VSUMX 9406 Copyright (c) 1990-94 by Patricia M. Hoffman. All rights reserved. Patricia M. Hoffman Telephone: (408) 988-3773 3333 Bowers Avenue Suite 130 Fax: (408) 988-2438 Santa Clara, CA 95054, USA BBS: (408) 244-0813 aVTK/N above action activates activation added additional after aliases alias allocation altered anti-Pascal anti-viral anything appear approximately april attempting attempts august available based becomes become beginning being below besides boundary bulgaria bytes cHKDSK cOMMAND.COM cPAV/N certification changed changes change characters command common contains contain corruption current dark Avenger date/time december decreased decrease delete described detection Method directory direct discovered discovery diskettes diskette displayed display drive drVirus eff Length encrypted errors error europe executed execute execution experience f-Prot family february file's files first following found functionally general Comments growth hangs hooked iBMAV including increase indicated infected infecting infection infector infects infect information innoc install interrupts interrupt isolated isolation itself january jerusalem keyboard known lProt length listing located master memory messages message nShld naughty Hacker nAV/N netherlands non-Resident non-resident november nProt occassionally occurred occur october opened originally original origin other overwrite overwriting overwritten panda parasitic partition point previously program's programs program properly pS-MPC received removal Instructions replicate resident result return screen sectors sector september similar stealth stoned strings string submitted sweep/N sweep symptoms systems system table their there these though total uTScan uninfected united States unknown updated v Status vBuster vi-Spy variant(s) variants variant version vienna violator viral virexPC viron viruScan virus Name virus visible which COLORS=1f,1e,0f,1b,1e,1d,0f,,1f,1f,1f,1f,1f,1f,1e,11,1f,1e,11,18,0f,,,, DISABLECOPY=1 (C)=HyperText VSUM Copyright (c) 1990-94 by Patricia M. Hoffman (408)988-3773 THINSCROLLBAR=1 _CA=Copyright (c) 1990-94 by Patricia M. Hoffman. _CB=All rights reserved. _CD=Patricia M. Hoffman Telephone: (408) 988-3773 _CE=3333 Bowers Avenue Suite 130 Fax: (408) 988-2438 _CF=Santa Clara, CA 95054, USA BBS: (408) 244-0813 _BA=fff5,ffee,45,05, F1:Help _BB=0002,ffc4,00,00,F2:Menu _BC=ffec,ffe1,53,03,F4:Srch _BD=ffed,ffe7,50,03,F5:Print _BE=ffe5,ffe8,4f,04,F7:Color _BF=ffee,ffef,57,06,F8:Viewed _BG=fffb,002d,2d,02,<<- _BH=fffa,002b,2b,00,+>> _BI=fffe,ffd3,58,05,F10:Exit _BJ=fffc,ffd0,42,06,ESC:GoBack _BK=ffe9,ffc0,00,00,F6:Credits _BL=ffef,ffbd,00,00,F9:Files _BM=fff9,ffc3,00,00,F3:Index _BN=ffea,ffa9,00,00,SearchAgain _MA=0000,0000,56,00,VSUM Sections _MB=04cf,0000,57,02,A Word From Patricia... _MC=055a,0000,55,0c,Licensing VSUM _MD=055d,0000,41,00,Authorized VSUM Agents _ME=04d6,0000,43,00,Certification Data and Info _MF=054a,0000,52,05,VSUM Revision History _MG=ffff,0000,00,00,- _MH=0003,0000,49,06,Virus Index by VSUM Virus Name _MI=04d2,0000,4e,07,Common Name Cross-Reference _MJ=04fa,0000,54,06,Viral Type Cross-Reference _MK=04d4,0000,4c,00,Length Cross-Reference _ML=0502,0000,4f,00,Origin Cross-Reference _MM=0533,0000,50,0b,Relationship Charts _MN=04f6,0000,44,12,Virus Activiation Dates _MO=ffff,0000,00,00,- _MP=04d5,0000,53,0b,Common Virus List _MQ=052e,0000,45,06,Virus Entry Fields _MR=04f7,0000,4d,00,McAfee Scan-IDs FZPAPN Hyper Patricia M. Hoffman's xSummary List (tmi The Reference for all MS-DOS H y p e r T e x t may not be used in a business, corporation, organization, government, or agent en ment out a negotiated site license. Copyright (c) -94 by Patricia M. Hoffman. All rights reserved. 3 Bowers Ave Suite 130, Santa Clara, CA 95054 Tel: (408)988-3773 PZPAPN Alpha Index 5 ( L P Y ! p h PTJB Alphabetic Index 4Res 5Lo 10 Past 3 302 337 500 572 621 702 834 923 1008 1024 Print 1024 SBC 1067 1210 1226 1241 1244 1260 1308 1385 1392 1403 1452 1575 1605 1661 1689 1720 1784 1804 1835 1840 1963 2153 2559 2560 2623 3040 3445- 4096 5120 7808 A&A Abraxas 5 Ada Adolf Hitler Adolph African 109 Agena AIDS II AirCop Akuku Alabama Alameda Albania Albanian Alex-368 Alexander Alfa All Sys 9 Alpha-743 Ambulance Car Andre Andromeda 1.0 Andromeda 1.1 Angarsk Animus Anna Anthrax Antimon Anti-D Anti-DAF Anti-Tel Anto Aragon Aragorn Arale ARCV 330 ARCV Friends ARCV Xmas ARCV-670 ARCV-n Arf Argentina Armagedon Arriba Arusiek Ash Ashar ASP-472 Astra AT144 Atas Atas II AtomAnt 3.0 Atomic 1 Atomic 2 Attack Attention! Attention-629 Aurea Aussie Dir Aussie Parasite Australian Australian 403 Australian Avispa AVV-2300 Axe-1024 Azusa B&B Back BackFont-896 Bad Boy Bad-389 Badsec Bad Bandit Baobab Barcelona Barrotes Basilisk Beast-N-Black Bebe Beeper Beer Belgium-320 Benoit Best Wishes Beta Beware Big Bang Big Joke Big-2000 Bios Bit Addict Bizarre Black Monday Black Wizard Blinker Blinky Bljec Blood Blood Sugar Bloody Warrior Bloody! Bomber Boojum &Killer Bow Boys Brain Brainy Brazilian Bug Breeze Bryansk Bubonic Burghofer Butterflies Butt Stink ButtUgly Cacophony Cadkill Cannabis Cansu Capitall Cara Career Of Evil Carfield Carioca Cartuja Cascade Casino Casper Casteggio Catman Caz CB-1530 CCCP-510 CD Cerburus Chad Chang Changu Mangu Chaos Chaos Year Chaser CheckSum Cheeba Chemmy Chemnitz Chile Mediera China CHR-869 Chris Christmas Tree Chromo 1.0 Cinderella Civil War Clone 2.0 Clonewar Close CLS-853 Cmdr Bomber Cobra Coffeeshop-1568 Collor de Mello 7wealth Commy Como Copyright Cossiga Costeau CPSU-2535 CPW Cracker Jack Crash Crazy Eddie Crazy Imp Creeper Crew-2480 Criminal Cruncher Crusher Curse Cyber Cybercide CyberTech Cysta Dad Dada Damage DAME Dark End Dark Lord Darkray Datacrime DataLock Davis Day10 dBASE Dead-790 Death Dragon Deicide Democracy Demolition Demon Viper Den Zuk Deranged Desperado Dest Destructor V4.00 Devil's Dance Dewdz Digger Dima Dir Dir-2 Dirty Discom KKiller Dismember Distrust DLSU Do-Nothing Doctor Qumak 2 DoDo Dodo 2456 Doom II DOS-1 DOS3 DOS7 DOSHunter Dostepu DOSVer Dot Killer Dreamer Drop Dutch 555 Dutch Ear Ebbelwoi Edcl Egg-1000 Eight Tunes Ein Volk Einstein Eliza Elvis-1250 Emmie Emo-899 End Of Enemy Enemy Enigma Enola Estepa ETC Evil Evil Empire Exebug Experiments Experiments-416 Explosion Exunt Faerie Fairz Father Father Christmas Feist Fellowship Fich Fichv-896 >11-537 Filler Fingers Finnish-709 FireFly Fish Fish Fisher Flagyll Flash Flex Flip Flower Flue Fly 1.1 Foetus 1.1 FoneSex Forger FORM- Frajer-649 Freddy ew-692 Freak Frere Jacques Friday 13th Friends Frodo Soft Frogs Fu Manchu Funeral Fungus Fuse Box Dwarf FWord-383 G2 Geek Geodesic 2.0 Gergana Ghostballs Gidra-469 Gingerbread Man Gippo Gipsy-304 Gliss Globe Gnose Godoy GoldGeld Golgi Gorlovka Gosia Got-You Gotcha Granada Grapje Graveyard-479 Green Caterpillar-1989 Green Joker Gremlin Grither Groen Links Grog 3.1 Groove Growing Block Groz-999 Grunt-1 Guillon Guppy Ha Hacktic Hafenstrass Hafenstrass 2 Haifa Hallo-496 Halloechen Halloween Hambone Hamster Handi-215 Happy Happy New Year kDays Harm-1082 Hary Anto Hates-213 Hell Hellween Hero Hero-394 Hexametricx HH&H Hi HiDos Highlander Hiperion Hitchcock HLLS Hobbit Holiday Holocaust Hominy Honey Horror Horse Hungarian Hungarian 482 Hybryd Hydra Hymn Ice 9 Icelandic Idle Ieronim Ignorant IKV 528 Ilja-1704 Ill Incom Infinity Inky Interceptor Internal Intruder Invader Invol Ionkin Iper Iranian Iraqui Warrior Iron Umbrella Italian 803 Italian Boy Itavir IVP James Bond Japanese Christmas Jason JD Jeff Jericho Jerk 11-30 -Haifa Joanna JoJo JoJo 2 Joker Joker 2 Joker-1602 Jos Joshi Joshua Julia-1000 Junior K-4B K-4C K-Hate Kalah Karin Karlik Keeper Kemerovo Keydrop Keypress Kiev 483 Kiev 2049 Kiwi-550 Klaeren KLF-356 Kode4 Kohntark Korea Kremikovtzi Krivmous Kthulhu Kuku-448 Label Lancs Larry Laufwerk Lazy LCT Leech Legalize Lehigh Leningrad II Liberty Liberty-2 Liberty-1172 Lippi-286 Lisbon Little Br Little Girl Little Pieces Little-139 Loa Duong LockUp Lockup 3.0 Loki Lokjaw Lord-933 Los-693 LoveChild-2710 LowerCase Lozinsky LPT Off Luca-309 Lucifer Lurve LV 1.2 Lycee Lythyum LZRQ M.I.R. Maaike Macedonia MacGyver Magnitogorsk 2048 Malaga Malaise Malign Malmsey Maltese Amoeba Mannequin Manola Manta Marauder March 25th Mardi Bros Mark II Marl Marzia Matura Max.347 Mayak Mayberry Medical Meditation Lapse Mercenary Merry Xmas Meta-2048 Metallica II Mexican Mud MGTU Mich II Michelangelo Micro 128 Microbes Micropox Miky Milano Milena MiniMax Minimite Ministry Minsk Ghost Mirror Mithrandir Mix1 Mix2 MMIR Moctezumas Revenge Monika-686 Monkey Mono Month 4-6 Monxla Monxla B Mordor.1110 More-649 Mosquito MPS 1.1 MPS 3.1 MPS 3.2 MPS 4.01 MPS II-754 Mr. D Mr. G MShark MSTU Mugshot Mule Multi 1.1 Multi Child Multi-123 Multi-Face Mummy Munich Murphy MusicBug Mutant Mutation MX-335 Mystic-377 Nazgul NaziPhobia NCU LI Necro Fear Necro Shadow Necrosoft Dementia NeverMind Newcom NGV Nina Nines Ninja No Frills NoBock NoInt Nomenklatura Not-586 NPox NR-481 NTKC Null Set Null-178 Number 6 Nygus Nympho 1.0 Offspring Ohio Oi Dudley OMud-512 Ontario Ontario 730 Ontario III Oropax Otto6 Outland Oxana Pa Parasite Paris Parity Parity Particle Man Path Pathhunt Patient Paturuzu Pay Rise PC Flu PC Flu-2 PCBB Peace Man Pegg-833 Pentagon Penza Perfume Phalcon.894 Phantom Phoenix Phoenix 2000 PhoenixD Piazzolla Pila Ping Pong Pinky Pirate 1344 Pisello Pitch Piter-1228 Pixel Pixie Plastique Plastique-B Play Tetris Plovdiv 1.1 Plovdiv 1.3 Plumbum Plutto Poem Poet Pogue Poison Pojer Polimer Polish 217 Polish 529 Polish 583 Polish Polish-376 Poor Man Porridge Possessed Praying Predator Pregnant Press Prime Print PrintMonster Problem Protecto Protipus Proud Psychosis Puke-393 PV-81 QMU Quake Queens Quiet Quick Quirk R-10 R-11 Radyum Rael Rage RAM Random Rattle RaubKopie Reaper Red Diavolyata RefRef Reklama Relzfu Reset Revenge Attacker Revelation Riihi RIP-699 RNA Rocko Roguey Rosen RPVS RSP-1876 RTL4 Ryazan Rybka Sabbath Saddam Sadist Sayha Watpu Sandwich Saturday The 14TH Schrunch-420 Scott's Valley Scream Scroll Scythe SeaCat Search-1000 Self Semtex Sentinel Serena Seventh Son Shadow Shake Shaker Shaman Shanghai Shield Shifter Shiny Happy Shirley Shock Therapy Sicilian Mob Signs Silence Silly Silly Silly-365 Simple Simulati Sinep Siskin Sistor Skater Skew-469 Skynet Skull Slayer Sleepwalker Slime Slovak Slow Sluknov Small ARCV Small Small-115 Small-145 Small-178 Smaug Smiley Socha Solano 2000 thing Sonik Youth Sorlec Sorry Soupy Spanish Spanish Fools Spanz Sparse Spring Spyer Squawk Squeaker Squisher Staf Stahl Stanco StarDot 600 StarDot 789 StarDot 801 Stasi Sterculius Sticky StinkFoot Stone`90 Storm-1163 Storyteller Striker #1 Student-776 Stupid-1355 Suicidal Sunday Sunday-2 Sundevil Suriv 1.01 Suriv 2.01 Suriv 3.00 Suriv 4.02 Surrender Susan SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 SVC-2936 SVC.3241 Sverdlov SVir Swap Swedish Boys Swedish Disaster Swiss 143 Swiss Phoenix Sylvia SysLock TBug-634 Tabulero Tack Taiwan Taiwan 3 Taiwan 4 Talentless Tamanna Tankard Tao Cheng Tatou Tchantches TechnoRat Telecom Ten Tequila Terminator Terminator-2294 Terminator-3549 Tester Thimble Thirty Three Timid Timor Tiso TMTM Tobacco Todor Tokyo Tolbuhin Tomato Tony Tony Tormentor Tormentor-205 Totoro TPWorm Traceback Traceback 3029 Traceback II Traveller Tremor Trident Trigger Troi Tu-482 Tula Tumen Turbo Tver-308 Twin-351 Typo Typo UFA-1201 Ugur Ultimation Under 7 UnExe Unk Urfydus Uruguay Uruk-hai V-3n V270x V351 V388 V483 V651 V800 V801 V82 V1024 V2000 V2100 V2P2 V2P6 Vacsina Varicell VComm VCS VFSI VHP2 Victor Vinchuca Vindicator Violetta Violite Viperize VirDem VirDem-792 VirDem-1542 Vivaldi VMem Voice-1495 Voodoo Voronezh Voronezh-370 Voronezh-Chemist Vote Vriest VS-2790 VVF 3.4 VX-163 W13 Walker Wanderer Warez-1341 Warning Warrior Warsaw-850 Wave Weak Were Here Westwood Whale Wharps Wild Thing 2 istrover III Windmill WinVir Wisconsin Witch Wolfman Wonderful WordSwap World Peace Worm-16850 Worm-17690 WW-658 WXYC X-2 Xpeh XPH Xuxa Yafo YAM-3599 Yankee Doodle Yankee 2 YB.Old Scribe Year Youth Zaphod Zaragosa Zero Bug ZeroHunt Zherkov ZK900 ZMT Zoid Zombie Zu1 s and Research 382 Recovery 422 4870 Acid AIDS Amstrad Argentina-102 Bad Brain Banana Blaze Blood Lust Budo Burger Busted Darth Vader Define DisDev Druid Explode Fat Fratricide Groove OW Green Peace Gyro Harakiri Hastings Hellraiser House Immolation Itti Kamikazi Leprosy Madismo Mindless MindRiot Mini-45 Naught-865 Nowhere Man Number One Ondra Over-4032 Pascal-4260 Pascal-5220 Pirate Polish-45 Possum Psychogenius Repent Seneca-B Shhs Silver Dollar Simple Minds Skism Small-38 T-1000 TalkingHeads Today Toxic Twin Peaks Tyst V-1n Viper Wonder WWT Yukon ZigZag PZPAPN MAIN MENU WEL -E TO A word fPatricia... Using Index Cross-Reference Relationship Chart Revision History Licensing Appendices Exit PZPAPN Index PZPAPN 10 Past 3 4Res 5Lo 99% 302 310 334 337 382 Recovery 405 408 422 439 500 512 557 572 595 604 621 646 66A 702 708 834 889 914 923 981 1008 1024 Print 1024 SBC 1067 1210 1226 1241 1244 1253 1260 1308 1385 1392 1403 1452 1575 1605 1661 1689 1720 1784 1804 1835 1840 1963 2153 2559 2560 2623 3040 3445- 4096 4870 5120 7808 PZPAPN A&A ABC Abraxas 5 Acid Ada Adolf Hitler Adolph African 109 Agena AIDS AIDS II Aircop Akuku Alabama Alameda Albania Albanian Alex-368 Alexander Alfa All Sys 9 Alpha-743 Ambulance Car Amstrad Andre Andromeda 1.0 Andromeda 1.1 Angarsk Animus Anna Ant Anthrax Anti-D Anti-DAF Anti-Tel Antimon Anto Aragon Aragorn Arale ARCV 330 ARCV Friends ARCV Xmas ARCV-670 ARCV-n Arf Argentina Argentina-102 Armagedon Arriba Arusiek Ash Ashar ASP-472 Astra AT144 Atas Atas II AtomAnt 3.0 Atomic 1 Atomic 2 Attack Attention! Attention-629 Aurea Aussie Dir Aussie Parasite Australian Australian 403 Australian Avispa AVV-2300 Axe-1024 Azusa PZPAPN B&B BackFont-896 Back Bad Boy Bad Brain Bad Bad-389 Badsec Banana Bandit Baobab Barcelona Barrotes Basilisk Beast-N-Black Bebe Beeper Beer Belgium-320 Benoit Best Wishes Beta Beware BFD Big Bang Big Joke Big-2000 Billboard 1.0 Bios Bit Addict Bizarre Black Monday Black Wizard Blaze Blinker Bljec Blood Blood Lust Blood Sugar Bloody Warrior Bloody! Bob Bomber Boojum &Killer Bow Boys Brain Brainy Brazilian Bug Breeze Bryansk Bubonic Budo Burger Burghofer Busted Butterflies Butt Stink ButtUgly PZPAPN Cacophony Cadkill Cannabis Cansu Capitall Cara Career Of Evil Carfield Carioca Cartuja Cascade Casino Casper Casteggio Catman Caz CB-1530 CCCP-510 Cerburus Chad Chang Changu Mangu Chaos Chaos Year Chaser CHCC CheckSum Cheeba Chemmy Chemnitz Chile Mediera China CHR-869 Chris Christmas Tree Chromo 1.0 Cinderella Civil War Clone 2.0 Clonewar Close CLS-853 Cmdr Bomber Cobra Coffeeshop-1568 Collor de Mello 7wealth Commy Como Copyright Cossiga Costeau CPSU-2535 CPW Cracker Jack Crash Crazy Eddie Crazy Imp Creeper Crew-2480 CRF Criminal Cruncher Crusher CSL Curse CV4 Cyber Cybercide CyberTech Cysta PZPAPN Dad Dada Damage DAME Dark End Dark Lord Darkray Darth Vader Datacrime DataLock Davis Day10 dBASE Dead-790 Death Dragon Define Deicide Democracy Demolition Demon Viper Den Zuk Deranged Desperado Dest Destructor V4.00 Devil's Dance Dewdz Digger Dima Dir Dir-2 Dirty Discom DisDev KKiller Dismember Distrust DLSU DNR Do-Nothing Doctor Qumak 2 DoDo DoDo 2456 Doom II DOS-1 DOS3 DOS7 DOSHunter Dostepu DOSVer Dot Killer Dreamer Drop Druid Dutch 555 Dutch DWI PZPAPN Ear Ebbelwoi ECU Edcl EDV Egg-1000 Eight Tunes Ein Volk Einstein EkoT Eliza Elvis-1250 Emf Emmie Emo-899 End Of Enemy Enemy Enigma Enola Estepa ETC Exebug Experiments Experiments-416 Explode Explosion Exunt Evil Evil Empire PZPAPN Faerie Fairz Fat Father Father Christmas FCB Feist Fellowship FGT Fich Fichv-896 Fil >11-537 Filler Fingers Finnish-709 FireFly Fish Fish Fisher Flagyll Flash Flex Flip Flower Flue Fly 1.1 Foetus 1.1 FoneSex Forger FORM- Frajer-649 Fratricide Freak Freddy ew-692 Frere Jacques Friday 13th Friends Frodo Soft Frogs Fu Manchu Funeral Fungus Fuse Box Dwarf FWord-383 PZPAPN Geek Generic Generic Geodesic 2.0 Gergana Ghostballs Gidra-469 Gingerbread Man Gippo Gipsy-304 Gliss Globe Gnose Godoy GoldGeld Golgi Gorlovka Gosia Got-You Gotcha Granada Grapje Graveyard-479 Green Caterpillar-1989 Green Joker Green Peace Gremlin Grither Groen Links Grog 3.1 Groove Groove OW Growing Block Groz-999 Grunt-1 Guillon Guppy Gyro PZPAPN Hacktic Hafenstrass Hafenstrass 2 Haifa Hallo-496 Halloechen Halloween Handi-215 Hambone Hamster Happy Happy New Year Harakiri kDays Harm-1082 Hary Anto Hastings Hates-213 Hell Hellraiser Hellween Hero Hero-394 Hexametricx HH&H HiDos Highlander Hiperion Hitchcock HLLS Hobbit Holiday Holocaust Hominy Honey Horror Horse House Hungarian Hungarian 482 Hybryd Hydra Hymn PZPAPN I-B Ice 9 Icelandic Idle Ieronim Ignorant IKV 528 Ilja-1704 Ill Immolation Incom Infinity Interceptor Internal Intruder Invader Invol Ionkin Iper Iranian Iraqui Warrior Iron Umbrella Italian 803 Italian Boy Itavir Itti IVP PZPAPN James Bond Japanese Christmas Jason Jeff Jericho Jerk 11-30 -Haifa Joanna JoJo JoJo 2 Joker Joker 2 Joker-1602 Jos Joshi Joshua Julia-1000 Junior JW2 PZPAPN K-4B K-4C K-Hate Kalah Kamikazi Karin Karlik Keeper Kemerovo Keydrop Keypress Kiev 483 Kiev 2049 Kit Kiwi-550 Klaeren KLF-356 Kode4 Kohntark Korea Kremikovtzi Krivmous Kthulhu Kuku-448 PZPAPN Label Lancs Larry Laufwerk Lazy LCT Leech Legalize Lehigh Leningrad II Leprosy Liberty Liberty-2 Liberty-1172 Lippi-286 Lisbon Little Br Little Girl Little Pieces Little-139 Loa Duong LockUp LockUp 3.0 Loki Lokjaw Lord-933 Los-693 LoveChild-2710 LowerCase Lozinsky LPT Off Luca-309 Lucifer Lurve LV 1.2 Lycee Lythyum LZRQ PZPAPN M.I.R. Maaike Macedonia MacGyver Madismo Magnitogorsk 2048 Malaga Malaise Malign Malmsey Maltese Amoeba Mannequin Manola Manta Marauder March 25th Mardi Bros Mark II Marl Marzia Matura Max Max.347 Mayak Mayberry Medical Meditation Lapse Mercenary Merry Xmas Meta-2048 Metallica II Mexican Mud MGTU Mich II Michelangelo Micro 128 Microbes Micropox Miky Milano Milena Mindless MindRiot Mini-45 MiniMax Minimite Ministry Minsk Ghost Mirror Mithrandir Mix1 Mix2 MMIR Moctezumas Revenge Monika-686 Monkey Mono Month 4-6 Monxla Monxla B Mordor.1110 More-649 Mosquito MPS 1.1 MPS 3.1 MPS 3.2 MPS 4.01 MPS II-754 Mr Mr. D Mr. G MShark MSJ MSTU Mugshot Mule Multi 1.1 Multi Child Multi-123 Multi-Face Mummy Munich Murphy MusicBug Mutant Mutation MVF MX-335 Mystic-377 PZPAPN Naught-865 Nazgul NaziPhobia NCU LI Necro Fear Necro Shadow Necrosoft Dementia NeverMind Newcom NGV Nina Nines Ninja No Frills NoBock NoInt Nomenklatura Not-586 Nowhere Man NPox NR-481 NTKC Null Set Null-178 Number One Number 6 Nygus Nympho 1.0 PZPAPN Offspring Ohio Oi Dudley OMT OMud-512 Ondra Ontario Ontario 730 Ontario III Oropax Otto6 Outland Over-4032 Oxana PZPAPN Parasite Paris Parity Parity Particle Man Pascal-4260 Pascal-5220 Path Pathhunt Patient Paturuzu Pay Rise PC Flu PC Flu-2 PCBB PCV Peace Man Pegg-833 Pentagon Penza Perfume Phalcon.894 Phantom Phoenix Phoenix 2000 PhoenixD Piazzolla Pif Pila Ping Pong Pirate Pirate 1344 Pisello Pitch Piter-1228 Pixel Pixie Plastique Plastique-B Play Tetris Plovdiv 1.1 Plovdiv 1.3 Plutto Plumbum Poem Poet Pogue Poison Pojer Polimer Polish 217 Polish 529 Polish 583 Polish Polish-45 Polish-376 Poor Man Porridge Possessed Possum Praying Predator Pregnant Press Prime Print PrintMonster Problem Protecto Protipus Proud Psychogenius Psychosis Puke-393 PV-81 PZPAPN QMU QP3 Quake Quiet Quick Quirk Queens PZPAPN R-10 R-11 Radyum Rael Rage RAM Random Rattle RaubKopie Reaper Red Diavolyata RefRef Reklama Relzfu Repent Reset Revenge Attacker Revelation Riihi RIP-699 RNA Rocko Roguey Rosen RPVS RSP-1876 RTL4 Ryazan Rybka PZPAPN Sabbath Sad Saddam Sadist Sandwich Saturday The 14TH Sayha Watpu Schrunch-420 Scott's Valley Scream Scroll Scythe SeaCat Search-1000 Seneca-B Self Semtex Sentinel Serena Seventh Son Shadow Shake Shaker Shaman Shanghai Shhs Shield Shifter Shiny Happy Shirley Shock Therapy Sicilian Mob Signs Silence Silly Silly Silly-365 Silver Dollar Simple Minds Simple Simulati Sinep Siskin Sistor Skater Skew-469 Skism Skull Skynet Slayer Sleepwalker Slime Slovak Slow Sluknov Small ARCV Small Small-38 Small-115 Small-145 Small-178 Smaug Smiley Socha Solano 2000 thing Sonik Youth Sorlec Sorry Soupy Sov Spanish Spanish Fools Spanz Sparse Spring Spyer Squawk Squeaker Squisher Staf Stahl Stanco StarDot 600 StarDot 789 StarDot 801 Stasi Sterculius Sticky StinkFoot Stone`90 Storm-1163 Storyteller Striker #1 Student-776 Stupid-1355 Suicidal Sunday Sunday-2 Sundevil Suriv 1.01 Suriv 2.01 Suriv 3.00 Suriv 4.02 Surrender Susan SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 SVC-2936 SVC.3241 Sverdlov SVir Swap Swedish Boys Swedish Disaster Swiss 143 Swiss Phoenix Sylvia SysLock PZPAPN T-1000 Tabulero Tack Taiwan Taiwan 3 Taiwan 4 Talentless TalkingHeads Tamanna Tankard Tao Cheng Tatou TB1 TBug-634 Tchantches TechnoRat Telecom Ten Terminator Terminator-2294 Terminator-3549 Tequila Tester Thimble Thirty Three Timid Timor Tiso TMTM Tobacco Today Todor Tokyo Tolbuhin Tomato Tony Tony Tormentor Tormentor-205 Tormentor-1072 Totoro Toxic TPE TPWorm Traceback Traceback 3029 Traceback II Traveller Tremor Trident Trigger Troi TSoft Tu-482 Tula Tumen Turbo Tver-308 Twin Peaks Twin-351 Typo Typo Tyst PZPAPN UFA-1201 Ugur Ultimation Under 7 UnExe Unk Urfydus Uruguay Uruk-hai PZPAPN V-1n V-3n V270x V351 V388 V483 V651 V800 V801 V82 V1024 V2000 V2100 V2P2 V2P6 Vacsina Varicell VComm VCL VCS VFSI VHP VHP2 Victor Vinchuca Vindicator Violetta Violite Viper Viperize VirDem VirDem-792 VirDem-1542 Vivaldi VMem Voice-1495 Voodoo Voronezh Voronezh-370 Voronezh-Chemist Vote Vriest VS-2790 VVF 3.4 VX-163 PZPAPN W13 Walker Wanderer Warez-1341 Warning Warrior Warsaw-850 Wave Weak Were Here Westwood Whale Wharps Wild Thing 2 istrover III Windmill WinVir Wisconsin Witch Wit Wizard 3.0 Wolfman Wonder Wonderful WordSwap World Peace Worm-16850 Worm-17690 WW-658 WWT WXYC PZPAPN X-2 X77 Xpeh XPH Xuxa PZPAPN Yafo YAM-3599 Yankee Doodle Yankee 2 Yap YB.Old Scribe Year Youth Yukon PZPAPN Zaphod Zaragosa Zero Bug ZeroHunt Zherkov ZigZag ZK900 ZMT Zoid Zombie Zu1 PZPAPN : 4Res H: &failure; R: 1,049 5: PNAK - 6.55+, n1.04+, 2.10+, V111+, \2.10g+, NAV 3.0A02+, 2.58+, 1.22+, V111+, 2.58+, The 4Res . Its . 4Res is a uof . -and . the 4Res wone . -or . in the the 4Res pof 1,049 at the end of the a. The >and in the DOS not be . The can be in the 5in all "4RESPATH= -SPEC=*. W4RES" jfrequently © of r, the fail to fthe PZPAPN : 5Lo H: Poland R: 1,030 - 1,040 5: PRhE - 3.96+, NAV 3.0+, 1.25+ The 5Lo , and is fPoland. 5Lo is a uof . b5Lo X, the 5Lo at the top of the ', hooking |21. 5Lo pof 1,030 to 1,040 at the end of the a. The >and in the DOS to the >and . The can be in the 5in all 5Lo "92.05.24.5lo.2.23MZ" PZPAPN 10 Past 3 : 10 Past 3 H: keypresses kware devices disabled or interference R: 748 5: PRaCK - , NAV, The 10 Past 3, or 748, was actually }much earlier, in early . 10 Past 3 is a uof . The the 10 Past 3 in low , hooking {21 and 6B. , as measured by the DOS not be the 10 Past 3 , it pof 748 at the end of the a. The in the DOS not be . No in the The 10 Past 3 between 15:10 and 15:13 (3:00PM and 3:15PM) every day, at cause the "Ctrl" or "Shift" keys to be invokes enters a character on the . As a , the character input may not be the same as what the intended. ly, it either disables or interfers the functioning of the devices on the days of any month 1st day of any month - 10th day of any month - 16th day of any month - monitor/ 29th day of any month - On the 22nd day of any month, unexpected &s may of 10 Past 3 are: 10 Past 3-B: A 789 of the 10 Past 3 adds 789 )to the . ,. It the on the monitor: The in the 5in all 10 Past 3-B : Republic Of South Africa PZPAPN : 99% 99 Percent, Traveling Jack H: seconds set to 14 R: 821 - 835 5: PNE - /2.0+, 8/93+, 3.96+, NAV 3.0+, The 99% . Its , but it s to be V. 99% is a uof . 99% is X, the 99% wone . in the Eor in the O's root pof 821 to 835 the end of the a. The >and in the DOS to not be , but the seconds !set to "14". The in the 99% "Het 99%- heeft toegeslagen. . ." is my revenge E.V !" released 6 W\* \" It is what 99% may do of 99% are: 99%-B: in May fthe , 99%-B is a 979 of the 99% . It vone . ain the ever an pof 979 to 993 at the end of the a. The >and in the DOS . The in the 99%-B "\*. *. The 99%-B 5to perform an absolute write : The May, PZPAPN : 302 H: 2; TSR R: 302 5: PRsCK - , NAV, /2.0+, 8/93S+, 8/93+, .2.0+ The 302 . Its . The 302 is a uof . b302 X, the 302 as a low TSR of 864 ). It hooks the 302 , it pof 302 at the end of the a. The >and in the DOS to the >and . No 9ed in the The 302 Nn't do PZPAPN : 310 H: i; write protect R: 310 5: PRaCK - , NAV, The 310 . Its is a uof . The 310 is X, the 310 hooking {21 and 63 in the |area. the DOS the 310 , it X. If X, it the 310 pof 310 at the end of the a. The >and in the DOS the 310 notice fwrite protected write protect Lby DOS. because the Nn't check for the Uand handle PZPAPN : 334 Made H: May, England R: 334 5: PNCK - 3.96+, NAV 3.0+, 8/93+, The 334 in May, . It is England. is a the 334 X, the 334 check the bthree . in the see if it finds the three . `, it wit. completed process, the the 334 of 334 at the end of the a. The >and in the DOS to the >and . No in the The 334 Nn't to do of 334 are: 334-B: on the 334 very . It vone . ain the Nnot `past the bfive in the pof 334 at the end of the a. The >and in the DOS to the >and . The in the "Made in England" : England 334-C: on the 334 is an very minor . It 8the "Made in England" : England May, PZPAPN : 337 V337 H: May, i; TSR R: 337 5: PRsC - , NAV, 1.53S+, The 337 Vin May, . 337 is a uof . . It Nnot The 337 is X, the as a low TSR of 944 mby the 337 is , it by 337 at the end of `. The >and in the not be 337 Nnot do PZPAPN 382 Recovery : 382 Recovery 382, Recovery, 382 Recovery.1 H: b382 )of . spurious Ospinning; &failures Taiwan R: N/A 5: ONAK - , NAV, The 382 Recovery in Taiwan. It is generic uof . -and . the 382 Recovery X, the check the Efor a . has not . If it finds an a, it wit. If the less , the now be 382 were greater not show any always lthe b382 )of the the all . `in the Eare r, the next Xthe `to . `, however, may or may not later of the 382 Recovery #present on a aare the . In cases, the hang upon Z, requiring the to be re &ed. In cases, spurious on the and the not run. Lastly, the may do nothing but leave the Ospinning, requiring the to be powered off and re Occasionally, the 382 Recovery corrupt IO.SYS, one of the hidden :has fthe fail. Since the b382 the `cannot be recovered. The the aare permanently lost. `should be Bd or erased and replaced backup copies to be of 382 Recovery are: 382 Recovery.1: A minor of 382 Recovery gequivalent to the differs by See: Burger PZPAPN : 405 Hammelburg, 405-EST H: 1987 `fail to run; b405 )of . Austria or Germany R: N/A 5: ONC - \, NAV, \, NAV, or The 405 is an in the C: Oroot E. If the of the . less ), the of 405 ;ly cannot recognize are already r, so it attempt to them again. The 405 Nn't carry an >, and Nn't do in the C: Oroot E. However, since it s the b405 )of . `are not recoverable except by replacing them backups or distribution of 405 are: 405-EST: , 405-EST is an of the 405 . The purpose of the alteration is to avoid detection by See: Burger PZPAPN : 408 H: i; unexpected ; write protect Ton write protected R: 408 5: PRfCK - The 408 . 408 is a uof . The 408 is in low be no qby the DOS {80, 82, 83, 85, 88, 89, 8A, 8C, 8E, 91, 93, 95, 96, 98, 9C, 9E, A0, A1, A2, A3, A5, A7, A8, AA, AC, AF, B4, B8, and BB all be mby the 408 is , it wany . by 408 at the end of the be no 3in the >and in the DOS [write protect fwrite-protected require 6line input receive 6line input was not 408 Nnot to do PZPAPN : 422 H: March, `corrupted; 2; TSR; DOS DIR 6output not correct; fail to function R: 422 5: PRsC - 1.22+ The 422 in March, . Its . 422 is a , but not b422 as a low TSR of 1,120 by the the 422 , it one . a DOS DIR X. The 6output of the DOS DIR be affected, usually one . #repeated multiple the 422 pas the where in the middle of the host a. The one exception is were smaller over 65K t. The in the DOS to the >and . No in the the 422 not function PZPAPN : 439 H: Poland R: 439 5: PRhCK - , NAV, 8/93+, .2.0+ The 439 . It is Poland. 439 is a uof . The the 439 the 439 at the top of $the , as qby the DOS @by 2,064 by the the 439 , it pof 439 at the end of the a. The and in the DOS not be The 439 Nn't to do of 439 are: 439-B: gequivalent to the , 439-B is a minor . A couple )differ fthe : Poland PZPAPN : 500 H: R: 500 5: PRaCK - 3.96+, NAV 3.0+, 1.53S+, The 500 uof . b500 Since the Nnot reserve the it occupies, and keep it in may [frequent the 500 , it pof 500 at the "of the . The and in the DOS not be The 500 cannot determine it has , so re `may tof a in an to the PZPAPN : 512 512-A, Number of the Beast H: , 1989 crashes; j; TSR R: 512 5: PRCK - , NAV, : CleanUp, or The 512 is not the same as the Friday The 13th . The 512 , 1989, by Vesselin Bontchev. It zing is run. becoming , any for any reason rif its is at least 512 the 512 crashes due to unexpected T, as well as j. Damage may `if the runs the /F parameter as the of the in the Eentry not match the actual Kspace used. adjust the ing in damaged The of "Number of the Beast" is because the author of the used a signature of 666 near the end of the to determine if the ais already r. Since 512 adds its 5to the end of `, it is easy to verify rby the 512 by checking for signature. of 512 are: 512-B: to the 512 , except the DOS check in the !omitted. The author's signature of '666' has !omitted. 512-C: to the 512-B , minor 512-D: to the 512-C , except no longer checks to see if a ahas the Attribute on it before 512-E: to the , such as on video cards. la 55,104 qby the DOS Nnot use the 666 signature to designate 512-F: , the DOS show any . The "666" signature can be `as offset 1FD. PZPAPN : 557 H: R: 557 - 566 5: PRhE - , NAV, 3.96+, NAV 3.0+, 1.22+, The 557 . Its is a b557 at the top of the qby the DOS @by 624 mby the 557 the 557 , it pof 557 to 566 at the end of the a. The >and in the DOS to the and . One s in all "X[YZ]" The 557 Nn't to do PZPAPN : 572 H: R: 572 5: PRhE - , NAV, 1.53S+, The 572 . Its is a The the 572 at the top of $the , as qby the DOS @by 1,024 {21 and 24 the 572 the 572 , it pof 572 at the end of the a. The >and in the DOS to the >and It is if 572 of 572 are: 572-COD: A minor of the 572 has three differ. May, PZPAPN : 595 H: R: 595 5: PNCK - 2.58+, 1.22+, 2.58+ The 595 . Its . The 595 is a uof . the 595 X, the 595 wone . in the E. If all of the . `in the already r, the search for a . in the Oroot pof 599 the end of the a. The >and in the DOS to the and is one in the It is if 595 PZPAPN : 604 H: R: 604 5: PRhCK - /2.0+, 2.10+, .2.0+, 6.64+ The 604 . Its . 604 is a uof . b604 at the top of the ', not moving |12's , as qby the DOS @by 880 mby the the 604 , it pof 604 at the end of the a. The >and in the DOS not be . No in the PZPAPN : 621 thing H: R: 621 5: PNCK - NAV, The 621 . Its ~are . 621 is a uof . 