10 Past 3 adds 789 (to the . +. It the on the monitor: The in the 4in all 10 Past 3-B : Republic Of South Africa , 1993. PZPAPN : 99% 99 Percent H: seconds set to 14 R: 821 - 835 4: PNE - 6.0+, 2.43a+, \2.07+, V100+, V100+ The 99% . Its , but it s to be V. 99% is a vof . 99% is X, the 99% xone . in the Eor in the O's root qof 821 to 835 the end of the a. The =and in the DOS to not be , but the seconds set to "14". The in the 99% "Het 99%- heeft toegeslagen. . ." is my revenge E.V !" released 6 W\* \" It is what 99% may do PZPAPN : 302 H: 1; TSR R: 302 4: PRsCK - \, VET, 2.42+, 6.00+, 3.93+, NAV 2.1.4+, V99+, The 302 . Its . The 302 is a vof . b302 X, the 302 as a low TSR of 864 (. It hooks the 302 , it qof 302 at the end of the a. The =and in the DOS to the =and . No 8ed in the The 302 Nn't do PZPAPN : 310 H: j; write protect R: 310 4: PRaCK - i, VET, NAV 2.1+, The 310 . Its is a vof . The 310 is X, the 310 hooking {21 and 63 in the |area. the DOS the 310 , it X. If X, it the 310 qof 310 at the end of the a. The =and in the DOS the 310 notice fwrite protected write protect Lby DOS. because the Nn't check for the Uand handle PZPAPN : 334 Made H: May, England R: 334 4: PNCK - .1.4+, 6.00+, The 334 in May, . It is England. is a the 334 X, the 334 check the bthree . in the see if it finds the three . `, it xit. completed process, the the 334 of 334 at the end of the a. The =and in the DOS to the =and . No in the The 334 Nn't to do of 334 are: 334-B: on the 334 very . It wone . ain the Nnot `past the bfive in the qof 334 at the end of the a. The =and in the DOS to the =and . The in the "Made in England" : England PZPAPN : 337 V337 H: May, j; TSR R: 337 4: PRsC - , VET, , IBM , NAV 2.1+, 1.53S+ The 337 Vin May, . 337 is a vof . . It Nnot The 337 is X, the as a low TSR of 944 nby the 337 is , it by 337 at the end of `. The =and in the not be 337 Nnot do PZPAPN 382 Recovery : 382 Recovery 382, Recovery, 382 Recovery.1 H: b382 (of . spurious Ospinning; %failures Taiwan R: N/A 4: ONAK - , NAV, IBM , VET, The 382 Recovery in Taiwan. It is generic vof . ,and . the 382 Recovery X, the check the Efor a . has not . If it finds an a, it xit. If the less , the now be 382 were greater not show any always mthe b382 (of the the all . `in the Eare s, the next Xthe `to . `, however, may or may not later of the 382 Recovery "present on a aare the . In cases, the hang upon Z, requiring the to be re %ed. In cases, spurious on the and the not run. Lastly, the may do nothing but leave the Ospinning, requiring the to be powered off and re Occasionally, the 382 Recovery corrupt IO.SYS, one of the hidden 9has fthe fail. Since the b382 the `cannot be recovered. The the aare permanently lost. `should be Ad or erased and replaced backup copies to be of 382 Recovery are: 382 Recovery.1: A minor of 382 Recovery gequivalent to the differs by See: Burger PZPAPN : 405 Hammelburg, 405-EST H: 1987 `fail to run; b405 (of . Austria or Germany R: N/A 4: ONC - \, IBM , NAV, , VET, \, NAV, or The 405 is an in the C: Oroot E. If the of the . less (, the of 405 :ly cannot recognize are already s, so it attempt to them again. The 405 Nn't carry an =, and Nn't do in the C: Oroot E. However, since it s the b405 (of . `are not recoverable except by replacing them backups or distribution of 405 are: 405-EST: , 405-EST is an of the 405 . The purpose of the alteration is to avoid detection by See: Burger PZPAPN : 408 H: j; unexpected ; write protect Ton write protected R: 408 4: PRfCK - }, VET, The 408 . 408 is a vof . The 408 is in low be no rby the DOS {80, 82, 83, 85, 88, 89, 8A, 8C, 8E, 91, 93, 95, 96, 98, 9C, 9E, A0, A1, A2, A3, A5, A7, A8, AA, AC, AF, B4, B8, and BB all be nby the 408 is , it xany . by 408 at the end of the be no 2in the =and in the DOS [write protect fwrite-protected require 5line input receive 5line input was not 408 Nnot to do PZPAPN : 422 H: March, 1993 `corrupted; 1; TSR; DOS DIR 5output not correct; fail to function R: 422 4: PRsC - \2.07+, 2.48+, 2.48a+ The 422 in March, 1993. Its . 422 is a , but not b422 as a low TSR of 1,120 by the the 422 , it one . a DOS DIR X. The 5output of the DOS DIR be affected, usually one . "repeated multiple the 422 qas the where in the middle of the host a. The one exception is were smaller over 65K u. The in the DOS to the =and . No in the the 422 not function PZPAPN : 439 H: Poland R: 439 4: PRhCK - , VET, 1.15a+, 6.00+, 3.93+, NAV 2.1.2+, 25.10+, V99+, The 439 . It is Poland. 439 is a vof . The the 439 the 439 at the top of #the , as rby the DOS ?by 2,064 by the the 439 , it qof 439 at the end of the a. The and in the DOS not be The 439 Nn't to do of 439 are: 439-B: gequivalent to the , 439-B is a minor . A couple (differ fthe : Poland PZPAPN : 500 H: R: 500 4: PRaCK - 1.15a+, .1.4+, 6.00+, 2.43a+, NAV 2.1.2+, 25.10+, \2.07+, 1.53S+ The 500 vof . b500 Since the Nnot reserve the it occupies, and keep it in may [frequent the 500 , it qof 500 at the !of the . The and in the DOS not be The 500 cannot determine it has , so re `may uof a in an to the PZPAPN : 512 512-A, Number of the Beast H: , 1989 crashes; k; TSR R: 512 4: PRCK - , IBM , NAV, , VET, : CleanUp, or The 512 is not the same as the Friday The 13th . The 512 , 1989, by Vesselin Bontchev. It zing is run. becoming , any for any reason sif its is at least 512 the 512 crashes due to unexpected T, as well as k. Damage may `if the runs the /F parameter as the of the in the Eentry not match the actual Kspace used. adjust the ing in damaged The of "Number of the Beast" is because the author of the used a signature of 666 near the end of the to determine if the ais already s. Since 512 adds its 4to the end of `, it is easy to verify sby the 512 by checking for signature. of 512 are: 512-B: to the 512 , except the DOS check in the omitted. The author's signature of '666' has omitted. 512-C: to the 512-B , minor 512-D: to the 512-C , except no longer checks to see if a ahas the Attribute on it before 512-E: to the , such as on video cards. ma 55,104 rby the DOS Nnot use the 666 signature to designate 512-F: , the DOS show any . The "666" signature can be `as offset 1FD. PZPAPN : 557 H: R: 557 - 566 4: PRhE - , NAV 2.1+, 2.48+, V99+, 2.48a+ The 557 . Its is a b557 at the top of the rby the DOS ?by 624 nby the 557 the 557 , it qof 557 to 566 at the end of the a. The =and in the DOS to the and . One s in all "X[YZ]" The 557 Nn't to do PZPAPN : 572 H: R: 572 4: PRhE - , VET, , NAV 2.1+, .1.4+, 1.53S+ The 572 . Its is a The the 572 at the top of #the , as rby the DOS ?by 1,024 {21 and 24 the 572 the 572 , it qof 572 at the end of the a. The =and in the DOS to the =and It is if 572 of 572 are: 572-COD: A minor of the 572 has three differ. May, PZPAPN : 595 H: R: 595 4: PNCK - 6.04+, The 595 . Its . The 595 is a vof . the 595 X, the 595 xone . in the E. If all of the . `in the already s, the search for a . in the Oroot qof 599 the end of the a. The =and in the DOS to the and is one in the It is if 595 PZPAPN : 621 thing H: R: 621 4: PNCK - IBM , VET, NAV 2.1+, The 621 . Its . 621 is a vof . 621 is X, the search the Oand Efor an , it sby the 621 621 at the end of the a. The in the "Water detected in math-co-processor" "PARITY ERROR" halted" thing wonderful has happened, your PC is alive..." It is what 621 PZPAPN : 646 H: R: 646 4: PNCK - , IBM , NAV, , VET, The 646 . Its is a vof . the 646 X, the xone ain the by 646 the end of the `can be easily identified as always end the hex : "EAF0 s to do nothing except PZPAPN : 66A Satan-B H: failure; "Too many `open" R: 512 4: PNCK - 6.00+, 25.10+, The 66A . Its is a the 66A search the Eto locate all `. As the `are d, the xthem. the 66A qof 512 at the end of the a. The =and in the DOS to the =and The can be in all 66A "66A" The "66A" is used by the to determine if the awas s, and is at the end of the the 66A may fail to or unusual , such as "Too many `open". PZPAPN : 702 H: j; TSR R: 702 4: PRsC - 2.43a+, The 702 . 702 is a of . it is what picky about what it The the 702 as a low TSR of 944 nby the the 702 , it may qof 702 at the end of the a. The =and in the DOS not be . No the 702 It is if 702 PZPAPN : 834 Arab H: j; TSR; ; unexpected Kaccesses to may hang Saudi Arabia R: 834 4: PRsC - , IBM , VET, NAV 2.1+, The 834 . Its is a vof . but not The the 834 the as a low TSR of 1,808 nby the well. At , the access the , altering it. the 834 , it `of a greater 4K in +, however, not be by 834 (, the at the end of the . The =and in the Eis not by the the 834 may notice unexpected accesses to the executing accesses are the accessing the X, or a by the . The xious copy of the , but has later %the fthe in a hang ring during the %process. of 834 are: 834-B: (Arab) to the are greater 1K in before u. Two 4: "nsed Materi" and " Low TSR is 1,792 PZPAPN : 889 H: March, 1993 R: 889 - 903 4: PRhA - 6.04+, \2.07+, 2.48+, 2.48a+ The 889 in March, 1993. Its . 889 is a vof . , but not b889 X, the 889 at the top of the &, hooking |21. , as rby the DOS ?by 960 |12's not be moved. the 889 , it ,and . , but not qof 889 at the end of the by 889 to 903 at the end of the a. The =and in the DOS to the and . No the It is what the 889 may do PZPAPN : 914 Russian Mutant H: R: 914 4: PRhC - , VET, , NAV 2.1+, The 914 . Its . The 914 is a vof . . It Nnot The the 914 at the top of #the |12's not moved. rby the DOS ?by 912 {1C and AC nby the the 914 , it larger 1K in qof 914 the at the end of the a. The =and in the DOS are no in the It is if 914 PZPAPN : 923 Hey You H: may fail to R: 923 4: PRhAK - \, IBM , VET, NAV 2.1+, The 923 . Its 923 is a generic vof . ,and . The 923 is X, 923 at the top of #the rby the DOS @by 944 nby the 923 is , it ,and . X. If X, it 923 to 942 at the end of the Nnot alter in the 8the is part of the "Hey, YOU !!! thing's happening to you ! Guess what it is ?! HA HA HA HA" may be L, the be terminated and the ed to a DOS prompt. PZPAPN : 981 Joe's Demise H: May, R: 981 - 1,932 4: PRhA - , VET, 1.15a+, .1.4+, 1.53S+ The 981 Gin the in May, . Its is a ,and . `, but not b981 X, the 981 at the top of #the |12's not be moved. , as rby the DOS ?by 1,952 21 and 22 nby the , the 981 ,and . for any reason. . by 981 if the smaller 1,934 by 1,015 to 1,025 (. In both cases the at the end of the adding an (to the a. The =and in the DOS not be One can be din all 981 requires MS-DOS 3.00 or later" It is what the 981 may do of 981 are: Joe's Demise: to the has 11 differ. PZPAPN : 1008 Suomi, Oulu H: j; internal stack halt on Helsinki, Finland R: 1,008 4: PRCK - \, NAV, IBM \, NAV, or The 1008 by Petteri Jarvinen of Helsinki, Finland. It is a v, and s referred to as the Suomi The the 1008 the ing in its increasing by 1,008 (. The +cannot be seen by doing a if the is present in %ing a scopy of +may in an internal stack U, and the "halted. effect was noted on the author's test machine is a XT-clone running Microsoft MS-DOS 3.30. , it xany . X, adding 1,008 (to the . The qcannot be seen by doing a if the is present in PZPAPN 1024 SBC : 1024 SBC Ontario II, SBC H: j; intermittent printing problems; Canada R: 1,024 4: PRhAK - , IBM ., NAV 2.1+, 25.10+, : CleanUp, or The 1024 SBC . Its is Canada. 1024 SBC is a ,and . It is on the Ontario The 1024 SBC is at the top of #the &, hooking , as measured by the DOS ?by 3,072 12's moved. At , the +if it was not many as the part of the 00h at the end of , 1024 SBC ,and . for any reason. and . qof 1,024 be hidden if the . The at the end of the A symptom of a 1024 SBC intermittent printing problems printer. Unlike several hide the the DOS 1024 SBC is an , and no the See: Ontario Ontario III PZPAPN 1024 Print : 1024 Print 1024PSCR H: May, 1; Print failure; R: 1,024 4: PRhCK - , NAV, , IBM , VET, The 1024 Print in May, . Its and its , are is a vof . The 1024 Print X, the at the top #the , as measured by the DOS 2,048 and 21 nby the 1024 Print , it over 1K in for any reason. by 1,024 at the !of the 1024 Print =and in the to the 1024 Print , it interfer the functioning of the Print key. Pressing the Print in a Mof the 's CMOS configuration instead of printing the contents of the PZPAPN : 1067 H: ; TSR; R: 1,067 4: PRhCK - , NAV, , IBM , VET, The 1067 . 1067 is vof . It is The a 1067 X, the 1067 as a low TSR of 1,808 or 1,856 nby the . Unlike most are TSRs, the uof the in a in increments of 64K. The may be mapped by utilities as an qin the of the in interpretor. the 1067 , it xone . over 3K in in the X. If E, it may 1067 1,067 (. The at the end of the . The =and in the DOS are no in the A symptom of a 1067 Ylarge may fail due to the of large amounts of large . may receive the Ythem: too big to fit in 1067 Nn't to do PZPAPN : 1210 Prudents H: >, 1989 Kwrite failure; TSR Spain R: 1,210 4: PRE - \, NAV, , IBM , VET, \, NAV, or The 1210, or Prudents , was ~in Barcelona, Spain, >1989. The 1210 is a between May 1st and May 4th of any year, causing Kwrites to be Kverifies, so writes to the Knever between PZPAPN : 1226 V1226 H: k; spurious Lin place of executing; Ospinning R: 1,226 4: PRhC - \, NAV, , VET, 1.53S+ The 1226 by Vesselin Bontchev. is a generic . Nnot +. The 1226 is a self- encrypting , and simple search algorithms work to detect its presence on a The the 1226 the , reserving 8,192 at the top of 1226 is , the attempt to is at least 1,226 before u. The is rather "buggy" and the process is not always entirely successful. Successfully by 1,226 `multiple s, it is unable to determine ais already grow in by an 1,226 (. Eventually, the . grow too large to fit into the 1226 [unexpected . An effect instead of a executing, a line or two of spurious on the M. Lastly, always indicate m8,192 less is actually on the machine. of 1226 are: 1226-B: , 1226-B is a bug fixed of the 1226 Nnot mthe bugs present in the earlier cause Ming of spurious Nstill re xalready `until too large to fit into . It is fairly to 1226D. 1226-B Dropper: is an . drops the 1226-B 1226D: on the 1226 Nnot the kand the Mof spurious . 1226D `over 1,226 , copied, 1226M: (V1226M) to the 1226D , except are not aopen, PZPAPN : 1241 H: j; TSR R: 1,241 4: PRsCK - NAV 2.1+, , VET, 1.53S+ The 1241 . Its is a vof . b1241 X, the 1241 as a low TSR of 1,584 (, hooking |21. Its TSR may 5data" or as part of the 5interpretor in mapping utilities. the 1241 , it X. If X, it sas well. 1241 qof 1,241 at the end of the be no 2to the =and in the DOS It is what 1241 PZPAPN : 1244 H: j; TSR R: 1,244 - 1,258 4: PRsA - NAV 2.1+, , VET, The 1244 . It is where it was ~. 1244 is a vof . ,and . `, it Nnot It is on the The the 1244 as a low TSR of 1,440 (. It {08 and the 1244 , it qof 1,244 at the !of the qof 1,244 to 1,258 at the end of the be no 2to the =and in the DOS . One can be dconsistently in the "CONFIG" It is what 1244 of 1244 are: 1244-B: to the 7the "KATALOG". : Poland See: PZPAPN : 1253 Anticad, V-1, ksgiving H: TSR; BSC; Austria R: 1,253 4: PRsBCKX - , NAV, IBM , VET, : NAV or `and replace The 1253 . It is believed to ated in (or at least to ~in) Austria. 1253 is a generic vof . +. It wthe Iand the The the 1253 the as a low TSR. The TSR be 2,128 , hooking 13, 21, and 60. remain un 0, and @by 2,128 (. At , the of the the 1253 . If the J, the the . sif it hasn't s. The 1253 appends its 4to the end of the a, and 1the bfew (of the be a jump to the appended by 1,253 (, and the makes no attempt to hide the fourth through sixth (set to "V-1" (hex 56 2D 31). Any are accessed while the is present in Newly formatted I, likewise, simmediately. The 1253 is destructive . The author of was able to get it to activate by setting the >24th and executing an The promptly went and overwrote the entire a pattern of 9 of what s to be a fragment. has started to J, the way to stop the Kactivity is to power off the The in the and/or is of special note. fthe in the , the . At , the resides the top of #the &. The be 77,840 (. It can be seen 5. At , any . the 1253 , even on the before the One effect of Oor floppy is the FORMAT 5may in unexpected Kactivity to inactive Os. For example, on the author's formatting a OC:, was always Kactivity to tthe 1253 requires deleting , the the of any Iexposed to the be dis s. If the not dis s, the promptly fthe J. Dis tthe done in the 's full again It is =s for if it Kif an >24th fthe PZPAPN : 1260 V2P1, Chameleon Research H: Minnesota, R: 1,260 4: PNC - Encrypting , IBM , NAV, , VET, : CleanUp, \, or The 1260 not , but is it extremely virulent qd by 1,260 (, and the The encryption key The 1260 is derived fthe is highly modified. was developed as a research by Mark Washburn, who wished to show the community why identification ners do not work in all cases. The encryption used in 1260 is one of many possible cases of the encryption Washburn's later research , V2P2. See: Casper V2P2 V2P6 PZPAPN : 1308 KSpoiler H: j; lost clusters R: 1,308 4: PNCK - NAV 2.1+, 25.10+, The 1308 . Its . The 1308 is a of . the 1308 X, the 1308 search the Efor the a. If an , it it. qof 1,308 at the end of the . The =and in the DOS the 1308 may notice increasing numbers of lost clusters clusters may `, and typically in multiples of 10. PZPAPN : 1385 KPlus 1 H: j; TSR; R: 1,385 4: PRsCK - , NAV 2.1+, The 1385 . Its . 1385 is a of . +. It Nnot, however, xvery small . The the 1385 the 1385 as a low TSR of 3,376 {13, 21, CC, and F8 nby the 1385 , the +if it was not s, and one in the Oand the 1385 , it X, plus one in the mechanism allows the to spread very quickly. the 1385 qof 1,385 at the !of the . The =and in the DOS . Two in the "c:\ "PATH=" the 1385 It is if 1385 PZPAPN : 1392 Amoeba H: March, TSR; . =s modified Indonesia R: 1,392 4: PRA - \, NAV, , IBM , VET, 1.15a+, \, NAV, or The 1392, or Amoeba, ~in Indonesia in March . The 1392 is a and . +. It copies the b1,089 (of the host ato the end of the s the b1,089 4. An to the end of the a. As `are creation/modification 0to the =the `were Nnot to cause any destructive damage. The s in the is where its of Amoeba was derived "SMA KHETAPUNK - Nouvel Band A.M.O.E.B.A" PZPAPN : 1452 H: j; unexpected R: 1,452 - 1,465 4: PRCK - IBM , NAV 2.1+, 1.53S+ The 1452 . Its is a vof . The 1452 is X, the xall . in the C: Oroot The , however, Nnot Later, is re fthe C: O, the as part of the 5interpretor. qof 1,452 to 1,465 at the end of the are no in the 4in the 1452 may [unexpected require 5line input. For example, Zof the DOS EDLIN in the "Invalid ", and the be terminated. It is what 1452 and disrupt operation. See: Antimon PZPAPN 003 M PT3 : 1575 1577, 1591, Green Caterpillar H: ; sluggishness of DIR "green caterpillar" s on Taiwan Ontario, Canada R: 1,575 4: PRfAk - , IBM \, NAV, , VET, : CleanUp, or The 1575 ~in Ontario, Canada, in widely reported, and is believed to be fthe Far East, probably Taiwan. It is a vof . ,and . `, and the 1575 X, the in 1,760 to 1,840 the top of , but #the is not reserved, and may be later by an nby the the Oroot the 1575 , it xone . one . on the ever a DOS DIR or COPY Nnot spread =and in the DOS to the =and show an qof between 1,577 and 1,591 at the end of ma green caterpillar the to the Centipede game creature. of 1575 are: 1575-B: to the 1575 . The major difference is reserves the it occupies at the top of is not moved. 