621 is X, the search the Oand Efor an , it rby the 621 621 at the end of the a. The in the "Water detected in math-co-processor" "PARITY ERROR" halted" thing wonderful has happened, your PC is alive..." It is what 621 PZPAPN : 646 H: R: 646 5: PNCK - , NAV, The 646 . Its is a uof . the 646 X, the wone ain the by 646 the end of the `can be easily identified as always end the hex : "EAF0 s to do nothing except PZPAPN : 66A Satan-B H: failure; "Too many `open" R: 512 5: PNCK - 3.96+, NAV 3.0+, The 66A . Its ~are is a the 66A search the Eto locate all `. As the `are d, the wthem. the 66A pof 512 at the end of the a. The >and in the DOS to the >and The can be in all 66A "66A" The "66A" is used by the to determine if the awas r, and is at the end of the the 66A may fail to or unusual , such as "Too many `open". PZPAPN : 702 H: i; TSR R: 702 5: PRsC - /2.0+, \2.09+, n1.03+, 2.10+, , NAV 3.0A06+, 1.22+, .2.0+, 1.0A06+ The 702 . 702 is a of . it is what picky about what it The the 702 as a low TSR of 944 mby the the 702 , it may pof 702 at the end of the a. The >and in the DOS not be . No the 702 It is if 702 PZPAPN : 708 H: i; TSR; R: 708 5: PRsCK - \2.10g+, 2.11+, 6.64+, 1.25+ The 708 . Its . 708 is a uof . The the 708 the 708 as a low TSR of 1,040 mby the , the wthe copy of in the C: Oroot Eif it was not the 708 , it wthree . in the 708 at the end of the The >and in the DOS to the >and The in the 708 "Bad "C:\ -MAND . The 708 corrupt the corrupted lthe bthree , no . The in the DOS not be Zof one of corrupted hang. PZPAPN : 834 Arab H: i; TSR; ; unexpected Kaccesses to may hang Saudi Arabia R: 834 5: PRsC - , NAV, The 834 . Its is a uof . but not The the 834 the as a low TSR of 1,808 mby the well. At , the access the , altering it. the 834 , it `of a greater 4K in ,, however, not be by 834 ), the at the end of the . The >and in the Eis not by the the 834 may notice unexpected accesses to the executing accesses are the accessing the X, or a by the . The wious copy of the , but has later &the fthe in a hang ring during the &process. of 834 are: 834-B: (Arab) to the are greater 1K in before t. Two 5: "nsed Materi" and " Low TSR is 1,792 PZPAPN : 889 H: March, R: 889 - 903 5: PRhA - 3.96+, NAV 3.0+, The 889 in March, . Its . 889 is a uof . , but not b889 X, the 889 at the top of the ', hooking |21. , as qby the DOS @by 960 |12's not be moved. the 889 , it -and . , but not pof 889 at the end of the by 889 to 903 at the end of the a. The >and in the DOS to the and . No the It is what the 889 may do PZPAPN : 914 Russian Mutant H: R: 914 5: PRhC - , NAV, The 914 . Its . The 914 is a uof . . It Nnot The the 914 at the top of $the |12's not !moved. qby the DOS @by 912 {1C and AC mby the the 914 , it larger 1K in pof 914 the at the end of the a. The >and in the DOS are no in the It is if 914 PZPAPN : 923 Hey You H: may fail to R: 923 5: PRhAK - , NAV, The 923 . Its 923 is a generic uof . -and . The 923 is X, 923 at the top of $the qby the DOS Aby 944 mby the 923 is , it -and . X. If X, it 923 to 942 at the end of the Nnot alter in the 9the is part of the "Hey, YOU !!! thing's happening to you ! Guess what it is ?! HA HA HA HA" may be L, the be terminated and the ed to a DOS prompt. PZPAPN : 981 Joe's Demise H: May, R: 981 - 1,932 5: PRhA - P, NAV 3.0+, 1.53S+, .2.0+ The 981 Gin the in May, . Its is a -and . `, but not b981 X, the 981 at the top of $the |12's not be moved. , as qby the DOS @by 1,952 21 and 22 mby the , the 981 -and . for any reason. . by 981 if the smaller 1,934 by 1,015 to 1,025 ). In both cases the at the end of the adding an )to the a. The >and in the DOS not be One can be din all 981 requires MS-DOS 3.00 or later" It is what the 981 may do of 981 are: Joe's Demise: to the has 11 differ. PZPAPN : 1008 Suomi, Oulu H: i; internal stack halt on Helsinki, Finland R: 1,008 5: PRCK - \, NAV, \, NAV, or The 1008 by Petteri Jarvinen of Helsinki, Finland. It is a u, and s referred to as the Suomi The the 1008 the ing in its increasing by 1,008 ). The ,cannot be seen by doing a if the is present in &ing a rcopy of ,may in an internal stack U, and the #halted. effect was noted on the author's test machine is a XT-clone running Microsoft MS-DOS 3.30. , it wany . X, adding 1,008 )to the . The pcannot be seen by doing a if the is present in PZPAPN 1024 SBC : 1024 SBC Ontario II, SBC H: i; intermittent printing problems; Canada R: 1,024 5: PRhAK - NAV, : CleanUp, or The 1024 SBC . Its ~is Canada. 1024 SBC is a -and . It is on the Ontario The 1024 SBC is at the top of $the ', hooking , as measured by the DOS @by 3,072 12's !moved. At , the ,if it was not lany as the part of the 00h at the end of , 1024 SBC -and . for any reason. and . pof 1,024 be hidden if the . The at the end of the A symptom of a 1024 SBC intermittent printing problems printer. Unlike several hide the the DOS 1024 SBC is an , and no the See: Ontario Ontario III PZPAPN 1024 Print : 1024 Print 1024PSCR H: May, 2; Print failure; R: 1,024 5: PRhCK - , NAV, The 1024 Print in May, . Its and its ~, are is a uof . The 1024 Print X, the at the top $the , as measured by the DOS 2,048 and 21 mby the 1024 Print , it over 1K in for any reason. by 1,024 at the "of the 1024 Print >and in the to the 1024 Print , it interfer the functioning of the Print key. Pressing the Print in a Mof the 's CMOS configuration instead of printing the contents of the PZPAPN : 1067 H: ; TSR; R: 1,067 5: PRhCK - , NAV, The 1067 . 1067 is uof . It is The a 1067 X, the 1067 as a low TSR of 1,808 or 1,856 mby the . Unlike most are TSRs, the tof the in a in increments of 64K. The may be mapped by utilities as an pin the of the in interpretor. the 1067 , it wone . over 3K in in the X. If E, it may 1067 1,067 ). The at the end of the . The >and in the DOS are no in the A symptom of a 1067 Ylarge may fail due to the of large amounts of large . may receive the Ythem: too big to fit in 1067 Nn't to do PZPAPN : 1210 Prudents H: ?, 1989 Kwrite failure; TSR Spain R: 1,210 5: PRE - \, NAV, \, NAV, or The 1210, or Prudents , was }in Barcelona, Spain, ?1989. The 1210 is a between May 1st and May 4th of any year, causing Kwrites to be Kverifies, so writes to the Knever between PZPAPN : 1226 V1226 H: j; spurious Lin place of executing; Ospinning R: 1,226 5: PRhC - \, NAV, 1.53S+, 6.64+ The 1226 by Vesselin Bontchev. is a generic . Nnot ,. The 1226 is a self- encrypting , and simple search algorithms work to detect its presence on a The the 1226 the , reserving 8,192 at the top of 1226 is , the attempt to is at least 1,226 before t. The is rather "buggy" and the process is not always entirely successful. Successfully by 1,226 `multiple s, it is unable to determine ais already grow in by an 1,226 ). Eventually, the . grow too large to fit into the 1226 [unexpected . An effect instead of a executing, a line or two of spurious on the M. Lastly, always indicate l8,192 less is actually on the machine. of 1226 are: 1226-B: , 1226-B is a bug fixed of the 1226 Nnot lthe bugs present in the earlier cause Ming of spurious Nstill re walready `until too large to fit into . It is fairly to 1226D. 1226-B Dropper: is an . drops the 1226-B 1226D: on the 1226 Nnot the jand the Mof spurious . 1226D `over 1,226 , copied, 1226M: (V1226M) to the 1226D , except are not aopen, PZPAPN : 1241 H: i; TSR R: 1,241 5: PRsCK - , NAV, 1.53S+, The 1241 . Its is a uof . b1241 X, the 1241 as a low TSR of 1,584 ), hooking |21. Its TSR may 6data" or as part of the 6interpretor in mapping utilities. the 1241 , it X. If X, it ras well. 1241 pof 1,241 at the end of the be no 3to the >and in the DOS It is what 1241 PZPAPN : 1244 H: i; TSR R: 1,244 - 1,258 5: PRsA - NAV, The 1244 . It is where it was }. 1244 is a uof . -and . `, it Nnot It is on the The the 1244 as a low TSR of 1,440 ). It {08 and the 1244 , it pof 1,244 at the "of the pof 1,244 to 1,258 at the end of the be no 3to the >and in the DOS . One can be dconsistently in the "CONFIG" It is what 1244 of 1244 are: 1244-B: to the 8the "KATALOG". : Poland See: PZPAPN : 1253 Anticad, V-1, ksgiving H: TSR; BSC; Austria R: 1,253 5: PRsBCKX - , NAV, : NAV or `and replace The 1253 . It is believed to ated in (or at least to }in) Austria. 1253 is a generic uof . ,. It vthe Iand the The the 1253 the as a low TSR. The TSR be 2,128 , hooking 13, 21, and 60. remain un 1, and Aby 2,128 ). At , the of the the 1253 . If the J, the the . rif it hasn't r. The 1253 appends its 5to the end of the a, and 2the bfew )of the be a jump to the appended by 1,253 ), and the makes no attempt to hide the fourth through sixth )set to "V-1" (hex 56 2D 31). Any are accessed while the is present in Newly formatted I, likewise, rimmediately. The 1253 is destructive . The author of was able to get it to activate by setting the ?24th and executing an The promptly went and overwrote the entire a pattern of 9 of what s to be a fragment. has started to J, the way to stop the Kactivity is to power off the The in the and/or is of special note. fthe in the , the . At , the resides the top of $the '. The be 77,840 ). It can be seen 6. At , any . the 1253 , even on the before the One effect of Oor floppy is the FORMAT 6may in unexpected Kactivity to inactive Os. For example, on the author's formatting a OC:, was always Kactivity to sthe 1253 requires deleting , the the of any Iexposed to the be dis r. If the not dis r, the promptly fthe J. Dis sthe done in the 's full again It is >s for if it Kif an ?24th fthe PZPAPN : 1260 V2P1, Chameleon Research H: Minnesota, R: 1,260 5: PNC - Encrypting , NAV, 1.25+ : CleanUp, \, or The 1260 not , but is it extremely virulent pd by 1,260 ), and the The encryption key The 1260 is derived fthe is highly modified. was developed as a research by Mark Washburn, who wished to show the community why identification ners do not work in all cases. The encryption used in 1260 is one of many possible cases of the encryption Washburn's later research , V2P2. See: Casper V2P2 V2P6 PZPAPN : 1308 KSpoiler H: i; lost clusters R: 1,308 5: PNCK - , NAV, The 1308 . Its . The 1308 is a of . the 1308 X, the 1308 search the Efor the a. If an , it it. pof 1,308 at the end of the . The >and in the DOS the 1308 may notice increasing numbers of lost clusters clusters may `, and typically in multiples of 10. PZPAPN : 1385 KPlus 1 H: i; TSR; R: 1,385 5: PRsCK - NAV, 3.96+, The 1385 . Its ~are . 1385 is a of . ,. It Nnot, however, wvery small . The the 1385 the 1385 as a low TSR of 3,376 {13, 21, CC, and F8 mby the 1385 , the ,if it was not r, and one in the Oand the 1385 , it X, plus one in the mechanism allows the to spread very quickly. the 1385 pof 1,385 at the "of the . The >and in the DOS . Two in the "c:\ "PATH=" the 1385 It is if 1385 PZPAPN : 1392 Amoeba H: March, TSR; . >s modified Indonesia R: 1,392 5: PRA - \, NAV, \, NAV, or The 1392, or Amoeba, }in Indonesia in March . The 1392 is a and . ,. It copies the b1,089 )of the host ato the end of the s the b1,089 5. An to the end of the a. As `are creation/modification 1to the >the `were Nnot to cause any destructive damage. The s in the is where its of Amoeba was derived "SMA KHETAPUNK - Nouvel Band A.M.O.E.B.A" PZPAPN : 1403 H: R: 1,403 - 1,417 5: PRhAK - 1.53S+, 1.22+, 6.64+ The 1403 . Its . 1403 is a -and . b1403 X, the 1403 at the top of $the ', not moving |12's , as qby the DOS @by 3,296 {08, 12, 13, and 21 mby the the 1403 , it -and . pof 1,403 ). . by 1,403 to 1,417 ). In both cases, the at the end of the a. The >and in the DOS not be . No in the It is what 1403 PZPAPN : 1452 H: i; unexpected R: 1,452 - 1,465 5: PRCK - /, NAV, 1.53S+, The 1452 . Its is a uof . The 1452 is X, the wall . in the C: Oroot The , however, Nnot Later, is re fthe C: O, the as part of the 6interpretor. pof 1,452 to 1,465 at the end of the are no in the 5in the 1452 may [unexpected require 6line input. For example, Zof the DOS EDLIN in the "Invalid ", and the be terminated. It is what 1452 and disrupt operation. See: Antimon PZPAPN : 1575 1577, 1591, Green Caterpillar H: ; sluggishness of DIR "green caterpillar" s on Taiwan Ontario, Canada R: 1,575 5: PRfAk - \, NAV, : CleanUp, or The 1575 }in Ontario, Canada, in !widely reported, and is believed to be fthe Far East, probably Taiwan. It is a uof . -and . `, and the 1575 X, the in 1,760 to 1,840 the top of , but $the is not reserved, and may be later by an mby the the Oroot the 1575 , it wone . one . on the ever a DOS DIR or COPY Nnot spread >and in the DOS to the >and show an pof between 1,577 and 1,591 at the end of la green caterpillar the to the Centipede game creature. of 1575 are: 1575-B: to the 1575 . The major difference is reserves the it occupies at the top of is not moved. 1575-C: to the 1575-B, Xin addition to a DOS DIR or COPY 6is issued. may hang 1575-D: Zof an in the C: becoming r. Later the fthe C: in the becoming are copied (both source and target), or a DIR 6is issued. as Green Caterpillar due to the graphic caterpillar and eat all the fthe 1575-E: Zof an in the C: becoming r. The the next X. Its at the top of the 'is 1,840 ), hooking 1575-E -and . a DOS DIR X, or a by 1,575 - 1,591 at the end of the a. The >and the DOS to the >and has to avoid detection by : Australia 1575-Libin: Fairly in behavior to 1575-E, to avoid detection by utilities. See: Green Caterpillar-1989 PZPAPN : 1605 1605-B, 1600, Anti , Tel Aviv H: i; TSR; slowdown R: 1,605 5: PRsA - , NAV, : NAV, or The 1605 was uploaded to John McAfee's Homebase BBS by an anonymous . The . The 1605 is a uof . `, and it Nnot ,. It is roughly on the The the 1605 the as a low TSR of 1,728 {13 and 21 mby the . At , the slowdown by 15-20%. becoming , any . -or . rby the by 1,605 )in all cases at the "of the a. . by between 1,601 and 1,610 at the end of the replicating, it is carries any damage potential. of 1605 are: 1605-B: by MicroCom in London, England in March in a plain envelope a London postmark. The label on the Jread "Solomon is not related in any way to Dr. Solomon. very to the 1605 . The major difference is by 1,605 to 1,619 See: PZPAPN : 1661 Cascade.1661, Turkey H: i; TSR Turkey R: 1,661 5: PRsCK - n, NAV 3.0+, 30.00+, 8/93+, The 1661 , in Istanbul, Turkey. 1661 is a uof . `, it The 1661 is X, the as a low TSR of 2,000 mby the , 1661 X. If X, it by 1,661 at the end of the It is what 1661 of 1661 are: 1661-B: as Turkey, Turkey in . It is to the to avoid detection by familiar 1661. : Turkey 1661-C: }in Turkey in It is to 1661-B. : Turkey See: Cascade PZPAPN 1689 : 1689 H: March, R: 1,689 5: PRhAK - 3.96+, NAV 3.0+, /2.1+, .2.0+, The 1689 in March, . Its . 1689 is a -and . b1689 at the top of $the ', hooking {21, 22, and 2F. , as qby the DOS @by 1,728 |12's !moved. the 1689 , it and . pd in by 1,689 ), but the is hidden by the it is . The >and in the DOS not be Two in the "5V3" The DOS Ton all . The attempt to hide the aalterations so utilities perform CRC or checksumming not detect alterations on 1689 is active in PZPAPN : 1720 PSQR H: March, : TSR; . damage on Bd on Friday the 13th Spain R: 1,719 - 1,733 5: PRsA - , NAV, : NAV, or The 1720, or PSQR , is a of the was }in Barcelona, Spain, in March -and . unlike , it woverlay not be The X, the as a low TSR of 2,048 mby 1720 in the 1720 , it by 1,720 ), and the at the "of the by 1,719 to 1,733 ), and the the end of the a. In both cases, be no 3to the >and in the DOS E. All can be easily identified as the character "PSQR", is the tmarker for On Friday the 13th, the 1720 activate the X, it K. More damaging, however, is the 1720 check to see if the has a O. If a Ois present, the and ing in all data on the Kbecoming . The to hang. of 1720 are: 1720-B: }in Spain in to the . The encryption used in the !slightly modified, most detect out any problem. See: PCBB PZPAPN : 1784 H: : . R: 1,784 5: PRhAK - \2.10g+, V111+, n1.04+, 2.10+, 2.58+, 6.60+, NAV 3.0A06+, V111+, 2.58+, 6.64+, 1.25+, 3.0A06+ The 1784 . Its is a of . -and . b1784 X, the 1784 at the top of $the ', not moving |12's , as qby the DOS @by 2,304 mby the , the ,if it was not the 1784 , it -and . , but not copied. pof 1,784 at the end of the a. The >and in the DOS . No in the It is what 1784 PZPAPN : 1804 H: : . Germany R: 1,804 - 1,805 5: PNE - \2.09+, 6.55+, 2.53+, 30.00+, NAV 3.0+, 2.10+, n1.04+, 2.53+, 1.22+, .2.0+, 6.64+ The 1804 fGermany in . 1804 is uof . the 1804 X, the 1804 wone . in the usually pof 1,804 be 1,805 ). The at the end of the a. The >and in the DOS to the >and . No are in the It is what 1804 PZPAPN : 1835 H: R: 1,835 5: PNE - , NAV 3.0+, /2.1+, .2.0+, The 1835 . It is a uof . and is very roughly on the Yankee Doodle . The sample has ated the 1835 X, the 1835 wtwo . in the pof 1,835 at the end of the a. The >and in the DOS not be Two in the can be "*.exe *.*" It is if 1835 PZPAPN : 1840 H: i; TSR; Write protect R: 1,838 - 1,891 5: PRsAK - , NAV, The 1840 }and . Its . 1840 is a uof . and . The 1840 is X, the as a low TSR of 2,144 mby the , 1840 X, it by 1,838 to 1,891 ). The at the end of the Two in the can be "NV71. -MAND" It is if 1840 PZPAPN : 1963 V1963, 1963 OverWrite H: May, R: 1,963 5: PRsAK - , NAV, The 1963 in May, . Its . 1963 is a of . -and . , it hides its regardless of whether the . It is related to the The the 1963 the as a low TSR of 5,136 mby the mark its TSR as " is in fact reserved. 1963 is , it -and . over 1,963 X. The vthe by writing the b1,963 of the end of amark, and copying into the b1,963 )of the a. (. lthe b2,475 )of the , the difference is due to the . Wheader.) do not in the DOS Zof the DOS #detected. regardless whether the 1963 is capable of dis on the fly. As a unaware of be unable to locate it on using CRC or checksumming techniques. Further, Zof an unaware of 1963 in all becoming It is what 1963 of 1963 are: 1963-B: in May, V. 1963-B is in behavior to 1963. The primary difference is are 48 differ fthe See: Cracker Jack PZPAPN : 2153 H: i; TSR R: 2,153 - 2,217 5: PRsA - \2.09+, 30.00+, n1.03+, 2.10+, The 2153 . Its is a -and . . It Nnot The the 2153 the 2153 as a low TSR of 2,672 mby the the 2153 , it pof 2,153 to 2,168 pof 2,203 to 2,217 ). In both cases the at the end of the a. The >and in the DOS not be It is what 2153 PZPAPN : 2559 Yaunch H: j; unexpected Kaccess to R: 2,559 - 2,933 5: PNE - /, NAV, The 2559 xabout its is un . 2559 is a uof . 2559 is X, the search the Efor a candi If one is d, it wit. If not, it search the B: and C: Estructures for a candi , and 2559 of 2,559 to 2,933 ). The at the end of a 2559 tare large . fail to s due to the having al a large amount of host Xby the . The isn't released until the host completes jmay PZPAPN : 2560 Magnitogorsk H: R: 2,560 5: PRhA - , NAV, The 2560 . It is fthe is a uof . -and . `, it Nnot The the 2560 2560 at the top of but $the |12's is not moved. {08, 13, 21, and 22 mby the , as measured by the DOS Aby 5,184 becoming , 2560 -and . over 3K in for any reason. pof 2,560 at the end of the a. The >and in the DOS not be The DOS EDLIN fail to function 2560. YEDLIN in the "Invalid L, and EDLIN terminate leaving the at a DOS prompt. 2560 is a . While it Nnot hide it's p, it Nactively employ techniques in order to avoid utilities are unaware of it. It is what 2560 of 2560 are: 2560-B: in May, V, 2560-B's major difference f2560 is ,the p, regardless of whether the 2560-C: in May, V, 2560-C's is very to 2560-B. Magnito-3000: on the 2560-C , Magnito-3000 is a 3,000 of the . Its 6,064 ), hooking {08, 13, 21, and 22. It -and . X, copied, or for any reason. pof 3,000 be hidden the . The at the . The >and in the DOS not be . The in the -MAND" "AND" Magnum: on the 2560-C , Magnum has avoid #detected by . It reset the >to 1-03-1988 it is . The the "Mr. Lozinsky Just read document on your AIDSTEST (1-Jan-91 ) we release new . (C) TeleFucks, Ltd See: Magnitogorsk 2048 PZPAPN : 2623 H: May, R: 2,623 - 2,633 5: PRhE - /2.0+, 3.96+, NAV 3.0+, 8/93+, .2.0+ The 2623 in May, . Its ~are . The 2623 is a of . The the 2623 at the top of $the , as qby the DOS @by 2,864 {21, 22, and 2F by the |12's !moved. , the 2623 wa randomly selected . in the the 2623 , it intermittently wone . in the the 2623 pof 2,623 to 2,633 at the end of the a. The >and in the DOS are no in the in 2623 It is what the 2623 PZPAPN 3040 : 3040 3040 H: R: 3,040 - 3,183 5: PRaA - NAV 3.0+, 1.25+ The 3040 . Its . 3040 is a uof . -and . , but not ,. It uses techniques to avoid detection. The the 3040 at the top $the as the Nnot allocate the where it resides. to the the 3040 , it may of the . -and . in the pof 3,040 to 3,183 at the "of the a. The >and in the DOS to the >and . No in the The portion of the performs the function to avoid the detection of . It effectively on the fly are read into , thus avoiding locating the 2due to PZPAPN 3445- : 3445- 3445 H: R: 3,445 5: PRhA - NAV 3.0+, The 3445- , or 3445, . Its . 3445- on all configurations, and on most Zof an in a hang. It is a uof . employs techniques to avoid detection. The the 3445- X, one of two things happen. On most , the be hung, and the lto re &the , the 3445- , it at the top of $the and , as qby the DOS @by 3,488 |12's !moved. The 3445- 21 at the top of |01 in low the 3445- , it and . , but not copied. In the case of copying, both the source and target the 3445- pof 3,445 not be in the DOS if the . The at the end of the . The >and in the DOS of a 3445- tare the DOS indicate Ton all the in a hang. PZPAPN : 4096 FroDo H: W, & overlay i; TSR hides crosslinks; :of data Israel R: 4,096 5: PRsA - , NAV, : CleanUp, \, NAV or The 4096 considered a it is almost in to the The 4096 W, and Overlay `, adding 4,096 the in a into , it execu oif it is COPY or XCOPY is destructive to both data `and execu as it very slowly cross-links `on the K. The cross-linking s so slowly is a kware problem, the #almost in . The cross-linking of `is the of the manipulating the FATs, changing the number of , as well as the issuing think llost cross-linking if the is in As a side note, if the is present in and you attempt to copy `, the new copy of the not be if the new copy Nnot lan execu extension. Thus, one way to dis is to copy off all the a non-execu aextension (i.e., don't use . -, .SYS, etc.) while the is active in power off the and re fa write-protected, &ed and the is not in Bthe `and copy back the Ito the execu s and extensions. The wthe , if done correctly, but still leave the problem of cross-linked are permanently damaged. On or 22 of any year, the 4096 s to be a "bug" in the it goes into a consuming loop. The 4096 in its 5; however, it is never written out to the . Moving to the of a Jand re &ing the in the "FRODO LIVES" 22 is Bilbo and Frodo Baggin's birthday in the Lord of the Rings trilogy. An important note on the 4096 data s, the data to be fine on . However, is later now be corrupted and unpredic s may of 4096 are: 4096-B: to the 4096 , the main encryption mechanism has 1in order to avoid detection. 4096-C: of 4096 is to the . The major difference is the DOS not show any cross-linking of lost clusters. A symptom of Kspace according to a DIR be more Kspace according to the DOS 4096-D: of 4096 is to the 4096-C in behavior. The major difference is it has !modified to avoid detection by anti- utilities. 4096-E: of 4096 is to the 4096-C in behavior. The major difference is it has !modified to avoid detection by most anti- utilities. Its is 5,648 PZPAPN 4870 : 4870 4870 H: fail to R: 4,870 5: ONAK - , NAV 3.0+, 1.25+ The 4870 . It's is not -and . the 4870 the search the Efor an or . a. The bsuch rby the lthe b4,870 )of the candi by the . If the was 4,870 )or more, be no pin the in the DOS E. If the was less 4,870 in the DOS now be 4,870 ). The in the not be the 4870 checked for a w, and rthe candi if one was d, the terminate and to a DOS prompt. A side note on : the is compressed Wutility, accounts for much of the 4,870 lthe markers of din the b4,870 )of the It is not possible to dis the 4870 as the b4,870 )of the are lost. must be Bd or erased, replaced clean copies. PZPAPN : 5120 VBasic , Basic H: May, West Germany :; unexpected Kactivity R: 5,120 5: PNAK - \, NAV, \, or The 5120 }in May, . It is a non- generic -and . is was written in compiled Turbo Basic assembly language. X, the 5120 -and one . aon the Oand E, followed wone randomly selected . -or . Eon the 's C: by 5,120 ). . rby the 5120 by between 5,120 and 5,135 Unlike most of the MS-DOS es, the 5120 Nnot intercept Kwrite . Thus, may notice Kwrite no access should be ring for a O, such as the C: Data `may corrupted on , and cross-linking of `may The can be 5120 near the end of the "BASRUN" "BRUN" "IBMBIO. "IBMDOS. "Access denied" is one of the 5120 Nnot , but be ls in a very manner. second is not qhere as the author Nnot la copy. PZPAPN : 7808 H: May, "Not enough R: 7,808 5: PNA - , NAV, 1.25+ The 7808 in May, . Its . 7808 is a uof . . It Nnot 7808 is X, the search the Oand Efor a . -or . w. It wthe -or . it finds in the by 7,808 ). The at the >and in the DOS to the >and The in the may be re rby 7808. s, an 7,808 to the 7808 may in the "Not enough L, and the Yterminating. in the not be r. An symptom of 7808 take longer to load Xdue to the searching the >and in the PZPAPN : A&A H: R: 506 5: PRxC - 3.96+, NAV 3.0+, 1.22+, 6.64+ The A&A , and is . A&A is a uof . , but not ,. It uses a tunneling technique to avoid detection by monitoring bA&A X, the A&A in a "hole" in low al , hooking |21. , as qby the DOS not be the A&A , it pof 506 at the "of the a. The >and in the DOS to the >and . The can be in the 5in all A&A "{A&A}" It is what A&A may do PZPAPN : ABC H: keystrokes repeated; R: 2,952 - 2,972 5: PRhE - , NAV 3.0+, 1.22+, The ABC . It is the . ABC is a uof . alter . The the ABC X, the ABC at the top of $the ', hooking {16 and 1C. , as measured by the DOS , but 8,960 ). The copy of ed to by the -SPEC en mental variable may the ABC , it wor alter . and . X. . are not rby the , but may be , adding 4 to 30 may be rby the , adding 2,952 to 2,972 the end of the a. . are not rmay be , adding 4 to 30 . The in the DOS to the >and awas in the , but the in the "ABC_FFEA" "Minsk 8.01.92" "ABC" the ABC [keystrokes on the are frequently repeated, as well as ring of ABC are: ABC-2918: A of ABC, is 8,960 ), hooking {16, 1C, and 60. It adding 2,918 to 2,927 . The at the end of the a. The and in the DOS to the >and . Like the alters . , adding 4 to 16 The same in the are ABC-2918B: to ABC-2918, ABC-2918B is a very minor PZPAPN Abraxas 5 : Abraxas 5 H: fail to graphic "ABRAXAS" and noise on speaker; 2; C:\DOS\DOSSHELL. -created R: 1,171 5: ONA - 30.00+, NAV 3.0+, 2.58+, V112+, V106+, 2.58+, 1.25+ The Abraxas 5 . Its . Abraxas 5 is a -and . , but not the Abraxas 5 wthe copy of DOSSHELL. in the C:\DOS E(creating the aif it Nn't exist), as well as one in the E. Due to a bug in the in any by the Abraxas 5 the Abraxas 5 1,171 , and 9the Abraxas 5 5. The >and in the DOS be set to the >and The can be in the 5in all Abraxas 5 "*.exe c:\dos\dosshell.com .. MS-DOS (c) "->>ABRAXAS-5<<--" "...For he is not of "...Nor he of mind" the Abraxas 5 in the Mof a graphic "ABRAXAS" on the accompanied by an ascending scale #played on the speaker. PZPAPN : Acid H: fail to R: 792 5: ONAK - The Acid . Its . Acid is a -and . the Acid wall of the . in the E. Later, if an X, it start sthe . in the the Acid lhad the )of the host the Acid be no punless the was smaller ), in case it 792 . The >and in the DOS not be . The can be din all Acid too big to fit in "Acid "Legalize ACiD and Pot" "By: Copyfright Corp-$MZU" PZPAPN : Ada H: i; slow clicking speaker; Argentina R: 2,600 5: PRsCK - , NAV, The Ada Gin Argentina in . Ada is a uof . The the Ada Ada as a low as measured by the DOS @by 21,296 to 21,312 {08, 13, and mby the Ada is , it are X. If X, it of 2,600 at the be no 3in the >and in the DOS E. The can be "PCCILLIN. "PCCILLIN.IMG" "HATI-HATI !! ADA VIRUS DISINI !! [a slow clicking sound emitted fthe speaker. clicking occasionally 3in pitch. The receive a " Kfull" even Kthe to write to is not actually full. PZPAPN Adolf Hitler : Adolf Hitler Adolf H: R: 475 5: PR?CK - 3.96+, 8/93+ The Adolf Hitler, or Adolf, Its d due to a s in the . It should not be confused the Adolph is no relationship between the two es. Adolf Hitler is a uof . bAdolf Hitler in a "hole" in low , hooking |21. , as qby the DOS not be the Adolf Hitler , it pof 475 at the end of the a. The in the DOS to the >and . The in the 5in all Adolf Hitler "Adolf Hitler" PZPAPN Adolph : Adolph H: May, R: 2,109 - 2,445 5: PNCK - \, NAV, 6.55+, 1.25+ The Adolph Vin May, . Adolph is a uof . ,. Adolph is a of V2P6. Adolph is X, the search the Efor an w. If an d, it Adolph by 2,109 to 2,445 at the end of the It is if Adolph See: V2P6 PZPAPN African 109 : African 109 H: Republic of South Africa R: 109 5: PNCK - /, NAV, The African 109 in the Republic of South Africa by Oliver Steudler and Peter Stoffberg of the Resource Centre. African 109 is a uof . African 109 is X, the African 109 wall `in the E. If ,happens to be in ras well. African 109 of 109 ). The at the "of the a. The >and in the DOS to the >and . One can be din the African 109 Nn't do PZPAPN Agena : Agena H: Spain R: 723 - 738 5: PRhAK - \2.10g+, /2.1+, 2.58+, 2.11+, 6.64+ 2.58+, 6.64+, 1.25+ The Agena Gin Spain in . Agena is a uof . -and . the Agena the Agena at the top of $the , as qby the DOS @by 1,296 {20 and 21 mby Agena in the Agena , it pof 723 to 738 at the end of the a. The >and in the DOS . No in the It is what Agena may do PZPAPN : Ah Tuesday, David-1173 Research H: May, Kformat; Italy R: 1,173 5: PRhC - , NAV, The Ah, or Tuesday, in May, . Ah is the V1024 , its is Italy. Ah is a very buggy Ah is X, Ah at the top of , but qby the DOS Aby 1,216 {08 and 21 mby the Ah is , it over 1K by 1,173 hidden if Ah is >and in the DOS to be un if the was 12:00a, it now be blank. The at the [frequent Ah. frequently is very noticeable. The Ah on Tuesdays, at attempt to format the bfew tracks of the Ah can be easily identified as 9the "(C) David Grant Research PCVRF Disribuite ely!!! ...ah...John...Fuck You!" Ah is believe to !created by the same person as several fItaly, oSmack and Enigma. David Grant and the PCVRF had nothing to do its creation. of Ah are: Ah-B: to the wan . . It 8the same as the See: Alfa V1024 PZPAPN : AIDS Hahaha, Taunt, VGA2CGA, Burger.Pascal H: 1989 R: N/A 5: ONA - /, NAV, The AIDS as the Hahaha referred to as the Taunt by IBM, is a generic . , it Ms the "Your computer now has AIDS", AIDS covering about half of the . The halted, and must be powered down and re &ed to restart it. Since s the b13,952 )of the execu , the `must be Bd and replaced clean copies in order to remove the . It is not possible to recover the portion of the Note: is NOT the Aids Info K/PC Cyborg Trojan. of AIDS are: AIDS B: Very to the AIDS 13,952 . Unlike the `, as well as ,, and Nnot activate as the did. Instead, occasionally issue the "I/O U99, PC=2EFD aborted". AIDS- }at several locations in the May, of the AIDS avoid detection by utilities. Among the to the less two sub Fories on the jmay X, as well as the video mode may be switched to 25 x 40 Black & White fcolor mode. May, See: Number One PZPAPN AIDS II : AIDS II Companion Endangered H: Creates . `; melody; R: 8,064 5: SNA - Spawning , NAV, 1.22+, Bcorresponding . The AIDS II , or Companion , was }for the . Unlike generic us, the AIDS is the to employ what could be called a "corresponding atechnique" of target . ais never 1. The takes advantage of the DOS feature where if a exists in both . -and . Wform, the . The AIDS II Nnot actually `, instead it stores a copy of the in a corresponding . tries to Yone of his . The . aand the . both lthe same base The method of tis as follows: X, since a corresponding . aexists, the . 9ing the X. The blocates an ain the Eand creates a corresponding (or companion) . always be 8,064 =of the t. The . ais not at all. creating the new . a, the plays a melody and Ms the "Your computer is Aids - Signed WOP & PGT of DutchCrack -" The AIDS II spawns to the . to be X, and the runs out problem. completion of the , control s to the AIDS II . The melody is played again "Getting used to me? Next , use a Condom Since the aremains un , CRC checking cannot detect having One way to manually remove the AIDS II is to check the for lboth an . Wand a . the . ahaving a of 8,064 ). The . `thus identified should be erased. The do not in the PZPAPN AirCop 00$ Q 0PT$ : AirCop H: Washington, BSC; halt; Taiwan R: N/A 5: FR - Floppy \, NAV, : CleanUp, M K, or DOS SYS The AirCop Gin the State of Washington in the early ts of however, !traced back to Taiwan, and Taiwan is probably where it ated. AirCop is a u, and it w360K 5.25" floppy AirCop , the . The AirCop at the top of high . The Aby 1,024 the AirCop . AirCop hooks AirCop is , any non-write protected accessed the AirCop . AirCop copy the 719 (Side 1, Cyl 39, 9 on a normal 360K 5.25" J) and replace the a copy of the . If a of a AirCop is viewed, it be missing almost all of the normally in a normal . The remaining "Non- just before the end of the The AirCop do one of two things on depending on how compatible the 's software and kware is . On most , the at random intervals: "Red State, Germ Offensive. AIRCOP." , the #present in the receiving a Stack Overflow Uand the #halted. In case, you must power off the in order to be able to AirCop Nnot AirCop can be removed bpowering off the and re &ing clean, write-protected DOS J. The DOS SYS 6should be used to replace the . Alternately, M Kcan be used cthe power-down and re of AirCop are: AirCop-B: in May, fthe , AirCop-B is of the AirCop . Like the , it vfloppy . The Stack Overflow Uand halt no longer . AirCop-B during the month of , and &ing rfloppy in a flashing, scrolling Mof the is Aircop" The proceed. AirCop-B has to avoid detection by utilities. Utilities can detect AirCop may not be able to detect PZPAPN Akuku : Akuku H: Unexpected Oaccesses R: 891 5: PNAK - /2.0+, 3.96+, NAV 3.0+, n1.04+, 8/93+, .2.0+ The Akuku , and comes is a uof . and . Akuku is X, the wthree in the E. If three cannot be din the E, the search the Eof the O, as well as the C: O. Both . -and . r, as well as smaller not be by 891 to 907 ), the at the end of the The >and in the not be the The in the 5, and can be din all "A kuku, Nastepny komornik !!!" fail to the Akuku Man " and terminate Ythem. of Akuku are: Akuku-3: gequivalent to the Akuku has three differ. It switch to the C: all the candi `on the Columbus: on the Akuku , Columbus is an of the . It wone . in the ,. Columbus pof 512 at the end of the a. On 12th, of an in the #repeatedly Lon the monitor while the reads the entire "Columbus Raped America. Now I Rape your The is not `as it is in the 5. The in the -Berlin, Md" "NOT!! The procedure is a bit off. Hehe" : Maryland, Cop-Mpl: Cop-Mpl is a of the Akuku . It wthree . -or . X. If the not find three won the O, it search and in the C: structure. Cop-Mpl pof 1,113 to 1,128 at the end of the a. The can be in the "Sorry, I'm copmpletly dead." Cop-Mpl may [very long loads, or Ohas unexpectedly to the C: Metal Thunder: Metal Thunder was May, fItaly. by 892 to 908 Unlike the , Metal Thunder in the X. The "(c) by Metal Thunder IVRL MI" the Metal Thunder [frequent : Italy May, Wilbur: on the Akuku , Wilbur is an the . It wone . in the ,. Wilbur pof 512 at the end of the Wilbur lthe "Wilbur sez Hi!" The is not `as it is May, Wilbur-B: on the Wilbur very minor . The in the "Wilbur sez Hi!" : Berlin, Maryland 7Apr92" : Maryland, Wilbur-C: on the Wilbur to avoid detection. The in the "Wilbur sez Hi!" : Berlin, Maryland 7Apr92" : Maryland, Wilbur 2: on the Wilbur-C of Wilbur adds 512 )to the . are two distinct s of the may be fa Wilbur 2 sample. The Mthe "Wilbur sez Hi!" The second Mone of the "I am not an Animal. I am a Human "I am not an Animal. I am Wilbur!" "I am not Akuku. I am a Human "I am not Akuku. I am Wilbur!" The in the "I am not" "I am" "Wilbur sez Hi!" "Akuku." "an Animal." "Wilbur!" "a Human : Maryland, Wilbur 3: on the Wilbur 2 in the Spring of any year, primarily during the month of . In Zof an may in the repeatedly, scrolling down the , while the accesses the "Wilbur sez: Formatting your K. Please stand by." The Nn't actually format the the sample tested. The is not as it is : Maryland, PZPAPN Alabama : Alabama Endangered H: , 1989 (see ; FAT Israel R: 1,560 5: PRfET - , NAV, : CleanUp, \, or The Alabama }at Hebrew University in Israel by Ysrael Radai in , 1989. Its was on 13, 1989. The Alabama increasing by 1,560 ). It however, it Nn't use the normal TSR function. Instead, hooks {09 and 21 in a CTL-ALT-DEL combination is detected, the causes an apparent &, but remains in RAM. The loads 30K under the highest location reported by DOS, and Nnot lower the amount of reported by the BIOS or by DOS. for one hour, the in a flashing box: "SOFTWARE COPIES PROHIBITED BY INTERNATIONAL LAW Box 1055 Tuscambia ALABAMA USA." The Alabama uses a complex mechanism to determine whether or not to wthe b, it checks to see if ain the E, if is one it vit. are no `in the Eis the r. However, s instead of sthe candi a, it instead manipulate the FATs to ex 3the candi out renaming it, so the ends up thinking he is executing one in effect he is actually executing an one. The end are slowly lost on aswapping the on ANY Friday. PZPAPN Alameda : Alameda Mazatlan, Merritt, Peking, Seoul, Yale H: 1987 Floppy &failures; -TOM; BSC California, R: N/A 5: RtF - Floppy , NAV, K, CleanUp, \, NAV, or DOS SYS The Alameda Gat Merritt college in Alameda, California in 1987. The caused no intentional damage, is now at least one now causes floppy Ks to &able a counter has r Qed its limit (Alameda-C The Alameda , and its , all a CTL-ALT-DEL and 5-1/4" 360K es do stay in through a warm re &, and wboth and non- Ks. can be ron a warm &even if BASIC is loaded instead of DOS. The saves the real at track 39, 8, head 0. The of the Alameda would run on a 8086/8088 machine, later s can now run on 80286 of Alameda are: Alameda 1.2M: }in the of Alameda is able to w1.2M 5.25 inch Iin addition to 360K 5.25 inch I. The hang computers using an 8088 processor , allocating 1,024 at the top of $the |12's moved. It Iin the A: performs a CTL-ALT-DEL key combination. Golden Gate: The Alameda a modification so the counter in the has determined it has r500 I. Upon the C: Ois formatted. The counter in the is reset on Qnew : California, 1988 Golden Gate-B: Same as Golden Gate, except the counter has f500 to 30 ts before and Iare Golden Gate-C: Same as Golden Gate-B, except can the Mazatlan , and is the most dangerous of the Alameda : A modified of the Alameda the counter in the has determined it has r100 I. Upon , the Jin the floppy Ois reformatted. The SF v5-1/4" : California, ?, 1987 PZPAPN Albania : Albania Albania-429, Albania-506, Albania-575, Albania-606 H: failure; R: 429 - 606 ), depending on present 5: PNCK - , NAV, Albania is actually a ]of four were (. All of are us of . general behavior is specific xlisted under one of the Albania es is the Albania wone . in the E. If it may r. The pfor Albania depends on the Albania present, but the always be at the end of the . The >and in the DOS to the >and The can be din all regardless of the present: "PATH=" It is if Albania of Albania are: Albania-429: The smallest of the Albania adds 429 )to the . 9the "ALBANIA" in addition to the Albania-506: Albania-506 adds 506 )to the . v. Like Albania-429, the "ALBANIA" can be din all addition to the Albania-575: Albania-575 adds 575 )to the . v. In addition to the for all members of ], the "albania" the Albania-575 may notice fail to , or random may be jmay Albania-606: Albania-606 adds 606 )to the . v. Unlike members of ], it Nnot always X. It 8the "albania" in addition to the PZPAPN Albanian : Albanian H: May, R: 1,991 5: PRhAK - NAV 3.0+, 1.22+, The Albanian in May, . Its . Albanian is a uof . -and . the Albanian the Albanian at the top of $the '. It Nnot move |12's measured by the DOS @by 2,000 {08, 17, and 21 mby Albanian in , the ,if it was not the Albanian , it for any reason. pof 1,991 at the end of the a. The >and in the DOS to 12/17/89 7:21p. The can be in the "C:\ It is what Albanian PZPAPN Alex-368 : Alex-368 H: R: 368 5: PNC - 3.96+, NAV 3.0+, The Alex-368 . It is fthe . Alex-368 is a of . , but not the Alex-368 wall . larger in the pof 368 the end of the a. The >and in the DOS to the and . The can be in the 5in all Alex-368 "The One Night (c) Alex Hacker" PZPAPN Alexander : Alexander H: Romania R: 1,951 - 1,965 5: PRhAK - , NAV 3.0+, 1.22+, The Alexander . It fRomania. Alexander is a uof . and . The the Alexander X, the Alexander at the top of $the , as qby the DOS @by 3,088 {08, 21 and 27 mby Alexander in the Alexander , it and . copied, or for any reason. by 1,951 by 1,951 to 1,965 ). In both cases the at the end of the a. The in the DOS not be . The in the 5in all "ALEX0302" The in the , and hence not "Apa depistata in microprocesor Functionarea poate fi compromisa Se recomanda oprirea calculatorului citeva ore pentru uscare" "Alexander" "Constanata" "Romania" It is what Alexander See: CB-1530 PZPAPN : Alfa H: (for R: Varies (see 5: PRhAK - 8/93S+, NAV 3.0+, The Alfa is actually two closely related similiar characteristics. The two es, Alfa-1150 and Alfa-1202, Ctogether differences ed out under the " " section. Both es were , and The an Alfa X, it at the top of $the '. Depending on is present, , as determined by the DOS Aby either 1,280 or 1,344 mby the at the top of , as well as min graphic card an Alfa , it and . small . `. The ps are given Qof the es. In the case of both es, the at the end of the be no 3to the >and in a DOS in the It is if Alfa of Alfa are: Alfa-1150: Alfa-1150, or Yankee Doodle-1150, is the earlier of the Alfa . It adds 1,150 to 1,165 `. . rby the , adding an 1,152 1,280 Alfa-1202: Alfa-1202, or Yankee Doodle-1202, is the later of the Alfa . Unlike Alfa-1150, it not re `. It adds 1,202 to 1,217 is 1,344 Alfa-1712: Alfa-1712 is an of the Alfa at the top of but $the ', not moving |12's by 3,008 ), and , it -and . X, adding 1,712 to 1,731 The at the end of the a. The >and in the DOS 1to 14-25-12 12:01a. Alfa-Tired: The Alfa-Tired, or Tired, is an of the Alfa . It at the top $the ', not moving |12's @by 3,760 ), and , it X, adding 1,748 to 1,766 . The the end of the a. The >and in the DOS not be Rust: The Rust . It , as qby the DOS @by 2,048 ), and mby the be used by the , but not be mapped by most mapping utilities. , Rust X, adding 1,710 to 1,725 )to the . The at the end of the a. The >and in the DOS not be . Rust plays a three note melody Ys a See: Ah Damage Gremlin Lucifer Newcom V651 V1024 PZPAPN All Sys 9 : All Sys 9 H: i; TSR; "Abort, Retry, Ignore ?" &s; unexpected beeps on speaker R: 1,838 - 2,088 5: PRsAK - 6.55+, 2.53+, /2.1+, NAV 3.0A06+ 2.53+, 1.22+, .2.0+, 6.64+ The All Sys 9, or IOU, . Its . All Sys 9 is a uof . -and . The the All Sys 9 as a low TSR of 2,576 ). It , All Sys 9 -and . pof 1,838 to 1,863 at the "of the pof 2,080 to 2,088 at the end of the a. . may be re rby the , adding an 2,080 t. The in the DOS not be . The can be in the 5in all All Sys 9 "All 9 - (c) , Jerry C." "Parity Uat address 14344" "Abort, Retry, Ignore ?" All Sys 9 may [the "Abort, Retry, Ignore ?" pressing any key on the in a &. Beeping be emitted fthe speaker. PZPAPN Alpha-743 : Alpha-743 H: March, R: 743 5: PNCK - \2.09+, 30.00+, n1.03+, 2.10+, , NAV 3.0A06+, V116+ The Alpha-743 in March, . Its . Alpha-743 is a uof . the Alpha-743 X, the Alpha-743 wone . in the E. If an Nnot exist in E, a hang accessing the the Alpha-743 pof 743 at the end of the a. The >and in the DOS not be . The in the 5in Alpha-743 "*.com *.*" PZPAPN Ambulance Car : Ambulance Car Ambulance, RedX H: i; graphic M& sound West Germany R: 796 5: PNCK - \, NAV, : NAV, or The Ambulance Car }in West Germany in is a the Ambulance Car the attempt to wone . a. The . ato be on the C: one . ain any E, and never the ain the E. It avoids ais normally the ain the root On a random basis, the effect of a graphics Mof an ASCII block drawing of an ambulance moving across the bottom of the graphics be accompanied the sound of a siren played on the 's speaker. Both of effects a graphics capable Madapter. of Ambulance Car are: Ambulance Car-B: to the Ambulance Car, wzero, one, or two . (s) on the pof 796 the end of the are seven differ between and the RedX-Any listed RedX-Any: on the Ambulance Car, the Ambulance Car graphic its accompaning siren X. It vone . on the path and may See: Hafenstrass 2 PZPAPN Amstrad : Amstrad H: , 1989 Portugal R: 847 5: ONCK - , NAV, \, or The Amstrad breported in , 1989, by Jean Luz of Portugal; however, it has of in Spain and Portugal for a year prior to . The is a generic . u, but is not . It ,. It is the Pixel Amstrad is X, the Amstrad wthree . in the `not by the The carries a fake advertisement for the Amstrad computer: "=!= Buy AMSTRAD it is THE CHEAPEST -PUTER you can buy" The Amstrad Nn't do of Amstrad are: Amstrad-End Is Near: The Amstrad-End Is Near is very to the Amstrad . The major difference "=!= THE END IS NEAR!! THE SIGNS OF THE BEAST ARE EVERYWHERE" The ain the by 847 it is pas the part of the host Amstrad-End Is Near B: is a very minor of the Amstrad-End Is Near . It vthe bfive . `in the of 847 at the the a. It 8the same as the End Is Near , 1994. Amstrad-Luz: The Amstrad-Luz is very to the Amstrad . The "=!= Hello, John Mcafee,please uprade me. Bests regards,Jean Luz" : Portugal , 1989 See: Hell Pixel Silly Silly-365 PZPAPN Andre : Andre Andre-0, Andryushka H: R: 3,568 - 3,648 5: PRhA - V116+, 3.0A06+, V116+, 1.25+, 1.0A06+ The Andre, or Andryushka, . It fthe . Andre is a of . -and . . It Nnot is a polymorphic , and a simple search for detection is not possible. bAndre at the top of but $the '. It Nnot move |12's , as the DOS @by 8,192 ). It Fly hooks {, and mapping utilities show {mapped to the the Andre , it , or a DOS DIR or Copy 6is issued. It Nnot wvery small . `, nor . `larger 64K. `in structure. pof 3,568 to 3,648 at the end of the a. The >and the DOS not be . The in the 5, and are not "Hello!!!" "My is Andryushka" "I come fPerm, Symptom's of an Andre tare DOS DIR 6s may be very sluggish due to the a DIR is issued. alter the of Andre are: Andre-3568: A minor of the Andre , Andre-3568 adds 3,568 - 3,668 )to the . -and . v. Its is 7,632 8the same as the PZPAPN Andromeda 1.0 : Andromeda 1.0 H: i; interfers Hungary R: 1,140 5: PNC - V105+, \2.09+, 2.53+, n1.03+, 30.00+, 2.10+, /2.1+, NAV 3.0A06+, V106+, 2.53+, 1.22+, 1.0A06+ The Andromeda 1.0 fHungary in Andromeda 1.0 is a uof . , but not ,. A later Andromeda 1.1, is listed separately as it has different basic characteristics. the Andromeda 1.0 the Andromeda 1.0 wtwo . the pof 1,140 at the "of the a. The >and in the DOS not be . The in the Andromeda 1.0 5, and are thus not "-= The Andromeda Strain >- 1.00" "By : Crypt Keeper" "Mission Complete... lfun your (es)" "\ANDROM.SEC *. "RUNME. ,SCAN. WCLEAN. WNAV. NAV_._NO" Andromeda 1.0 may interfer the functioning of of the on non-write protected See: Andromeda 1.1 PZPAPN Andromeda 1.1 : Andromeda 1.1 H: Hungary R: 758 5: PRhC - \2.09f+, 2.58+, 6.64+, 2.58+, 6.64+, 1.25+ The Andromeda 1.1 fHungary in Andromeda 1.1 is a uof . , but not ,. An earlier , Andromeda 1.0, is listed separately as it has different basic characteristics. bAndromeda 1.1 wone . in the as well as at the top of $the , as qby the DOS @by 1,136 mby Andromeda 1.1 in |12's not be moved. , the Andromeda 1.1 ly, if a X, an ain the of the Andromeda 1.1 of 758 at the end of the The >and in the DOS not be . The in the 5in all Andromeda 1.1 "[ANDROMEDA V1.1] BUDAPEST HUNGARY" It is what Andromeda 1.1 See: Andromeda 1.0 PZPAPN Angarsk : Angarsk H: R: 238 5: PNCK - 3.96+, NAV 3.0+, The Angarsk . It is fthe . Angarsk is a of . the Angarsk X, the Angarsk wall of the . in the pof 238 at the end of the a. The >and in the DOS to the >and . One can be in the 5in Angarsk Angarsk Nn't to do PZPAPN Animus : Animus Animus-7360, Cookie-7360 H: i; switches `and unexpected accesses to the C: T; TSR; R: 7,360 5: PRsAK - , NAV, 3.96+, 8/93S+, 30.00+, 1.25+ The Animus, Animus-7360, or Cookie-7360 . Its . Animus is a uof . -and . . Advanced ts may The the Animus X, the Animus a low TSR, hooking {22 and 24. Aby as much as 70K. the wtwo . in the the Animus , it wtwo . pof 7,360 at the "of the a. The >and in the DOS 9-13-91 10:30a. The can be din all Animus "Animus.id" "com "Animus.exe" Animus is a malicious . As the tof Animus progresses, the switch various s so the Eindicates is the no longer matches the contents of the process both execu and data `. As a , the may not to run, and unpredica . Animus Nnot avoid switching an ,, so unexpected warm re &s or shelling of the interpretor may . The switching of the . Wextension possibly r, and all must be tested to determine if 9the are dis r, the actual contents of the `must be determined and re d to proper of Animus are: Animus-7392: Animus-7392 is a later of the Animus It adds 7,392 )to the . >and the DOS 9-13-91 10:31a. Instead of switching start all of the . in the by 7,392 at the "of the all of the the r, it start on the C: PZPAPN : Anna H: Manchester, England R: 742 5: PNCK - /2.0+, 3.96+, NAV 3.0+, n1.05+, 8/93+, .2.0+, The Anna fManchester, England in . Anna is a uof . the Anna X, the Anna wone . in the pof 742 the at the end of the a. The and in the DOS the >and . The in the "[ANNA] Slartibartfast, ARCV NuKE the French" la Cool Yule fthe ARcV" "xCept Anna Jones" "I hope you get run over by a Reindeer" "Santas bringin' you a Bomb" "All my Lurve - SlarTiBarTfAsT" "(c) ARcV - England Raining Again" "\ *. *.com" It is what Anna PZPAPN : Ant H: has seconds set to 62 R: 770 5: PNC - 3.96+, n1.03+, NAV 3.0+, 1.53S+, The Ant . Its . Ant is a uof . , but not ,. It is roughly on the the Ant X, Ant wone in the Ant pof 770 at the "of the a. The in the DOS lhad the seconds field set to 62, the tmarker. No in the 5in Ant Ant of any year. At , the Mthe and attempt to "MIT Sux!" PZPAPN Anthrax : Anthrax H: R: 1040 - 1279 5: PRAKX - W, & \, NAV, 6.64+ : See The Anthrax in the it was uploaded onto several BBSs in a Trojan USCAN.ZIP. It is the second to be din a copy of U during , the #V2100. Anthrax is a generic uof . -and . The the Anthrax on the K, the wthe ). At , the is not . It write a copy of on the last few of the K. If data existed on those last few of the K, it be destroyed. fthe K, the Anthrax . It remain until the X. At , it wone . -or . Nnot `in the b, but instead starts to `at the lowest level of the Etree. Later, X, Anthrax -or . a, searching the Estructure fthe lowest level of the Etree. If the on the floppy O, a . -or . amay or may not be The Anthrax 5is 1,024 )long, but by 1,040 to 1,279 ). On the author's test , the largest [d was 1,232 always is a multiple of 16. The can be Anthrax "(c)Damage, Inc." "ANTHRAX" A third s in the 5, but it is in the Cyrillic alphabet. Per Vesselin Bontchev, third translates to: "Sofia Since Anthrax vthe must lthe ror rebuilt in order to remove the tcan be done either a low-level format or use of the M for the correct DOS powering off and re &ing write-protected Jfor the . Any . -or . Anthrax must be dis ror erased. Since a copy of the exist on the last few of the must Anthrax interacts : V2100. If a Anthrax should V2100 , the V2100 check the last few of the Kfor the spare copy of Anthrax. If the spare copy is Anthrax be copied to the It is not if Anthrax carries any destructive capabilities or trigger/ PZPAPN Antimon : Antimon H: R: 1,452 - 1,465 5: PNCK - , NAV, 1.53S+, The Antimon . Its . Antimon is a Antimon is X, the Antimon wall in the C: Oroot E. Since ,normally resides in E, it ras well. Antimon by 1,452 to 1,465 The at the end of all be no 3in the >and in a DOS The in the Antimon "*.com" "FLUSHOT3. "C:\PANDA\MONITOR. -TSRMON. -TSRMONEZ. "= C:\PDPROG" It is what Antimon See: 1452 PZPAPN Anti-D : Anti-D Xuxa-945 H: March, i; TSR; interfers Argentina R: 945 5: PRsC - n, NAV, 1.53S+, The Anti-D, or Xuxa-945, in March, . It is fArgentina. Anti-D is a uof . but it Nnot The the Anti-D X, Anti-D as a low TSR of 1,264 ). It hook 21, and F8. the Anti-D , it pof 945 at the "of the a. The >and in the DOS not be . Two can be din the -MAND "$$TMP. Anti-D interfers the usage of the "D" key on the , hence the of Anti-D are: Anti-D B: to the Anti-D is a very minor : Argentina See: Xuxa PZPAPN Anti-DAF : Anti-DAF H: March, The R: 561 5: PNCK - n1.03+, NAV 3.0+, 8/93+, 1.22+, The Anti-DAF in March, , and is . Anti-DAF is a of . the Anti-DAF wone . in the pof 561 at the end of the a. The >and in the DOS not be The in the Anti-DAF "*.com" "The Anti-DAF "DAF-TRUCKS Eindhoven" "Hugo vd Goeslaan 1" "Postbus 90063" "5600 PR Eindhoven, The "DAF sucks..." "(c) Dark Helmet + The Research Centre" The company and individual mentioned , along address, are not associated the creation of PZPAPN , AP, AP-605, C-605, V605 Research H: i; .BAK and .PAS Sofia, R: 605 5: PNCK - , NAV, : NAV, or The , V605 or C-605, was }in Sofia, by Vesselin Bontchev. , it was fthe or Poland, but it has since !determined to !a research written (over one year before it was }. The author was not aware it had "escaped" until The is a generic . ,. While is not it is in the process of X, the attempt to wtwo `on the Oor on are between 605 and 64,930 `must not lthe read- attribute set. If ameeting the 's selection criteria is d, the b605 )of the 5. The )of the appended to the end of the by 605 ), and begin "PQVWS" as well as 9the "combakpas???exe" at offset 0x17. lhad stamps in the to the If the cannot find two . w, it check the Oand Efor .BAK and .PAS `exist, 5. If the `were .PAS `, the has now lost Pascal source .BAK and .PAS `, the attempt to re them to . `, or . `if a . aalready exists. renaming Nnot work due to a bug in the AP-529: to the 605 , the major differences are AP-529 `over 2,048 529 ly, instead of the .BAK and .PAS `, one .BAK and .PAS Bd if are no of at least 2,048 )on the O. . `on the C: Oroot Emay rby AP-529 fthe A: or B: should be considered a "Research ", as it is not believed to !publicly released. See: PZPAPN 400, AP-400 Research H: i; .BAK, .BAT and .PAS adeletion; alteration on Sofia, R: 400 5: PNCK - , NAV, The , or AP-400, was }in Sofia, by Vesselin Bontchev. It is one of five es or in the ]. Two of the earlier (AP-605) and AP-529, are documented under the ". The listed under separated due to characteristics differing 605 *and 529 The is a generic . ,. While is not it is in the process of The Xon a , the attempt to wone . ain the root Oaccessible on the `are is at least 2,048 ), and the be less 64K in . Since ,is usually the aon a O, it immediately r. One ron the O. The mechanism used to ais to write the 5to the end of the a. A jump is used to Ythe 5before the `do not =stamps in the to the >and If the cannot find a . won a given O, or two . won the O, it check for the existence of .BAK, .PAS, or .BAT `. If Bd. deletions root Fories and on the Since Qroot E(as well as the typically not lall of its . rat the same the deletions on different Os and Fories at different tof the include ps of 400 ), unexpected Kaccess to O, and dis ing .BAK, .PAS, and .BAT `. One symptom of an be slightly by the CRC-check the indicate tmay . The alteration Nnot 9a live , but throw the off into thinking problem is instead of a u, and if the Kwas a &able K, it now be un &able. The and its $are not believed to !publicly released. As such, classified as "Research II are: AP-440: Very to the 400 of the , the major characteristic has a of 440 ). The is no longer by the is an intermediary between AP-480 and the 400 documented AP-440B: on AP-440, 's major difference is wtwo . in the E, and one in the Qof the accessible on the AP-480: to the is the is 480 . It Nnot .BAT `, but .BAK and .PAS. is the latest of the II grouping. AP-480B: on AP-480, 's major difference is wtwo in the E, and one in the Eof all Os accessible on the See: PZPAPN Anti-Tel : Anti-Tel Telecom H: BSC; slowdown Spain R: N/A 5: BRtX - , NAV, \, or M- K/P on DOS SYS on &able The Anti-Tel . It is fSpain. Anti-Tel is a uof the ) and . It is extremely destructive Anti-Tel, the at the top of , but $the '. The DOS indicate is 1,024 )less is expected. |12's !moved. Anti-Tel is , it wthe I, as well as the ais accessed on the On high density 1.2MB 5.25" I, the 28. The Anti-Tel 0, and continued in 27. Since 27 and 28 are the last two of the root `may be lost portion of the root On double density 360K 5.25" I, the 11. The Anti-Tel 0, and continued in 10. Since 10 and 11 are the last two of the root `may be lost portion of the root Ks, Anti-Tel vthe at Side 0, Cylinder 0, 1. The is continued in the at Side 0, Cylinder 0, 6. The at Side 0, Cylinder 0, Data be lost on the Kimmediately upon if the Khad !initialized or formatted placed data in are normally not used by DOS. Anti-Tel is a , it actively to prevent #able to detect it if the . However, is a bug in 5, and it is unsuccessful on I. Anti-Tel hide the &secotr t, so if the utilities not be able to detect Anti-Tel on the is very destructive &s. On the 400th &, it Mthe btwo random data: "VIRUS ANTITELEFONICA (BARCELONA)" II are: Telecom &: Telecom &is the ts of the Telecom . Telecom &is very to Anti-Tel, the major difference Nnot like Anti-Tel. Since of Anti- Tel always Telecom ts, it is suggested be powered off and re a clean write-protected Kand checked for the Telecom See: Telecom PZPAPN : Anto H: &failure; Divide overflow R: 129 5: PNCK - , NAV, /2.1+, The Anto . Its , or ~, are . Anto is a uof . the Anto X, the Anto wall . in the E, it cannot recognize rby the , so be re the Anto pof 129 tof the Anto present on the host a. The at the the a, and in the case of re dat the end of the a. The >and in the DOS to the >and the last the Anto may notice frequent jor "Divide overflow" rcopy of in a hang "Cannot start -MAND, exiting". PZPAPN Aragon : Aragon H: BSC; R: N/A 5: BRtX - \2.09+, 2.53+, NAV 3.0+, 2.10+, : DOS SYS on I; M- K/P on The Aragon . Its . Aragon is a vthe ) and the I. It cannot be detected on the The fan Aragon J, the Aragon at the top of $the ', moving |12's qby the DOS @by 1,024 , the Aragon wthe if it was not r. The !moved to side 0, cylinder the Aragon , it an unwrite-protected Jis accessed for any reason. In the case of 360K 5.25" I, the !moved to Aragon is a . It Fany to read the stored by the be shown instead. As such, no 3in the , or the , cannot be detected on the the PZPAPN Aragorn : Aragorn H: March, i; write protect Italy R: 1,522 - 1,537 5: PNAK - \2.09+, 6.55+, 2.53+, 30.00+, NAV 3.0+, 2.10+, n1.04+ 2.53+, 1.22+, 6.64+ The Aragorn in March, , and is fItaly. Aragorn is a -and . ,. It Ms an Ansi graphics on its 28th of any year. the Aragorn wone . aand one . the E. Due to a bug in the Aragorn vthe ain the E, it in the same bug the Aragorn pof 1,522 to 1,537 the end of the a. The >and in the DOS not be . The are in the 5in all Aragorn "(C) Aragorn-Rome" "*.com *.exe" The last s at the very end of The Aragorn 28th of any year, at in Ansi . The q{color bar} is a representation of the Italian flag: "MUSSOLINI 28 OTTOBRE ANNIVERSARIO MARCIA SU ROMA { color bar } BOIA CHI MOLLA" The is not PZPAPN Arale : Arale H: ^, 1994 i; TSR; to DOS prompt Spain R: 1,526 - 1,541 5: PRsA - V112+, /2.1+, \2.13+, .2.0+, V113+ The Arale ^, 1994. It is fSpain. Arale is a uof . -and . , but not ,. It Ms a on seven days during the year. bArale as a low TSR of 1,984 mby the Arale , the Arale -and . pof 1,526 to 1,541 at the end of the a. The >and in the DOS not be . The in the 5in all Arale "FELICIDADES:" "Maite C. P." "Roberto R. I." "Elsa B. E." "Esther F. P." "Carol C. B." "David M. E." "Anselmo B. V." "(P) by Arale & Goku Corp." The are used by the Mthe two line on seven days of the year: "FELICIDADES: (P) by Arale & Goku Corp." The " be the for the particular March 14th : "Elsa B. E." : "Roberto R. I." May 13th : "Anselmo B. V." May 17th : "David M. E." : "Carol C. B." : "Esther F. P." ?12th : "Maite C. P." Arale Ys a on one of the >s. The two line L, and the ed to the DOS prompt. PZPAPN ARCV 330 : ARCV 330 H: England R: 330 5: PNCK - n1.03+, 3.96+, NAV 3.0+, 8/93+, 1.22+, The ARCV 330, or 330, . It is fEngland. ARCV 330 is a uof . the ARCV 330 X, the ARCV 300 wone . in the E. If E, it may the ARCV 330 pof 330 the end of the a. The >and in the DOS to the and . The near the end of all the ARCV 330 "aRcv" The ARCV 330 in the month of of any year. During , the Mthe and hang the "[330] by ICE-9" in the 5, as is the "*.com" PZPAPN ARCV Friends : ARCV Friends H: England R: 839 5: PNCK - /2.0+, 3.96+, 30.00+, NAV 3.0+, 1.22+, .2.0+, The ARCV Friends England. ARCV Friends is a uof . ,. It is not related to the Friends the ARCV Friends wone . in the 839 at the end of the a. The >and in the DOS to the >and The ARCV Friends 12th of any year, ing in the Mof the on the monitor: [FRIENDS] ICE-9 (c) ICE-9 released 5th ARcV Productions. Dedicated to all my friends" The in the , and is not . The in the PZPAPN ARCV Xmas : ARCV Xmas H: March, England R: 670 5: PNCK - n1.03+, \2.09+, 2.10+, 1.22+ The ARCV Xmas in March, , and is fEngland. ARCV Xmas is a of . ,. It Ms a during the Christmas season. the ARCV Xmas wone . in the Nnot smaller pof 670 at the end of the a. The >and in the DOS . The in the ARCV Xmas 5in all "Happy Xmas fThe ARCV." "*.com *.*" ?20th through ?25th in years , the ARCV Xmas Mthe "Happy Xmas fThe ARCV." PZPAPN ARCV-670 : ARCV-670 H: March, England R: 670 5: PNCK - n1.03+, \2.09+, 2.10+, 1.22+ The ARCV-670 in March, , and is England. ARCV-670 is a of . the ARCV-670 wone . in the Nnot smaller pof 670 at the end of the a. The >and in the DOS . The in the 5in all "*.com *.