1575-C: to the 1575-B, Xin addition to a DOS DIR or COPY 5is issued. may hang 1575-D: Zof an in the C: becoming s. Later the fthe C: in the becoming are copied (both source and target), or a DIR 5is issued. as Green Caterpillar due to the graphic caterpillar and eat all the fthe 1575-E: Zof an in the C: becoming s. The the next X. Its at the top of the &is 1,840 (, hooking 1575-E ,and . a DOS DIR X, or a by 1,575 - 1,591 at the end of the a. The =and the DOS to the =and has to avoid detection by : Australia PZPAPN : 1605 1605-B, 1600, Anti , Tel Aviv H: j; TSR; slowdown R: 1,605 4: PRsA - , NAV, IBM , VET, : NAV, or The 1605 was uploaded to John McAfee's Homebase BBS by an anonymous . The . The 1605 is a vof . `, and it Nnot +. It is roughly on the The the 1605 the as a low TSR of 1,728 {13 and 21 nby the . At , the slowdown by 15-20%. becoming , any . ,or . sby the by 1,605 (in all cases at the !of the a. . by between 1,601 and 1,610 at the end of the replicating, it is carries any damage potential. of 1605 are: 1605-B: by MicroCom in London, England in March in a plain envelope a London postmark. The label on the Jread "Solomon is not related in any way to Dr. Solomon. very to the 1605 . The major difference is by 1,605 to 1,619 See: PZPAPN : 1661 Cascade.1661, Turkey H: j; TSR Turkey R: 1,661 4: PRsCK - VET, The 1661 , in Istanbul, Turkey. 1661 is a vof . `, it The 1661 is X, the as a low TSR of 2,000 nby the , 1661 X. If X, it by 1,661 at the end of the It is what 1661 of 1661 are: 1661-B: as Turkey, Turkey in . It is to the to avoid detection by familiar 1661. : Turkey 1661-C: ~in Turkey in It is to 1661-B. : Turkey See: Cascade PZPAPN 1689 : 1689 H: March, 1993 R: 1,689 4: PRhAK - \2.07+, 2.48+, 2.48a+ The 1689 in March, 1993. Its . 1689 is a ,and . b1689 at the top of #the &, hooking {21, 22, and 2F. , as rby the DOS ?by 1,728 |12's moved. the 1689 , it and . qd in by 1,689 (, but the is hidden by the it is . The =and in the DOS not be Two in the "5V3" The DOS Ton all . The attempt to hide the aalterations so utilities perform CRC or checksumming not detect alterations on 1689 is active in PZPAPN : 1720 PSQR H: March, : TSR; . damage on Ad on Friday the 13th Spain R: 1,719 - 1,733 4: PRsA - , NAV, IBM , VET, : NAV, or The 1720, or PSQR , is a of the was ~in Barcelona, Spain, in March ,and . unlike , it xoverlay not be The X, the as a low TSR of 2,048 nby 1720 in the 1720 , it by 1,720 (, and the at the !of the by 1,719 to 1,733 (, and the the end of the a. In both cases, be no 2to the =and in the DOS E. All can be easily identified as the character "PSQR", is the umarker for On Friday the 13th, the 1720 activate the X, it K. More damaging, however, is the 1720 check to see if the has a O. If a Ois present, the and ing in all data on the Kbecoming . The to hang. of 1720 are: 1720-B: ~in Spain in to the . The encryption used in the slightly modified, most detect out any problem. See: PCBB PZPAPN : 1804 H: , 1993 : . Germany R: 1,804 - 1,805 4: PNE - V102+, V102+ The 1804 fGermany in , 1993. 1804 is vof . the 1804 X, the 1804 xone . in the usually qof 1,804 be 1,805 (. The at the end of the a. The =and in the DOS to the =and . No are in the It is what 1804 PZPAPN : 1835 H: R: 1,835 4: PNE - \, IBM 25.10+, NAV 2.1.4+, The 1835 . It is a vof . and is very roughly on the Yankee Doodle . The sample has ated the 1835 X, the 1835 xtwo . in the qof 1,835 at the end of the a. The =and in the DOS not be Two in the can be "*.exe *.*" It is if 1835 PZPAPN : 1840 H: j; TSR; Write protect R: 1,838 - 1,891 4: PRsAK - IBM , VET, C, NAV 2.1+, The 1840 ~and . Its . 1840 is a vof . and . The 1840 is X, the as a low TSR of 2,144 nby the , 1840 X, it by 1,838 to 1,891 (. The at the end of the Two in the can be "NV71. ,MAND" It is if 1840 PZPAPN : 1963 V1963, 1963 OverWrite H: May, R: 1,963 4: PRsAK - , NAV, , IBM , VET, The 1963 in May, . Its . 1963 is a of . ,and . , it hides its regardless of whether the . It is related to the The the 1963 the as a low TSR of 5,136 nby the mark its TSR as " is in fact reserved. 1963 is , it ,and . over 1,963 X. The wthe by writing the b1,963 of the end of amark, and copying into the b1,963 (of the a. (. mthe b2,475 (of the , the difference is due to the . Wheader.) do not in the DOS Zof the DOS "detected. regardless whether the 1963 is capable of dis on the fly. As a unaware of be unable to locate it on using CRC or checksumming techniques. Further, Zof an unaware of 1963 in all becoming It is what 1963 of 1963 are: 1963-B: in May, V. 1963-B is in behavior to 1963. The primary difference is are 48 differ fthe See: Cracker Jack PZPAPN : 2153 H: j; TSR R: 2,153 - 2,217 4: PRsA - 2.43a+, The 2153 . Its is a ,and . . It Nnot The the 2153 the 2153 as a low TSR of 2,672 nby the the 2153 , it qof 2,153 to 2,168 qof 2,203 to 2,217 (. In both cases the at the end of the a. The =and in the DOS not be It is what 2153 PZPAPN : 2559 Yaunch H: k; unexpected Kaccess to R: 2,559 - 2,933 4: PNE - \, IBM NAV, , VET, The 2559 yabout its is un . 2559 is a vof . 2559 is X, the search the Efor a candi If one is d, it xit. If not, it search the B: and C: Estructures for a candi , and 2559 of 2,559 to 2,933 (. The at the end of a 2559 uare large . fail to s due to the having al a large amount of host Xby the . The isn't released until the host completes kmay PZPAPN : 2560 Magnitogorsk H: R: 2,560 4: PRhA - , NAV, VET, IBM The 2560 . It is fthe is a vof . ,and . `, it Nnot The the 2560 2560 at the top of but #the |12's is not moved. {08, 13, 21, and 22 nby the , as measured by the DOS @by 5,184 becoming , 2560 ,and . over 3K in for any reason. qof 2,560 at the end of the a. The =and in the DOS not be The DOS EDLIN fail to function 2560. YEDLIN in the "Invalid L, and EDLIN terminate leaving the at a DOS prompt. 2560 is a . While it Nnot hide it's q, it Nactively employ techniques in order to avoid utilities are unaware of it. It is what 2560 of 2560 are: 2560-B: in May, V, 2560-B's major difference f2560 is +the q, regardless of whether the 2560-C: in May, V, 2560-C's is very to 2560-B. Magnito-3000: on the 2560-C , Magnito-3000 is a 3,000 of the . Its 6,064 (, hooking {08, 13, 21, and 22. It ,and . X, copied, or for any reason. qof 3,000 be hidden the . The at the . The =and in the DOS not be . The in the ,MAND" "AND" Magnum: on the 2560-C , Magnum has avoid "detected by . It reset the =to 1-03-1988 it is . The the "Mr. Lozinsky Just read document on your AIDSTEST (1-Jan-91 ) we release new . (C) TeleFucks, Ltd See: Magnitogorsk 2048 PZPAPN : 2623 H: May, R: 2,623 - 2,633 4: PRhE - 1.15a+, 6.00+, The 2623 in May, . Its . The 2623 is a of . The the 2623 at the top of #the , as rby the DOS ?by 2,864 {21, 22, and 2F by the |12's moved. , the 2623 xa randomly selected . in the the 2623 , it intermittently xone . in the the 2623 qof 2,623 to 2,633 at the end of the a. The =and in the DOS are no in the in 2623 It is what the 2623 PZPAPN 3040 : 3040 3040 H: R: 3,040 - 3,183 4: PRaA - V99+, 6.04+, \2.07+, 2.45+, V99+, The 3040 . Its . 3040 is a vof . ,and . , but not +. It uses techniques to avoid detection. The the 3040 at the top #the as the Nnot allocate the where it resides. to the the 3040 , it may of the . ,and . in the qof 3,040 to 3,183 at the !of the a. The =and in the DOS to the =and . No in the The portion of the performs the function to avoid the detection of . It effectively on the fly are read into , thus avoiding locating the 1due to PZPAPN 3445- : 3445- 3445 H: R: 3,445 4: PRhA - , IBM , VET, The 3445- , or 3445, . Its . 3445- on all configurations, and on most Zof an in a hang. It is a vof . employs techniques to avoid detection. The the 3445- X, one of two things happen. On most , the be hung, and the mto re %the , the 3445- , it at the top of #the and , as rby the DOS ?by 3,488 |12's moved. The 3445- 21 at the top of |01 in low the 3445- , it and . , but not copied. In the case of copying, both the source and target the 3445- qof 3,445 not be in the DOS if the . The at the end of the . The =and in the DOS of a 3445- uare the DOS indicate Ton all the in a hang. PZPAPN : 4096 FroDo H: W, & overlay j; TSR hides crosslinks; 9of data Israel R: 4,096 4: PRsA - \, IBM , NAV, , VET, : CleanUp, \, NAV or The 4096 considered a it is almost in to the The 4096 W, and Overlay `, adding 4,096 the in a into , it execu pif it is COPY or XCOPY is destructive to both data `and execu as it very slowly cross-links `on the K. The cross-linking s so slowly is a lware problem, the "almost in . The cross-linking of `is the of the manipulating the FATs, changing the number of , as well as the issuing think mlost cross-linking if the is in As a side note, if the is present in and you attempt to copy `, the new copy of the not be if the new copy Nnot man execu extension. Thus, one way to dis is to copy off all the a non-execu aextension (i.e., don't use . ,, .SYS, etc.) while the is active in power off the and re fa write-protected, %ed and the is not in Athe `and copy back the Ito the execu s and extensions. The xthe , if done correctly, but still leave the problem of cross-linked are permanently damaged. On or 22 of any year, the 4096 s to be a "bug" in the it goes into a consuming loop. The 4096 in its 4; however, it is never written out to the . Moving to the of a Jand re %ing the in the "FRODO LIVES" 22 is Bilbo and Frodo Baggin's birthday in the Lord of the Rings trilogy. An important note on the 4096 data s, the data to be fine on . However, is later now be corrupted and unpredic s may of 4096 are: 4096-B: to the 4096 , the main encryption mechanism has 0in order to avoid detection. 4096-C: of 4096 is to the . The major difference is the DOS not show any cross-linking of lost clusters. A symptom of Kspace according to a DIR be more Kspace according to the DOS 4096-D: of 4096 is to the 4096-C in behavior. The major difference is it has modified to avoid detection by anti- utilities. 4096-E: of 4096 is to the 4096-C in behavior. The major difference is it has modified to avoid detection by most anti- utilities. Its is 5,648 PZPAPN 4870 : 4870 4870 H: fail to R: 4,870 4: ONAK - 3.93+, 2.48+, 2.48a+ The 4870 . It's is not ,and . the 4870 the search the Efor an or . a. The bsuch sby the mthe b4,870 (of the candi by the . If the was 4,870 (or more, be no qin the in the DOS E. If the was less 4,870 in the DOS now be 4,870 (. The in the not be the 4870 checked for a x, and sthe candi if one was d, the terminate and to a DOS prompt. A side note on : the is compressed Wutility, accounts for much of the 4,870 mthe markers of din the b4,870 (of the It is not possible to dis the 4870 as the b4,870 (of the are lost. must be Ad or erased, replaced clean copies. PZPAPN : 5120 VBasic , Basic H: May, West Germany 9; unexpected Kactivity R: 5,120 4: PNAK - \, IBM , NAV, , VET, \, or The 5120 ~in May, . It is a non- generic ,and . is was written in compiled Turbo Basic assembly language. X, the 5120 ,and one . aon the Oand E, followed xone randomly selected . ,or . Eon the 's C: by 5,120 (. . sby the 5120 by between 5,120 and 5,135 Unlike most of the MS-DOS es, the 5120 Nnot intercept Kwrite . Thus, may notice Kwrite no access should be ring for a O, such as the C: Data `may corrupted on , and cross-linking of `may The can be 5120 near the end of the "BASRUN" "BRUN" "IBMBIO. "IBMDOS. "Access denied" is one of the 5120 Nnot , but be ms in a very manner. second is not rhere as the author Nnot ma copy. PZPAPN : 7808 H: May, "Not enough R: 7,808 4: PNA - , NAV, , VET, The 7808 in May, . Its . 7808 is a vof . . It Nnot 7808 is X, the search the Oand Efor a . ,or . x. It xthe ,or . it finds in the by 7,808 (. The at the =and in the DOS to the =and The in the may be re sby 7808. s, an 7,808 to the 7808 may in the "Not enough L, and the Yterminating. in the not be s. An symptom of 7808 take longer to load Xdue to the searching the =and in the PZPAPN : A&A H: ^, 1993 R: 506 4: PRxC - 2.48+, 2.48a+ The A&A ^, 1993, and is . A&A is a vof . , but not +. It uses a tunneling technique to avoid detection by monitoring bA&A X, the A&A in a "hole" in low al , hooking |21. , as rby the DOS not be the A&A , it qof 506 at the !of the a. The =and in the DOS to the =and . The can be in the 4in all A&A "{A&A}" It is what A&A may do PZPAPN : ABC H: keystrokes repeated; R: 2,952 - 2,972 4: PRhE - 1.15a+, V99+, 2.43a+, 6.04+, \2.07+, V99+, The ABC . It is the . ABC is a vof . alter . The the ABC X, the ABC at the top of #the &, hooking {16 and 1C. , as measured by the DOS , but 8,960 (. The copy of ed to by the ,SPEC en mental variable may the ABC , it xor alter . and . X. . are not sby the , but may be , adding 4 to 30 may be sby the , adding 2,952 to 2,972 the end of the a. . are not smay be , adding 4 to 30 . The in the DOS to the =and awas in the , but the in the "ABC_FFEA" "Minsk 8.01.92" "ABC" the ABC [keystrokes on the are frequently repeated, as well as ring of ABC are: ABC-2918: A of ABC, is 8,960 (, hooking {16, 1C, and 60. It adding 2,918 to 2,927 . The at the end of the a. The and in the DOS to the =and . Like the alters . , adding 4 to 16 The same in the are ABC-2918B: to ABC-2918, ABC-2918B is a very minor PZPAPN : Acid H: fail to R: 792 4: ONAK - \, IBM , NAV 2.1+, The Acid . Its . Acid is a ,and . the Acid xall of the . in the E. Later, if an X, it start tthe . in the the Acid mhad the (of the host the Acid be no qunless the was smaller (, in case it 792 . The =and in the DOS not be . The can be din all Acid too big to fit in "Acid "Legalize ACiD and Pot" "By: Copyfright Corp-$MZU" PZPAPN : Ada H: j; slow clicking speaker; Argentina R: 2,600 4: PRsCK - , VET, , NAV 2.1+, The Ada Gin Argentina in . Ada is a vof . The the Ada Ada as a low as measured by the DOS ?by 21,296 to 21,312 {08, 13, and nby the Ada is , it are X. If X, it of 2,600 at the be no 2in the =and in the DOS E. The can be "PCCILLIN. "PCCILLIN.IMG" "HATI-HATI !! ADA VIRUS DISINI !! [a slow clicking sound emitted fthe speaker. clicking occasionally 2in pitch. The receive a " Kfull" even Kthe to write to is not actually full. PZPAPN Adolf Hitler : Adolf Hitler Adolf H: R: 475 4: PR?CK - 6.00+, 2.43a+, \2.07+, V100+, V100+ The Adolf Hitler, or Adolf, Its d due to a s in the . It should not be confused the Adolph is no relationship between the two es. Adolf Hitler is a vof . bAdolf Hitler in a "hole" in low , hooking |21. , as rby the DOS not be the Adolf Hitler , it qof 475 at the end of the a. The in the DOS to the =and . The in the 4in all Adolf Hitler "Adolf Hitler" PZPAPN Adolph : Adolph H: May, R: 2,109 - 2,445 4: PNCK - \, NAV, , VET, The Adolph Vin May, . Adolph is a vof . +. Adolph is a of V2P6. Adolph is X, the search the Efor an x. If an d, it Adolph by 2,109 to 2,445 at the end of the It is if Adolph See: V2P6 PZPAPN African 109 : African 109 H: Republic of South Africa R: 109 4: PNCK - ., NAV 2.1+, , VET, The African 109 in the Republic of South Africa by Oliver Steudler and Peter Stoffberg of the Resource Centre. African 109 is a vof . African 109 is X, the African 109 xall `in the E. If +happens to be in sas well. African 109 of 109 (. The at the !of the a. The =and in the DOS to the =and . One can be din the African 109 Nn't do PZPAPN Agena : Agena H: Spain R: 723 - 738 4: PRhAK - The Agena Gin Spain in . Agena is a vof . ,and . the Agena the Agena at the top of #the , as rby the DOS ?by 1,296 {20 and 21 nby Agena in the Agena , it qof 723 to 738 at the end of the a. The =and in the DOS . No in the It is what Agena may do PZPAPN : Ah Tuesday, David-1173 Research H: May, Kformat; Italy R: 1,173 4: PRhC - D: IBM , VET, NAV 2.1+, The Ah, or Tuesday, in May, . Ah is the V1024 , its is Italy. Ah is a very buggy Ah is X, Ah at the top of , but rby the DOS @by 1,216 {08 and 21 nby the Ah is , it over 1K by 1,173 hidden if Ah is =and in the DOS to be un if the was 12:00a, it now be blank. The at the [frequent Ah. frequently is very noticeable. The Ah on Tuesdays, at attempt to format the bfew tracks of the Ah can be easily identified as 8the "(C) David Grant Research PCVRF Disribuite ely!!! ...ah...John...Fuck You!" Ah is believe to created by the same person as several fItaly, pSmack and Enigma. David Grant and the PCVRF had nothing to do its creation. of Ah are: Ah-B: to the xan . . It 7the same as the See: Alfa V1024 PZPAPN : AIDS Hahaha, Taunt, VGA2CGA, Burger.Pascal H: 1989 R: N/A 4: ONA - ., NAV, , IBM The AIDS as the Hahaha referred to as the Taunt by IBM, is a generic . , it Ms the "Your computer now has AIDS", AIDS covering about half of the . The halted, and must be powered down and re %ed to restart it. Since s the b13,952 (of the execu , the `must be Ad and replaced clean copies in order to remove the . It is not possible to recover the portion of the Note: is NOT the Aids Info K/PC Cyborg Trojan. of AIDS are: AIDS B: Very to the AIDS 13,952 . Unlike the `, as well as +, and Nnot activate as the did. Instead, occasionally issue the "I/O U99, PC=2EFD aborted". AIDS- ~at several locations in the May, of the AIDS avoid detection by utilities. Among the to the less two sub Fories on the kmay X, as well as the video mode may be switched to 25 x 40 Black & White fcolor mode. May, See: Number One PZPAPN AIDS II : AIDS II Companion Endangered H: Creates . `; melody; R: 8,064 4: SNA - Spawning , NAV, , IBM , VET, Acorresponding . The AIDS II , or Companion , was ~for the . Unlike generic vs, the AIDS is the to employ what could be called a "corresponding atechnique" of target . ais never 0. The takes advantage of the DOS feature where if a exists in both . ,and . Wform, the . The AIDS II Nnot actually `, instead it stores a copy of the in a corresponding . tries to Yone of his . The . aand the . both mthe same base The method of uis as follows: X, since a corresponding . aexists, the . 8ing the X. The blocates an ain the Eand creates a corresponding (or companion) . always be 8,064 , 1987 PZPAPN Albania : Albania Albania-429, Albania-506, Albania-575, Albania-606 H: failure; R: 429 - 606 (, depending on present 4: PNCK - , VET, NAV 2.1+, Albania is actually a ]of four were '. All of are vs of . general behavior is specific ylisted under one of the Albania es is the Albania xone . in the E. If it may s. The qfor Albania depends on the Albania present, but the always be at the end of the . The =and in the DOS to the =and The can be din all regardless of the present: "PATH=" It is if Albania of Albania are: Albania-429: The smallest of the Albania adds 429 (to the . 