*" all of the . rin the higher level Fories, a hang PZPAPN ARCV-n : ARCV-n ARCV-4 H: Manchester, England R: 664 5: PNAK - 3.96+, n1.03+, NAV 3.0+, The ARCV-n series of es were fEngland in and es are us of . and/or . `, and ,. The ARCV-4 members of the series included $under " members". The three earliest members, ARCV-1, ARCV-2, and ARCV-3, !generated The ARCV-4 fManchester, England. ARCV-4 is a uof . -and . the ARCV-4 wthree in the preference given to . over . pof 664 at the end of the a. The in the DOS not be . The can be in the 5in all ARCV-4 "[ARCV-4] Apache Warrior, ARCV Pres." "*.exe *.com" "So Who`s the Best "Oh Well Sorry But The ARCV Are The Best!" "Well Your in Favor It is what ARCV-4 members of the ARCV-n series of es are: ARCV-1: , ARCV-1 is an 826 uof . -and . , but not ,. It vone in the preference given to . pof 826 at the end of the The >and in the DOS not be . The "Long Live The ARCV. MUFC for the League!" "(c) Apache Warrior, ARCV Pres. 92" "Welcome to the REAL World. And the ARCV 1 "[ARCV-1] Apache Warrior, ARCV Pres." "*.exe *.com" : Manchester, England ARCV-2: , ARCV-2 is an 692 uof . . It vone in the pof 692 at the end of the a. The >and in the DOS not be . The "*.exe .. [ARCV-2] Apache Warrior, ARCV. Pres." "Help.. Help.. I`Sinking : Manchester, England ARCV-3: , ARCV-3 is an 657 uof . ,. It vfour in the pof 657 at the end of the The >and in the DOS not be . The "[ARCV-3] Apache Warrior." "Yo.." "I`ve Just .. Opps.. Sorry I`m the "Well let me introduce myself.." "I am ARCV-3 , by Apache Warrior." "Long Live The ARCV and Whats an kECU?" "Vote Yes to the Best Vote ARCV.." "*.com .." : Manchester, England ARCV-5: , ARCV-5 is an 475 uof . ,. It vone . in the pof 475 at the end of the The >and in the DOS not be . The "[ARCV-5] Apache Warrior, ARCV Pres" "SU*. : England ARCV-6: , ARCV-6 is an 335 uof . ,. It vone . in the pof 335 at the end of the The >and in the DOS not be . The "[ARCV-6] Apache *.com" : England ARCV-7: , ARCV-7 is an 541 uof . . It vone . in the pof 541 at the end of the a. The >and in the DOS not be . The "[ARCV-7] Apache ARCV. *.exe" : England ARCV-8: , ARCV-8 is an 679 uof . . It vone . in the pof 679 at the end of the a. The >and in the DOS not be . The "Naughty, Naughty... ARCV Productions Ltd." "[ARCV-8] *.exe" : England ARCV-9: , ARCV-9 is an 745 uof . X, ARCV-9 at the top of , hooking |21. qby the DOS 2,048 ARCV-9 is , it pof 745 at the end of the The be hidden . The >and in the DOS not be . The "[ARCV-9] Apache Warrior. *.com" : England ARCV-10: , ARCV-10 is an 827 uof . -and . ARCV-10 at the top of , hooking |21. , as qby the DOS @by 1,648 ARCV-10 , it -and . for any reason. pof 827 the at the end of the a. The not be hidden. The in the DOS not be The "[ARCV-10]" "Apache Warrior" "Well its finally here The -= ARCV =-" "Welcome To our New Members The last two may be Las a the . Write protect and the fa write-protected : England ARCV-10B: to the ARCV-10 has to avoid detection by familiar ARCV-10. : England March, See: PZPAPN : Arf Rigor Mortis, Thor H: March, Canada R: 1,000 5: PNCK - \, NAV, The Arf, Thor, or Rigor Mortis in March, fthe . Arf is a written by RABID, in Canada. is a uof . ,. Arf is on the and may identify it as Arf is X, the check to see if ,has r. If it is not r, the wit and Mthe "Rigor Mortis !!! I am Hi.pas" checking (and possibly ,, the search the Efor one . w. If an d, it "Arf krad krad krad krad krad kr" The proceed to check the B: Ofor a the Arf of 1,000 ). The at the end of the . The can be in the The Arf may not be in the public domain, the sample is not a natural tof the . Its is due to the "Arf" r. Its of Thor is because it is believed to written by a group calling Thor. Note: the sample of was on an . a, and is not a natural may be a research and not in the public domain. of Arf are: Arf-B: Arf-B was in May, . It is fthe United States. s to be an earlier of the Arf Arf-B is X, it check the Efor an w. If an d, it wthe . The B: may be accessed. Whether or not a Mthe "Arf Arf Got you! -- RABID '90" pof 1,000 ), and >and in the not to the >and it has in the , and a hang: WC failure Cannot start -MAND, exiting" Arf-B usually fail to function ing in a hang. PZPAPN Argentina : Argentina Argentina 1.0 H: i; TSR; Buenos Aires, Argentina R: 1,249 5: PRsC - , NAV, The Argentina Gin Buenos Aires, Argentina, in . Argentina is a uof . . It Nnot The Argentina is X, the as a low TSR of 1,568 mby the Argentina is , it pof 1,249 at the "of the 3in the DOS The Argentina on four >s, at pertaining to the >s. are of patriotic significance in Argentina. The >s and are as follows: May 25th: "25 de Mayo Declaracion de la independencia Argentina Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Jun 20th: "20 de Junio Dia de la bandera Argentina Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Jul 9th: "9 de Julio Dia de la independencia Argentina Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Aug 17th: "17 de Agosto Aniversario de la defuncion del Gral. San Martin Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Hitting any key in the Xcontinuing. %the , one "Argentina 1.00" PZPAPN Argentina-102 : Argentina-102 H: & truncated to 102 Argentina R: 102 5: ONCK - 6.55+, 2.10+, \2.10g+, 2.58+, 2.58+, 6.64+, 1.25+ The Argentina-102 fArgentina in is a u. It rby the Argentina-102 Bthe in the and create a 102 The replacement 9pure 5. The >and in the DOS to the >and Two can be in the 5in all Argentina-102 "*.com" Argentina-102 Nn't do , corrupting the PZPAPN Armagedon : Armagedon Arma H: intermittently sent to -ports s, Greece R: 1,079 5: PRsC - \, NAV, \, or The Armagedon , by George Spiliotis of A s, Greece. Armagedon is a `, increasing by 1,079 The at the The Xon a , the as a low of 1,392 ), hooking {8 and 21. Any . are later Xare rby the [the "Armagedon the GREEK" #sent to -ports 1 - 4 at d intervals. Between 5:00 and 7:00, the attempt to use the -ports to make a phone call to Local xin Crete, Greece. If a connection is made, the phone line remain open until the notices the phone line is in use. (Needless to say, Nn't work if the outside of Greece as dialing 5s are considerably different between countries.) wise is not destructive. of Armagedon are: Armagedon #911: on the Armagedon adds 1,079 )to the . v. The phone number called by the has 1to "911", is the police and emergency services phone number implemented in much of the . The is sent to the -ports has "Support Your Police". Armagedon-1074: to the Armagedon, adds 1,074 `. Its TSR is 1,408 , and hooks {8 and 21. The in the "+++aTh0m0s7=35dp081 ,141" "Armagedon the GREEK" : Greece, Armagedon-1077: to the Armagedon, adds 1,077 `. Its TSR is 1,392 , and hooks {8 and 21. }: Greece, PZPAPN Arriba : Arriba 1590 H: R: 1,590 5: PRaA - /2.0, 8/93S+, 3.96+, NAV 3.0+, 8/93+, The Arriba . Its , and the may actually !written in Arriba is a uof . -and . but not bArriba X, the Arriba at 9000, hooking {21 and 24. , as qby the DOS not be the Arriba , it pof 1,590 ). In the case of . the at the "of the a. In . , the at the end of the a. The >and in the DOS . No in the It is what Arriba PZPAPN Arusiek : Arusiek H: May, Morocco R: 817 5: PRhA - V105+, 3.96+, NAV 3.0+, V106+, 1.22+, The Arusiek in May, , and is fMorocco. Arusiek is a uof . -and . but not bArusiek X, the Arusiek at the top of $the ', hooking , as qby the DOS @by 1,088 12's not be moved. the Arusiek , it for any reason. pof 817 the at the end of the a. The and in the DOS not be The in the 5in all Arusiek "MKS" "NAV" "CLEAN" -MAND" "Mum3" It is what Arusiek PZPAPN : Ash H: R: 280 5: PNCK - , NAV 3.0+, .2.0+, The Ash . Ash is a uof . Its the Ash X, the Ash wall of the . in the of 280 at the end of the a. The >and in the DOS to the >and . One in the Ash Ash Nn't do See: Green Joker PZPAPN Ashar : Ashar Shoe_ , UIUC BSC; R: N/A 5: BRt - , NAV, K, CleanUp, \, NAV, or DOS SYS &able The Ashar is a of the Brain . It differs fthe Brain it can wboth floppies and K, and the in the !modified to be: "VIRUS_SHOE RECORD, v9.0. Dedicated to the dynamic memories of millions of who are no longer today". However, the is never L. The identification "ashar" is normally dat offset 04a6 hex in the of Ashar are: Ashar-B: (Shoe_ !modified so can no longer Os. The v9.0 in the has to v9.1. See: Brain PZPAPN ASP-472 : ASP-472 H: Eastern R: 472 5: PRfAK - , NAV, The ASP-472 . Its . ASP-472 is a uof . -and . The ASP-472 is X, the ASP-472 , hooking |21. be no as measured by the DOS ASP-472 has , it for any reason. by 472 at the end of the a. The and in the DOS can be easily identified as end the three character "ASP". ASP-472 Nn't do PZPAPN Astra : Astra Astra-976 H: i; data `truncated; R: 976 5: PRhCK - 6.55+, 6.64+ The Astra, or Astra-976, . It is reported to be fthe . Astra is a of . bAstra X, the Astra at the top of $the |12's not be moved. , as qby the DOS @by 1,056 mby Astra in the Astra , it X. If X, it the Astra pof 976 at the end of the a. The >and in the DOS not be . The in the Astra 5, and are not "(C) AsTrA, The "(2)" can be dnear the end of all Astra A symptom of an Astra data read/write intent may be truncated by slowly corrupting the 's data of Astra are: Astra-498: , Astra-498 is a 498 of the Astra v.SYS . It rdevice Or is loaded fthe CONFIG.SYS , it .SYS Eentry is accessed, by 498 - 513 tof the a, and 498 t. The at the end of the a. The >and in the DOS to the >and . The can be din all "I like a flower's smell!" "(C) AsTrA,JPN" "(5)" Astra-510: , Astra-510 is a 510 of the Astra and is to Astra-498. It adds 510 to 525 )to the .SYS t, and 510 t. It 8the "I like cold flavour!" "(C) AsTrA, ,JPN" "(5)" Astra-521: to Astra-498 and Astra-510, adds 521 to 536 )to the .SYS the t, and 521 8the "I like fragrant smell of flower!" "(C)AsTrA, "(5)" Astra-1010: , Astra-1010 is a 1,010 of the Astra . Its is 1,072 ), hooking It adds 1,010 )to the . The din the are present in . The "(2)" the end of the Astra 1to "(3)". Nnot truncate data PZPAPN AT144 : AT144 H: 8086/8088 processor R: 144 5: PRfbCK - NAV 3.0+, The AT144 . AT144 is uof . and function on AT class machines. On XT class machines, the simply hang the The AT144 is X, AT144 a portion of the residing in be no qby the DOS {91, 93, 94, 95, 97, 98, 9A, 9B, 9C, 9D, 9E, 9F, A0, A1, A2, A6, A7, A9, AA, AB, and AF mby the in low AT144 is , it X. If X, it by 144 at the end of the lhad >and in the DOS to the >and AT144 Nnot do An earlier " " of , but it not of AT144 are: AT108: to the AT144 in a "hole" in low , hooking 21. , it of 108 at the of the a. The >and in the DOS to the >and AT114: to the AT144 in a "hole" in low , hooking 21. , it -and . pof 114 at the "of the a. The remainder of the hex "FF" 4. The in the DOS to the >and Frequent , as well as &failures AT118: to the AT144 in a "hole" in low , hooking 21. , it of 118 at the of the a. The >and in the DOS to the >and AT122: to the AT144 in a "hole" in low , hooking 21. , it of 122 at the of the a. The >and in the DOS to the >and AT140: to the AT144 in a "hole" in low , hooking 21. , it of 140 at the end of the a. The >and in the DOS to the AT149: to the AT144 adds 149 to the . PZPAPN : Atas Atas-384 H: Poland R: 384 5: PNCK - , NAV 3.0+, .2.0+, The Atas . It is Poland. Atas is a uof . the Atas X, the Atas wone the E. The newly pof 384 at the end of the . The >and in the DOS to the >and The 9ed in the Atas are not -Ok." "ATAS V0.1 Cr.24.01.92" advanced ts of Atas may notice "Ok" X. The Mof "Ok" usually of the Atas Atas-400: , Atas-400 is a 400 of the Atas . It adds 400 )to the end of the . v. The >and in the DOS to the >and . The in the -I like to travel..." "ATAS(Kiev) V3.03 Cr.91.10.11" : Poland See: Atas II PZPAPN Atas II : Atas II Atas-3321 H: Poland R: 3,321 5: PRtCK - 3.96+, n1.03+, V106+, The Atas II, or Atas-3321, , and fPoland. Atas II is a ,. It is a semi- it hides the bAtas II X, the Atas II at the top of but $the ', moving |12's , as qby the DOS @by 10,240 {08, 10, 16, 1C, and 21 mby Atas II in the Atas II , it pof 3,321 be hidden . The at the end of `, and the >and in the DOS not be . The in the Atas II "bye < > music" "letters" MBye-Bye" =.===" "ATAS Corporation.(B) ,V1 Created in the Kiev by ATAS." the Atas II #detected on all by the DOS it is . It is what else Atas may do. See: Atas PZPAPN H: May, i; "General Failure Ureading s, Greece R: 1,463 5: PRfAK - , NAV, /2.0+, 8/93+, .2.0+ The A Gin A s, Greece, in May, is a and . the A at the top of $the is not reserved. not be . If ,was not r, it . No the A , it for any reason. pof 1,463 at the end of the a. The be hidden by the it is . The >and in the DOS not be The in the "TROJECTOR II,(c) Armagedon Utilities, A the A [general failure requiring an Abort, Retry, Ignore, or Fail response. It is Trojector: Probably an earlier of the A , Trojector's 3,776 ), hooking |21. It 1,561 not be Trojector is . The at the end of the The in the "TROJECTOR ]I[,(c) Armagedon Utilities, A "Greetings to Vesselin" Trojector may X, as well as the DOS indicating regardless of whether the : Greece Trojector-B: to Trojector, Trojector-B has to avoid detection by ning , 1994. PZPAPN AtomAnt 3.0 : AtomAnt 3.0 Filling R: 2,143 - 2,157 5: PRhAK - V106+, 6.55+, 2.53+, 2.11a+, \2.13+, V106+, 2.53+, 6.64+ The AtomAnt 3.0 or Filling . Its . AtomAnt 3.0 is a uof . -and . bAtomAnt 3.0 X, the at the top of $the ', not moving |12's , as the DOS @by 2,144 {01, 09, 1C, 21 and 80 mby AtomAnt 3.0 in the AtomAnt 3.0 , it and . pof 2,143 by 2,145 to 2,157 ). In both cases, the at the end of the a. The >and in the DOS . The in the and is not "A billenty zet 5000 le sig garanci lis.Ez most lej rem cser lje ki !" "Csak azt n idej ben hagyja abba!" "Ez nem SK t igaz n nem kedveltek benn nket ?" "MC Hammer rap-szt s PEPSI lt, de most kicser a PEPSI- "valami m sra ... FILLING, NOTHING MORE THEM FILLING ..." rem fogadjon el egy v rust a vall si eszm s egyh "Nem akar adakozni ?" gi ROM-BIOS verzi ! Cser lje ki jabbra !" "Atomant v3.0 Er sebb, mint valaha !" s az I-O csatorn bkan. rem azonnal h vjon szerel ket!!!" meg van az adatbuszon.Gyors tsa meg azl" It is what AtomAnt 3.0 of AtomAnt 3.0 are: AtomAnt 1.0: , AtomAnt 1.0 is an earlier of AtomAnt 3.0. It's is 576 ), hooking {21 and 80. It by 564 at the end of the a. The in the DOS not be . The can be the 5in all AtomAnt 1.0 t igaz m nem kedveltek benn nket ?" "AtomAnt v1.00" PZPAPN Atomic 1 : Atomic 1 Atomic 1A H: May, Zfailure; "Bad Canada R: 371 5: ONCK - \2.09+, 6.55+, 30.00+, V108+, 2.10+, n1.04+, /2.1+, NAV 3.0A06+, V108+, 1.22+, 6.64+, 1.0A06+ The Atomic 1, or Atomic 1A, in May, , and fCanada. Atomic 1 is a over- writing . It permanently corrupts the . the Atomic 1 X, the Atomic 1 wthe btwo . in the E, and "Bad The ed to the DOS prompt. the Atomic 1 lthe by the Atomic 1 5. Since the not check to see if the it is swere r, it not spread past the btwo . `in any E. The >and in the DOS not be . The in the 5in all Atomic 1 "[TAD1A] Lapse -- Toronto, CANADA" "The Atomic Dustbin 1A -- is just the bstep" "Bad -.. c Dustbin 1A -- is just the bstep" of Atomic 1 are: Atomic 1B: A 480 of the vthe btwo . `in the X, and the Zterminated" The in the 5in all Atomic 1B "[TAD1B] Lapse -- Toronto, CANADA" "The Atomic Dustbin 1B -- is almost the second step" Zterminated" "The Atomic Dustbin - YOUR PHUCKED!" : Canada May, See: Atomic 2 PZPAPN Atomic 2 : Atomic 2 Atomic 2A H: May, Zterminated" fail to function Canada R: 350 5: PNCK - 2.53+, 30.00+, V108+, NAV 3.0+, n1.04+, /2.1+, V108+, 2.53+, 1.22+, The Atomic 2, or Atomic 2A, in May, , and fCanada. Atomic 2 is a Atomic 2 not function the Atomic 2 X, the Atomic 2 wone . in the E, and Zterminated" The ed to the DOS prompt. the Atomic 2 pof 350 at the end of the a. The >and in the DOS not be . The in the 5in all Atomic 2 -[TAD2A] Created by Lapse of Ontario, CANADA" "[TAD2A] The Atomic Dustbin 2A -- Just Shake Your Rump!" "Fail on INT 24 .. NOT!!" of Atomic 2 are: Atomic 2B: A 831 of the vthe one . ain the X, and one of the "Unable to "Fail on INT 21" It may wa copy of in the route Eof the O, even not the E. Atomic 2B bfive . `in any by 831 at the end of the a. The >and in the DOS to the . The are in the 5in all Atomic 2B ,\DOS\ "Copyright (c) Lapse - Ontario, Canada" "[TAD2B]-The-Atomic-Dustbin-2B" "Unable to "Fail on INT 21" "The Atomic Dustbin 2B - I'm Here To Stay" : Canada May, See: Atomic 1 PZPAPN Attack : Attack Attack-1501, Cuban H: i; TSR; "Not enough Cuba R: 1,501 5: PRsC - , NAV 3.0+, /2.0+, 8/93+, The Attack, or Attack-1501, fCuba. is a of . , but not an earlier of the is an The the Attack as a low TSR of 3,552 ). It hooks {13, 21, and the Attack , it wtwo . in the Eany Xor a DOS DIR 6is performed. the Attack typically 1,501 ). The exception is if the was smaller 1,173 ), the of 2,684 ). The >and in the DOS not be The can be din all Attack "The Terminator Attack Now" ,ERROR IN DEBBUG" the Attack may notice no longer function ing in a "Not enough of Attack are: Attack-918: An earlier of the Attack zs a 1.2K TSR it is , it two . in the ever any Xor a DOS DIR is performed. lthe 918 )of the host by the Attack-918 , and must be replaced fclean, backups. : Cuba PZPAPN Attention! : Attention! 394, -394, 394 H: clicking emitted speaker on keypress; R: 394 5: PRhCK - \, NAV, The Attention! and was }in the is a uof . The the Attention! X, the reserve 416 )at the top of , but $the '. The area, and hooks |21. and ed by the DOS Aby 416 ). The is not moved. , a clicking sound be emitted by the speaker a key is pressed on the , such as the EDLIN supplied MS-DOS, receive an "Invalid attempted to be Attention! are X. The exception is very small . by 394 at the end of the 9the : "ATTENTION !" near the "of the PZPAPN Attention-629 : Attention-629 H: March, R: 629 5: PNCK - /2.0+, n1.03+, 1.22+, .2.0+ The Attention-629 in March, . Its . Attention-629 is a uof . the Attention-629 wone . in the 629 at the "of the The >and in the DOS to the >and . The in the 5in all Attention-629 "*.com" "Attention! I'm The second of be repeatedly the ing in a scrolling of the may PZPAPN Iron Maiden H: i; unexpected access to C: Poland R: 636 5: PNCK - , NAV, The 16th, or Iron Maiden, 16th is a ,. It is fPoland. 16th is X, the 16th check to see if the btwo . `in the r. If ln't r, the proceed to wthem. Next, the 16th check the C: to see if it 8two . ln't r, and wthose if d. The was proceed to 16th pof 636 at the end of the be no 3to the >and in the DOS Two can be in the 16th "*.com AA" "=!= IRON MAIDEN" It is what 16th 16th, 9destructive PZPAPN Aurea : Aurea H: random Italy R: 653 - 668 5: PNC - \2.09f+, V109+, 2.10+, 2.58+, 6.60+, n1.05+ V109+, 1.22+, 2.58+, 6.64+ The Aurea , and is fItaly. It is a uof . , but not the Aurea wone . in the pof 653 to 668 at the end of the a. The >and in the DOS . The in the Aurea -C:\DOS\*. -MAND." "I'm sorry, you lost thing because of AUREA" The Aurea randomly of the K, and the may be Lon the monitor: "I'm sorry, you lost thing because of AUREA" PZPAPN Aussie Dir : Aussie Dir Sdir H: i; sluggish DOS Dir Melbourne, Australia R: 550 5: PRhCK - \2.09+, 2.53+, NAV 3.0+, 2.10+, n1.04+, 6.60+, 1.22+, 2.58+, 6.64+ The Aussie Dir, or Sdir, fAustralia in March, . It was Gin Melbourne, Australia in . Aussie Dir was "Sdir", but was not used as it is the of a computer unconnected to . Aussie Dir is a uof . bAussie Dir at the top of $the ', hooking |21. , as qby the DOS @by 608 |12's not be moved. the Aussie Dir , it in the ever a DOS DIR 550 at the end of the a. The >and in the DOS . The can be in the 5in all Aussie Dir "1 Did David Gerrold la harley he was one?" "2 Is John Brunner a shocking wave rider?" "3 Is iam Gibson a neurotic romantic?" "4 Is Australian Parasite the Best?" "1:No, 2:Yes, 3: Probably, 4: Absolutley" "AP*. The "AP" can dstarting in the fourth of all is the tmarker for the Aussie Dir 8destructive Oon the 29th day of a specific month, due to a bug in the not be PZPAPN Aussie Parasite : Aussie Parasite Australian Parasite H: &failures; Melbourne, Australia R: 292 5: PRhCK - \2.09+, 30.00+, 2.10+, n1.04+, The Aussie Parasite, or Australian Parasite, in Melbourne Australia in . Aussie Parasite is a uof . the Aussie Parasite the Aussie Parasite at the top of $the and , as qby the DOS @by 320 Aussie Parasite in the Aussie Parasite , it pof 292 the at the end of the a. The and in the DOS not be . The in the 5in all "Australian Parasite" jfrequently , and the fail to © of of Aussie Parasite are: Dorn: on the Aussie Parasite Dorn is a 377 . Its is 448 hooking |21. Dorn adds 377 )to the . v, the at the end of the a. The in the 5in all "Kill Dorn W. Stickle" "(C) Australian Parasite" : Australia on the Aussie Parasite Elviris is a 369 . Unlike Assie Parasite, it is uof . ,. El vthe in the is executing, adding 369 )to the . El is unable to determine r, it many s. The El the on the top portion of the monitor Xin the evening: "Night of the Living pt: El Misstress of the Dark Assembler ming: Australian Parasite (Enough said) Loves to Tonya H and Dianna G" The in the . The : Australia Grue: on the Aussie Parasite Grue is a 338 . Its is 400 hooking |21. Grue adds 338 )to the . v, the at the end of the a. The in the 5in all "It is pitch black. You are likely to be eaten by a Grue." : Australia PZPAPN Australian : Australian Clipper H: i; TSR Australia R: 1,413 5: PRsA - , NAV, The Australian . It is fAustralia. Australian is a uof . and . . It Nnot ,. It is on the 1720 bAustralian X, the as a low TSR of 1,392 mby the Australian is , it occasionally -and . by 1,413 at the "of the by 1,413 to 1,425 at the end of the In both cases, be no 3to the >and in the Australian 9one in the "CLIPPER" It is if Australian PZPAPN Australian 403 : Australian 403 403, Zeroto-O H: 403 ; TSR; `do not function Australia R: 403 5: PRsCK - , NAV, The Australian 403 by Colin Keeble of Australia. is a The the Australian 403 X, the as a low TSR of 720 ). The hook , the replace two . in the a copy of the any X. The replaced of 403 ), and >and in the to the >and . Needless to say, the replaced since 9the Nnot do of Australian 403 are: Zeroto-0: to Australian 403, has 10 differ fthe g, its TSR is 736 ), hooking Zeroto-0 is , it X. As the replaced a 403 >and to the >and PZPAPN Australian : Australian Australian H: Australia R: 153 5: PNCK - \2.09+, 2.53+, 30.00+, NAV 3.0+, 2.10+, n1.04+, /2.1+, 6.60+, 2.53+, 1.22+, .2.0+, 6.64+ The Australian , or Australian -153, cits Hin Australia in the same month. Australian , and its listed $, are non- the Australian the Australian wone . in the E. A hang may the Australian pof 153 at the "of the a. The >and in the DOS not be . The can be viewed in the 5in all Australian adding an )to the of Australian Australian -142: A 142 of the Australian : Australia Australian -142B: to Australian -142, has a few differ. : Australia Australian -143: A 143 of the Australian : Australia Australian -147: A 147 of the Australian : Australia Australian -150: A 150 of the Australian : Australia Australian -162: A 162 of the Australian . The "AP" can be `starting in the 4th *of the : Australia PZPAPN Avispa : Avispa H: ^, 1994 i; TSR; =seconds = "00" Argentina R: 2,048 - 2,062 5: PRsE - V112+, 6.64+, V113+, 6.64+ The Avispa ^, 1994, and is Argentina. is a uof . bAvispa as a low TSR of 2,304 |13 and 21 mby the the Avispa , it may pof 2,048 to 2,062 at the end of the a. The >and the DOS to be un the seconds field !set to "00". The in the Avispa "__ Avispa - Buenos Aires - Noviembre "$$ AVISPA $$ Republica Argentina$$ Elijah Baley $$ Noviembre 10 de is not an old , and it was written in Argentina by Elijah Baley." "It uses polymorphic technics to avoid conventional ning." "MENEM: Libertador de torturadores y asesinos de inocentes, que Dios se apiade de tu pobre alma. $$" It is what Avispa PZPAPN AVV-2300 : AVV-2300 AVV 1.12 H: R: 2,300 5: PNCK - \2.10g+, V111+, n1.04+, 2.10+, /2.1+, 6.60+, 2.58+, V111+, .2.0+, 2.58+, 6.64+, 1.25+ The AVV-2300 or AVV 1.12 . Its . AVV-2300 is a uof . ,. It wvery small . the AVV-2300 wone . in the pof 2,300 the at the "of the a. The and in the DOS not be . The in the 5in all AVV-2300 "The AVV 1.12, Copyright (C) "(ARV)" "*.com AVV Warning!" "In .ext may be "AVV Warning!" "In area may be "AVV Warning!" "In may be "AVV=off" "The Anti 1.12: I am checking 200++ k's Yankee Doodle for vectors" As implied by the is capable of detecting the presence of many older es in , as well as `. It 5to remove if the AVV en mental variable is set to "off". PZPAPN Axe-1024 : Axe-1024 1024E H: Hungary R: 1,024 - 1,038 5: PRhE - V109+, \2.13+, V109+ The Axe-1024, or 1024E, . It is fHungary. Axe-1024 is a uof . bAxe-1024 at the top of the ', not moving |12's , as qby the DOS @by 1,328 {09 and 21 mby the the Axe-1024 , it wthe in the X. The in the by 1,024 to 1,038 t, and 1,024 t. The at the end of the a. The >and in the DOS not be . The are in the 5in all Axe-1024 "AXE" It is what Axe-1024 PZPAPN Azusa : Azusa Hong Kong H: BSR; LPT1 & -1 ports may be disabled Hong Kong R: N/A 5: BRtX - \, NAV, : CleanUp, M- K/P, F K/MBR on DOS 5 The Azusa . Its is believed to be Hong Kong. is a and the The the Azusa , the at the top of , but $the '. The moves the report 1,024 )less zed on the . At , the wthe the a copy of the Azusa . A copy of the is not stored by the Azusa is , it are accessed on the write intent (i.e., a as output, or read/write intent) or to re the Jvia CTL-ALT-DEL. Iare by copying the to track 40 and writing a copy of to the . On 360K 5.25" I, the end up in the middle of the K, possibly corrupting The Azusa keeps track of how many s the &s, the disable the -1 and LPT1 ports on the , and reset its counter. A later in the ports functioning again. of Azusa are: Azusa 2: fHong Kong. The portion of Azusa 2 is 2,048 at the top of tof high-density in severe cross-linking of `and invalid clusters, as well as 0 Fories. CTRL-C may fail to function, as well as may hang the . Disabling of -1 and LPT1 may See: Evil Empire PZPAPN : B&B Beavis & Butthead H: aand may not function R: 716 5: PNCK - V108+, 6.55+, \2.09f+, 2.10+, n1.04+, V108+, 1.22+ The B&B, or Beavis & Butthead, It is fthe is a uof . the B&B wone . ain the pof 716 at the end of the a. The in the DOS not be . The in the B&B "Beavis & Butthead were here. Huhuh." "Dude. check out the secret sucks." "Huh Hnn Hnn Ahuh" "It is what "Huh Huhhuh Huhhuh Huh" "*.**Beavis & Butthead , by Primal FuryA*.*" The B&B corrupt and data othe hidden `, by adding 41 )to the end of the be the "Beavis & Butthead were here. Huhuh. PZPAPN BackFont-896 : BackFont-896 H: i; DOS Mfont may be R: 896 5: PRhE - V106+, \2.09+, NAV 3.0+, 3.96+, 2.53+, /2.1+, V106+, 8/93+, 2.53+, 1.22+, .2.0+, The BackFont-896 . Its . BackFont-896 is on the Badsec , and is a uof . . It has characteristics. bBackFont-896 at the top of $the ', not moving |12's , as qby the DOS @by 928 mby the the BackFont-896 , it for any reason. pof 896 be hidden by the it is . The at the end of the , and the >and in the DOS . No in the The DOS indicate Ton all . The alter the Mfont. See: Badsec PZPAPN : Back H: clock runs backwards R: 528 5: PRtCK - , NAV, The Back . Back uof . Its bBack X, Back at the top of the Aby 528 ), as measured by the DOS {08 and 21 mby the , it X. If X, it by 528 The Back at the end of the The "Back " can be din all The Back affect the operation of the by running the clock backwards. For example, `created became stamps in the fbefore the became . Re &ing the in the clock ing to the normal expected >and See: Blinker Shaker PZPAPN Bad Boy : Bad Boy Bad Boy 2 H: May, R: 1,000 5: PRtCK - , NAV, 6.55+, The Bad Boy in May, V. Bad Boy is a uof . , it The Bad Boy is X, the at the top of , but $the mby the is not moved. If the became &ing qby the DOS @by 3,072 ). If Bad Boy became by executing (not Aof 3,072 , but @by 6,704 ). The is due to a low zed by the Bad Boy is , the by 1,000 at the `. Occasionally, by 1,001 ). The >and the not be 9two , the d, natural ts of the are not Lby the "The bad boy halt your "The Bad Boy , Copyright (C) The Bad Boy on a random basis, at to hang the . The hang is followed by the scrolling several s of repeated 4, and halt of Bad Boy are: Bad Boy 2: A later of Bad Boy, Bad Boy 2 Nnot the TSR zed if the became &ing The hang, scrolling of 4, and halt may still , but not as frequently. The in the "Make me better!" "The Bad Boy 2.0, Copyright (C) Bad Boy, the d samples of Bad Boy 2. Bad Boy-D: , Bad Boy-D is a uof . , but not at the top of $the 'in 3,072 m. Bad Boy-D by either 1,073 or 1,074 ). The be at the "of the a. The >and in the DOS . The the 5in all "The Worthless Piece of shit vi-rus is a joke" Immortal Riot: , Immortal Riot is a uof . ,. It at the top of $the 3,072 Immortal Riot by either 1,054 or 1,055 ), or may lthe b1,054 by the 5. The be at the the a. The >and in the DOS not be . The in the 5in all "Senseless Destruction..." "Protecting what we are joining together to take on the world.." "METAL MiLiTiA [iMM0RTAL RI0T] SVW" The Las a on the monitor. At hang may See: Boys PZPAPN Bad Brain : Bad Brain H: fail to R: 576 5: ONCK - 3.96+, NAV 3.0+, 1.53S+, The Bad Brain . Its . Bad Brain is a of . ,. It corrupts all Bad Brain is X, the Bad Brain wone . on the Oin the 2nd or lower sub fthe O's root the Bad Brain lthe b576 the 5, so be no 3in the in the DOS . The >and the DOS The in the Bad Brain 5, and thus are not "SKISM*" "BadBrains" the Bad Brain not function Ythem. The ed to the DOS prompt upon Since the Bad Brain s the "of the host cannot be dis rand should be replaced clean backup copies. of Bad Brain are: Bad Brain 1.2: , Bad Brain 1.2 is a 554 of the lthe b554 by the . The in the in all Bad Brain 1.2 "The Thing Should Not Be" "He searches" "Hunters of the shadow is rising" "Crawling chaos, underground," "out fruins possessed" "Fallen city, living death..." "* *. "Metal Militia / Immortal Riot" PZPAPN : Bad H: i; slow response; R: 3,430 - 3,443 5: PRtAK - V106+, \2.09+, 2.10+, /2.1+, 6.64+, V106+, 1.22+, .2.0+, 1.25+ The Bad . Its is a uof . -and . ,. It characteristics, is not a full bBad at the top of $the ', moving |12's , as qby the DOS @by 5,120 08, 16, 21, 25, and 26 mby the , the Bad X. It wone . or . in the #accessed a DOS DIR 6is issued. Bad of 3,430 to 3,443 at the end of the p, however, be hidden the . The >and in the DOS not be . The in the 5in all Bad "Bad "*.*" [sluggish or slow response , particularly regard to the DOS DIR Random :may PZPAPN Bad-389 : Bad-389 H: March, 2; TSR R: 389 5: PRsCK - V106+, 3.96+, V106+, 1.22+ The Bad-389 in March, . Its . Bad-389 is a bBad-389 X, the Bad-389 as a low TSR of 544 mby the . Bad-389 cannot determine it is already , so it X, taking up an , the Bad-389 pof 389 at the end of the a. The >and in the DOS !set to the >and . The in the 5in all Bad-389 "Bad PZPAPN Badsec : Badsec 905, Backfont H: ; bad or lost clusters; unexpected accesses to R: 765 5: PRhE - NAV, The Badsec . Its . Badsec is a of . The the Badsec at the top of $the '. It Nnot move 12's , as by the DOS @by 4,384 mby the the Badsec , it pof 765 the end of the a. The >and in the DOS not be the Badsec may notice the access unexpectedly. accesses , a bad or a lost cluster may , hence the jmay as well. Topsy-900: , Topsy-900 is on the Badsec . It is fthe Topsy-900 zing at the top of $the 2,736 to 5,472 ), and by the , Topsy-900 may sporatically. pof 900 at the end of the See: BackFont-896 PZPAPN Banana : Banana Trivial-Banana H: &failures Sweden R: 139 5: ONCK - \, NAV, 8/93+, The Banana . It is fSweden. Banana is a of . . It corrupts the the Banana X, the Banana wall of the . in the E. Banana s the b139 )of the v, so were larger 139 smaller 139 . The >and in the DOS not be The can be in the all Banana "BANANA, 5d by Morbid Angel -92 in Stockholm/Sweden" "*.com" Banana no longer function Since the "of the host , it is not possible to dis should be replaced clean, copies. See: Mini-45 PZPAPN Bandit : Bandit Research H: May, Italy R: 1,641 5: PNE - , NAV, /2.1+, The Bandit in May, . Bandit is fItaly. It is a uof . Bandit is X, Bandit search the Oand Efor an w. If an d, it r. Bandit 1,641 at the end of the The >and in the DOS not be Bandit 9the , the second of at the end of "*.