8the "ALBANIA" in addition to the Albania-506: Albania-506 adds 506 (to the . w. Like Albania-429, the "ALBANIA" can be din all addition to the Albania-575: Albania-575 adds 575 (to the . w. In addition to the for all members of ], the "albania" the Albania-575 may notice fail to , or random may be kmay Albania-606: Albania-606 adds 606 (to the . w. Unlike members of ], it Nnot always X. It 7the "albania" in addition to the PZPAPN Albanian : Albanian H: May, R: 1,991 4: PRhAK - 1.15a+, 6.00+, 2.43a+, \2.07+, The Albanian in May, . Its . Albanian is a vof . ,and . the Albanian the Albanian at the top of #the &. It Nnot move |12's measured by the DOS ?by 2,000 {08, 17, and 21 nby Albanian in , the +if it was not the Albanian , it for any reason. qof 1,991 at the end of the a. The =and in the DOS to 12/17/89 7:21p. The can be in the "C:\ It is what Albanian PZPAPN Alex-368 : Alex-368 H: R: 368 4: PNC - V99+, 2.43a+, 6.04+, \2.07+, V99+, The Alex-368 . It is fthe . Alex-368 is a of . , but not the Alex-368 xall . larger in the qof 368 the end of the a. The =and in the DOS to the and . The can be in the 4in all Alex-368 "The One Night (c) Alex Hacker" PZPAPN Alexander : Alexander H: Romania R: 1,951 - 1,965 4: PRhAK - 1.15a+, VET, 6.04+, \2.07+, The Alexander . It fRomania. Alexander is a vof . and . The the Alexander X, the Alexander at the top of #the , as rby the DOS ?by 3,088 {08, 21 and 27 nby Alexander in the Alexander , it and . copied, or for any reason. by 1,951 by 1,951 to 1,965 (. In both cases the at the end of the a. The in the DOS not be . The in the 4in all "ALEX0302" The in the , and hence not "Apa depistata in microprocesor Functionarea poate fi compromisa Se recomanda oprirea calculatorului citeva ore pentru uscare" "Alexander" "Constanata" "Romania" It is what Alexander See: CB-1530 PZPAPN : Alfa H: (for R: Varies (see 4: PRhAK - , VET, , IBM The Alfa is actually two closely related similiar characteristics. The two es, Alfa-1150 and Alfa-1202, Btogether differences ed out under the " " section. Both es were , and The an Alfa X, it at the top of #the &. Depending on is present, , as determined by the DOS @by either 1,280 or 1,344 nby the at the top of , as well as nin graphic card an Alfa , it and . small . `. The qs are given Qof the es. In the case of both es, the at the end of the be no 2to the =and in a DOS in the It is if Alfa of Alfa are: Alfa-1150: Alfa-1150, or Yankee Doodle-1150, is the earlier of the Alfa . It adds 1,150 to 1,165 `. . sby the , adding an 1,152 1,280 Alfa-1202: Alfa-1202, or Yankee Doodle-1202, is the later of the Alfa . Unlike Alfa-1150, it not re `. It adds 1,202 to 1,217 is 1,344 Alfa-1712: Alfa-1712 is an of the Alfa at the top of but #the &, not moving |12's by 3,008 (, and , it ,and . X, adding 1,712 to 1,731 The at the end of the a. The =and in the DOS 0to 14-25-12 12:01a. Alfa-Tired: The Alfa-Tired, or Tired, is an of the Alfa . It at the top #the &, not moving |12's ?by 3,760 (, and , it X, adding 1,748 to 1,766 . The the end of the a. The =and in the DOS not be Rust: The Rust . It , as rby the DOS ?by 2,048 (, and nby the be used by the , but not be mapped by most mapping utilities. , Rust X, adding 1,710 to 1,725 (to the . The at the end of the a. The =and in the DOS not be . Rust plays a three note melody Ys a See: Ah Damage Gremlin Lucifer Newcom V651 V1024 PZPAPN All Sys 9 : All Sys 9 H: j; TSR; "Abort, Retry, Ignore ?" %s; unexpected beeps on speaker R: 1,838 - 2,088 4: PRsAK - The All Sys 9, or IOU, . Its . All Sys 9 is a vof . ,and . The the All Sys 9 as a low TSR of 2,576 (. It , All Sys 9 ,and . qof 1,838 to 1,863 at the !of the qof 2,080 to 2,088 at the end of the a. . may be re sby the , adding an 2,080 u. The in the DOS not be . The can be in the 4in all All Sys 9 "All 9 - (c) , Jerry C." "Parity Uat address 14344" "Abort, Retry, Ignore ?" All Sys 9 may [the "Abort, Retry, Ignore ?" pressing any key on the in a %. Beeping be emitted fthe speaker. PZPAPN Alpha-743 : Alpha-743 H: March, 1993 R: 743 4: PNCK - 2.48+, 2.48a+ The Alpha-743 in March, 1993. Its . Alpha-743 is a vof . the Alpha-743 X, the Alpha-743 xone . in the E. If an Nnot exist in E, a hang accessing the the Alpha-743 qof 743 at the end of the a. The =and in the DOS not be . The in the 4in Alpha-743 "*.com *.*" PZPAPN Ambulance Car : Ambulance Car Ambulance, RedX H: j; graphic M& sound West Germany R: 796 4: PNCK - \, NAV, IBM , VET, : NAV, or The Ambulance Car ~in West Germany in is a the Ambulance Car the attempt to xone . a. The . ato be on the C: one . ain any E, and never the ain the E. It avoids ais normally the ain the root On a random basis, the effect of a graphics Mof an ASCII block drawing of an ambulance moving across the bottom of the graphics be accompanied the sound of a siren played on the 's speaker. Both of effects a graphics capable Madapter. of Ambulance Car are: Ambulance Car-B: to the Ambulance Car, xzero, one, or two . (s) on the qof 796 the end of the are seven differ between and the RedX-Any listed RedX-Any: on the Ambulance Car, the Ambulance Car graphic its accompaning siren X. It wone . on the path and may See: Hafenstrass 2 PZPAPN Amstrad : Amstrad H: , 1989 Portugal R: 847 4: ONCK - \, IBM , NAV, , VET, \, or The Amstrad breported in , 1989, by Jean Luz of Portugal; however, it has of in Spain and Portugal for a year prior to . The is a generic . v, but is not . It +. It is the Pixel Amstrad is X, the Amstrad xthree . in the `not by the The carries a fake advertisement for the Amstrad computer: "=!= Buy AMSTRAD it is THE CHEAPEST ,PUTER you can buy" The Amstrad Nn't do of Amstrad are: Amstrad-End Is Near: The Amstrad-End Is Near is very to the Amstrad . The major difference "=!= THE END IS NEAR!! THE SIGNS OF THE BEAST ARE EVERYWHERE" The ain the by 847 it is qas the part of the host Amstrad-Luz: The Amstrad-Luz is very to the Amstrad . The "=!= Hello, John Mcafee,please uprade me. Bests regards,Jean Luz" : Portugal , 1989 See: Hell Pixel Silly Silly-365 PZPAPN Andre : Andre Andre-0, Andryushka H: R: 3,568 - 3,648 4: PRhA - 2.43a+, The Andre, or Andryushka, . It fthe . Andre is a of . ,and . . It Nnot is a polymorphic , and a simple search for detection is not possible. bAndre at the top of but #the &. It Nnot move |12's , as the DOS ?by 8,192 (. It Fly hooks {, and mapping utilities show {mapped to the the Andre , it , or a DOS DIR or Copy 5is issued. It Nnot xvery small . `, nor . `larger 64K. `in structure. qof 3,568 to 3,648 at the end of the a. The =and the DOS not be . The in the 4, and are not "Hello!!!" "My is Andryushka" "I come fPerm, Symptom's of an Andre uare DOS DIR 5s may be very sluggish due to the a DIR is issued. alter the of Andre are: Andre-3568: A minor of the Andre , Andre-3568 adds 3,568 - 3,668 (to the . ,and . w. Its is 7,632 7the same as the PZPAPN Angarsk : Angarsk H: R: 238 4: PNCK - 6.00+, 2.43a+, \2.07+, V100+, V100+ The Angarsk . It is fthe . Angarsk is a of . the Angarsk X, the Angarsk xall of the . in the qof 238 at the end of the a. The =and in the DOS to the =and . One can be in the 4in Angarsk Angarsk Nn't to do PZPAPN Animus : Animus Animus-7360, Cookie-7360 H: j; switches `and unexpected accesses to the C: T; TSR; R: 7,360 4: PRsAK - D: IBM , NAV 2.1+, The Animus, Animus-7360, or Cookie-7360 . Its . Animus is a vof . ,and . . Advanced us may The the Animus X, the Animus a low TSR, hooking {22 and 24. @by as much as 70K. the xtwo . in the the Animus , it xtwo . qof 7,360 at the !of the a. The =and in the DOS 9-13-91 10:30a. The can be din all Animus "Animus.id" "com "Animus.exe" Animus is a malicious . As the uof Animus progresses, the switch various s so the Eindicates is the no longer matches the contents of the process both execu and data `. As a , the may not to run, and unpredica . Animus Nnot avoid switching an +, so unexpected warm re %s or shelling of the interpretor may . The switching of the . Wextension possibly s, and all must be tested to determine if 8the are dis s, the actual contents of the `must be determined and re d to proper of Animus are: Animus-7392: Animus-7392 is a later of the Animus It adds 7,392 (to the . =and the DOS 9-13-91 10:31a. Instead of switching start all of the . in the by 7,392 at the !of the all of the the s, it start on the C: PZPAPN : Anna H: Manchester, England R: 742 4: PNCK - V99+, 6.04+, \2.07+, 2.45+, V99+, 2.48a+ The Anna fManchester, England in . Anna is a vof . the Anna X, the Anna xone . in the qof 742 the at the end of the a. The and in the DOS the =and . The in the "[ANNA] Slartibartfast, ARCV NuKE the French" ma Cool Yule fthe ARcV" "xCept Anna Jones" "I hope you get run over by a Reindeer" "Santas bringin' you a Bomb" "All my Lurve - SlarTiBarTfAsT" "(c) ARcV - England Raining Again" "\ *. *.com" It is what Anna PZPAPN : Ant H: has seconds set to 62 R: 770 4: PNC - 1.15a+, 6.00+, .1.4+, 25.10+, 1.53S+ The Ant . Its . Ant is a vof . , but not +. It is roughly on the the Ant X, Ant xone in the Ant qof 770 at the !of the a. The in the DOS mhad the seconds field set to 62, the umarker. No in the 4in Ant Ant of any year. At , the Mthe and attempt to "MIT Sux!" PZPAPN Anthrax : Anthrax H: R: 1040 - 1279 4: PRAKX - W, & , IBM \, NAV, , VET, : See The Anthrax in the it was uploaded onto several BBSs in a Trojan USCAN.ZIP. It is the second to be din a copy of U during , the "V2100. Anthrax is a generic vof . ,and . The the Anthrax on the K, the xthe ). At , the is not . It write a copy of on the last few of the K. If data existed on those last few of the K, it be destroyed. fthe K, the Anthrax . It remain until the X. At , it xone . ,or . Nnot `in the b, but instead starts to `at the lowest level of the Etree. Later, X, Anthrax ,or . a, searching the Estructure fthe lowest level of the Etree. If the on the floppy O, a . ,or . amay or may not be The Anthrax 4is 1,024 (long, but by 1,040 to 1,279 (. On the author's test , the largest [d was 1,232 always is a multiple of 16. The can be Anthrax "(c)Damage, Inc." "ANTHRAX" A third s in the 4, but it is in the Cyrillic alphabet. Per Vesselin Bontchev, third translates to: "Sofia Since Anthrax wthe must mthe sor rebuilt in order to remove the ucan be done either a low-level format or use of the M for the correct DOS powering off and re %ing write-protected Jfor the . Any . ,or . Anthrax must be dis sor erased. Since a copy of the exist on the last few of the must Anthrax interacts : V2100. If a Anthrax should V2100 , the V2100 check the last few of the Kfor the spare copy of Anthrax. If the spare copy is Anthrax be copied to the It is not if Anthrax carries any destructive capabilities or trigger/ PZPAPN Antimon : Antimon H: R: 1,452 - 1,465 4: PNCK - IBM , Nav 