* *.exe ww "!!PCBANDIT!!" Bandit is on the Enigma s to be a research See: Enigma PZPAPN Baobab : Baobab H: India R: 1,641 - 1,651 5: PRhE - , NAV 3.0+, /2.1+, .2.0+ The Baobab . It is fIndia. Baobab is a uof . bBaobab X, the Baobab at the top of $the '. It Nnot move |12's qby the DOS 2,560 mby the Baobab the Baobab , it pof 1,641 to 1,651 at the end of the a. The Baobab , adding an 1,648 >and in the DOS to the >and the last of the It is what Baobab may do of Baobab are: Baobab-731: A 731 of the Baobab is 1,552 , it are X, adding 733 to 752 )to the The at the end of the a, and the >and in the DOS to the >and . Like the , adding 736 t. The in the "Fhello" March, PZPAPN Barcelona : Barcelona H: 3; TSR Spain R: 1,792 5: PRsC - /, NAV, The Barcelona fBarcelona, Spain, in . Barcelona is a uof . on the bBarcelona X, the Barcelona as a low TSR of 2,096 ). It Barcelona is , it pof 1,792 at the "of the a. The >and in the DOS to the The can be in the in Barcelona "CATALUNYA" "CATALUNYA LLIURE" "FORA LES FORCES D`OCUPACIO" "MORT ALS TERRORISTES TRICORNUTS" It is if Barcelona carries any damage potential. See: PZPAPN Barrotes : Barrotes H: ; vertical bars & &failure; corrupted Spain The R: 1,310 5: PRhAK - /2.1+, 6.64+, 1.25+ The Barrotes }in The s to ated in Spain. Barrotes is a uof . W, and overlay bBarrotes X, the Barrotes at the top of $the ', hooking |21. and , as qby the DOS @by 1,600 |12's be moved. , the Barrotes copy of in the C: Oroot Eif it was not the Barrotes , it W, and overlay pof 1,310 at the end of the a. The and in the DOS not be The in the Barrotes 5in all "c:\ 6.com" "l7SO" The Barrotes 5th of any year. At , the vertical bars across the M, and the at the DOS prompt: BARROTES por OSoft" s, the write a portion of its 5to the . The next the fthe K, the fail. of Barrotes are: Barrotes.840: in March, 1994 fSpain, Barrotes.840 is an 840 of the Barrotes Its is 1,600 ), hooking Like the , it wthe copy of in the C: Oroot pof 840 at the end of the a. The in the the last ring at the very end of all "c:\ 6.com" "OS" 5th of any year, the Barrotes.840 : Spain March, 1994. Barrotes.1303: fSpain in ^1994, Barrotes.1303 is a 1,303 of the Barrotes Its is 1,632 ), hooking Like the , it wthe copy of in the C: Oroot pof 1,303 at the end of the a. The in the 5, the Swhile the last is un can be dat the very end of all "C:\ "Sta Tecla (MAD1)" "ST" It is what Barrotes.1303 : Spain ^, 1994. PZPAPN Basilisk : Basilisk H: March, ; DOS =seconds = 62 North America R: 1,639 - 1,653 5: PRhAK - \, NAV 3.0+, 2.53+, 30.00+, 2.53+, 1.22+, The Basilisk in March, , and is fNorth America. Basilisk is on the R-10, R-11, and Sunday 2 and is a uof . -and . ,. It should be considered a as it on open, as well as hiding the bBasilisk X, the Basilisk at the top of $the ', hooking {21, 22 and 27. , as qby the DOS @by 3,408 12's not be moved. , Basilisk the Basilisk , it larger 2K in for any reason. pof 1,639 ). . pof 1,639 to 1,653 ). In both cases, the be hidden by the . The at the end of the . The >and in the DOS not to be , but actually seconds field set to 62. The in the Basilisk 5in all "Basilisk v1.0" "Packed ais corrupt" "(c) YAM/RABID International" "The slave thinks he is released fbondage" to find a stronger set of chains" the Basilisk Tdetected on the Basilisk See: Sunday-2 PZPAPN H: The R: 1,392 - 1,406 5: PRtE - V108+, 2.11a+, 2.58+, \2.13+, V108+, 2.58+ The B , and is Qes is a uof . . The 8a poem, is how it derives its X, the B at the top of $the ', moving |12's , as qby the DOS @by 4,912 ). No are Fly mapped to the The B vup to five . in the ever an pof 1,392 to 1,406 at the end of the a. The >and in the DOS not be The in the B "sandy b "bridges sinking into the sea" "beautiful confusion" "you're a fading "Dis W\* \" It is what B PZPAPN Beast-N-Black : Beast-N-Black Beast H: in \DOS Emay be R: 429 5: PNCK - , NAV, The Beast-N-Black }in the is a uof . the Beast-N-Black search the Efor all , and wthem. it completes E, it attempt to wall . in the root Eof the the Beast-N-Black pof 429 ). The at the end of the . The >and in the DOS not be . The can be in the 5of all -\DOS\*. "Beware the Beast-N-Black" "(C) , Night Crawler - SKISM/PHALCON" The Beast-N-Black is malicious. It all . in the DOS Eon the of Beast-N-Black are: Beast-N-Black B: gequivalent to the has three differ. : Canada May, Public Enemy: on the Beast-N-Black vall . `in the Eand the Oroot X. It adds 429 )to the ,. The at the end of the a. The can be in all Public Enemy -\DOS\*. "Public enemy number one" PZPAPN : Bebe H: i; long Kaccess on . clicking on speaker and R: 1,000 - 1,019 5: PRCK - , NAV, The Bebe fthe . Bebe is a s as a Bebe is X, Bebe search and wall on the and E. If ,resides in the E, it Bebe by 1,000 to 1,019 at the end of the a. The lhad >and in the DOS to the >and Since Bebe searchs the E, and vall . Zof an in a long, slow load much access while the Bebe is a Nn't be llike one. X, it portion of for awhile, the activate. At , it emit a "click" on the speaker, and the be hung. Bebe Nnot on 386 class , on those Zof a Bebe- in a hang. PZPAPN Beeper : Beeper Russian Mirror H: 2; beeps on speaker; R: 482 5: PRCK - , NAV, The Beeper, or Russian Mirror, }in the . It was not until to previous samples not replicating. Beeper is a uof . ,. It can corrupt the The the Beeper the Beeper in low , hooking |21. , as qby the DOS not be the Beeper , it Xtwice in a row. pof 482 at the end of the a. The >and in the DOS to the >and . No in the the Beeper [the Kbecoming corrupted, ing in an "Invalid specification" to access it. s of may notice a "beep" be emitted fthe speaker PZPAPN : Beer Beer-2794 H: R: 2,794 - 3,069 5: PRtA - 3.96+, NAV 3.0+, The Beer, or Beer-2794, , and fthe . Beer is a -and . , but not bBeer X, the Beer at the top of but $the ', moving |12's , as qby the DOS @by 4,096 mby Beer in , the Beer -and . pof 2,794 pof up to 3,069 ). In both cases the at the end of the a. The >and in the DOS not be It is what the Beer of Beer are: Beer-2850: A 2,850 of the Beer 4,096 ), hooking |21. It -and . , but not of 2,850 )while . by up to 3,125 ). The at the end of the a, and the >and in the DOS not be Beer-3164: A 3,164 of the Beer 4,096 ), hooking |21. It -and . , but not of 3,164 )while . by up to 3,437 ). The at the end of the a, and the >and in the DOS not be The in the Beer-3164 ,AIDSTEST. WDISKDATA.DTL" March, PZPAPN Belgium-320 : Belgium-320 H: May, Belgium R: 320 5: PRaCK - V105+, \2.09+, 6.55+, 2.53+, 30.00+, 2.10+, n1.04+, V106+, 2.53+, 1.22+, 6.64+ The Belgium-320 in May, , and is Belgium. is a uof . bBelgium-320 in a "hole" in , hooking |21. It access the it won't on the the Belgium-320 , it pof 320 the end of the a. The >and in the DOS to the and . The very close to the end of all Unexpected jmay PZPAPN Benoit : Benoit H: jmay DOS England R: 1,183 5: PRhE - \2.09+, 3.96+, V108+, n1.03+, NAV 3.0+, V108+, 1.22+, The Benoit . It is one of the es written by the ARCv writing group fEngland. Benoit is a bBenoit X, the Benoit at the top of $the ', hooking , as qby the DOS @by 2,048 |12's not be moved. the Benoit , it for any reason. pof 1,183 at the end of the a. The p, however, not be . The >and in the DOS to be the seconds field be set to "62". The the Benoit "[BENOIT] ICE-9" "Made in Engalnd" "Release 5th ICE-9." "Dedicated to Beno t B. Mandelbrot G" England is spelled as in the 5, it isn't a typo. may hang the Benoit PZPAPN Best Wishes : Best Wishes Best Wish, Wishes H: anot modification R: 970 5: PRtCK - \, NAV, The Best Wishes and is believed to be fthe . Best Wishes is a uof . is a , Best Wishes B, is 1,024 The the Best Wishes X, the high , but $the '. The be moved. Aby 61,440 Aby 61,360 , and the be modified. modification and still Best Wishes is , the a probability of 50%. by 970 the end of the near the end of the m ... Best Wishes!" Best Wishes Nnot restore the >and in the , so all =stamps set to the >and Two of a Best Wishes tare may anot ais actually on K, as well as jon every fourth of Best Wishes are: Best Wishes B: An earlier of Best Wishes, 1,024 . The major differences are !modified. Zof a . in the most likely r, but the hang. Best Wishes C: An of Best Wishes, not hang the by the Zof . , however, usually in a hang. PZPAPN : Beta Phalcon H: R: 1,117 5: PNC - , NAV, .2.0+, The Beta . Its . Beta is a uof . . It Nnot a Beta X, the Beta wup to three . in the pof 1,117 ). The at the end of the be no 3to the >and in the DOS . No in the It is if Beta See: Elvis-1250 Ministry Phalcon.894 PZPAPN Beware : Beware H: Moscow, R: 442 5: PNC - \, NAV, The Beware . It s to ated fMoscow. Beware is a uof . . It Nnot the Beware X, the Beware search the Efor an ,over 2K in w. If it is d, the Beware the Beware pof 442 ). The at the end of the . The >and in the DOS . The can be in the 5in all Beware "BEWARE ME - 0.01," "Copr (c) DarkGraveSoft - Moscow The Beware on the bMonday of any month, at on the PZPAPN : BFD BFD-452 H: BSC; . ; high density Imay fail to R: 452 5: ORhEB - /2.0+, 8/93S+, NAV 3.0+, 8/93+, The BFD }in the is a multi-partite and . . It should be considered a do not lany , and it `on open. It spreads very quickly. The the BFD wthe if the Ois a floppy O. It access the C: the C: , the at the top of $the DOS , as by the DOS @by 2,048 mby BFD in . The should note BFD can &ing J. The same the BFD , it , as well as a non-write protected Jis accessed. pregardless of whether the . The BFD writing its 5to the . Wheader area of the lany >and in the DOS . No the the BFD I, it s the . The be missing the usual DOS . In the case of high density 5.25" fthe fail, in a hung BFD Nn't to do of BFD are: BFD-452: A 452 of the BFD PZPAPN Big Bang : Big Bang H: , 1994 R: 346 5: PNC - /2.1+, V112+, \2.13+, 6.64+, .2.0+, V113+ The Big Bang , 1994. Its . Big Bang is a `. It Big Bang is X, the wall of the . in the Big Bang pd in by 346 the end of the a. The >and in the DOS not be . The in the 5in all "[Big Bang] (c) Evil Avatar *. 1st of any year, Zof an trigger the PZPAPN Big Joke : Big Joke H: R: 1,068 5: PNC - NAV, The Big Joke . Its . Big Joke is a `. It Big Joke is X, the wone in the Big Joke pd in by 1,068 the end of the a. The >and in the DOS to the >and The Big Joke to the L, it is written one line at a to the center of the completes, it be repeated until the is re &ed. The "At last . ALIVE I guess your computer is rby the Big Joke Release 4/4-91 Lucky you, is the kind Be more careful while duplicating in the future. The Big Joke , killer strike The Big Joke rules forever." The can be Big Joke, as well as the ctwo -MAND" Big joke, in its currect Nnot do Mits PZPAPN Big-2000 : Big-2000 V-1391 H: March, 3; TSR R: 2,000 5: PRsE - \, NAV 3.0+, 2.10+, 6.64+, The Big-2000, or V-1391, in March, . Its . Big-2000 is a uof large . bBig-2000 X, the Big-2000 as a low TSR of 2,848 ), hooking {01 and 18. the Big-2000 , it `larger 60K in pof 2,000 at the end of the a. The >and in the DOS to the >and in the 5in Big-2000 It is what Big-2000 PZPAPN Billboard 1.0 : Billboard 1.0 H: =seconds = "00"; R: 835 5: PNCK - 2.11+, \2.13+, n1.05+, 1.25+ The Billboard 1.0 claims to be fAustralia, its . Billboard 1.0 is a of . ,. It Nnot wvery small . the Billboard 1.0 wall of the . in the are larger 3K. pof 835 at the "of the a. The in the DOS may dis as the sets the seconds field in the >and to "00". The in the Billboard 1.0 "Billboard 1.0, (c) [Nuke]." "Jeff K. - You are a lying prick, just like all politicians" "Patty - was written fthe ground up, in Australia" "Alan - You are wasting your chasing Rock Steady" "Frisk - Pull your head out of your ass [NuKE] is way ahead of you AV wankers" "Johnny - is just too lame to worry about ha ha" "*.com" The Billboard 1.0 Mthe PZPAPN : Bios H: i; continuous R: 2,048 5: PRhAK - 8/93+ The Bios, or Ned, . Bios is uof . -and . ,. It employs techniques to avoid detection. The the Bios the Bios at the top of $the ', hooking 09, 1C, and 21. , as by the DOS @by 8,336 the Bios , it -and . by 2,048 hidden Bios is . The the "of . and the end of . . The >and in the DOS not be . The in the 5and cannot be seen in "Mr.Watshira Sae-eu KMIT-NB >12/28/ BIOS" the Bios may notice the DOS to re &the in a continuous series of re ring. PZPAPN Bit Addict : Bit Addict H: The R: 477 5: PRaCK - 3.96+, NAV 3.0+, /2.1+, 1.53S+, The Bit Addict fthe . Bit Addict is a uof . The the Bit Addict X, the Bit Addict in Video Card a hook to in low mby the . The DOS not indicate any the Bit Addict , it pof 477 at the end of the a. The in the DOS not be . The can be in the 5in all Bit Addict "BIT ADDICT" "The Bit Addict says" "You la good taste for Ks, it was delicious !!!" It is what may do of Bit Addict are: Bit Addict-496: , Bit Addict-496 to be an earlier of the . It zs a 2,576 *TSR X, hooking pof 496 at the end of the a. The >and in the DOS to the >and . No in the PZPAPN Bizarre : Bizarre H: DOS Belgium R: 2,716 5: PRhCK - 6.55+, 2.58+, 2.11+, 2.58+ The Bizarre , and is Belgium. Bizarre is a uof . ,, as well as .SYS `. It is a polymorphic a fast bBizarre , as well as wthe copy of ed to by the -SPEC en mental variable. The at the top of $the not moving |12's , as qby the DOS by 7,264 {21 and 2F mby the the Bizarre , it .SYS for any reason. pof 2,716 at the "of the a. The >and in the DOS year field 1to an value, usually during the 50's. The in the Bizarre "Bizarre by Dreamer" "Do You Believe?" The Bizarre interfers the DOS Xmay indicate fake PZPAPN Black Monday : Black Monday Borderline, Monday H: i; TSR; stamp Kuala Lumpur, Malaysia R: 1,055 5: PRsAK - , NAV, : CleanUp, or The Black Monday }in Fiji in . It is reported to be widespread in Fiji and locations in the Far East and Asia. is a generic -and . The the Black Monday X, the as a low TSR of 2,048 the , any the Black Monday by 1,055 the end of the `. . by 1,055 to the end of the Nnot `multiple The Nnot hide the =stamp to the and awas The can be din all `near the "of the "Black Monday 2/3/90 KV KL MAL" Black Monday X, at attempt to format a portion of the of Black Monday are: Black Monday-B: gidentical to Black Monday, has six differ. While . `still by 1,055 by 1,055 to 1,069 Black Monday-C: }in Malaysia in , Black Monday-C s to be an earlier . Like Black Monday-B, . pof 1,055 )while . pof 1,055 - 1,069 ). Unlike the of Black Monday, X. It frequently hang the X, and the . lhad >and in the DOS to the >and Borderline: Borderline is a smaller of the Black Monday by 781 at the end of the a. The >and in the DOS to the >and may , adding 781 for TSR is 2,048 , and hooks 08 and 21. It is if it PZPAPN Black Wizard : Black Wizard H: i; music R: 2,051 5: PNE - , NAV, 3.96+, The Black Wizard . Its . Black Wizard is a of . . It is on the Enigma and Yankee 2 Black Wizard is X, the search the Efor an w. If one is d, it Black Wizard 2,051 at the end of the be no 3in the >and in a DOS . Two can be the "*.exe *.*" "Black Wizard" in the playing the tune "Turkey In The Straw" on the speaker, followed by the executing. Black Wizard may be a research , and not in the public domain, as the sample is not a natural rence of the See: Enigma Yankee 2 PZPAPN Blaze : Blaze H: 2; TSR; &failure R: 284 5: ORsAK - , NAV, 3.95+, 1.53S+, The Blaze . Its . Blaze is a uof . and . the Blaze wthe btwo . -and btwo . in the E. If E, it may it has , it za low TSR of 65,584 ). The "The Eternal Blaze !unleashed...Beware!" "[JD]" the Blaze lthe )of the host the Blaze The can be be no 3to the in the DOS , but the >and to the >and Since the Blaze s the "of the host cannot be dis must be replaced backup copies. the Blaze may fail to ,has of Blaze are: MSK: The MSK, or Midnight Serial Killer, is a 252 of the Blaze . It vthe bthree . `in the X, as well as the C: lthe b252 by the MSK 5. The >and in the DOS to the =. The in the "The Midnight Serial Killer is roaming in your computer..." "Beware!" "[JD]" "*.exe" The may be PZPAPN Blinker : Blinker Blinker-496, Prague.Blinker H: ; spurious Prague, Czechoslovakia R: 512 5: PRhCK - , NAV, The Blinker . It ated in Prague, Czechoslovakia. Blinker is a ,. It is on the Back , and may identify it as such. The Blinker is X, the Blinker at the top of $the , as qby the DOS @by 528 {08 and 21 by Blinker in |12's moved. Blinker is , it wany . X. If X, it ras well. Blinker pof 512 ). The at the end of the be no 3to the >and in the DOS It is what Blinker of Blinker are: Blinker-496: Blinker-496 is a 496 of the Blinker . It 8the "Joker". may receive the Umeesages for no apparent reason , both of require a response to abort, retry, ignore, or fail: "Bad Ureading device CON" "Bad Uwriting device CON" See: Back Shaker PZPAPN Blinky : Blinky Blinky Ghost H: {01 and 03 tof Inky &failure R: 1,302 5: PRaCK - , NAV 3.0+, n1.04+, 6.60+, 2.58+, 1.22+, 2.58+, .2.0+, 6.64+ The Blinky, or Blinky Ghost, and is one of three related fthe popular Pac-Man video game. Blinky is a uof . . It "drops" or is the carrier of a , the Inky bBlinky X, the za portion of hooking {01 and 03. is an attempt by the avoid having debugger used against it. The on to the Blinky wthree . in the E. If ,is in E, it may the Blinky pof 1,302 at the "of the a. The >and in the DOS not be . The are in the 5in all Blinky "[Blinky Ghost]" "The Pac-Man BLINKY Ghost is watching." "[-Inky!-]" "[INKY Ghost] by PacMan and Associates Inc." "Non- "Replace and press any key ready..." The Blinky "drops", or is a carrier for the Inky . The last four fInky. As the Inky is actually a separate distinct , it Cin its own entry. See: Inky Pinky PZPAPN Bljec : Bljec Bljec3, Bljec3B, Bljec4, Bljec4B, Bljec5, Bljec5B, Bljec6, Bljec6B, Bljec7, Bljec7B, Bljec7C, Bljec8, Bljec8B, Bljec9, Bljec9B H: May, Write fault Ton device PRN; &failures R: 231 - 374 5: PNC - , NAV, The bBljec Vin May, . In , six were , four of them fItaly. Bljec is actually a es. All of the es are us of . exception of Bljec3 and Bljec4, do not typically ,. Bljec es mark `by checking for two NOP instructions (9090h) at the very "of the The description $applies to Bljec6, the differences for the qlater in entry. Bljec6 is X, the search the Oand Efor three . by 276 ), the at the "of the a. The >and in the to the >and Bljec6 may hang the X, or may simply refuse to function of Bljec are: Bljec3: Probably the earliest member of Bljec3 vthe bfour . `in the ever an X. If bfour . `are already r, it not `in the by 231 at the "of the a. The >and in the to the >and . A symptom of an Bljec3 is may receive the "Write fault Uwriting device PRN" It is what Bljec3 was to write to the printer. in a hang. particular sample of Bljec3 was fItaly Bljec3B: , Bljec3B is a 236 of the Bljec3 Bljec4: fthe NCSA in , Bljec4 is to Bljec3. It vthe bfour . in the cthe tof the hang usually Bljec4 by 247 at the "of the lhad in the DOS to the >and in a hang ring. Bljec4B: in May, , Bljec4B is a 252 of the Bljec4 May, Bljec5: fthe NCSA in , Bljec5 is to Bljec4. Its major difference is `is 267 Bljec5B: , Bljec5B is a 272 of Bljec5. Bljec6: See description is 276 Bljec6B: in May, , Bljec6B is a 281 of the Bljec6 May, Bljec7: fItaly in , Bljec7 wthe third, fifth, and sixth . `in the `are already r, nothing more Bljec7 by 287 at the end of the a. The >and in the DOS to the >and . Like Bljec3, write fault Ton device PRN may be Bljec7B: Bljec7B was . It is a 292 of Bljec7. Bljec7C: Bljec7C was . It is a 440 of Bljec7. wno more three . in any E, and resets the clock to 2-27-1989 9the "Digital F/X - Created on 2/5/92 by Phoney Phreak" "*?.com" jmay frequently are Bljec8: Bljec8 was fItaly in . It to Bljec7, the exception pis 358 ), and be no in the >and in the DOS Efor Bljec8B: in May, , Bljec8B is a 363 of the Bljec8 . The in the DOS May, Bljec9: to Bljec8, Italy in . Its pis 369 ), and no 3in the >and in the DOS s. Unlike Bljec8, it not usually not the root Bljec9B: to Bljec9, Bljec9B is a 374 Bljec-XYZ: on the Bljec adds 441 to the . v. It 8the 1.0 - Buddy and Chloe 5/27/89" "?*.com" "XYZ 1.0 - 5/27/89" Bljec-235: on the Bljec adds 235 to the . and .BAT v. It the ?.???" Bljec-284: on the Bljec adds 284 to the . v. It 8the "*.com *.exe *.ovl *.sys" jfrequently See: Sad PZPAPN Blood : Blood Blood2 H: &s and/or cascading effect Natal, Republic of South Africa R: 418 5: PNCK - , NAV, The Blood by Fridrik Skulason in It was }in Natal, Republic of South Africa. are two , Blood and Blood2. is a uof . the Blood X, it wone . in the C: Oroot E. The newly pd in by 418 ). If the just ,, a cthe &, executing an in a cascading effect of the cursor down the The next . in the accessed followed by the hanging. Spurious on the on the line $the line. Zof an hang. of Blood are: Blood2: to Blood, the major difference j, and the cascading cursor effect no longer Nnot hang the 15th. PZPAPN Blood Lust : Blood Lust Trivial-Blood Lust H: &failures Sweden R: 302 5: ONCK - , NAV, 8/93+, The Blood Lust . It is fSweden. Blood Lust is a of . ,. It s the "of the Blood Lust is X, the Blood Lust wall of the . in the E. If E, it the Blood Lust lthe b302 )of the by the 5. Unless the smaller be no smaller 302 be no 3to the >and in the DOS The in the Blood Lust and are not "*.C*" "Hi! is the Blood Lust striking." "Sorry to tell you, but your The may be Lby the circumstances. See: Mini-45 PZPAPN Blood Sugar : Blood Sugar H: ^, 1994 R: 416 5: PNCK - \2.13+, 1.22+ The Blood Sugar ^, 1994. It's is a uof . Blood Sugar is X, the Blood Sugar wall of the . in the E. If E, it of 416 at the end of the The >and in the DOS not be . The in the "[C6H1206] $ Blood Sugar by MnemoniX" PZPAPN Bloody Warrior : Bloody Warrior H: , 1994 Italy R: 1,344 5: PRhAK - \2.10g+, 2.11a+, V114+, 6.64+, V116+, 1.25+, 6.64+ The Bloody Warrior ^, 1994. It to be fItaly. is a uof . and . bBloody Warrior at the top of $the ', not moving |12's , as the DOS @by 2,768 mby the the Bloody Warrior , it -and . pof 1,344 at the end of the a. The >and in the DOS not be . The in the Bloody Warrior's "FUCK YOU" -SCANSTOPSHIELDCLEANCVDEBUGTDHello, world" "I am the Bloody Warrior. Nice to meet you. What about ? Funny ?" is no hope for you. was released in Milan . Bloody Warrior" It is what Bloody Warrior PZPAPN Bloody! 00] O PT] : Bloody! Beijing, H: Extended Taiwan R: N/A 5: BRtX - \, NAV, : CleanUp, or see The Bloody! , and reports were V, Taiwan, and the is a uof floppy as well as the fa floppy or Bloody! , the at the top of $the Aby 2,048 ). The be moved. The much longer expected. The rimmediately if it was not the source of the At the &, the maintains a counter of how many s the Ohas , the Mthe during the "Bloody! Jun. 4, 1989" 4, 1989 is the >of the confrontation in Beijing, China between Chinese students and the Chinese Army in many students were killed. later be Lon every sixth 128 &limit has Qed. The in the 5, so it is not in the Bloody! is , the wany is accessed. not be enough to cause the wthe be missing all of the normal DOS are normally din the . The !moved to 11 on 360K I, a part of the root E. If were root Eentries in , those be lost. On the K, the moved to side 0, cylinder 0, For floppies of 360K, unusable or corrupted as the Nnot take into account the existence of For I, Bloody! can be removed by powering the off and &ing clean, write-protected J. The DOS SYS 6should Qof the To remove the Bloody! fthe the should be copied back to its position. The option is to backup the `on the Kand low level format the O. In the case of DOS 5.0, the can be rebuilt by using the DOS FDISK the undocumented /MBR option. of Bloody! are: Bloody!-B: in May, equivalent to the . It has avoid detection by most utilities. May, PZPAPN : Bob ew-718 H: R: 718 - 1,414 5: PNCK - /, NAV, The Bob . Its ~, are . Bob is a uof . the Bob wall the in the Eof the usually pof 718 the was less ), its 1,416 ). The at the of the . The >and in the DOS not be The can be din all Bob "*. *. ,MKS_VIR. terminated normally" It is if the Bob PZPAPN Bomber : Bomber Bomb H: May, ; sluggish DOS DIR 6s; beeps & &failures; Malaysia R: 2,204 5: PRhCK - \2.13+, The Bomber, or Bomb, fMalaysia in May, is a uof . employs technology to avoid detection. It 31st, Malaysia's Independence Day. the Bomber the Bomber at the top of $the |12's not be moved. qby the DOS @by 3,072 {1C, 20, 21, and 22 mby the Bomber the Bomber , it . It of the . in a a DOS DIR issued. the Bomber pof 2,204 hidden if Bomber is . The the "of the >and in the DOS Bomber is an , and no the The Bomber 31st, Malaysia's Independence Day. On 31st, the emit three beeps and the "! I AM THE STEALTH BOMBER ! I BELONG TO THE NEW GENERATION OF -PUTER VIRUSES. LIKE THE STEALTH BOMBER, I GO UNDETECTED BY ENEMY RADAR DO NOT PANIC I AM SHOWING OFF HOW EASY I CAN EVADE YOUR ANTI VIRUS SYSTEM - I DO NO HARM" Bomber Nn't do malicious Ming its . However, the Bomber &failures r, as well as #detected by the DOS Bomber is . Lastly, the DOS DIR be very sluggish. of Bomber are: Messy: fMalaysia in May, , Messy is a of the Bomber . The major 3between the two es is Messy emit more beeping on 31st, and Mthe "MESSY VIRUS CATCH ME IF YOU CAN !!! HA..HA..HA!!!" PZPAPN Boojum : Boojum H: May, R: 340 - 350 5: PRhE - , NAV, 8/93+ The Boojum in May, . Its ~are . Boojum is a the Boojum the Boojum at the top of $the |12's not be moved. qby the DOS 368 mby Boojum in the Boojum , it pof 340 to 350 at the end of the a. The in the DOS not be . No in the 5in Boojum Boojum Nn't do PZPAPN &Killer &Killer H: BSC; &failures; inaccessible R: N/A 5: BNX - \2.09f+, NAV 3.0+, 2.10+ : DOS SYS on I, Norton KDoctor on The &Killer . Its &Killer is a uof the ) and is attempted to be &Killer J, the &Killer be read into , and the fail, Ming the "Non- Replace and press any key ready" has replaced the J, and struck a key, the the proceed. If the Jwas a non-write protected J, the &Killer it, . At same , the rthe it as well. &Killer [frequent failures I, as well as the Khaving inaccessible due to &Killer fthe in the same The damage to the can be repaired using various Kdiagnostic oNorton KDoctor. I, the DOS SYS 6can be used to replace the PZPAPN : Bow 5856 H: May, R: 5,856 5: PRhAK - 8/93+, 1.22+ The Bow, or 5856, in May, is a uof . -and . The a Bow X, the Bow at the top of the ', not moving |12's , as measured by the DOS @by 5,888 ). The Bow {1C and 21. the Bow , it -and . X, as well as pof 5,856 at the end of the a. The >in the DOS not be , but the may be to a different value. Two in the 5in Bow "TRUS" "bow!" It is if the Bow PZPAPN : Boys H: May, acreation R: 500 5: PRCK - , NAV, The Boys in May, (. It is a uof . and The the Boys Boys . Unlike most be no mapping utilities not indicate is in as no {are Boys is , any . larger by 500 at the end of `. The can be Boys: "The good and the bad boy." The at the end of Boys is a malicious X, it alter the attribute )of . setting the attribute. The . lists the E. If the to copy back the missing . , a " acreation since the `still exist. The . has hidden can be recovered by removing the attribute. of Boys are: Boys 2: on the Boys , Boys 2 is a uof . Boys 2 is X, Boys 2 search the Efor an w. If one is d, it r, and Bone . fthe E. Boys 2 pof 500 at the end of the . The can be in the "The good and the bad boy." See: Bad Boy PZPAPN Brain : Brain Pakistani, Pakistani Brain, Clone, Nipper H: 1986 Extended ; volume label -TOM; three contiguous bad (floppy ); BSC Pakistan R: N/A 5: BRt - , NAV, K, CleanUp, \, NAV, or DOS SYS The Pakistani Brain ated in Lahore, Pakistan and by moving the contents of the to an location on the K, marking those 3 clusters (6 bad in the FAT, and writing the 5in the One sign of a Khaving r, at least , is the volume label 1to "(c) Brain". sign is the label "(c) Brain" can be (the ) on an , taking up between 3K and 7K of RAM. The Brain is able to hide detection by intercepting any might interrogate the and re Fing the read to the elsewhere on the K, thus be unable to see the The Brain rfloppies, however the can now Ks. the "(c) Brain" label removed to make them ker to detect. of Brain are: Brain-B: ( KBrain/Houston Brain-C: Brain-B the "(c) Brain" label removed. Clone: Brain-C but restores ©right label. Clone-B: Clone modified to destroy the FAT 5/5/92. Nipper: fSpain in Ks. The 8the in the "Welcome to the Dungeon (c) 1999 NIPPER SOCIEDAD GAMBERRISTICA VIVA LA PIRATERIA. Dedicated to the memories of See: Ashar PZPAPN Brainy : Brainy H: R: 768 - 1,531 5: PRsCK - , NAV, The Brainy . It is (. Brainy is a uof . ,. It is on the Warrior The Brainy is X, the Brainy at the top of $the mby the Brainy |12's !moved. , as by the DOS @by 1,552 the Brainy , it wall . pof 768 to 1,531 ). Unlike most es, the Brainy inserted into the a, possibly in the middle. The can be dat the end of the 5in all Brainy "eAWRREI!R" Brainy usually not 386 processor, and may hang the It is if Brainy See: Warrior PZPAPN Brazilian Bug : Brazilian Bug H: May, Brazil R: 1,343 5: PNCK - , NAV, The Brazilian Bug Gin May, . It is fBrazil, and may >back to late is a uof . , but not the Brazilian Bug is X, the wall . in the it completes sall the , it Mthe * HELLO FRIEND WE ARE SORRY TO INFORM YOU THAT YOUR SYSTEM IS VERY ILL AND WILL NOT SURVIVE " MUCH LONGER YOU UNFORTUNATELY HAVE - THE BRAZILIAN BUG - FOR WHICH THERE IS NO CURE WE HOPE THIS WILL NOT BE AN INCONVENIENCE TO YOU LOVE, $ THE MAGIK MUSICIANS" The host complete the Brazilian Bug pof 1,343 at the end of the a. The >and to the >and . All of the in the PZPAPN Breeze : Breeze H: The R: 358 5: PNCK - /2.0+, 8/93S+, 3.96+, 30.00+, NAV 3.0+, 8/93+, .2.0+, The Breeze , and is fThe . Breeze is a uof . ,. It is written by the same author as the Deicide the Breeze X, the Breeze wone . in the E. If E, it may the Breeze pof 358 the "of the a. The >and in the DOS not be . The can be in the 5in all Breeze "Dutch [Breeze] by Glenn Benton" Breeze Nn't to do See: Deicide PZPAPN Bryansk : Bryansk H: ; Read- attribute set R: 673 5: PNCK - /2.0+, 3.96+, NAV 3.0+, .2.0+, The Bryansk . It is fthe . Bryansk is a the Bryansk X, the Bryansk check the >and . If it is not a Friday before 15:00 (3:00PM), the wone . in the E. If an acannot be din the E, it move upward in the Estructure searching for a . until it r Qes the root the Bryansk pof 673 ). The at the end of the a. The >and in the DOS not be . The can be in the 5in all Bryansk "BRYANSK , BITE 0.01 (C)" On any Friday before 15:00 (3:00PM), the Bryansk `, instead it set the Read- attribute on for `using the aspecification "*.