2.1+, 1.53S+ The Antimon . Its . Antimon is a Antimon is X, the Antimon xall in the C: Oroot E. Since +normally resides in E, it sas well. Antimon by 1,452 to 1,465 The at the end of all be no 2in the =and in a DOS The in the Antimon "*.com" "FLUSHOT3. "C:\PANDA\MONITOR. ,TSRMON. ,TSRMONEZ. "= C:\PDPROG" It is what Antimon See: 1452 PZPAPN Anti-D : Anti-D Xuxa-945 H: March, j; TSR; interfers Argentina R: 945 4: PRsC - , VET, o, NAV 2.1+, 1.53S+ The Anti-D, or Xuxa-945, in March, . It is fArgentina. Anti-D is a vof . but it Nnot The the Anti-D X, Anti-D as a low TSR of 1,264 (. It hook 21, and F8. the Anti-D , it qof 945 at the !of the a. The =and in the DOS not be . Two can be din the ,MAND "$$TMP. Anti-D interfers the usage of the "D" key on the , hence the of Anti-D are: Anti-D B: to the Anti-D is a very minor : Argentina See: Xuxa PZPAPN Anti-DAF : Anti-DAF H: March, 1993 The R: 561 4: PNCK - 2.48+, 2.48a+ The Anti-DAF in March, 1993, and is . Anti-DAF is a of . the Anti-DAF xone . in the qof 561 at the end of the a. The =and in the DOS not be The in the Anti-DAF "*.com" "The Anti-DAF "DAF-TRUCKS Eindhoven" "Hugo vd Goeslaan 1" "Postbus 90063" "5600 PR Eindhoven, The "DAF sucks..." "(c) Dark Helmet + The Research Centre" The company and individual mentioned , along address, are not associated the creation of PZPAPN , AP, AP-605, C-605, V605 Research H: j; .BAK and .PAS Sofia, R: 605 4: PNCK - , NAV, ., IBM , VET, : NAV, or The , V605 or C-605, was ~in Sofia, by Vesselin Bontchev. , it was fthe or Poland, but it has since determined to a research written 'over one year before it was ~. The author was not aware it had "escaped" until The is a generic . +. While is not it is in the process of X, the attempt to xtwo `on the Oor on are between 605 and 64,930 `must not mthe read- attribute set. If ameeting the 's selection criteria is d, the b605 (of the 4. The (of the appended to the end of the by 605 (, and begin "PQVWS" as well as 8the "combakpas???exe" at offset 0x17. mhad stamps in the to the If the cannot find two . x, it check the Oand Efor .BAK and .PAS `exist, 4. If the `were .PAS `, the has now lost Pascal source .BAK and .PAS `, the attempt to re them to . `, or . `if a . aalready exists. renaming Nnot work due to a bug in the AP-529: to the 605 , the major differences are AP-529 `over 2,048 529 ly, instead of the .BAK and .PAS `, one .BAK and .PAS Ad if are no of at least 2,048 (on the O. . `on the C: Oroot Emay sby AP-529 fthe A: or B: should be considered a "Research ", as it is not believed to publicly released. See: PZPAPN 400, AP-400 Research H: j; .BAK, .BAT and .PAS adeletion; alteration on Sofia, R: 400 4: PNCK - , NAV, \, IBM , VET, The , or AP-400, was ~in Sofia, by Vesselin Bontchev. It is one of five es or in the ]. Two of the earlier (AP-605) and AP-529, are documented under the ". The listed under separated due to characteristics differing 605 )and 529 The is a generic . +. While is not it is in the process of The Xon a , the attempt to xone . ain the root Oaccessible on the `are is at least 2,048 (, and the be less 64K in . Since +is usually the aon a O, it immediately s. One son the O. The mechanism used to ais to write the 4to the end of the a. A jump is used to Ythe 4before the `do not 20th through >25th in years , the ARCV Xmas Mthe "Happy Xmas fThe ARCV." PZPAPN ARCV-670 : ARCV-670 H: March, 1993 England R: 670 4: PNCK - 6.04+, 2.48+, 2.48a+ The ARCV-670 in March, 1993, and is England. ARCV-670 is a of . the ARCV-670 xone . in the Nnot smaller qof 670 at the end of the a. The =and in the DOS . The in the 4in all "*.com *.*" all of the . sin the higher level Fories, a hang PZPAPN ARCV-n : ARCV-n ARCV-4 H: Manchester, England R: 664 4: PNAK - 6.04+, \2.07+, V100+, 2.48+, V100+, 2.48a+ The ARCV-n series of es were fEngland in and es are vs of . and/or . `, and +. The ARCV-4 members of the series included #under " members". The three earliest members, ARCV-1, ARCV-2, and ARCV-3, generated PS-MPC. The ARCV-4 fManchester, England. ARCV-4 is a vof . ,and . the ARCV-4 xthree in the preference given to . over . qof 664 at the end of the a. The in the DOS not be . The can be in the 4in all ARCV-4 "[ARCV-4] Apache Warrior, ARCV Pres." "*.exe *.com" "So Who`s the Best "Oh Well Sorry But The ARCV Are The Best!" "Well Your in Favor It is what ARCV-4 members of the ARCV-n series of es are: ARCV-1: , ARCV-1 is an 826 vof . ,and . , but not +. It wone in the preference given to . qof 826 at the end of the The =and in the DOS not be . The "Long Live The ARCV. MUFC for the League!" "(c) Apache Warrior, ARCV Pres. 92" "Welcome to the REAL World. And the ARCV 1 "[ARCV-1] Apache Warrior, ARCV Pres." "*.exe *.com" : Manchester, England ARCV-2: , ARCV-2 is an 692 vof . . It wone in the qof 692 at the end of the a. The =and in the DOS not be . The "*.exe .. [ARCV-2] Apache Warrior, ARCV. Pres." "Help.. Help.. I`Sinking : Manchester, England ARCV-3: , ARCV-3 is an 657 vof . +. It wfour in the qof 657 at the end of the The =and in the DOS not be . The "[ARCV-3] Apache Warrior." "Yo.." "I`ve Just .. Opps.. Sorry I`m the "Well let me introduce myself.." "I am ARCV-3 , by Apache Warrior." "Long Live The ARCV and Whats an lECU?" "Vote Yes to the Best Vote ARCV.." "*.com .." : Manchester, England ARCV-5: , ARCV-5 is an 475 vof . +. It wone . in the qof 475 at the end of the The =and in the DOS not be . The "[ARCV-5] Apache Warrior, ARCV Pres" "SU*. : England ARCV-6: , ARCV-6 is an 335 vof . +. It wone . in the qof 335 at the end of the The =and in the DOS not be . The "[ARCV-6] Apache *.com" : England ARCV-7: , ARCV-7 is an 541 vof . . It wone . in the qof 541 at the end of the a. The =and in the DOS not be . The "[ARCV-7] Apache ARCV. *.exe" : England ARCV-8: , ARCV-8 is an 679 vof . . It wone . in the qof 679 at the end of the a. The =and in the DOS not be . The "Naughty, Naughty... ARCV Productions Ltd." "[ARCV-8] *.exe" : England ARCV-9: , ARCV-9 is an 745 vof . X, ARCV-9 at the top of , hooking |21. rby the DOS 2,048 ARCV-9 is , it qof 745 at the end of the The be hidden . The =and in the DOS not be . The "[ARCV-9] Apache Warrior. *.com" : England ARCV-10: , 1993, ARCV-10 is an 827 vof . ,and . ARCV-10 at the top of , hooking |21. , as rby the DOS ?by 1,648 ARCV-10 , it ,and . for any reason. qof 827 the at the end of the a. The not be hidden. The in the DOS not be The "[ARCV-10]" "Apache Warrior" "Well its finally here The -= ARCV =-" "Welcome To our New Members The last two may be Las a the . Write protect and the fa write-protected : England , 1993. ARCV-10B: to the ARCV-10 has to avoid detection by familiar ARCV-10. : England March, 1993. See: PS-MPC PZPAPN : Arf Rigor Mortis, Thor H: March, Canada R: 1,000 4: PNCK - , IBM \, NAV, , VET, The Arf, Thor, or Rigor Mortis in March, fthe . Arf is a written by RABID, in Canada. is a vof . +. Arf is on the and may identify it as Arf is X, the check to see if +has s. If it is not s, the xit and Mthe "Rigor Mortis !!! I am Hi.pas" checking (and possibly +, the search the Efor one . x. If an d, it "Arf krad krad krad krad krad kr" The proceed to check the B: Ofor a the Arf of 1,000 (. The at the end of the . The can be in the The Arf may not be in the public domain, the sample is not a natural uof the . Its is due to the "Arf" s. Its of Thor is because it is believed to written by a group calling Thor. Note: the sample of was on an . a, and is not a natural may be a research and not in the public domain. of Arf are: Arf-B: Arf-B was in May, . It is fthe United States. s to be an earlier of the Arf Arf-B is X, it check the Efor an x. If an d, it xthe . The B: may be accessed. Whether or not a Mthe "Arf Arf Got you! -- RABID '90" qof 1,000 (, and =and in the not to the =and it has in the , and a hang: WC failure Cannot start ,MAND, exiting" Arf-B usually fail to function ing in a hang. PZPAPN Argentina : Argentina Argentina 1.0 H: j; TSR; Buenos Aires, Argentina R: 1,249 4: PRsC - ., IBM \, VET, , NAV 2.1+, The Argentina Gin Buenos Aires, Argentina, in . Argentina is a vof . . It Nnot The Argentina is X, the as a low TSR of 1,568 nby the Argentina is , it qof 1,249 at the !of the 2in the DOS The Argentina on four =s, at pertaining to the =s. are of patriotic significance in Argentina. The =s and are as follows: May 25th: "25 de Mayo Declaracion de la independencia Argentina Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Jun 20th: "20 de Junio Dia de la bandera Argentina Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Jul 9th: "9 de Julio Dia de la independencia Argentina Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Aug 17th: "17 de Agosto Aniversario de la defuncion del Gral. San Martin Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Hitting any key in the Xcontinuing. $the , one "Argentina 1.00" PZPAPN Argentina-102 : Argentina-102 H: & truncated to 102 Argentina R: 102 4: ONCK - The Argentina-102 fArgentina in is a v. It sby the Argentina-102 Athe in the and create a 102 The replacement 8pure 4. The =and in the DOS to the =and Two can be in the 4in all Argentina-102 "*.com" Argentina-102 Nn't do , corrupting the PZPAPN Armagedon : Armagedon Arma H: intermittently sent to ,ports s, Greece R: 1,079 4: PRsC - \, NAV, IBM , VET, \, or The Armagedon , by George Spiliotis of A s, Greece. Armagedon is a `, increasing by 1,079 The at the The Xon a , the as a low of 1,392 (, hooking {8 and 21. Any . are later Xare sby the [the "Armagedon the GREEK" "sent to ,ports 1 - 4 at d intervals. Between 5:00 and 7:00, the attempt to use the ,ports to make a phone call to Local yin Crete, Greece. If a connection is made, the phone line remain open until the notices