*". PZPAPN Bubonic : Bubonic H: May, i; DOS sluggish DOS DIR R: 2,181 - 2,193 5: PRhAK - /2.1+, 2.58+, 6.64+, 1.22+, 2.58+, 6.64+ The Bubonic in May, . Its . Bubonic is a , fast -and . It is a , hiding the bBubonic X, the Bubonic at the top of $the ', hooking |6B. , as qby the DOS @by 2,592 |12's not be moved. , the Bubonic -and . pof 2,181 Bubonic of 2,181 to 2,193 one may by up to 2,254 ). In both cases, the is hidden , and the at the end of the a. The >and in the DOS not be . The in the 5in all Bubonic "Bubonic[BBP],alpha.02a,fixedFCBbug.Soon:tighter "anti-(debug,heuristics),norunifanti- prog.running (FSP,etc.)better "NEW!genetic,algorithmicdarwin-encryptionandadrop libraryofmanyvirii,allless "Ooops, Sorry..." the Bubonic [sluggish DOS DIR 6output. The DOS the Bubonic detect all PZPAPN : Budo H: fail to Finland R: 890 5: ONA - 3.96+, NAV 3.0+, The Budo fFinland in . Budo is a -and . , but not the Budo may wone . -or . in the The ed to the DOS prompt. lthe b890 by the Budo 5. Unless the host was smaller . In the case of smaller 890 . The >and in the DOS . The can be in the "BUDO V1.2 TH HV FINLAND PQ" "FLOW LIKE A RIVER - STRIKE LIKE THUNDER" Budo destroys the v, and be replaced fclean, backups. PZPAPN Burger : Burger 404, 505, 509, 537, 540, 541, 542, 560, 560-B, 909090h, CIA, CIA-2 H: 1986 not run West Germany R: 560 5: ONAK - , NAV, The Burger, or 909090h, was written and copyrighted in 1986 by Ralf Burger of West Germany. is extinct in the "public domain". is a -and . the Burger X, the attempt to wone in the C: Oroot E. To determine if the r, the checks to see if the bthree )of the . aare three NOP instructions (909090h). If the bthree )are the NOP instructions, the goes on checking until it finds an a. If no aexists, the s all the . `in the root Eto . `and checks those it finds w, it s the b560 )of the 5. At , the the to run either end or hang the never as the bportion of the !destroyed. the Burger fail to the ,, or the copy of `can be easily identified by the "909090B8 026A245" hex sequence in the bnine )of all `cannot be must be replaced fa clean source. of Burger are: 404: to the Burger 's actual is 404 b560 bnine 9the hex : "909090B8 026A245". 505: to the Burger 's actual is 505 b560 bnine 9the hex : "909090B8 026A3A0". 509: to the Burger 's actual is 509 b560 bnine 9the hex : "909090B8 026A3A4". 540: to the Burger 's actual is 540 b560 bnine 9the hex : "909090B8 026A3A3". 541: to the Burger s the 560 actually 541 start the hex sequence: "909090B8 026A3A4". 542: to the Burger s the 560 actually 542 start the hex sequence: "909090B8 026A3A5". 560-B: to the Burger s the b560 , and the is 560 ). The end of the 8the : "his awas downloaded fthe Vir". in all d samples. start the hex : "909090B8 026A3B2". CIA: Gin the to the Burger . The bnine )of all `in hex "909090B8 026A3A5". The actual 541 b560 CIA-2: }in May, is a minor the CIA See: 382 Recovery 405 Dewdz VirDem VirDem-1542 Wonderful PZPAPN Burghofer : Burghofer H: Switzerland R: 525 5: PRhCK - , NAV, The Burghofer , in Switzerland. Burghofer is a uof . bBurghofer X, Burghofer at the top of but $the as measured by the DOS Aby 528 mby the Burghofer is , it X. If X, it by 525 ), the at the end of the The >and in the not be Burghofer 9the "GS/02" at the fourth thru eighth )of the Burghofer Nn't do PZPAPN Busted : Busted H: /corrupted R: 571 5: ONE - NAV, 1.53S+, The Busted . Its ~, are . Busted is a the Busted wall . in the has completed sall . in the E, the too big to fit in lthe b571 by the , permanently damaging them. be no 3to the unless the . smaller ), in case the 571 ). The >and in the DOS Several are Sin all d samples. "Busted!" on Leprosy-B." x PCM2" "Busted, Strain A, 1.08y" "(Psychogenius), Busted Nnot to do %replicating, destroying the . PZPAPN Butt Stink : Butt Stink H: North America R: 540 5: PNE - 8/93S+, NAV 3.0+, n1.04+, 6.64+, 1.22+, .2.0+, 6.64+ The Butt Stink , and is probably fNorth America. Butt Stink is a uof . the Butt Stink wall of the . in the 540 at the end of the a. The >and in the DOS . The in the Butt Stink "You know what?" "Your Butt Stinks!!!" "And YAM can't stand it!" The last three lines of forms a Lon the monitor PZPAPN Butterflies : Butterflies Butterflies-302, Goddamn Butterflies H: Illinois, jmay R: 302 5: PNC - , NAV 3.0+, 8/93S+, 3.96+, 30.00+, 2.53+, V111+, .2.0+, The Butterflies, Butterflies-302 or Goddamn Butterflies, in the state of Illinois in the . Butterflies is a uof . , but not ,. It has !given a status of 7as many reports of were mid to late due to its distribution on a shareware communications package. reports were fthe Canada, V, and Israel. As such, its the Butterflies wall of the . in the meet its selection criteria. pof 302 at the end of the a. The >and in the DOS not be . The are in the 5in all Butterflies "Goddamn Butterflies" Butterflies Nn't to do much jmay unexpectantly are of Butterflies are: Crusades: on the Butterflies wthree or four . `in the by 302 at the end of the a. The >and in the DOS . The the 5in all Crusades "Hurray The Crusades" jfrequently Crusades to the Crusades wfour . `in the by 302 at the end of the a. The >and in the DOS not be . The in the 5in all Crusades "Hurray The Crusades" , 1994. PZPAPN ButtUgly : ButtUgly H: May, R: 552 5: PNCK - n1.04+, 2.58+, 1.22+, 2.58+, The ButtUgly in May, . Its . ButtUgly is a uof . the ButtUgly wone . in the pof 552 the at the end of the a. The and in the DOS not be . The in the ButtUgly "PATH=" "Fool. Dolt.. Fuck You! HaHah. You Limp Cock! Damn! Your Butt-Ugly." "by Primal Fury" "* *.*" It is what ButtUgly PZPAPN Cacophony : Cacophony Cacophony 1 H: ^, 1994 1to 4:08a tune played on speaker R: 950 - 960 5: PNE - V112+, /2.1+, \2.13+, .2.0+, V111+ The Cacophony, or Cacophony 1, ^, 1994. Its . Cacophony is a non- uof . . A later , Cacophony 2, is adds encryption to the , as well as no longer altering the >and a Cacophony one . in the pof 950 to 960 at the end of the a. The >and in the DOS field is set to 4:08a. The in the 5in all Cacophony "cacophony" "*.e?*" "\ .. smartc*.cps" Cacophony may interfer the functionality of the Central Anti- . The zs a small portion of at the top of $the ', hooking |08. 5is not a complete copy of the , but a routine to play a tune on the speaker of Cacophony are: Cacophony 2: A later of the Cacophony vone . ain the pof 1,056 to 1,066 at the end of the a. The >and in the DOS not be . The in the Cacophony "CACOPHONY * EpidemicWare 93 G.I.P.Po." "Cacofonia" W\ *.* smartchk.cp?" Like the play a tune on the speaker #present on the for . It may interfer the functioning of Central Anti- ^, 1994. PZPAPN Cadkill : Cadkill Milous H: R: 1,163 5: PRhAK - , NAV, /2.1+, 8/93+, .2.0+, The Cadkill . Its . Cadkill is a generic uof . and . The Cadkill is X, the Cadkill at the top of $the , as measured by the DOS Aby 2,048 {1C, 21, and 24 mby the Cadkill is , it -and . X. If X, it by 1,163 ). The at the end of the It is what Cadkill PZPAPN Cannabis 00z S PTz : Cannabis Cannabis 2, Cannabis 3 H: BSC; The R: N/A 5: BRh - Floppy 8/93+, .2.0+ : DOS Sys on The Cannabis fthe . Cannabis is a uof floppy . The ;submission of Cannabis, the usually in a indicating Kis a non- J, and to replace it Kand press any key. Replacing the J, or removing it and allowing the &to proceed fthe in the &completing. At , Cannabis at the top of $the DOS measured the DOS be 2,048 )less expected. Cannabis is , it wany non-write protected Jexposed to the r360K lthe moved to 9, and the Cannabis 5written to 0, the location of the . Since 9 is normally part of the root :may Cannabis is a very buggy , and it . As a , the was re by the The Cannabis occasionally Mthe "Hey man, I don't wanna work. I'm too right now..." , along the word "Cannabis". of Cannabis are: Cannabis Dropper: A very small . 9ed the Cannabis nothing but the Cannabis Cannabis 2: Cannabis 2 is a of the Cannabis has the bug fixed prevented Cannabis I. It 8one : "CANNABIS". where the DOS number is normally in the . It uses 1,024 , rather 2,048 )required for the . Cannabis 2 is a very poor replicator, and not likely to widespread problem. : The Cannabis 2 Dropper: A very small . 9ed the Cannabis 2 Nnothing but the Cannabis 2 : The Cannabis 3: Cannabis 3 is a minor of the Cannabis 3 . Like Cannabis 2, it 8the one : "CANNABIS". : The Cannabis 3 Dropper: A very small . 9ed the Cannabis 3 Nnothing but the Cannabis 3 : The PZPAPN Cansu : Cansu Sigalit, V-Sign H: BSC; ; graphic Turkey R: N/A 5: BRXh - Floppy , NAV, : M- K/P or DOS 5.0 F- K/MBR on DOS SYS &able The Cansu fCanada in . It is fTurkey. Cansu is a uof the ) and bCansu &ed, the Cansu at the top of but $the , as qby the DOS by 2,048 ). The uses Cansu is , it wthe accesses the K. It wany non-write protected are accessed Cansu vthe K, it saves )of the in its s Side 0, Cylinder 0, 1. The is too large to fit entirely in the , so the remainder of the is written to Side 0, Cylinder 0, 4 and 5. On I, the saves 38 )of the and s the . The remainder of the be stored in the last two of the root E. For example, on 360K 5.25" 10 and 11 9the remainder of the Cansu is slightly polymorphic, and a wildcard search necessary to detect the . Since the and are not saved, dis tshould be performed by replacing the clean copies using utilities intended for purpose. The Cansu Ma V-shaped block character graphic on the monitor the . The graphic is accompanied by a hang. PZPAPN Capitall : Capitall H: i; TSR Poland R: 927 5: PRsCK - , NAV 3.0+, The Capitall fPoland in is a uof . ,. It uses an encryption mechanism used by the Cascade , so it is possible utilities identify it as Cascade. the Capitall as a low TSR of 1,952 {1C, 21, and 28 mby Capitall in the Capitall , it X. If X, it the Capitall pof 927 at the end of the a. The in the DOS not be It is what Capitall may do PZPAPN : Cara H: i; TSR; Spain R: 1,025 5: PRsCK - , NAV, The Cara . It is fSpain. Cara is a uof . ,. It alters do not 9a live The Cara is X, Cara at the top of Aby 3,048 {13 and 21 the Cara . At , Cara ,if it was not r, and alter the Cara is , it are by 1,025 at the end of be no 3in the >and in the DOS Cara lthe "CARA" in the fifth thru eighth )of the is the marker used by the to determine if the already can be dnear the end of `are: es en memoria! Disco es wado. Reemplaza " Clandestino Auto- Reproductivo Anti- CARA" CARA's of the is an attempt to es by providing a new PZPAPN Career Of Evil : Career Of Evil Career Of Evil-446 H: -& .SYS i; DOS R: 446 5: PRhCK - 30.00+, NAV 3.0+, n1.04+, 2.58+, 2.11+, 1.22+, 2.58+, .2.0+, 6.64+ The Career Of Evil, or Career Of Evil-446, . Its . Career Of Evil is a uses techniques to avoid detection and spread quickly to `. It ,, as well as .SYS bCareer of Evil at the top of $the ', hooking , as qby the DOS @by 704 |12's not be moved. the Career of Evil , it -and .SYS for any reason. 446 at the end of the The p, however, be hidden . The >and in the DOS not be . The "UK" can be dstarting in the fourth *of all . The in the the end of "tenUKCareer of Evil" the Career Of Evil , the DOS Ton all of Career of Evil are: Career Of Evil-697: A 697 of the Career Of Evil 960 ), hooking |21. It -and .SYS for any reason. pof 697 be hidden the . The at the end of the a. The >and in the DOS not be . The same as the DOS PZPAPN Carfield : Carfield H: i; TSR; R: 1,508 - 1,522 5: PRsA - , NAV, 1.53S+, : CleanUp, or The Carfield fthe NCSA in Its Hand Carfield is a uof . -and . `. It Nnot on the Sunday The Carfield is X, the as a low TSR of 1,744 ). The Carfield is , it -and . by 1,508 at the "of the by 1,508 to 1,522 the at the end of the be no 3to the >and in the DOS The Carfield on Mondays. It hook in addition to . It Mthe "Carfield!" while it is See: Sunday PZPAPN Carioca : Carioca H: TSR; . R: 951 5: PRsC - \, NAV, The Carioca uof . `, it Nnot The the Carioca X, the as a 1,280 *low TSR. mby the . The Aby 1,312 , any . exception of the Carioca show an of 951 at the end of the lthe chex character at the very end of the a: "2EFF1E1A010203CD21". It is if Carioca 8any damage potential. of Carioca are: Carioca-B: , Carioca-B is a very minor to avoid detected by a particular utility. It is not believed to be in the public domain. PZPAPN Cartuja : Cartuja H: R: 1,568 - 1,600 5: PRhAK - n1.04+, 2.58+, 6.64+, 1.22+, 2.58+, 6.64+ The Cartuja . Its . Cartuja is a -and . bCartuja X, the Cartuja at the top of $the ', hooking |21. , as qby the DOS @by 60,704 |12's !moved. the Cartuja , it may Nn't always wthe a. As a , it may take several Zs of a particular . -or . before the the Cartuja pof 1,568 to 1,600 at the end of the a. The >and in the DOS not be . The in the 5in all Cartuja "Frz G" Frequent jmay Cartuja X. The damage potential for See: Estepa PZPAPN Cascade : Cascade BlackJack, Fall, Falling Letters, 1701, 1704, 1701 Mutation, 1704 Format, 1704-B, Cascade-1621, Cascade-1706 H: , 1987 TSR; falling letters; . i; random re Germany R: 1,701 or 1,704 5: PRsC - Encrypting . , NAV, : CleanUp, , or was a Trojan horse was disguised as a was supposed to turn off the Num-Lock light the &ed. The Trojan horse instead caused all the 4on the to fall into a pile at the bottom of the . In late 1987, the Trojan horse was one into While the had a of 1,701 )and would wboth true IBM PCs and clones, a variation exists of is 3 )longer wtrue IBM PCs. Both es are gidentical in all respects. Both of the fairly unique qualities: Both use an encryption algorithm to avoid detection and complicate any attempted analysis of them. The mechanisms are sophisticated randomization algorithm incorporating machine checks, monitor s, presence or absence of a clock card, and the season of the year. The activate on any machine a CGA or VGA monitor in the months of , or ?in the years 1980 and 1988. of Cascade are: 1701 Mutation: of has had two )modified in order to avoid detection. 1701-B: Same as 1701, except it can activate in the Fall of any year. 1701-Yap: on the Cascade adds 1,701 )to the . v. Its TSR is 2,048 ), and hooks The encryption mechanism has !slightly to avoid detection by utilities. 1704 Format: Like the Cascade , but the Kis formatted s during the months of , and ?of any year except , 1989. 1704-C: Same as Cascade-B except can activate in ?of any year. 1704-D: Same as the 1704, except the IBM selection has disabled so it can wtrue IBM PCs. 17Y4: to the Cascade 1704 , the difference is one *in the Cascade-1621: on the Cascade adds 1,621 )to the . v. Its TSR is 1,936 ), and hooks Y.BAT in the scrolling of the "Insufficient Kspace", and the .BAT anot executing. Cascade 1701.E: on the Cascade minor . It drops a single character down the it is ?31 of any year. Cascade-1704G: on the Cascade has to avoid detection by by the addition of a NOP instruction in the decryption routine. It adds 1,704 )to the . at the end of the a. It is a employs a 1,968 *TSR hooking : France May, Cascade-1706: on the Cascade adds 1,706 )to the . v. It is employs a 2,064 hooking {1C and 21. The at the end of Cascade-B: to the Cascade , except cascading Mhas !replaced at random intervals Cunning: on the Cascade , a major 3to the it now plays music. See: 1661 JoJo PZPAPN Casino : Casino Casino-B, Casino-C H: T; slot machine game; damaged Malta R: 2,332 - 2,346 5: PRhCK - , NAV, The Casino by David Chess of IBM. Casino was }in Malta. is a uof . The Casino is X, Casino at the top of , as qby the DOS Aby 37,568 to 37,632 ). 3,152 in low be used by the , and 00, 23, and 30 area. Casino is immediately in the C: root Casino is , it any of three events . If the issues a DIR or a Nan internal DIR 6, one . ain the ly, if the Ys an , a . r. Lastly, Casino by an for any reason. Casino 2,332 to 2,346 ). The p, however, is mostly hidden if the pof 1 to 16 ), but occasionally one may show a pof up to ). The Nnot alter the >and in the If Casino is and the DOS ed for If the +/F option is used, Casino 15, and play a slot machine game "DISK DESTROYER . A SOUVENIR OF MALTA ljust DESTROYED the FAT on your However, I la copy in RAM, and I`m giving you a last chance to restore your precious data. WARNING: IF YOU RESET NOW, ALL YOUR DATA WILL BE LOST - FOREVER!! Your Data depends on a game of JACKPOT CASINO DE MALTE JACKPOT" If the looses the game, Casino trash the of Casino are: Casino-B: to the Casino , the major trash the before playing the slot machine game |21 is by the Casino-C: to Casino-B, the major Nnot trash the before playing the slot machine game, and it is possible for the to win, avoiding :. If the wins the game, the "BASTARD ! You're lucky - but for your own sake now SWITCH OFF YOUR -PUTER AND DON`TURN IT ON TILL TOMORROW!!!" hang May, PZPAPN Casper : Casper Chameleon H: :(see R: 1,200 5: PNCK - Encrypting . , NAV, 1.53S+, 1.25+ : NAV, or The Casper by Fridrik Skulason of Iceland. The . Casper is a generic uof . the Casper X, the attempt to wone . in the and by 1,200 at the end of the . The Casper 8the cannot be seen in as Casper uses a complex self- encryption mechanism: "Hi! I'm Casper The , And On 1st I'm Gonna Fuck Up Your KREAL BAD! In Fact It Might Just Be Impossible To Recover! How's Grab Ya! " 1st, btrack of the Owhere the was f. Later to access the in " ring. The Casper on the . Unlike , it is self-encrypting. The self-encryption mechanism employed is to the encryption mechanism used in the V2P6 , and requires an algorithmic approach in order to identify it as are not any identifying in the of Casper are: Casper Dropper: Casper Dropper is the Scopy of the Casper . Executing in an tof a . in the the Casper . The S. The for Casper See: 1260 V2P2 V2P6 PZPAPN Casteggio : Casteggio H: Casteggio, Italy R: 2,881 - 2,900 5: PRhAK - 3.96+, NAV 3.0+, The Casteggio fItaly in its ~in the public domain in Casteggio, Italy. Casteggio is a uof . -and . the Casteggio the Casteggio at the top of $the , as qby the DOS @by 3,008 {1C and 21 the Casteggio , it pof 2,881 to 2,900 at the end of the a. The >and in the DOS not be . No in the It is what Casteggio PZPAPN Catman : Catman H: BSC; R: N/A 5: BRtX - D: NAV, 1.25+ : See The Catman , two samples of were not viable es. Catman is fthe . It is a and the The Catman in the form of a "dropper" If the dropper Xon a O, the of the Catman. The 71. If was part of a, the be corrupted. The remainder of the be placed in the second of the band second on the If the Catman dropper was Xon the K, the copy the is part of the second copy of the Catman Nnot fthe or the . The way it can spread, at least in its present form, is by executing the dropper a computer Catman , the usually in a hang. Likewise, &ing fthe in a hang. Catman can be removed fthe copying back the 71 to side 0, cyl 0, 1. For I, the DOS SYS can be used to replace the . Non- Ishould be dis rby copying all `using the DOS COPY 6, and reformatting the K. In any even, were damaged due to the not be able to be recovered, and should be replaced fbackup copies. PZPAPN : Caz H: Spain R: 1,204 5: PRhAK - /, NAV, The Caz }in Spain in . Caz is a uof . -and . bCaz Xon a , the Caz at the top of but $the , as qby the DOS 2,048 {08, 21, and 2F mby the . At , the check the copy of in the C: Oroot E, and if not already the Caz is , it 1,204 not be able to be seen in s if the . Caz at the end of `. The can be ,CLEAN." allocate all , such as utilities. [unexpected stack overflow successfully Yat a later . An symptom of Caz ts is if the , the DOS indicate Ton all It is what Caz it is probably related. of Caz are: Caz-B: , Caz-B is equivalent to the Caz . It has two differ fthe : Spain See: Zaragosa PZPAPN CB-1530 : CB-1530 1530 H: R: 1,530 - 1,544 5: PRhAK - , NAV, The CB-1530 . Its ~, are . CB-1530 is a uof . -and . It is on the , and software may detect it as such. The CB-1530 is X, the at the top of $the , as measured the DOS @by 3,696 {21 and 27 mby CB-1530 in |12's !moved. CB-1530 has , it very small ones) pd in by 1,530 pd in by 1,530 to 1,544 In both cases, the at the end of the be no 3to the >and in the DOS E. One : "CB". It is what CB-1530 See: Alexander < Edcl Father PZPAPN CCCP-510 : CCCP-510 H: R: 510 5: PNCK - , NAV 3.0+, 1.22+, .2.0+, The CCCP-510 . It is fthe . CCCP-510 is a the CCCP-510 X, the CCCP-510 wone . in the 510 at the end of the a. The >and in the DOS to the >and . The can be in the 5in all CCCP-510 "*** CCCP - 75! ***" "DoomsDay..." "*.com" It is what CCCP-510 PZPAPN : CD Thursday The 12th H: Kwrite protect Germany R: 2,161 - 2,175 5: PRhA - n, NAV, 1.53S+, The CD fGermany. CD is uof . -and . `, and ,. On Thursdays are the 12th day of the month, it The CD is X, CD at the top of , but $the , as measured by the DOS @by 2,448 mby the , CD -and . was less 2,161 to 2,175 at the end of the fwrite protected in a write protect Uas the Nnot intercept Ucondition. On Thursdays are the twelveth day of the month, it Mthe every fourth VirCheck V1.2 (C) Be aware of those worms out , violating your machine on Friday 13th = it's tomorrow! Special ks to Ross M. Greenberg, Patricia M. Hoffmann and John McAfee Press any key to continue... The Nnot do Mthe the highlighted box in the center of the . If the strikes any key, the were of CD are: Thursday The 12th: to CD, 's major on open as well as in Iceland, and was PZPAPN Cerburus : Cerburus H: i; dog's head graphic; ; interfers .BAT R: 1,353 5: PRaCK - NAV 3.0+, 2.58+, The Cerburus . Its place of . Cerburus is a uof . over 2K in The the Cerburus X, the Cerburus , hooking {21, 28, and 60. be no qby the DOS Cerburus is , it in the a DOS DIR issued. 1,353 at the "of the a. The >and in the DOS not be the Cerburus may notice a graphic dog's head on the upper half of the M. The head move fleft to right, wiping out the contents of the Mas it passes. At the same , the Lat the top of the "***CERBURUS***" The is not the can be in the all Zof .BAT `may be interfered Cerburus is may produce odd s. It is particularly noticeable in batch Zof the DOS DIR PZPAPN : Chad H: 1to 00-00-80 00:00; England R: 751 5: PNCK - /, NAV 3.0+, 1.53S+, The Chad . It is fEngland. Chad is a the Chad search the Eto locate a previouly w. If one is d, it rby the the Chad pof 751 at the end of the a. The in the DOS to be blank or missing, it has actually !set to 00-00-80 00:00. The can be in the Chad 5in all "Software "WOT!! No Anti - "CHAD Against Damaging es ... Save Our Software. The Chad Mthe 10th generation of the PZPAPN Chang : Chang H: R: 1,701 - 1,773 5: PRhAK - 3.96+, 30.00+, n1.04+, NAV 3.0A02+, 1.25+, 6.64+, 1.0A06+ The Chang . Its . Chang is a of . -and . the Chang the Chang at the top $the '. It move |12's , as qby the DOS by 1,760 mby Chang in the Chang , it X. If pof 1,701 to 1,773 at the end of the a. The >and the DOS not be The can be in the all Chang "YOU CAN CHANG SOMETHING OF THE PROGRAM I HAVE GIVEN UP MY COPYRIGHT, AND I HAVE LEFT SOME SPACE FOR YOU. THANKS!TOO MANY WRITE PROTECT!!!" It is what Chang may do of Chang are: Chang-B: gequivalent to the is slightly modified. Chang 007: Behaviourly to the Chang Chang 007's is 23,312 ), hooking |21. It adds 23,310 - 23,325 )to the W, and v. Its position in the aand are the same as for the . Most of the 23,310 plus adds to `consists of hex zero : Canada PZPAPN H: ; TSR China R: 3,072 - 3,104 5: PRsAKX - W, & , NAV 3.0+, 1.53S+, 2.58+, The C . It is fChina. C jha is a uof . -and . ,. It vthe X, the C as a low TSR of 3,392 ), hooking {08, 13, and 21. , it wthe if it was not the C , it for any reason. pof 3,072 3,091 to 3,104 ). In both cases, the the end of the a. The >and in the DOS not be . The can be in the 5in all C "Welcome!" "Auto-Copy Deluxe R3.0" "(C)Copyright . Mr. YaQi. C jha China" "No one can Beyond me!" "Invalid ULoading Operating "Missing Operating "New Century of Computer Now!" It is what C PZPAPN Changu Mangu : Changu Mangu JKTK H: BSC; India R: N/A 5: BRtX - 2.53+, : DOS SYS on I, M- K/P on , DOS FDISK /MBR for DOS 5.0 The Changu Mangu, or JKTK, }in India. Changu Mangu is a uof the ) and 360K 5.25" . It Nnot the of high density The the Changu Mangu at the top of $the DOS ', moving |12's , as qby the DOS @by 10,240 , the Changu Mangu wthe it was not rby the the Changu Mangu , it the of non-write protected, 360K 5.25" are accessed. The !moved to cylinder 39, side 1, Changu Mangu Nn't to do PZPAPN Chaos : Chaos H: ?, 1989 ; TSR; bad ; BSC England R: N/A 5: BR - K, CleanUp, or DOS SYS breported in ?, 1989 by James Berry of Kent, England, the Chaos is a uof floppy and the Chaos , it s the out copying it to an location on the 9the "Welcome to the New Dungeon" "Chaos" "Letz be cool guys" The Chaos flag the #full of bad upon most of the supposed bad are still readable. It is what the criteria is. PZPAPN Chaos Year : Chaos Year Chaos Year.1837 H: , 1994 i; DOS =seconds = "60" R: 1,837 5: PRhAK - V116+, \2.13+, n1.05+, NAV 3.0 A06+, 6.64+, 1.25+, 6.64+, V116+, 1.0A06+ The Chaos Year, or Chaos Year.1837, 1994. Its is a uof . -and . exhibits characteristics. bChaos Year at the top of $the ', not moving |12's , as qby the DOS @by 2,560 mby the the Chaos Year , it and . pof 1,837 at the end of the be hidden . The in the DOS to be un but the seconds field !set to "60". The in the "chao1837" the Chaos Year find the DOS detect Ton all . It is what else Chaos Year may do. PZPAPN Chaser : Chaser H: R: 980 - 994 5: PNE - 8/93S+, 3.96+, , NAV 3.0A06+, 1.22+, 1.0A06+ The Chaser . Its ~are . Chaser is a uof . the Chaser X, the Chaser wone . in the it has hang . The not be run. the Chaser pof 980 to 994 at the end of the a. The >and in the DOS not be . No in the 5in Chaser PZPAPN : CHCC H: R: 2,664 - 2,678 5: PNAK - The CHCC . CHCC is a uof . -and . the CHCC X, the CHCC wone . -and one . on the 2,664 to 2,678 at the end of the a. The >and in the DOS not be . The the 5in all CHCC WSYSBAT" "ChCC" The second very near the end of the It is what CHCC PZPAPN CheckSum : CheckSum CheckSum 1.00, CkSum H: Poland R: 1,233 5: PRhCK - , NAV, 8/93+ The CheckSum . It is fPoland. CheckSum is a uof . The the CheckSum X, the CheckSum at the top of $the |12's !moved. , as measured by the DOS @by 1,264 mby the the CheckSum , it the CheckSum of 1,233 at the end of the be no 3to the >and in the DOS the CheckSum [frequent , and later the again. of CheckSum are: CheckSum 1.01: to the CheckSum is one *shorter, adding 1,232 )to the . : Poland CheckSum 1.01B: to CheckSum 1.01B, has six differ. : Poland CheckSum-1569: on the CheckSum it can Its is 1,600 ), hooking -and . adding 1,569 )to the . The at the end of the a. Most ing in a "Divide overflow" Uand the ed to the DOS prompt. PZPAPN Cheeba : Cheeba H: R: 1,683 - 1,698 5: PRsAK - The Cheeba . Its . At the it was were two Cheeba es. The is a uof . ,, and $. The second, Cheeba-B, is a uof . -and . ,, and is listed under " The the Cheeba X, it at the top of $the , as qby the DOS @by 3,392 |12's not !moved. mby the Cheeba Cheeba is , it wthe target ,, are copied. It not . The source aof the copy operation not be Cheeba 1,683 to 1,698 at the end of the a. The >and in the DOS are no in the Cheeba It is if Cheeba . It uses a complex encryption mechanism. of Cheeba are: Cheeba-B: Very to the Cheeba , the major difference Cheeba-B is are copied. Like Cheeba, the target r, the source the copy operation Cheeba-1691: gequivalent to the Cheeba-B listed 's main difference is it adds 1,691 - 1,706 )to the . March, Cheeba-1691B: to Cheeba-1691, adds 1,691 - 1,706 )to the . minor March, See: Chemmy PZPAPN Chemmy : Chemmy H: R: 1,691 - 1,706 5: PRhAK - The Chemmy . Its . Chemmy is a uof . -and . bChemmy X, the Chemmy at the top of but $the , as qby the DOS by 3,392 |12's !moved. mby the Chemmy the Chemmy , it are copied. The source not be the target the Chemmy pof 1,691 to 1706 at the end of the . The >and in the DOS not be Chemmy is an , and no the It is what Chemmy may do of Chemmy are: Chemmy-B: Chemmy-B is a minor of the Chemmy , and gequivalent. See: Cheeba PZPAPN Chemnitz : Chemnitz H: March, R: 767 - 781 5: PRhE - 8/93S+, 3.96+, NAV 3.0+, .2.0+, The Chemnitz in March, . Its . Chemnitz is a , and Nnot wvery small . bChemnitz X, the Chemnitz at the top of $the ', hooking |21. , as qby the DOS @by 848 |12's not be moved. , the Chemnitz very small . pof 767 to 781 at the end of the a. The >and in the DOS . The in the 5in all Chemnitz "MsDos -MAND" "FMCIKLMOFR|" the Chemnitz PZPAPN Chile Mediera : Chile Mediera H: Bs AV Chile R: 1,527 5: PRhAK - , NAV 3.0+, /2.1+, 1.22+, The Chile Mediera , and fChile. Chile Mediera is a uof . and . ,. It interfers functioning of several packages by deleting or erasing the a(s). bChile Mediera at the top of $the ', hooking |21. , as qby the DOS @by 2,000 |12's !moved. , the the copy of in the C: Oroot it was not the Chile Mediera , it -and . larger for any reason. -and . pof 1,527 at the end of the a. The >and in the DOS not be . The in the Chile Mediera "CPW fue hecho en Chile en "VNA CHILE MIERDA!" "C:\ "GUARD guard /SCAN CHKVIRUS CLEAN TOOLKIT VSAFE CHKLIST.CPS" If the Yone of the listed in the last line of , the Chile Mediera Bor erase the K. If the happened to be write-protected J, a hang PZPAPN China : China H: March, i; TSR China R: 1,824 - 1,838 5: PRsA - , NAV 3.0A06+, 1.53S+, .2.0+, 1.0A06+ The China in March, , and is probably China. The China is a uof . , and Nnot ,. It is on the bChina X, the China as a low TSR of 2,128 {21 and 24 mby the China , the China -and . , but not pof 1,831 the at the "of the pof 1,824 to 1,838 at the end of the a. The >and in the DOS not be Unlike many of the , China Nnot re . No in the 5in China It is what China may do See: PZPAPN CHR-869 : CHR-869 H: March, 2; "#" character Zfailure R: 869 - 1,348 5: PRhA - 1.22+ The CHR-869 in March, . Its . CHR-869 is a , but not bCHR-869 X, the CHR-869 at the top of $the ', hooking |21. , as qby the DOS @by 3,120 |12's not be moved. , the CHR-869 -and . pof 869 pof up to 1,348 ). In both cases, the at the end of the a. The >and in the DOS to the and . No the CHR-869 the CHR-869 notice , a "#" character Lon the monitor ever a PZPAPN Chris : Chris H: beeping and fail to function Italy R: 463 5: PRaCK - \2.10g+, V111+, 2.10+, 6.60+, 2.58+, n1.05+, V111+, 2.58+, 6.64+, 1.25+ The Chris . It s to be fItaly. Chris is a uof . bChris X, the Chris hooking |21. qby the DOS not be , the Chris of 463 at the end of the The >and in the DOS to the >and . One in the "" The in the "Mary, . ti AMO!" second Lby the as a on the monitor, accompanied by beeping. the L, a hang may may not function as a PZPAPN Christmas Tree : Christmas Tree Tannenbaum, XA1, 1539 Endangered H: March, destruction Germany R: 1,539 5: PNCX - , NAV, : NAV, or The Christmas Tree, or XA1, }in March by Christoff Fischer of West Germany. is an encrypting 1st of any year, the Christmas Tree activate, destroying the ) of Ks the X. During the period ?24th until 1st of any year, X, the Ma full picture of a christmas tree. PZPAPN Chromo 1.0 : Chromo 1.0 H: R: 406 5: PNC - \2.10g+, /2.1+, 2.11+, n1.05+, 6.64+, .2.0+, 1.25+, 6.64+ The Chromo 1.0 . Its . Chromo 1.0 is a of . , but not ,. It Nnot wvery small . the Chromo 1.0 wthree . in the ;or a higher level pof 406 at the end of the a. The >and in the DOS not be . The the 5in all Chromo 1.0 -.. [Chromo Glitch] v1.0" "Copyright (c) Lapse." It is what Chromo 1.0 of Chromo 1.0 are: Chromo 2.0: , Chromo 2.0 is a 407 of the Chromo 1.0 vthree . `in the ;or a higher level pof 407 the end of the a. The >and the DOS not be The can be in the 5in all Chromo 2.0 "*M. W.. [Chromo Glitch] v2.0" "Copyright (c) Lapse." Chromo 3.0: , Chromo 3.0 is a of the Chromo 1.0 and Chromo 2.0 es. It at the top of $the , as qby the DOS @by 672 it is , Chromo 3.0 385 at the end of the a. The >and in the DOS not be . The in all Chromo 3.0 "[Chromo Glitch] v3.0" "Copyright (c) Lapse." See: Lapse PZPAPN Cinderella : Cinderella H: i; TSR Finland R: 390 5: PRsCK - , NAV, The Cinderella }in Finland in Cinderella is a uof . The Cinderella is X, the as a low TSR of 560 mby the Cinderella is , it for any reason. by 390 The at the end of the a. The can be "cInDeReL.la" Cinderella Nn't do of Cinderella are: Cinderella-B: gequivalent to the has two differ. : Finland Cinderella.C: to the its 5to the "of all . It 8the "CindyRul.ez 2" May, 1994. PZPAPN Civil War : Civil War H: The R: 244 5: PNC - 3.96+, NAV 3.0+, 8/93+, .2.0+, The Civil War , and fThe . Civil War is a uof . , but not ,. Later oCivil War II v1.1 and Proto-T, listed under , are us of . , and may ,. The Civil War III v1.0 . Later s of the Civil War S, and listed under the TPE entry as software most likely identify the encryption engine rather present. the Civil War wone . in the pof 244 at the end of the a. The >and in the DOS not be The in the 5in all Civil War "Civil War, (c) Dark Helmet" "*.com" of Civil War are: Civil War II v1.0: , Civil War II v1.0 is a later of the Civil War The at the top of $the , as qby the DOS @by 1,024 mby the Civil War II v1.0 is , it , but not pof 580 at the end of the a. The in the DOS not be The in the all "Civil War II v1.0,(c) 06/03/ : The Civil War II v1.1: , Civil War II v1.1 is a later of the Civil War II v1.0 The at the top of $the , as qby the DOS @by 1,024 mby the Civil War II v1.1 is , it any reason. pof 599 at the end of the a. The >and in the DOS not be . The in the 5in all "Civil War II v1.1," "(c) 06/03/ Trident/Dark Helmet, The : The Civil War III v1.0: in March, , Civil War III v1.0 is a later of the Civil War The at the top of $the , as qby the DOS @by 1,200 mby the Civil War III v1.0 is , it -and . for any reason. pof 901 the end of the a. The >and in the DOS not be . The in the 5in all "Civil War III v1.0," "(c) Dec , [ DH / TridenT ]" : The March, Civil War-282: , 1994, Civil War-282 (or Navigator) is a 282 of the Civil War Civil War-282 vone . ain the by 282 at the end of the a. The >and in the DOS not be . The in the all Civil War-282 "*.com" "The Navigator, (c) Dark Helmet" , 1994. Civil War-Lockjaw: , Civil War-Lockjaw is on the Proto-T $. Civil War- Lockjaw at the top of $the , as qby the DOS @by 4,096 by the pof 1,053 at the end of the a. The >and in the DOS not be . The in the 5in all utilities, utilities, in the Bd and the to the Lokjaw Proto-T: , Proto-T is on the Civil War , and s to be an earlier of the Civil War II v1.1 . It Nnot match the description of the rumored Proto-T was circulated on BBSes starting in . Proto-T the top of $the and , as qby the DOS @by 1,280 mby Proto-T in Proto-T is , it pof 695 at the end of the a. The and in the DOS not be . The in the 5in all Proto-T is sick." "[PROTO-T by Dumbco, INC.] Proto-T s access the Kinstead of becoming access ends, the be inaccessible until the is re Ritzen: , 1994, Ritzen is on the Civil War . It at the top of $the DOS , as qby the DOS @by 1,536 mby the , it -and . pof 1,087 at the end of the The >and in the DOS to the >and . The in the 5in all "Dedicated to Ritzen, our Minister of Education and Science. We are getting sick of your budget cuts so we hope get sick of .. (c) '93 by S.A.R. / TridenT" s of rby the Ritzen may find the cursor on the M, and fail to Ming the too big to fit in The Ritzen is buggy, re X. As a , the eventually not be able to run any since very little , 1994. See: Number 6 TPE PZPAPN Clone 2.0 : Clone 2.0 H: Hidden . `created; executing . ; TSR Australia R: 833 5: SRsE - Spawning 30.00+, \2.10g+, V112+, V113+, 1.25+, 6.64+ The Clone 2.0 , and is Australia. It is a spawning or companion bClone 2.0 as a low TSR of 2,048 mby the One the , it by creating a hidden . the same base . The hidden companion of 833 )and its >and be the >and it was created. The can be din all of the companion "Your PC is Cloned!!" "Clone ver 2.0..