the phone line is in use. (Needless to say, Nn't work if the outside of Greece as dialing 4s are considerably different between countries.) wise is not destructive. of Armagedon are: Armagedon #911: on the Armagedon adds 1,079 (to the . w. The phone number called by the has 0to "911", is the police and emergency services phone number implemented in much of the . The is sent to the ,ports has "Support Your Police". Armagedon-1077: to the Armagedon, adds 1,077 `. Its TSR is 1,392 , and hooks {8 and 21. ~: Greece, PZPAPN Arriba : Arriba 1590 H: R: 1,590 4: PRaA - 6.04+, \2.07+, V100+, 2.45+, V100+ The Arriba . Its , and the may actually written in Arriba is a vof . ,and . but not bArriba X, the Arriba at 9000, hooking {21 and 24. , as rby the DOS not be the Arriba , it qof 1,590 (. In the case of . the at the !of the a. In . , the at the end of the a. The =and in the DOS . No in the It is what Arriba PZPAPN : Ash H: R: 280 4: PNCK - , VET, 1.15a+, .1.4+, 3.93+, 25.10+, , NAV 2.1.4+, The Ash . Ash is a vof . Its the Ash X, the Ash xall of the . in the of 280 at the end of the a. The =and in the DOS to the =and . One in the Ash Ash Nn't do See: Green Joker PZPAPN Ashar : Ashar Shoe_ , UIUC BSC; R: N/A 4: BRt - \, IBM , NAV, , VET, K, CleanUp, \, NAV, or DOS SYS %able The Ashar is a of the Brain . It differs fthe Brain it can xboth floppies and K, and the in the modified to be: "VIRUS_SHOE RECORD, v9.0. Dedicated to the dynamic memories of millions of who are no longer today". However, the is never L. The identification "ashar" is normally dat offset 04a6 hex in the of Ashar are: Ashar-B: (Shoe_ modified so can no longer Os. The v9.0 in the has to v9.1. See: Brain PZPAPN ASP-472 : ASP-472 H: Eastern R: 472 4: PRfAK - ., IBM , NAV 2.1+, The ASP-472 . Its . ASP-472 is a vof . ,and . The ASP-472 is X, the ASP-472 , hooking |21. be no as measured by the DOS ASP-472 has , it for any reason. by 472 at the end of the a. The and in the DOS can be easily identified as end the three character "ASP". ASP-472 Nn't do PZPAPN Astra : Astra Astra-976 H: j; data `truncated; R: 976 4: PRhCK - 6.00+, 2.48a+ The Astra, or Astra-976, . It is reported to be fthe . Astra is a of . bAstra X, the Astra at the top of #the |12's not be moved. , as rby the DOS ?by 1,056 nby Astra in the Astra , it X. If X, it the Astra qof 976 at the end of the a. The =and in the DOS not be . The in the Astra 4, and are not "(C) AsTrA, The "(2)" can be dnear the end of all Astra A symptom of an Astra data read/write intent may be truncated by slowly corrupting the 's data of Astra are: Astra-498: , Astra-498 is a 498 of the Astra w.SYS . It sdevice Or is loaded fthe CONFIG.SYS , it .SYS Eentry is accessed, by 498 - 513 uof the a, and 498 u. The at the end of the a. The =and in the DOS to the =and . The can be din all "I like a flower's smell!" "(C) AsTrA,JPN" "(5)" Astra-510: , Astra-510 is a 510 of the Astra and is to Astra-498. It adds 510 to 525 (to the .SYS u, and 510 u. It 7the "I like cold flavour!" "(C) AsTrA, ,JPN" "(5)" Astra-521: to Astra-498 and Astra-510, adds 521 to 536 (to the .SYS the u, and 521 7the "I like fragrant smell of flower!" "(C)AsTrA, "(5)" Astra-1010: , Astra-1010 is a 1,010 of the Astra . Its is 1,072 (, hooking It adds 1,010 (to the . The din the are present in . The "(2)" the end of the Astra 0to "(3)". Nnot truncate data PZPAPN AT144 : AT144 H: 8086/8088 processor R: 144 4: PRfbCK - 2.43a+, 6.00+, The AT144 . AT144 is vof . and function on AT class machines. On XT class machines, the simply hang the The AT144 is X, AT144 a portion of the residing in be no rby the DOS {91, 93, 94, 95, 97, 98, 9A, 9B, 9C, 9D, 9E, 9F, A0, A1, A2, A6, A7, A9, AA, AB, and AF nby the in low AT144 is , it X. If X, it by 144 at the end of the mhad =and in the DOS to the =and AT144 Nnot do An earlier " " of , but it not of AT144 are: AT108: to the AT144 in a "hole" in low , hooking 21. , it of 108 at the of the a. The =and in the DOS to the =and AT114: to the AT144 in a "hole" in low , hooking 21. , it ,and . qof 114 at the !of the a. The remainder of the hex "FF" 3. The in the DOS to the =and Frequent , as well as %failures AT118: to the AT144 in a "hole" in low , hooking 21. , it of 118 at the of the a. The =and in the DOS to the =and AT122: to the AT144 in a "hole" in low , hooking 21. , it of 122 at the of the a. The =and in the DOS to the =and AT140: to the AT144 in a "hole" in low , hooking 21. , it of 140 at the end of the a. The =and in the DOS to the AT149: to the AT144 adds 149 to the . PZPAPN : Atas Atas-384 H: Poland R: 384 4: PNCK - , VET, 6.00+, o, NAV 2.1.4+, 3.93+, 25.10+, V100+, V100+ The Atas . It is Poland. Atas is a vof . the Atas X, the Atas xone the E. The newly qof 384 at the end of the . The =and in the DOS to the =and The 8ed in the Atas are not ,Ok." "ATAS V0.1 Cr.24.01.92" advanced us of Atas may notice "Ok" X. The Mof "Ok" usually of the Atas Atas-400: , Atas-400 is a 400 of the Atas . It adds 400 (to the end of the . w. The =and in the DOS to the =and . The in the ,I like to travel..." "ATAS(Kiev) V3.03 Cr.91.10.11" : Poland See: Atas II PZPAPN Atas II : Atas II Atas-3321 H: , 1993 Poland R: 3,321 4: PRtCK - 6.04+, 2.48+, 2.48a+ The Atas II, or Atas-3321, , 1993, and fPoland. Atas II is a +. It is a semi- it hides the bAtas II X, the Atas II at the top of but #the &, moving |12's , as rby the DOS ?by 10,240 {08, 10, 16, 1C, and 21 nby Atas II in the Atas II , it qof 3,321 be hidden . The at the end of `, and the =and in the DOS not be . The in the Atas II "bye < > music" "letters" MBye-Bye" =.===" "ATAS Corporation.(B) ,V1 Created in the Kiev by ATAS." the Atas II "detected on all by the DOS it is . It is what else Atas may do. See: Atas PZPAPN H: May, j; "General Failure Ureading s, Greece R: 1,463 4: PRfAK - , NAV 2.1+, 6.00+, 25.10+, The A Gin A s, Greece, in May, is a and . the A at the top of #the is not reserved. not be . If +was not s, it . No the A , it for any reason. qof 1,463 at the end of the a. The be hidden by the it is . The =and in the DOS not be The in the "TROJECTOR II,(c) Armagedon Utilities, A the A [general failure requiring an Abort, Retry, Ignore, or Fail response. It is Trojector: Probably an earlier of the A , Trojector's 3,776 (, hooking |21. It 1,561 not be Trojector is . The at the end of the The in the "TROJECTOR ]I[,(c) Armagedon Utilities, A "Greetings to Vesselin" Trojector may X, as well as the DOS indicating regardless of whether the : Greece PZPAPN Attack : Attack Attack-1501, Cuban H: j; TSR; "Not enough Cuba R: 1,501 4: PRsC - , VET, The Attack, or Attack-1501, fCuba. is a of . , but not an earlier of the is an The the Attack as a low TSR of 3,552 (. It hooks {13, 21, and the Attack , it xtwo . in the Eany Xor a DOS DIR 5is performed. the Attack typically 1,501 (. The exception is if the was smaller 1,173 (, the of 2,684 (. The =and in the DOS not be The can be din all Attack "The Terminator Attack Now" +ERROR IN DEBBUG" the Attack may notice no longer function ing in a "Not enough of Attack are: Attack-918: An earlier of the Attack zs a 1.2K TSR it is , it two . in the ever any Xor a DOS DIR is performed. mthe 918 (of the host by the Attack-918 , and must be replaced fclean, backups. : Cuba PZPAPN Attention! : Attention! 394, -394, 394 H: clicking emitted speaker on keypress; R: 394 4: PRhCK - \, NAV, , VET, IBM The Attention! and was ~in the is a vof . The the Attention! X, the reserve 416 (at the top of , but #the &. The area, and hooks |21. and ed by the DOS @by 416 (. The is not moved. , a clicking sound be emitted by the speaker a key is pressed on the , such as the EDLIN supplied MS-DOS, receive an "Invalid attempted to be Attention! are X. The exception is very small . by 394 at the end of the 8the : "ATTENTION !" near the !of the PZPAPN Attention-629 : Attention-629 H: March, 1993 R: 629 4: PNCK - 2.48+, 2.48a+ The Attention-629 in March, 1993. Its . Attention-629 is a vof . the Attention-629 xone . in the 629 at the !of the The =and in the DOS to the =and . The in the 4in all Attention-629 "*.com" "Attention! I'm The second of be repeatedly the ing in a scrolling of the may PZPAPN Iron Maiden H: j; unexpected access to C: Poland R: 636 4: PNCK - , IBM NAV 2.1+, , VET, The 16th, or Iron Maiden, 16th is a +. It is fPoland. 16th is X, the 16th check to see if the btwo . `in the s. If mn't s, the proceed to xthem. Next, the 16th check the C: to see if it 7two . mn't s, and xthose if d. The was proceed to 16th qof 636 at the end of the be no 2to the =and in the DOS Two can be in the 16th "*.com AA" "=!= IRON MAIDEN" It is what 16th 16th, 8destructive PZPAPN Aussie Dir : Aussie Dir Sdir H: , 1993 j; sluggish DOS Dir Melbourne, Australia R: 550 4: PRhCK - The Aussie Dir, or Sdir, fAustralia in March, 1993. It was Gin Melbourne, Australia in 1993. Aussie Dir was "Sdir", but was not used as it is the of a computer unconnected to . Aussie Dir is a vof . bAussie Dir at the top of #the &, hooking |21. , as rby the DOS ?by 608 |12's not be moved. the Aussie Dir , it in the ever a DOS DIR 550 at the end of the a. The =and in the DOS . The can be in the 4in all Aussie Dir "1 Did David Gerrold ma harley he was one?" "2 Is John Brunner a shocking wave rider?" "3 Is iam Gibson a neurotic romantic?" "4 Is Australian Parasite the Best?" "1:No, 2:Yes, 3: Probably, 4: Absolutley" "AP*. The "AP" can dstarting in the fourth of all is the umarker for the Aussie Dir 7destructive Oon the 29th day of a specific month, due to a bug in the not be PZPAPN Aussie Parasite : Aussie Parasite Australian Parasite H: , 1993 %failures; Melbourne, Australia R: 292 4: PRhCK - \2.07+, V102+, V102+ The Aussie Parasite, or Australian Parasite, in Melbourne Australia in 1993. Aussie Parasite is a vof . the Aussie Parasite the Aussie Parasite at the top of #the and , as rby the DOS ?by 320 Aussie Parasite in the Aussie Parasite , it qof 292 the at the end of the a. The and in the DOS not be . The in the 4in all "Australian Parasite" kfrequently , and the fail to %copy of of Aussie Parasite are: Dorn: on the Aussie Parasite Dorn is a 377 . Its is 448 hooking |21. Dorn adds 377 (to the . w, the at the end of the a. The in the 4in all "Kill Dorn W. Stickle" "(C) Australian Parasite" : Australia 1993. on the Aussie Parasite }is a 369 . Unlike Assie Parasite, it is vof . +. El wthe in the is executing, adding 369 (to the . El is unable to determine s, it many s. The El the on the top portion of the monitor Xin the evening: "Night of the Living pt: El Misstress of the Dark Assembler ming: Australian Parasite (Enough said) Loves to Tonya H and Dianna G" The in the . The : Australia 1993. Grue: on the Aussie Parasite Grue is a 338 . Its is 400 hooking |21. Grue adds 338 (to the . w, the at the end of the a. The in the 4in all "It is pitch black. You are likely to be eaten by a Grue." : Australia 1993. PZPAPN Australian : Australian Clipper H: j; TSR Australia R: 1,413 4: PRsA - , NAV, ., VET, IBM The Australian . It is fAustralia. Australian is a vof . and . . It Nnot +. It is on the 1720 bAustralian X, the as a low TSR of 1,392 nby the Australian is , it occasionally ,and . by 1,413 at the !of the by 1,413 to 1,425 at the end of the In both cases, be no 2to the =and in the Australian 8one in the "CLIPPER" It is if Australian PZPAPN Australian 403 : Australian 403 403, Zeroto-O H: ; TSR; `do not function Australia R: 403 4: PRsCK - , IBM NAV, , VET, The Australian 403 by Colin Keeble of Australia. is a The the Australian 403 X, the as a low TSR of 720 (. The hook , the replace two . in the a copy of the any X. The replaced of 403 (, and =and in the to the =and . Needless to say, the replaced since 8the Nnot do of Australian 403 are: Zeroto-0: to Australian 403, has 10 differ fthe g, its TSR is 736 (, hooking Zeroto-0 is , it X. As the replaced a 403 =and to the =and PZPAPN Australian : Australian Australian H: , 1993 Australia R: 153 4: PNCK - V102+, V102+ The Australian , or Australian -153, , 1993 cits Hin Australia in the same month. Australian , and its listed #, are non- the Australian the Australian xone . in the E. A hang may the Australian qof 153 at the !of the a. The =and in the DOS not be . The can be viewed in the 4in all Australian adding an (to the of Australian Australian -142: A 142 of the Australian : Australia , 1993. Australian -142B: to Australian -142, has a few differ. : Australia , 1993. Australian -143: A 143 of the Australian : Australia , 1993. Australian -147: A 147 of the Australian : Australia , 1993. Australian -150: A 150 of the Australian : Australia , 1993. Australian -162: A 162 of the Australian . The "AP" can be `starting in the 4th )of the : Australia , 1993. PZPAPN Azusa : Azusa Hong Kong H: BSR; LPT1 & ,1 ports may be disabled Hong Kong R: N/A 4: BRtX - \, NAV, IBM , VET, : CleanUp, M- K/P, F K/MBR on DOS 5 The Azusa . Its is believed to be Hong Kong. is a and the The the Azusa , the at the top of , but #the &. The moves the report 1,024 (less zed on the . At , the xthe the a copy of the Azusa . A copy of the is not stored by the Azusa is , it are accessed on the write intent (i.e., a as output, or read/write intent) or to re the Jvia CTL-ALT-DEL. Iare by copying the to track 40 and writing a copy of to the . On 360K 5.25" I, the end up in the middle of the K, possibly corrupting The Azusa keeps track of how many s the %s, the disable the ,1 and LPT1 ports on the , and reset its counter. A later in the ports functioning again. of Azusa are: Azusa 2: fHong Kong. The portion of Azusa 2 is 2,048 at the top of uof high-density in severe cross-linking of `and invalid clusters, as well as 0 Fories. CTRL-C may fail to function, as well as may hang the . Disabling of ,1 and LPT1 may See: Evil Empire PZPAPN : Back H: clock runs backwards R: 528 4: PRtCK - , IBM , VET, , NAV 2.1+, The Back . Back vof . Its bBack X, Back at the top of the @by 528 (, as measured by the DOS {08 and 21 nby the , it X. If X, it by 528 The Back at the end of the The "Back " can be din all The Back affect the operation of the by running the clock backwards. For example, `created became stamps in the fbefore the became . Re %ing the in the clock ing to the normal expected =and See: Blinker Shaker PZPAPN Bad Boy : Bad Boy Bad Boy 2 H: May, R: 1,000 4: PRtCK - , NAV, , IBM , VET, 25.10+, The Bad Boy in May, V. Bad Boy is a vof . , it The Bad Boy is X, the at the top of , but #the nby the is not moved. If the became %ing rby the DOS ?by 3,072 (. If Bad Boy became by executing (not @of 3,072 , but ?by 6,704 (. The is due to a low zed by the Bad Boy is , the by 1,000 at the `. Occasionally, by 1,001 (. The =and the not be 8two , the d, natural us of the are not Lby the "The bad boy halt your "The Bad Boy , Copyright (C) The Bad Boy on a random basis, at to hang the . The hang is followed by the scrolling several s of repeated 3, and halt of Bad Boy are: Bad Boy 2: A later of Bad Boy, Bad Boy 2 Nnot the TSR zed if the became %ing The hang, scrolling of 3, and halt may still , but not as frequently. The in the "Make me better!" "The Bad Boy 2.0, Copyright (C) Bad Boy, the d samples of Bad Boy 2. See: Boys PZPAPN Bad Brain : Bad Brain H: fail to R: 576 4: ONCK - 2.43a+, .1.4+, 1.53S+ The Bad Brain . Its . Bad Brain is a of . +. It corrupts all Bad Brain is X, the Bad Brain xone . on the Oin the 2nd or lower sub fthe O's root the Bad Brain mthe b576 the 4, so be no 2in the in the DOS . The =and the DOS The in the Bad Brain 4, and thus are not "SKISM*" "BadBrains" the Bad Brain not function Ythem. The ed to the DOS prompt upon Since the Bad Brain s the !of the host cannot be dis sand should be replaced clean backup copies. PZPAPN Bad-389 : Bad-389 H: March, 1993 1; TSR R: 389 4: PRsCK - 6.04+, \2.07+, 2.48+, 2.48a+ The Bad-389 in March, 1993. Its . Bad-389 is a bBad-389 X, the Bad-389 as a low TSR of 544 nby the . Bad-389 cannot determine it is already , so it X, taking up an , the Bad-389 qof 389 at the end of the a. The =and in the DOS set to the =and . The in the 4in all Bad-389 "Bad PZPAPN Badsec : Badsec 905, Backfont H: ; bad or lost clusters; unexpected accesses to R: 765 4: PRhE - , IBM NAV, , VET, The Badsec . Its . Badsec is a of . The the Badsec at the top of #the &. It Nnot move 12's , as by the DOS ?by 4,384 nby the the Badsec , it qof 765 the end of the a. The =and in the DOS not be the Badsec may notice the access unexpectedly. accesses , a bad or a lost cluster may , hence the kmay as well. Topsy-900: , Topsy-900 is on the Badsec . It is fthe Topsy-900 zing at the top of #the 2,736 to 5,472 (, and by the , Topsy-900 may sporatically. qof 900 at the end of the PZPAPN Banana : Banana Trivial-Banana H: %failures Sweden R: 139 4: ONCK - , VET, NAV 2.1+, 1.15a+, 25.10+, The Banana . It is fSweden. Banana is a of . . It corrupts the the Banana X, the Banana xall of the . in the E. Banana s the b139 (of the w, so were larger 139 smaller . The =and in the DOS not be The can be in the all Banana "BANANA, 4d by Morbid Angel -92 in Stockholm/Sweden" "*.com" Banana no longer function Since the !of the host , it is not possible to dis should be replaced clean, copies. See: Mini-45 PZPAPN Bandit : Bandit Research H: May, Italy R: 1,641 4: PNE - , VET, IBM NAV 2.1+, The Bandit in May, . Bandit is fItaly. It is a vof . Bandit is X, Bandit search the Oand Efor an x. If an d, it s. Bandit 1,641 at the end of the The =and in the DOS not be Bandit 8the , the second of at the end of "*.* *.exe ww "!!PCBANDIT!!" Bandit is on the Enigma s to be a research See: Enigma PZPAPN Baobab : Baobab H: India R: 1,641 - 1,651 4: PRhE - \, VET, 1.15a+, 3.93+, 25.10+, NAV 2.1.4+, The Baobab . It is fIndia. Baobab is a vof . bBaobab X, the Baobab at the top of #the &. It Nnot move |12's rby the DOS 2,560 nby the Baobab the Baobab , it qof 1,641 to 1,651 at the end of the a. The Baobab , adding an 1,648 =and in the DOS to the =and the last of the It is what Baobab may do of Baobab are: Baobab-731: A 731 of the Baobab is 1,552 , it are X, adding 733 to 752 (to the The at the end of the a, and the =and in the DOS to the =and . Like the , adding 736 u. The in the "Fhello" March, 1993. PZPAPN Barcelona : Barcelona H: 2; TSR Spain R: 1,792 4: PRsC - ., NAV 2.1+, , VET, The Barcelona fBarcelona, Spain, in . Barcelona is a vof . on the bBarcelona X, the Barcelona as a low TSR of 2,096 (. It Barcelona is , it qof 1,792 at the !of the a. The =and in the DOS to the The can be in the in Barcelona "CATALUNYA" "CATALUNYA LLIURE" "FORA LES FORCES D`OCUPACIO" "MORT ALS TERRORISTES TRICORNUTS" It is if Barcelona carries any damage potential. See: PZPAPN Barrotes : Barrotes H: ; vertical bars & %failure; corrupted Spain The R: 1,310 4: PRhAK - 6.04+, V100+, 2.48+, V100+, 2.48a+ The Barrotes ~in The s to ated in Spain. Barrotes is a vof . W, and overlay bBarrotes X, the Barrotes at the top of #the &, hooking |21. and , as rby the DOS ?by 1,600 |12's be moved. , the Barrotes copy of in the C: Oroot Eif it was not the Barrotes , it W, and overlay qof 1,310 at the end of the a. The and in the DOS not be The in the Barrotes 4in all "c:\ 5.com" "l7SO" The Barrotes 5th of any year. At , the vertical bars across the M, and the at the DOS prompt: BARROTES por OSoft" s, the write a portion of its 4to the . The next the fthe K, the fail. PZPAPN Basilisk : Basilisk H: March, 1993 ; DOS