(c) Cataclysm Sydney, Australia .To Create and Mutate..." -LOVEV20. jfrequently PZPAPN Clonewar 00Q T PTQ : Clonewar H: Hidden . `created; WC failure executing . R: 247 5: SNE - Spawning 8/93S+, 3.96+, NAV 3.0+, 8/93+, 1.0A06+ The Clonewar . It s to be fthe . Clonewar is a spawning or companion the Clonewar X, the Clonewar wone . in the Eby creating a hidden, read- the same base . The hidden, companion of 247 )and its >and be the and it was created. The din all of the companion The 9the of the companion a, and the Wextention. Clonewar may receive the WC failure" , and are ed to the DOS prompt. Clonewar Nn't do , but it Ninterfer operation. of Clonewar are: Acme: , Acme is a 923 the Clonewar . The companion creates of 923 the read- hidden attributes set. The same din the s in . Acme not always X, but s play a repeated a series of tones on the speaker while leaving the Ospinning. Clonewar 2: , Clonewar 2 is a 228 of the Clonewar . It ain the Xby creating a hidden 228 *companion . the same base companion read- and hidden attributes set, and the . The in the Clonewar 2 Nnot wpast the third . ain any TrekWar: in Septembe, , TrekWar is on the Clonewar 2 . Its hidden companion `are 546 , and 9the "Beyond" "The rim of the star-light" "My love" "Is wand'ring in star-flight" "I know" "He'll find in star-clustered r "Love" "Strange love a star woman t Qes." "I know" "His journey ends never" "His star trek" go on forever." "But tell him" "While he wanders his starry sea" "Remember, remember me." "[TrekWar] *. The the last , are the words to the theme song fthe Star Trek television series. PZPAPN Close : Close H: &failure on C: R: 662 - 672 5: PRhE - , NAV, 1.53S+, The Close . Its . Close is a uof . eventually corrupt one of the `required &the fthe C: The the Close Close at the top of $the , as qby the DOS @by 784 the Close , it pof 662 to 672 at the end of the a. The in the DOS not be . Two in the Close "C:\IO.SYS C:\IBMBIO. "Close .." The Close was intermittently activate, at Mthe "Close .." on the corrupt either C:\IO.SYS or C:\IBMBIO. -. The be hung. to re &the fthe C: fail as one of the hidden `is corrupted. sor replacing all the Close , the should replace the hidden `on the C: Ousing the DOS SYS PZPAPN CLS-853 : CLS-853 H: ; unexpected clears R: 853 5: PRhAK - 3.96+, NAV 3.0+, The CLS-853 . CLS-853 is a uof . -and . bCLS-853 X, the CLS-853 at the top of $the '. It {08, 13, and 21. |12's not be moved. , as the DOS @by 1,120 the CLS-853 , it and . pof 853 at the end of the a. The >and the DOS not be . No are in the the CLS-853 [the #cleared unexpectedly The , "CLS", refers to symptom of the PZPAPN Cmdr Bomber : Cmdr Bomber H: May, i; TSR R: 4,096 5: PRhC - The Cmdr Bomber in May, . It (, and is believed !written by the same person whom wrote the . Cmdr Bomber is unusual in the method in complicates the detection process for using certain s of technology. the Cmdr Bomber X, the Cmdr Bomber as a low TSR of 2,752 mby the Cmdr Bomber the Cmdr Bomber , it by 4,096 ). The the la number of garbled )at the in the Zof the jumping to a location in the middle of the awhere the 5. In effect, the in the middle of the a. The >and in the DOS not be The can be in the Cmdr Bomber -MANDER BOMBER WAS HERE" "[DAME] [DAME]" is not related the the Bomber Malaysia. PZPAPN Cobra : Cobra H: R: 400 5: PNCK - \2.10g+, V111+, /2.1+, 2.58+, 6.60+, V111+, .2.0+, 2.58+, 1.25+, 6.64+ The Cobra . Its . Cobra is a uof . the Cobra wone . in the pof 400 at the "of the a. The in the DOS not be . The can be in the 5in all "Cobra" "*.exe" "*.com" It is if Cobra PZPAPN Coffeeshop-1568 : Coffeeshop-1568 Coffeeshop 1 H: Sweden R: 1,568 5: PRhA - n, NAV 3.0+, /2.1+, 1.53S+, 1.22+, .2.0+ The Coffeeshop-1568 . It is probably fSweden. Coffeeshop-1568 is a of . -and . , but not ,. It is not and in the DOS not be . One in the 5in all "CoffeeShop" It is if Coffeeshop-1568 See: DAME PZPAPN Collor de Mello : Collor de Mello H: =seconds = 62 R: 878 5: PNCK - 6.64+, 6.64+ The Collor de Mello . Its . Collor de Mello is a uof . the Collor de Mello access the Oand determine if the copy of in the C: Oroot r. If copy of ,is not r, the wit at has checked, and possibly ,, it go on to wone on the C: the Collor de Mello pof 878 at the end of the a. The >and in the DOS to be the seconds field !set to "62". No the 5in Collor de Mello It is what Collor de Mello PZPAPN H: N/A R: N/A 5: G - Generic The is not actually a specific , but a general category or group of can be genericly detected by software using ner technology. It was implemented by McAfee Associates in The es detected by the detection mechanism in are generally us. es may be malicious. be detected as the include: Friday The 13th Hastings Possum Revenge Attacker Thimble Violetta New es may be detected by mechanism are not documented in . If you detect a , and it match one of the es, please submit a sample to the author of for analysis and inclusion in PZPAPN 7wealth 7wealth H: -& .ESE =seconds set to "58"; TSR R: 800 - 815 5: PRsA - \2.10g+, V112+, 6.60+, 2.58+, 2.11+, 2.58+, V113+, 6.64+, 1.25+ The 7wealth . Its 7wealth is a uof . -and . , but not 7wealth as a low TSR of 2,048 mby the 7wealth , it and . pof 800 to 815 at the end of the a. The >and in the DOS to be , but it lthe seconds field set to "58". The in the 7wealth 7wealth of Independent States" It is what 7wealth PZPAPN Commy : Commy H: =seconds R: 998 5: PNCK - NAV 3.0+, The Commy . It is fthe . Commy is a ,. It 9PM (21:00). the Commy X, the check the . If the is before 9PM, the pass control to the host and not . If The is 9PM or later, the wone . in the Ebefore passing control to the host the Commy pof 998 at the end of the a. The >and in the DOS to be the seconds field !set to 44, 46, 60, or 62. The in the 5in all Commy "The DIRTY -MY said .." "PATH=" It is what Commy PZPAPN : Como Como-Lake H: Italy R: 2,022 - 2,035 5: PNE - n, NAV, 3.96+, 8/93+, The Como, or Como-Lake, , and fItaly. Como is a uof . the Como may in the about a 1 in 7 probability. pof 2,022 to 2,035 at the end of the a. The >and in the DOS not be . The in the 5in Como is the" -O-LAKE" "(rel. 1.1)" "I'm a non-destructive developed to study the worldwide" "diffusion rate. I was released in by a software" "group near Como lake (north Italy)." "Don't worry about your data on K. My activity is limited "to auto-transferring into `. Perhaps you've got" "many r. It's your task to find and Bthem." "Best wishes." "Pres a key to Ythe PZPAPN Copyright 00Q U ~PTQ : Copyright V1193 H: R: 1,193 - 1,208 5: PRhCK - , NAV, The Copyright . It is the . Copyright is a uof . The the Copyright X, the at the top of $the , as qby the DOS @by 1,200 mby the Copyright |12's !moved. the Copyright , it 1,193 to 1,208 at the end of the `. Copyright >and in the DOS to the >and The can be in the Copyright "(C) 1987 American Megatrends Inc.286-BIOS" "(C) 1989 American Megatrends Inc" "(c) COPYRIGHT 1984,1987 Award Software Inc." "ALL RIGHTS RESERVED" The d due to the fake copyright . American Megatrends and Award Software had nothing to do ' creation. It is if Copyright of Copyright are: Copyright-1205: , Copyright-1205 is a 1,205 of the Copyright Its is 1,216 ), moving |12's . Like the , it hooks it is , Copyright-1205 X, adding 1,205 to 1,220 to the . The at the end of the a. The >and in the DOS to the >and . The can be in the Copyright-1205 5in all "(C) Software Developed by Maxi" "Lena All Rights Reserved" "(c) COPYRIGHT 1984,1987 Award Software Inc." "ALL RIGHTS RESERVED" Ungame: , Ungame is a 766 of the Copyright . Its is 768 ), and it hooks {08 and 21. , it -and . of 766 at the end of the lthe structure of . t. The >and in the DOS to the >and . The can be in the 5in all Ungame "Come On, no. 51, You is up." "Ungame(C)Dr" PZPAPN Cossiga : Cossiga H: i; video mode 3to 40 columns; don't Italy R: 875 - 899 5: PNE - , NAV, The Cossiga . It is fItaly. Cossiga is a the Cossiga X, the Cossiga search the Efor the . If an wit. it has completed , the switch the video mode to a 40 column M, and the block letters: "COSSIGA ?! NO GRAZIE! By Amissi dee Panoce (c) PADOVA" The host function, instead the ed to the DOS prompt. the Cossiga pof 875 - 899 ). The at the end of the . The >and in the DOS not be . The can be in the 5in Cossiga "*.*" "*.exe" "AXI TY" of Cossiga are: Cossiga-B: on the Cossiga adds 895 to 899 )to the . v. The at the end of the a. The the Cossiga-B "COSSIGA ?! NO GRAZIE!" "By Amissi dee Panoce (c) PADOVA" "AEGE/B V1.2" "*.* *.exe" The bthree Las a in 40 column mode, a blank line between ever an : Spain May, See: Friends PZPAPN Costeau : Costeau H: R: 512 5: PRE - 3.96+, NAV 3.0+, 1.22+, The Costeau . Its . Costeau is a of . bCosteau X, the Costeau in the DOS Data area in , hooking |21. , as qby the DOS not be the Costeau , it pof 512 at the end of the a. The >and in the DOS not be . The can be in the 5in all Costeau "COSTEAU" "End.MZ" It is what Costeau may do PZPAPN CPSU-2535 : CPSU-2535 Protecto-2535 H: R: 2,535 5: PRtA - , NAV 3.0+, The CPSU-2535 , and is is a uof . -and . , but not bCPSU-2535 X, the CPSU-2535 at the top of $the ', moving |12's , as qby the DOS @by 3,088 mby CPSU-2535 in the CPSU-2535 , it pof 2,535 the end of the a. The >and in the DOS not be . No in the It is what CPSU-2535 See: Protecto PZPAPN : CPW H: .Exe interference Chile R: 1,459 5: PRhAK - 3.96+, NAV 3.0+, /2.1+, .2.0+, The CPW . It is fChile. CPW is a uof . -and . bCPW X, the CPW at the top of but $the ', hooking {16 and 21. , as qby the DOS @by 2,000 ). Interupt 12's not be moved. , the copy of in the C: Oroot by the if it was not the CPW , it pof 1,459 at the end of the a. The >and in the DOS not be . The in the 5in all CPW "Este a fue hecho en Chile en por CPW." "C:\ "Feliz cumplea os CPW" "You are here CPW!" "ULS" the CPW for awhile, it activate. Upon , it Mthe at the DOS prompt, one character at a . The 4of the replace the 4the is typing on the "You are here CPW!" The character substitution continues until the hits an ALT+key combination on the , such as ALT+C. An effect of the in the .Exe fthe jmay PZPAPN Cracker Jack : Cracker Jack NeCrop H: May, Italy R: Varies The Cracker Jack, or NeCrop, in May, V. Cracker Jack is an ICE it has release the 1963-B into the . See the entry for 1963 for a description of the dropped See: 1963 PZPAPN Crash : Crash 1075, Russ-1075, DBF blank Rumored H: R: 1,075 \, NAV, The Crash or 1075 has had many samples over the last few months. The samples were fthe . All samples of " do not on an XT or 386 personal computer. Instead, the crashes the sample X. It may under configurations. PZPAPN Crazy Eddie : Crazy Eddie England H: England R: 2,600 - 2,715 5: PRtAKX - W, & , NAV, /2.0+, .2.0+, The Crazy Eddie fEngland. Crazy Eddie is a multi-partite the -, and . The the Crazy Eddie wthe it was not r. The locates a copy of its 5on the cylinder 0, side 0, 2-4, and alters the . The Nn't , and r, the Crazy Eddie &s the the K. At , Crazy Eddie at the top of ', moving |12's and , as qby the DOS @by 17,408 {00, 10, 14, and mby the Crazy Eddie is , it -and . wone in the a DOS DIR 6is performed. Crazy Eddie of 2,600 to 2,715 at the end of the . The >and in the DOS . One in the 5in all "Crazy Eddie" Crazy Eddie is a destructive on Monday The 28ths as well as on 28th. On >s, it corrupt the PZPAPN Crazy Imp : Crazy Imp H: may dis R: 1,445 5: PRtCK - , NAV, The Crazy Imp . Its ~are . Crazy Imp is a If the Crazy Imp not be able to detect it on are read into The the Crazy Imp X, the Crazy Imp the top of $the 12's !moved. , as qby the DOS by 4,096 {1C and 21 mby the . The ed to by the -SPEC en variable, usually if it was not rby the Crazy Imp the Crazy Imp , it lany pas the hides the is not pof 1,445 at the end of the a. The can be in the is not "Crazy imp" "v2.0" qearlier, Crazy Imp is a X, hides the p, and dis are read into Zof an is not aware of in the tof all . on the out any #detected on the If you think you , power off the and re fa write-protected, J, and check the for the It is if Crazy Imp of Crazy Imp are: Crazy Imp-1402: as Crazy Imp v1.5, Crazy Imp-1402 is an earlier of the Crazy Imp . Its is 6,144 ), hooking {1C, 21, and 22. are pof 1,402 at the "of the a. The p, however, is hidden by the it is . The >and in the DOS to be un may "dis ". The seconds field in the !set to "62". The are in the Crazy Imp-1402 "Crazy imp" "v1.5" Crazy Imp-B: to the Crazy Imp has two differ. PZPAPN Creeper : Creeper Creeping Tormentor H: R: 475 5: PRhCK - , NAV, The Creeper, or Creeping Tormentor, . Its . Creeper is a of . The Creeper is X, the Creeper at the top of $the |12's !moved. , as qby the DOS by 1,024 {1C and 21 mby the the Creeper , it X. If X, it r. Creeper pof 475 at the "of the . The >and the DOS The Creeper looks for the Tormentor , checking for the "TORMENTOR". It is if Creeper of Creeper are: Creeper-B: gequivalent to the Creeper has one May, PZPAPN Crew-2480 : Crew-2480 2480, V2480 H: &s; graphic Finland R: 2,480 5: PNCK - , NAV, The Crew-2480 . It was }in Finland. is a non- uof . over 10K in . It the Crew-2480 X, the wone . aover 10K in if the month is through May. rby the , the by 2,480 at the end of the . The >and in the to the >and %the a Crew-2480 tmay Later Zof the same may be successful. During the months of through ?, Crew-2480 Xduring period, the Ma formatted making reference to the Van Cracking Crew". of Crew are: Crew-2480 B: on the Crew-2480 Nnot Mthe graphic, it is present in the . Instead, a hang upon Crew-2480 C: on the Crew-2480 minor PZPAPN : CRF H: R: 270 5: PNCK - 2.58+, 6.64+, .2.0+, 6.64+, 1.25+ The CRF . Its Hare . CRF is a uof . the CRF X, the wall `in the Oand E. If by 270 at the end of the . The >and in the DOS to the >and . Two in the `: "OZR3" and "*. It is if CRF PZPAPN Criminal : Criminal H: i; TSR; R: 2,615 5: PRsCK - , NAV, The Criminal . Its . Criminal is a uof . The the Criminal X, the Criminal a low TSR of 480 {21, D0, and EA. An TSR of 3,712 zed, many , the Criminal wthe bthree . `in the sample of Criminal by the author of , it Nnot . Further, it is wious fthe sample, not d samples. the Criminal by 2,615 ). The at the end of the . The >and in the DOS Criminal may notice the DOS indicate ,has a s if the It is if Criminal of Criminal are: Criminal-B: to the one . Nnot wmore three . in a E. Its is 470 ). Nineteen )differ fthe PZPAPN Cruncher : Cruncher Cruncher 1.0 H: The R: N/A 5: !RhC - Compressing The Cruncher, or Cruncher 1.0 and is fThe . Cruncher is a compresses the v. As a , most , depending on the acontent and before the compression was applied by the bCruncher X, the Cruncher at the top of $the ', hooking |21. , as qby the DOS @by 2,352 |12's !moved. the Cruncher , it ,and very small . usually were smaller 3K may show a slight . The >and in the DOS not be . The in the 5in the Cruncher `, and are not since the compressed along the host "[ MK / Trident ]" "Cruncher V1.0 Cruncher Nn't to do %compress . its presence may not functioning of Cruncher are: Cruncher 2.0: on the Cruncher Cruncher 2.0 is a later of the wand compress . as well as . Its is 4,256 hooking |21. It 8the are not "*** CRUNCHER V2.0 *** Automatic acompression utility" "Written by Masud Khafir of the TridenT group (c) 31/12/92" "Greetings to Fred Cohen, Light Avenger, and Teddy Matsumoto" : The Cruncher 2.1: on the Cruncher 2.0 Cruncher 2.1 asks the 's permission to and start compressing `. Its Its is 5,056 ), hooking 8the not "*** CRUNCHER V2.1 *** Automatic acompression utility" "Written by Masud Khafir of the TridenT group (c) 23/8/93" "Greetings to Fred Cohen, Light Avenger, and Teddy Matsumoto" : The PZPAPN Crusher : Crusher H: ; cross-linking of The R: 2,048 5: PRhEX - 6.64+, 6.64+ The Crusher . It is . Crusher is a uof the ) and . . It employs techniques to avoid detection. The the Crusher the Crusher wthe . It writes an un Scopy of the 5to Side 0, Cylinder 0, 2 thru 5, and alters the Xthe next fthe K. It Nnot The next fthe K, the Crusher at the top of but $the , as qby the DOS by 2,064 mby Crusher in the Crusher , it pof 2,048 be hidden is active in . The in the DOS not be . The in the "Crusher" "You are damned" "Bit Addict / Trident" The Crusher Mthe it is cross-linking of PZPAPN : CSL MicroElephant V6 i; "Bad exist Eastern R: 457 5: PRtCK - /, NAV, The CSL, or MicroElephant, is a uof . bCSL X, the at the top of the |12's !moved, however to be no qby the DOS CSL has , it X. If X, it r. CSL pof 457 at the end of the a. The >and in a DOS not be . The can be in the "Microelephant V6 by CSL" CSL may [the "Bad ", and a to the DOS prompt, the over 64K in . The . themselves lnot but it is the ing the CSL Nn't do and interfer of CSL are: CSL Beta: CSL Beta, or MicroElephant Beta, is to the CSL , CSL Beta adds 381 )to the . not restore the host =in the DOS , so a be noted. It 8the "26.07.91.Pre-released Microelephant by CSL". CSL V4: CSL V4, or MicroElephant V4, is to the CSL , CSL V4 adds 517 to the . v. The >and in the DOS . The ctwo in the "Microelephant V4" and "by CSL". CSL V5: CSL V5, or MicroElephant V5, is to the CSL , CSL V5 adds 457 )to the . v. It 8the in its "Microelephant V5 by CSL". PZPAPN Curse : Curse Smiley Worm H: corrupted Northern California, R: N/A 5: BRt - , NAV, 2.10+ : CleanUp, or DOS SYS on The Curse reported in samples did not ing to be incomplete. The bworking sample of the Curse a public domain tat a college in Northern California in . Curse &is a 360K 5.25 inch , as well as . It is a aling it is The the Curse , the Curse wthe . The lmarked four bad in the , and transferred the and three bad . The rby the . At the Curse , allocating 4,096 fthe top of $the |12's moved. , the Curse w360K 5.25 inch are accessed for any reason. As K, the marks four bad, and places the and three vthe Curse &may notice upon lthe hours set to zero, instead of the actual value stored in CMOS for the clock. For example, if the clock on &is 21:30.00, &ing Curse K, the read 0:30.00. Curse &hides the ton 360K 5.25" Fing to read the to the . As a not be able to detect the Curse . It Nnot, however, hide the tof the PZPAPN : CV4 1.0 H: R: 321 5: PNCK - 3.96+, NAV 3.0+, n1.05+, 1.22+, The CV4 . Its . CV4 is a of . the CV4 X, the CV4 wone in the E. If it may the CV4 pof 321 at the end of the a. The >and in the DOS not be . The can be din the 5in all CV4 -VIRUS 1.0" The Lon the monitor CV4 Nn't do Mits PZPAPN Cyber : Cyber Intrep-1092 H: R: 1,092 - 1,106 5: PNAK - 8/93S+, 3.96+, NAV 3.0+, 8/93+, 1.22+, .2.0+ The Cyber . It s to be fNorth America. Cyber is a of . -and . the Cyber X, the Cyber search the Eto locate an . If one is d, the vit, and Yruns. If an awas not d, the search the for an w, and the Cyber pof 1,092 ). . pof 1,092 to 1,106 ). In both cases, the at the end of the a. The >and in the DOS not be The can be din the Cyber all "*.com *.exe" "A trip into the realm of intelligent replication..." The Cyber Nn't do of Cyber are: Cyber-946: A 946 of the Cyber vone . in the pof 946 at the end of the a. The >and in the DOS not be . The can be in the 5in all Cyber-946 "*.com *.exe" PZPAPN Cybercide : Cybercide Cybercide-2299 H: i; DOS DOS DIR 6performance slowed R: 2,299 5: PRhCK - n1.04+, 6.60+, 2.58+, 2.58+, 6.64+ The Cybercide . Its . Cybercide is a bCybercide X, the Cybercide at the top of $the ', not moving |12's , as qby the DOS @by 4,800 09, 1C, and 21 mby Cybercide in the Cybercide , it , as well as included as a part of the target of a DOS DIR the Cybercide of 2,299 be hidden the . The at the end `. The >and in the DOS not be . The can be in the 5in all Cybercide "... I SHALL FEAR NO EVIL ..." ">>> A.N.O.I <<<" "**CYBERCIDE** -- FLOATING THROUGH THE VOID" "iS AROUND!" "* *I* *h*e*r*e*b*y* *p*r*o*c*l*a*i*m* *t*h*i*s* *c*o*m*p*u*t*e*r* *a*s* *t*h*e* *p*r*o*p*e*r*t*y* *o*f* *A*.*N*.*O*.*I*" "*!*!* *A*L*L* *H*A*I*L* *D*A*R*T*H* *V*A*D*E*R*!*!*" "-=CYBERCIDE=- 01-30- * COPYRIGHT (C) A.N.O.I DEVELOPMENT" The asterisks (*) in the fifth and sixth are actually a character, or hex 0F. s of Cybercide may notice performance of the DOS DIR 6is sluggish due to the `included in the 6output. the DOS Ton all Cybercide is of Cybercide are: Cybercide-2299B: , 1994, Cybercide-2299B is to the Cybercide The in the 1to the "... I SHALL FEAR NO EVIL ..." ">>> A.N.O.I <<<" "**CYBERCIDE** -- FLOATING THROUGH THE VOID" "iS AROUND!" "* *I* *h*e*r*e*b*y* *p*r*o*c*l*a*i*m* *t*h*i*s* *c*o*m*p*u*t*e*r* *a*s* *t*h*e* *p*r*o*p*e*r*t*y* *o*f* *N*A*Z*I*S*.* *" "*H*E*I*L* *H*I*T*L*E*R* *!*!*!*" "COPYRIGHT (C) -93 A.N.O.I DEVELOPMENT" The asterisks (*) in the fifth and sixth actually a character, or hex 0F. Cybercide-2299B lthe =seconds field in the DOS 1to "24". : Sweden MLP-1321: , MLP-1321 is on the Cybercide . MLP-1321's is 1,600 ), hooking |21. are for any reason. by 1,321 be hidden The at the end of all The >and in the DOS to the and . The in the MLP-1321 "simple simon met a pieman going to the fair said simple simon to the pieman let me take your ware" "- my little pony - copyright(c) Cruel Entity and A.N.O.I. -" ">>> A.N.O.I <<<" , the DOS Ton all in a hang. : Sweden See: DNR PZPAPN CyberTech : CyberTech CyberTech-A H: ; removal of The R: 1,066 or 1,076 5: PNCK - 3.96+, NAV 3.0+, 8/93+, 1.22+, The CyberTech, or CyberTech-A, The s to be The . CyberTech is a uof . the CyberTech X, the CyberTech wone . in the 1,066 or 1,076 at the end of the pd in by 1,066 had 10 )of validation by the removed. The >and in the DOS The CyberTech Mthe "CyberTech - Strain A (C) John Tardy of Trident" ?31, , the Mthe and dis wthe athe is executing "The previous year you rby a out knowing or removing it. To be gentle to you I decide to remove myself fyour . I suggest you better buy of McAfee to ensure yourself complete security of your precious data. Next could be a malevolent May I say goodbye to you now All of the in the , as is the "chklist.cps" CyberTech may interfer the functioning of the Central Anti- of CyberTech are: CyberTech-222: on the CyberTech vone . pof 222 at the end of the a. The >and in the DOS not be . One tech in the : The CyberTech-501: as Ice Cream, CyberTech-501 in the pof 501 at the end of the a. The >and in the DOS not be the seconds field set to "02". The in the CyberTech-501 "I scream, you scream, we both scream for an ice-cream!" "John Tardy" : The CyberTech-654: CyberTech-654 vone . in the pof 654 the end of the a. The >and in the DOS not be the seconds field !set to "02". The in the CyberTech-654 "(C) John Tardy / Trident" "Satan Spawn, the Caco-Daemon - Mor(T)alities Death" : The , 1994. CyberTech-B: on the CyberTech adds 1,205 or 1,215 )to the . the exception of ,. In the case of ,, it part of the slack (hex 00) area in the be no p. It Ms the "CyberTech - Strain B (C) John Tardy of Trident" The ?31, Mthe same as the and dis wthe is executing. : The (?) PZPAPN Cysta : Cysta Cysta-2711 H: i; Hidden `may in DIR; Poland R: 2,711 - 2,726 5: PRhAK - 30.00+, 6.64+, 1.25+ The Cysta, or Cysta-2711, . Cysta is a uof . -and . ,. It is a fast are for any reason. bCysta X, the Cysta at the top of but $the ', not moving |12's , as qby the DOS @by 2,736 mby the , the ,if it was not the the Cysta , it for any reason. pof 2,711 to 2,726 at the end of the The >and in the DOS not be . The in the 5in all Cysta "(C) Cysta Inc." WIBMDOSIBMBIOMSDOSIOCONFIGCOUNTRYPSQVW" "GAME" "ENJO" "DZOJ" "DZOY" "PLAY" "FUCK" "DUPA" "PORNO" "JOY" "GRY" "RETAL" "GIER" "HUJ" "MKS" "VIRUS" "WIRUS" "SEX" "SONG" "GIF" "WOLF3D" "F19 \" "Enter NEW Password :" "NEW Password "ERROR, Press Any Key "Use Maximum 6 ASCII "ESC:Exit" "Hit , If you want to: It is what Cysta may do alter the hidden aattribute on hidden the DOS of Cysta are: Cysta-2954: A 2,954 of the Cysta is 2,976 hooking |21. Cysta-2954 adds 2,954 to 2,969 )to the v. The in the WIBMDOSIBMBIOMSDOSIOCONFIGCOUNTRYPSQVW" the Cysta , the hidden attribute may be reset on `, making the in the DOS : Poland Cysta-8045: A 8,045 of the Cysta is 8,064 hooking |21. Cysta-8045 adds 8,045 to 8,060 )to the v. The in the "(C) By Rycho Rak" WIBMDOSIBMBIOMSDOSIOCONFIGCOUNTRY -MAND" "MKS-VIRMKS_VIRMKSVIRMKS-DEMOMKS_DEMOMKSDEMOPSQVW" the Cysta , the hidden attribute may be reset on `, making the in the DOS : Poland PZPAPN : Dad H: i; TSR; Argentina R: 897 5: PRsC - , NAV, The Dad Gin Argentina in May, . It is a uof . , but not bDad X, the Dad as a low TSR of 1,232 ). It hook {21 and F8. becoming wany . X, and Mthe on the "DAD WAS HERE" the Dad pof 897 ). The at the of the be no 3to the >and in the DOS is unable to determine it has a, so it `, adding an )for The can be din the 5in all Dad "Argentina!" -MAND -A:TMP$$TMP. "Que dia es hoy?" "PRIMERO DE ABRIL!!!" "(C) DAD DAD WAS HERE" PZPAPN : Dada H: may fail to R: 1,358 - 1,372 5: PRsE - , NAV, The Dada . Its ~are . Dada is a of . The the Dada as a low TSR of 2,048 ). Most mapping utilities show it as an in the of the in- 6interpretor. and 21 mby Dada in . The alter the ceiling for conventional , so labout 64K of conventional . The remaining conventional the Dada , it pof 1,358 to 1,372 at the end of the . The >and in the DOS to the >and . The can be in the "PATH=. As a of the Dada ' alteration of conventional Zof . over 64K in may not Yin the way the expects. Unpredic Tmay PZPAPN Damage : Damage Damage-B H: May, effects; " Italy R: 1,063 5: PRhAK - , NAV, The Damage Vin May, . Damage is on the Diamond of V1024. It is a uof . -and . bDamage Xon a Damage at the top of $the , as measured by the DOS by 1,120 {08 and 21 mby the Damage is , it -and . over 1K in X, it by 1,063 at the end of the a. The however, be hidden if Damage is . If the in the Ewas 12:00a, its be blank Lif Damage is The DOS not find Tas it Damage is Damage is 14:59:53. At la large, multi-color diamond in the center of the M. The diamond break up into smaller diamonds shoot around the cleaning off the Occasionally, the Damage format a section of the formatting to read a amay damaged, or if the to write to one of areas. Damage lthe near the end of the "DAMAGE of Damage are: Damage-B: Damage-B is a 1,110 of Damage, ,. The be 1,152 Two can be "Jump for joy!!!" "DAMAGE-B!!" Damage-B may be detected as Lucifer by as it is very See: Alfa Lucifer V1024 PZPAPN : DAME Coffeeshop, Coffeeshop 2, CryptLab, DarkStar, Dedicated, Dedicated 2, Dedicated 3, Encroacher, Encroacher 2, Fear, MTE, MTE Spawn, MTE Spawn 2, PC Weevil, Questo H: Kwrite failures; warm re R: Over 3,000 5: PNCK - 3.96+, NAV 3.0+, The DAME, or and in the DOS not be . The in the 5, and not be in most "We dedicate little to Sara Gordon," "who wanted to lit corrected--" "learn to before you touch M_t_e" Dedicated 3: , Dedicated 3 is the Dedicated 2 . Dedicated 3 is a uof . -and . . Its is 5,120 ), hooking |21. Dedicated 3 -and adding 3,539 to 3,717 The at the end of the a. The >and in the DOS to the >and . The in the 5, and not be in most "We dedicate little to Sara Gordon," "who wanted to lit corrected--" "learn to before you touch M_t_e" Encroacher: A Encroacher wone . in the X. If E, it may Encroacher pof 3,227 to 3,483 at the end of the be no 3to the >and in the DOS . The are usually in the 5in Encroacher "ENCROACHER is here" -chklist.cps C:\ /\VSAFE. Encroacher may interfer the functioning of Central anti- it is zed in its default zation Encroacher 2: to Encroacher, minor Fear: A u, Fear wup to four . in the X. If E, it may Fear pin excess of 3,000 at the end of the be no 3to the in the DOS the Fear Scopy of the Fear samples 9the "Fear Created 2-5-92 by PkaHerONE" -You lnothing to fear except FEAR the Fear [warm ring unexpectedly, or general failure Twriting to a non-existant all the `in the hang March, MTE Spawn: , MTE Spawn is a non- spawning or companion uses the Dark Avenger Mutating Engine for its encryption. wone . in the E, creating a 6,666 to 6,746 the same base companion lthe read- , and hidden attributes set, and its >and be the >and . The not be Zof an MTE Spawn in a hang five . `in the the companion not be Xunder of DOS due to a minor bug in . To dis tof MTE Spawn, simply Bthe hidden companion MTE Spawn 2: , MTE Spawn 2 is a non- spawning or companion uses the Dark Avenger Mutating Engine for its encryption. wone . in the E, creating a 2,754 to 2,894 the same base companion lthe read- , and hidden attributes set, and its >and be the >and . The not be Zof an MTE Spawn 2 in a hang five . `in the the companion not be Xunder of DOS due to a minor bug in . To dis tof MTE Spawn 2, simply Bthe hidden companion PC Weevil: A PC Weevil wsix . in the X. It Nnot PC Weevil pof 3,139 to 3,299 at the end of the be no 3to the >and in the DOS . The are usually in the 5in PC Weevil "PC Weevil: Still the select choice for your research needs" "MtE 0.90" jfrequently Questo: A Questo wfour . in the X. If E, it may Questo pof 2,971 to 3,227 at the end of the be no 3to the in the DOS . The are usually in the 5in Questo "Questo sistema stato infettat*. "MtE 0.90" See: Groove Pogue PZPAPN Amilia, Black Avenger, Boroda, Eddie, Diana, Rabid Avenger, VAN Soft, <1801, <-C, PS!KO, Evil Men, <.1E, Dark Quest H: , 1989 TSR; . W, .SYS Davis, California, R: 1,800 5: PRsAK - , NAV, : CleanUp, \, NAV or 's format may be f"mm/dd/yy" to " y#mm#dd", and the ":" character in the 1to " <-B: Very to the , the major difference is be re adding 1,800 )to the in high instead of low TSR. din the 5include: "Eddie lives... where in "Diana P." was written in the city of Sofia" "(C)1988-1989 <-C: Very to the adds 1,800 to 1,814 The copyright notice is different, having 1to: "(C) 1988-89 <-D: is very adding 1,800 to 1,814 `. It has the same copyright notice as <-Romanian: fRomania. The major , adding 1,800 to 1,814 )to the . It 8the same : Romania <1801: to the , the major difference is has an effective of 1,801 ), one *longer . Like <-B, it at the top of instead of #a low TSR. It not, however, re N. The same and <-1693: The <-1693 is a 1,693 of the . Its is 3,696 )at the top of $the ', hooking {21 and 27. It adds 1,693 the . v, and 1,693 to 1,707 )to . . The at the end of the and the >and in the DOS not be Nnot hide the p. The as the keeps a counter . No in the frequently hang the , 1994. <-1799: The <-1799 is a 1,799 of the . Its is 3,696 )at the top of $the ', hooking {21 and 27. It adds 1,799 the . v, and 1,799 to 1,813 )to . . The at the end of the and the >and in the DOS not be Nnot hide the p. The as the keeps a counter . The in the "Francis lives...in Hong Kong!" "Diana P." was written in the city of Sofia (C) 1988-89 , 1994. <-1813: The <-1813 is a 1,813 of the . Its is 3,696 )at the top of $the ', hooking {21 and 27. It adds 1,813 the . v, and 1,813 to 1,827 )to . . The at the end of the and the >and in the DOS not be . The <-1813 hide the pd in by up to 16 unable to determine it has a, so it ends up re `. Re 1,813 )to the pis not hidden by the . The as the keeps a counter . The in the "Eddie lives... where in "Diana P." was written in the city of Sofia (C) 1988-89 , 1994. Dark Quest: The Dark Quest is a 1,800 the . Dark Quest's is 3,696 )at the top of $the ', hooking {21, 22, and 27. It adds 1,800 )to the . v, and 1,800 to 1,815 )to . . The at the end of the a, and the >and in the DOS not be hide the p. The as the keeps a counter . The can be in the 5in all Dark Quest "Never buy Quest computers again!" "iana P." is not dangerous stamp." "All new software seriosly danger" Evil Men: <-D, "The evil men do !" was written in the city of Sofia" "(C) 1988-89 "Diana P." Kang Yong: The Kang Yong is a 1,947 of Dark Avenger. Unlike members of group, it re . Kang Yong's 3,984 )at the top of $the DOS ', hooking {21 and 27. It adds 1,947 )to the . v, and 1,947 to 1,961 )to . . Re add an 1,947 ). The at the end of the a, and the >and in the DOS not be Nnot hide the p. The as the keeps a counter The can be in the "If you are a thieve man , lives... where always!" "You must good man!" "Kang Yong II" was adjustted in 'Commputer Home' of KOREA" "(C) 1988-89 ,LSR+KYL : Korea Mercury: The Mercury is a 2,829 of the Dark Avenger . Its is 5,808 )at the top of $the ', hooking {08, 21 and 27. It adds 2,829 )to the . v, and 2,829 to 2,843 )to . Mercury hides it is . The at the end of the and the >and in the DOS not be . The not be . The the "If You Liked , Call Asaf, At +972-4-225288!" "Written by Jasper, and Dedicated to Freddie Mercury." of a Mercury tinclude a sluggish response to DOS DIR 6s, DOS Ton all , as well as random on the , 1994. PS!KO: The PS!KO and in the DOS not be hides the . The DOS Ton all PS!KO-1459 is are no in the PS!KO-1687: The PS!KO-1687 on the PS!KO-1800 $. PS!KO-1687's 3,472 ), hooking {21 and 27. It adds 1,687 )to the . v, and 1,687 to 1,701 )to . . In both cases, the at the end of the a, and the >and in the DOS not be Nnot hide the it is are no in the PS!KO-1800: The PS!KO-1800 on the PS!KO . PS!KO-1800's is 3,696 hooking {21 and 27. It adds 1,800 )to the . v, and 1,800 to 1,814 )to the . v. In both cases, the at the end of the a, and the >and in the DOS not be Nnot hide the it is . The can be "The Ps!ko "SiTT" "The Ps!ko - Written in the USA, by SiTT and The Rabid Avenger: Rabid Avenger was }in the the . Its portion is at the top of $the ', and is 3,696 {21 and 27 are by 1,800 by 1,806 to 1,823 ). In both cases, the at the end of the din the 5include: "<- ks to the "Eat us!" "(C) RABID International Development Corp!" Killer Test" so as to avoid detection by utilities are able to detect Sneaker: Sneaker was . Its . The in the "Nadia FOTTIT!!...By the Sneaker" "Diana P." was written in the city of Sofia (C) 1988-89 by 1,800 at the end of the by 1,800 to 1,814 at the end of the VAN Soft: VAN Soft was Vin May, (and is on the . The major now: "V.A.N. Soft & M PRESENT:SOFIA" "VAN& by 1,800 at the end of the by 1,806 to 1,824 at the end of the See: 1963 CB-1530 Outland QP3 V651 V1024 V2000 PZPAPN Dark End : Dark End H: i; TSR; "of C:; interfers R: 1,188 5: PRsAK - 3.96+, NAV 3.0+, 8/93+, .2.0+ The Dark End . Its . Dark End is a uof . -and . bDark End X, the Dark End as a low TSR of 1,200 ), hooking |21. It as part of the 6interpretor in many mapping utilities. the Dark End , it and . pof 1,188 at the end of the a. The >and in the DOS not be . The can be in the 5in all Dark End "(c) Dark End." The Dark End 15th of any year. At , the of the C: the Dark End interference ounexpected clearing of the and the cursor flickering. jmay unexpectedly. PZPAPN Dark Lord : Dark Lord Dark Lord-B, ManOWar, T H: May, R: 923 5: PRhAK - , NAV, The Dark Lord in May, . It is (. Dark Lord is a uof . The Dark Lord is X, the at the top of $the , as measured by the DOS by 1,616 {21 and 24 mby Dark Lord. Dark Lord is , it -and . by 923 to 936 at the end of the ,is an exception, p, the the stack space on the end of Dark Lord 9the "Dark Lord, I summon thee! MANOWAR" The second near the end of Dark Lord Nnot on 386-class . On those Zof an in a hang. It is if Dark Lord of Dark Lord are: Dark Lord-B: Very to Dark Lord, fthe NCSA collection differs in 1 *internally fthe Lord the goes , if it was not already the exception of by 921 - 935 See: T PZPAPN Darkray : Darkray H: The R: 1,525 5: PRhE - 6.55+, \2.10g+, n1.05+, 6.64+, 1.25+ The Darkray , and is fThe . It is a uof . written by the Trident writing group. bDarkray X, the Darkray at the top of $the ', not moving |12's , as qby the DOS @by 1,888 13 and 21 mby the the Darkray , it pof 1,525 at the end of the a. The >and in the DOS not be . The in the 5in all Darkray It is what Darkray See: Flue Trident PZPAPN Darth Vader : Darth Vader Darth-1, Darth-2, Darth-3, Darth-4, Darth-5 Research H: May, R: 200 - 345 5: ORCK - , NAV, The Darth Vader es were in May, Darth Vader is actually a ]of four are very . All of es are are copied. a Darth Vader Darth Vader . Latter, as . are copied, the target . Depending on the particular Darth Vader , the target may leither the "of the , or an area of hex 00 by the in the E, and the >and not be Darth Vader es do not perform any malicious damage, are usually damaged and and . The at the end of `. The , indicating the , can dat the end of all "DataLock 1.00" DataLock >, if DataLock , it prevent the fopening lan extension ending "BF". to open `, such as .DBF in an "out of ahandles" of DataLock are: DataLock-828: of DataLock is a minor of the DataLock . It `as well as by 828 to 1,048 t, and 828 tof the of DataLock add up to 256 )to . Nnot wthem. >and in the DOS to the >and . One can be dat the very end of all "*10-03(HM)*" : Calgary, Ontario, Canada DataLock-1043: is a "bug-fixed" of the DataLock . It was }in the Washington DC/Virginia area of the by Brian Seborg in May, . DataLock-1043 -and . over 9K in while the pof 1,043 at the end of the pof 1,043 tof the a, and an 1,043 tof the a. The spread `due to a bug in . The din the removed. DataLock-1043 is destructive. It for one hour. At , it Os A:, B:, and the second physical if it exists. : USA DataLock-1740: DataLock-1740 is a later of the DataLock . DataLock-1740 -and . Xwhile the pof 1,740 at the end of the The p, however, not be the DOS . The in the all DataLock-1740 `are: "Hacker: NGUYEN HIEU VINH" "22 / 1A Truong Quoc Dung" "Phuong 10 Quan Ph Nhuan" k Pho Ho Chi Minh" "South of Viet Nam" lthe in the DOS set to "08-08-88 8:08a". The DOS Ton all DataLock-1740 is : Viet Nam DataLock-D: of DataLock is a minor of the DataLock . Like the , it adds 920 )to the . v. It ,if it is X, but not are 10 differ fthe . Unlike the , it May, PZPAPN Davis : Davis G: May, i; beeping & Malaysia R: 1,776 - 1,965 5: PRhE - The Davis fMalaysia in May, . Davis is uof . it has for 15 to 30 minutes. The the Davis the Davis at the top of $the '. It Nnot move |12's qby the DOS @by 1,776 {08 and 21 mby the Davis Davis is , it pof 1,776 to 1,965 the end of the a. The >and in the DOS not be 15 to 30 minutes the Davis , it start Ming the accompanied by 3 beeps every few minutes: DAVIS V1.01 Author : Davis : mm/dd/yy VIRUS STATION COPY Hi ! How are you today ? Don't worry about ! DAVIS VIRUS follow you forever and ever ! Don't care me! I really do not damage your Kor data. .make Funny to you Davis Nnot do malicious Ming its disruptive PZPAPN Day10 : Day10 Day/10, SYP R: 674 5: PNCK - , NAV, .2.0+, The Day10 . Its . Day10 is a uof . ,. It is destructive the Day10 X, the wone . in the E. If in the E, it may r. Day10 of 674 ). The at the end of the a. The >and in the DOS to the >and . The can be in the "DM? Day10 Xif the >is evenly di by 10 (day=10, 20, or 30). On days, Zof an in the Day10 of the PZPAPN dBASE : dBASE DBF Extinct , 1988 -& .OVL i; corrupt .DBF `; TSR; FAT and root New York, R: 1,864 5: PRC - -and Overlay , NAV, \, NAV or The dBASE Gby Ross Greenberg of New York. -& .OVL `, and corrupt data in DBF by randomly transposing )in any open .DBF a. It keeps track `and )were transposed in a hidden a(BUG.DAT) in the same Eas the .DBF a(s). The restores )if the ais read, so it nothing is wrong. the BUG.DAT ais 90 days old or more, the the FAT and root Eon the !detected, if you remove the dBASE and replace it a clean copy, your .DBF were during the period you were useless since are garbled on the Keven would Las expected by the rdBASE PZPAPN Dead-790 : Dead-790 Deaf , 1994 R: 790 5: PRhCK - V112+, 2.11a+, 2.58+, /2.1+, \2.10g+, n1.04+, 6.60+, .2.0+, 1.22+, V111+, 2.58+, 6.64+ The Dead-790, or Deaf, , 1994. Dead-790 is a uof . It receives its fthe combination of two in the bDead-790 at the top of $the DOS ', not moving |12's , as qby the DOS @by 800 mby the the Dead-790 , it any reason. 790 at the end of the a. The >and in the DOS not be . Two can be in Dead-790 "DE" "AD" The start in the fourth *of the awhile the last be at the very end of the PZPAPN Death Dragon : Death Dragon Eddy'93 Republic Of South Africa R: 528 5: PNCK - 6.60+, \2.13+, 1.22+, 6.64+ The Death Dragon, or Eddy'93, It is fthe Republic Of South Africa, where it was uploaded to at least one bulletin board (BBS). Death Dragon is a uof . the Death Dragon wall of the . in the pof 528 at the end of the a. The >and in the DOS to the >and . The in the 5in all Death Dragon "[DEATH DRAGON]" "@echo off" "echo Fuck you, arsehole! You are a SHITTY "echo I hate you!" "echo." "pause" "Eddie has ed on tour ( ) - VMAG "press a key..." "*.com c:\autoexec.bat" of any year, Zof an the Lon the monitor: "Eddie has ed on tour ( ) - VMAG PZPAPN Define : Define G: May, &failures Australia R: 30 5: ONAK - , NAV 3.0+, 8/93+ The Define . Its source distributed in a FidoNet echo in May, . Define is a uof . -and . , and may Define is X, Define wthe in the a copy of )of the . If the r, it simply previous t. Unless the in the Eis smaller be no . The in the >and in the to the >and The Define corrupt vthem since s the )of the host no longer function usually ing the to the DOS prompt. If r, the fail to Define is on the Mini-45 . It Nnot do of Define are: Define-B: to the Define is a minor several differ. Define-256: Define-256 is a 256 of the Define . Much of the Nn't do , and the base 5is very in the )of the a Define-256 X, the wthe in the E. If the previous t. The >and in the DOS : South Africa See: Mini-45 PZPAPN Deicide : Deicide Glenn ; FAT R: 666 5: ONC - 3.96+, NAV 3.0+, 8/93+, .2.0+ The Deicide is a `, but not ,. Later of Deicide are es, and are $under Deicide is X, the search the Efor an . If an d, the b666 )of the . If the newly was 666 more, show in the was smaller ), its now be 666 ). The may be Lby the If the Nnot find an in the E, it Mthe double spaced, and of the "DEICIDE! Glenn (666) says : BYE BYE HARDDISK!! Next be carufull illegal stuff" The can be din all `, along the is not experimental was written by Glenn Benton to see if I can make a while learning machine for 2,5 months. (C) 10-23- by Glenn. I keep on going making ses." of Deicide are: hood: Written by the same author as the Deicide hood is a of . ,. It one . ain the pof 477 at the "of the a. The >and in the DOS . The can be in the 5in all Br hood hood...' 'I am seeking my br s "DEICIDE" and "MORGOTH"...' dmy br "MORGOTH"!!!' dmy br "DEICIDE"!!!' '*** Glenn Benton ***' Deicide 2: as Deicide-1335, Deicide 2 is a 1,335 of the Deicide . It vone . in the pof 1,335 at the "of the be no 3to the >and in the DOS . The in the 5in all Deicide 2 "Suck my dick, Steffie!" : The Deicide-2405: on the Br hood of Deicide, Deicide-2405 vone . X, adding 2,405 )to the a, and Ms a on the The at the "of the and be no 3to the >and in the DOS different may be Lby the , all of . Many of the are insults to various researchers. : The Deicide-2570: on the Br hood of Deicide, Deicide-2570 is fairly to the Deicide-2405 . It adds 2,570 )to the . v, the at the "of the are 9ed in the , and one is X. Many of the mesages are of a sexual nature in : The Deicide-B: on the Deicide no longer s the it has rall of the . `in a See: Breeze PZPAPN Democracy : Democracy i; TSR; DOS DIR 6output slowed/sluggish R: 3,959 - 3,973 5: PRsA - \2.10g+, /2.1+, V112+, 2.58+, 6.60+, 2.11+, 2.58+, .2.0+, V113+, 6.64+ The Democracy . Its . Democracy is a uof . -and . , but not bDemocracy as a low TSR of 4,192 ). It {01, 03 and 22. the Democracy , it larger pof 3,959 to 3,973 at the end of the a. The >and in the DOS . The can be dat the very end of all Democracy "Democracy" s of the Democracy slow or sluggish response to the DOS DIR 6. It is what else may do PZPAPN Demolition : Demolition i; TSR; R: 1,585 5: PRsCK - , NAV, The Demolition . Its . Demolition is a uof . bDemolition X, the Demolition as a low TSR of 1,904 ). It the Demolition , it pof 1,585 ). The at the end of the a. The >and in the DOS . The can be in the 5in Demolition "UZD(T!EFNPMJUJPO" The Demolition hang the ais later X, it in a hang. It is if the Demolition 8any damage potential. PZPAPN Demon Viper : Demon Viper G: March, fail to function ; jumbled 4may R: 817 5: PNCK - 30.00+, NAV 3.0+, n1.04+, 6.64+ The Demon Viper in March, . Its . Demon Viper is a uof . the Demon Viper X, the Demon Viper wone . in the or next higher level pof 817 at the end of the a. The >and in the DOS to the and . The in the Demon Viper 5in all "May SATAN prevail on "I summon you!" "DEMON! ver" "by Viper!" the Demon Viper [unexpected ogarbled Lon the monitor and Zfailure. PZPAPN Den Zuk : Den Zuk Search, Venezuelan , 1988 ; floppy format; TSR; BSC Indonesia R: N/A 5: RtF - Floppy , NAV, K, CleanUp, \, NAV, or DOS SYS The Den Zuk is a uof 360K 5-1/4" I. The wany Jin a floppy is accessed, even if the Jis not &able. If an attempt is made to &the rnon- Den Zuk into even failed. purple "DEN ZUK" graphic a CTL-ALT-DEL is performed if the has a CGA, EGA, or VGA monitor. While the Den Zuk did not cause any damage to the maintain a counter of how many s the &ed, and the counter r Qes its limit, the floppy in the Ois reformatted. The counter in of the is usually in the range of 5 to 10. The can be din the the Den Zuk "Welcome to the C l u b --The HackerS-- Hackin' All The The HackerS" The Jvolume label of Imay be Y.C.1.E.R.P., s if the Den Zuk removed a Pakistani Brain tbefore sthe Den Zuk. The Den Zuk remove an Ohio tbefore sthe Den Zuk. The Den Zuk t to be written by the same person or persons as the Ohio . The "Y.C.1.E.R.P." the Ohio , and the in many respects. of Den Zuk are: Den Zuk-RPKS: A minor of Den Zuk, of the on track 40 well as the to avoid detection Den Zuk detection May, See: LZRQ Ohio PZPAPN Deranged : Deranged i; beeping speaker; R: 419 5: PNE - 8/93S+, /2.1+, 1.22+, .2.0+ The Deranged . Its . Deranged is a uof . the Deranged X, the Deranged wall of the . in the E. Beeping on the speaker may and/or possibly a hang. the Deranged pof 419 at the end of the a. The >and in the DOS not be . The in the 5in all Deranged "The Deranged "Criminal Behaviour" PZPAPN Desperado : Desperado Desperado.2403A, Desperado 1.0 ^, 1994 moved; Sweden R: 2,403 - 2,418 5: PRtAK - 2.11a+, \2.13+, 6.64+, 6.64+, 1.25+ The Desperado ^, 1994, and is Sweden. It is a , fast uof . -and . bDesperado at the top of $the ', moving |12's , as qby the DOS @by 6,144 mby the , the ,if it was not -and . pof 2,403 to 2,418 at the end of the a. The >and in the DOS not be . The in the Desperado "Dr White - Sweden "SCANCLEAVSHITOOL /VSAFF-PRVIRSTBAVTBSCTBCLTBUT -V UTSCUT CHKLIST.MS" "Desperado - Written in Malmo..." The Desperado included in many of the popular utilities. are identified by the by comparing the bfour 4of the the contents of the second It is what Desperado of Desperado 1.0 are: Desperado.2403B: Desperado.2403B, or Desperado 1.1, is a later of the Desperado . It is to the 8the same : Sweden ^, 1994. Desperado.2403C: Desperado.2403C is a later of the Desperado . It is to the 8the same : Sweden March, 1994. PZPAPN : Dest Dest-1 R: 323 5: PNCK - 3.96+, NAV 3.0+, 1.53S+, 1.22+, The Dest, or Dest-1, . Its . Dest is a uof . two later s of , one of is a . The later s of the $under the Dest X, the Dest wone . in the pof 323 at the end of the . The >and in the DOS to the >and . One in the "*.com" Dest-1 Nn't do of Dest are: Dest-2: A later of the Dest or Dest-1 adds 478 )to the . v. The >and in the DOS not be are no in the Dest-3: A later of Dest-2, Dest-3 is a uof . -progams. X, it at the top of $the decreasing by 2,192 {21 and 22 pof 491 at the end of the The >and in the DOS to the and . Dest-3 Nn't do PZPAPN Destructor V4.00 : Destructor V4.00 Destructor R: 1,150 - 1162 5: PRtAK - \, NAV, The Destructor V4.00 (, and is a uof . and . the Destructor V4.00 X, the at the top $the |12's is moved. be 1,216 )less what is expected on the , the ,if it is not already Destructor V4.00 is , it pd in by 1,150 ). . by 1,154 to 1,162 ). In both cases, the at the end of the Nnot alter the =in the E, and it makes no attempt to hide the The can be "DESTRUCTOR V4.00 (c) by ATA It is what Destructor V4.00 N, if PZPAPN Devil's Dance : Devil's Dance Devil's Dance-B ?, 1989 i; FAT :; TSR Mexico R: 941 5: PRsCKT - , NAV, : NAV, or The Devil's Dance ?, 1989, by Mao Fragoso of Mexico City. Devil's Dance is a of . ,. It can be very destructive. The Devil's Dance is Devil's Dance as a low TSR of 1.2K. {09 and 21 mby Devil's Dance , Devil's Dance wall . in the E. If the Devil's Dance, it be re Devil's Dance is , it wany the Devil's Dance by 941 Qlater re ing in an p. The at the end of >and in the DOS !run, any subsequent warm-re (CTL-ALT-DEL) may in the lyou ever danced the devil under the week light of the moon?" PRAY FOR YOUR DISKS!!" The Devil's Dance is destructive. b2,000 keystrokes, the starts changing the colors of any Lon the monitor. The changing of colors of s start to immediately b5,000 keystrokes, the erases the bcopy of the FAT. At is re &ed, it Mthe and again destroy the bcopy of the FAT, allow the &to proceed. of Devil's Dance are: Devil's Dance-B: to the Devil's Dance . The major difference is run very slowly, &. On &, the may receive the "Specified -MAND search Ebad". PZPAPN Dewdz : Dewdz &failure R: 601 5: PNCK - , NAV, The Dewdz is a ,. It is on the Burger group of es, and utilities identify it as such. Dewdz is X, the search the C: Oroot Efor an w. If one is d, it r. Dewdz pof 601 at the "of the be no 3to the >and in the DOS . The can be seen the "OUSE BBSTEMP" "*.com *" Mthe "Kewl Dewdz!" are X, and the to be hung. If the presses CTRL-C, processing usually continue. &failures the Dewdz ,on the See: Burger PZPAPN Diamond : Diamond WC failure on R: Varies, depending on present 5: PRAK - n, NAV 3.0+, 3.96+, /2.1+, 1.53+, The Diamond entry in Hyper actually represents several members of the group or on the V1024 The $are on the V1024 , and were as part of a large library of es. As such, Hare completely . The es in group are all us of . and/or . , and in most cases not function member(s) of the Diamond ]are: Diamond-444: A 444 on the V1024 . It -and . by 444 the at the end of the a. The >and in the DOS is not . Diamond-444 cannot determine it has a, so be re r, adding an t. The the 5in all "9090909090" Diamond-444 Zof any in the WC failure" L, and the ed to the DOS prompt. Diamond-465: A 465 on the V1024 . It -and . by 465 the at the end of the a. The >and in the DOS is not . Diamond-465 cannot determine it has a, so be re r, adding an t. The the 5in all "9090909090" Diamond-465 Zof any in the WC failure" L, and the ed to the DOS prompt. Diamond-485: A 485 on the V1024 . It -and . by 485 the at the end of the a. The >and in the DOS is not . Diamond-485 cannot determine it has a, so be re r, adding an t. The the 5in all "7106286813" Diamond-485 Zof any in the WC failure" L, and the ed to the DOS prompt. Diamond-584: to the Diamond-485 adds 584 )to the t. The in the 5in all "7106286813" Diamond-584 Zof any in the WC failure" L, and the ed to the DOS prompt. Diamond-594: to the Diamond-584 adds 594 )to the t. The in the 5in all "7106286813" Diamond-594 Zof any in the WC failure" L, and the ed to the DOS prompt. Diamond-602: to the Diamond-594 adds 602 )to the of the The in the in all "7106286813" Diamond-602 Zof any in the WC failure" L, and the ed to the DOS prompt. the DOS DIR 6is issued. Diamond-606: to the Diamond-602 adds 606 )to the of the The in the in all "7106286813" Diamond-606 Zof any in the WC failure" L, and the ed to the DOS prompt. the DOS DIR 6is issued. Diamond-607: to the Diamond-607 adds 607 )to the of the pis hidden . The in the 5in all "7106286813" Diamond-607 Zof any in the WC failure" L, and the ed to the DOS prompt. The DOS DIR Nnot hang the Diamond-608: to the Diamond-606 adds 608 )to the of the The in the in all "7106286813" Diamond-608 Zof any in the WC failure" L, and the ed to the DOS prompt. the DOS DIR 6is issued. Diamond-609: to the Diamond-609 adds 609 )to the of the The in the in all "7106286813" Diamond-609 Zof any in the WC failure" L, and the ed to the DOS prompt. the DOS DIR 6is issued. Diamond-614: A 614 of the Diamond , it adds 609 )to the of the the be hidden . The seconds field of the =in the DOS to "60". The in the 5in all "7106286813" Diamond-614 Zof any in the WC failure" L, and the ed to the DOS prompt. The DOS DIR Nnot produce a hang Diamond-620: A 620 of the Diamond , it adds 620 )to the of the the be hidden . The seconds field of the =in the DOS to "60". The in the 5in all "7106286813" Diamond-620 Zof any in the WC failure" L, and the ed to the DOS prompt. The DOS DIR hang the it is issued. corrupt very small vthem. Diamond-621: A 621 of the Diamond , it adds 621 )to the of the the be hidden . The seconds field of the =in the DOS to "60". The in the 5in all "7106286813" Diamond-621 function , as the DOS DIR 6. Its is 5,376 ), hooking {08 and Diamond-624: A 624 of the Diamond , it adds 624 )to the of the the be hidden . The seconds field of the =in the DOS to "60". The in the 5in all "7106286813" Diamond-624 function , as the DOS DIR 6. Its is 5,376 ), hooking {08 and Diamond-626: A 626 of the Diamond , it adds 626 )to the of the the be hidden . The seconds field of the =in the DOS to "60". The in the 5in all "7106286813" Diamond-626 function , as the DOS DIR 6. Its is 5,376 ), hooking {08 and Diamond-891: A 891 of the Diamond , it adds 891 )to the of the the be hidden . The seconds field of the =in the DOS to "60". The in the 5in all "7106286813" Diamond-891 function , as the DOS DIR 6. Its is 7,424 ), hooking {08 and Diamond-978: A 978 of the Diamond , it adds 978 )to the of the the be hidden . The seconds field of the =in the DOS to "60". The in the 5in all "7106286813" Diamond-978 function , as the DOS DIR 6. Its is 1,024 ), hooking {08 and Diamond-1013: A 1,013 of the Diamond , it adds 1,013 )to the of the v, the be hidden . The seconds field of the =in the DOS to "60". The in the 5in all "7106286813" Diamond-1013 function , as the DOS DIR Its is 1,056 ), hooking 08 and 21. See: Ah Gremlin Rocko V1024 PZPAPN Digger : Digger :; unexpected R: 1,475 5: PNCK - 3.96+, NAV 3.0+, 8/93+, The Digger . It is fthe . Digger is a ,. It corrupt . the Digger wone on the C: O. It starts in the C: Oroot E, and slow work its way down the Estructure. . rby the Digger 1,475 at the end of the The >and in the DOS not be . The can be in the 5in all "C) DIGGER" The Digger corrupt . it encounters it is searching for a . corrupted be completely s to be It is what Digger may do and corrupt PZPAPN : Dima requiring 6line input may not function Ms "9pm" R: 1,024 5: PNAK - 3.96+, NAV 3.0+, /2.1+, 8/93+, .2.0+ The Dima . It is fthe Dima is a uof . -and . the Dima wall of the . -and . in the E. If E, it the Dima pof 1,024 at the end of the a. The >and in the DOS to the and . The din all Dima "*.exe" "OMtE" "The -9pm-." "Call the Dima & Dima corporation if it be difficult." The Dima at 21:00 or 9PM, at of an in the Mof the and a hang ring: "9pm" the Dima [problems executing require 6line input, in the not functioning PZPAPN : Dir i; TSR; sluggishness of DIR R: 691 5: PRsCK - \, NAV, The Dir . It ated in the . The Dir is a uof . The the Dir the as a low TSR of 1,008 mby the . If ,is not already r, it the Dir , it a DOS DIR 6is performed. It Nnot Z, or `are a DIR 6is performed, the din the be a pause in the output of the DIR while the the output continue. by 691 pcannot be seen performed if the . The at the end of >and by the the Dir receive the DOS Xon a . If the is not not be Zof the DOS the /F option :of the Nnot 9any mechanism. PZPAPN Dir-2 : Dir-2 Creeping Death, FAT lost clusters; acopy; cross linked qby DOS fclean R: N/A 5: ZRAK - 8/93S+, NAV 3.0+, .2.0+ : CleanUp, or Low level format reformat The Dir-2, or FAT, was reported in (, Hungary, Poland, and Yugoslavia in . The copy analysed of was fTamas Szalay of Budapest, Hungary. The Dir-2 is a uses a completely new technique for replicating, and moves very quickly through exposed . It is very difficult to detect, not having many or measurable The Dir-2 the computer K, and a X. Since the Ys the hidden the X. The in low , in the area where the configuration x(IO and MSDOS) is normally &completes, , by be 1,552 )less expected. If the views mapping utilities. The "CONFIG" area be 1,552 larger expected. At the of the &, the by the as well, if it was not already Dir-2 is , any non-write protected accessed on the r. The places its 5in the last cluster of I. On the K, the in a unused cluster. The encrypts the ers for the execu `on the K, and copies them to an unused area of the E. The ers are to the 5on the Viewing the in a normal E. All execu indicate s and =stamps. In fact, the lnot at all. If the Ys one of the , the X(due to the the E). Using the ers to the actual location, the Dir-2 load the Y, so it is The major symptom of a Dir-2 tis the effect the has on the powering off and &ing clean DOS to copy in the `not #copied . The newly copied 9the in the last cluster of the to use backup . Executing DOS in a large number of lost clusters ddue to the 3in the E. All execu #cross-linked on the same is the location of the 5on the K. If the /F parameter is used, permanent :of all execu be the . Note Zof the DOS not indicate any or cross-linking of due to the presence of the If you suspect you la Dir-2 t, power off the and cold -clean write-protected DOS and check for the on the K. Be careful to not Yany fthe Kas the out an utility to detect and remove Dir-2, it is possible to manually dis by copying all execu to non-execu The should be powered off and re fa clean, write protected out executing any the K, backup the re `and your data The should be low level formatted. reformatted, restore the backup and re the re of Dir-2 are: CD10: gequivalent, is a minor undetec CD11: gequivalent to CD10 and the is an minor CD12: gequivalent to the members of es, it is a minor Dir 2-910: to the members of stores its 5on the last two of the O. Executing the in the tof the C: Oand root Fories. Its is 1,632 PZPAPN Dirty : Dirty Lavi Italy R: 483 5: PRhCK - n1.04+, 2.58+, 6.60+, V109+, 1.22+, 2.58+, .2.0+, 6.64+ The Dirty, or Lavi, . It s to be fItaly. Dirty is a bDirty at the top of the ', not moving |12's , as qby the DOS @by 544 mby Dirty in the Dirty , it pof 483 at the end of the a. The >and the DOS 1to a random value, and the seconds field !set to "62". The can be in the 5in all Dirty "HI ! I'm The Dirty Fucker !!" PZPAPN Discom : Discom TSR; . R: 2,053 5: PRsA - NAV 3.0+, : CleanUp, or The Discom . The location where the sample was . Discom is a uof . -and . `, and on the , and fthe Sunday . As such, utilities may identify 9ing both and Sunday. Nnot exhibit or the of either the or Sunday The the Discom the as a 2,304 TSR. {08 and 21 mby the , the -and . 2,053 )and lthe at the "of the by 2,059 to 2,068 at the end of the All chex character 11121704D0. Unlike many Nnot exhibit a slowdown for 30 minutes, and no "black window" s. Discom , at random intervals, send random 4to the -ports, as well as write portions of to random on the PZPAPN DisDev : DisDev `corrupted; . `truncated and/or dis R: 6,144 5: ONE - , NAV 3.0+, n1.04+, 6.60+, V111+, 1.53S+, V111+, 6.64+, 1.25+ The DisDev . Its . DisDev is a the DisDev X, the DisDev wall of the . in the of 6,144 ), having !replaced a pure copy of the DisDev >and in the DOS to the >and . The can be in the DisDev "<*>-==> DisDev -Copyright (c) 1066 ScumSoft- <==-<*" "disdev" "DisDev" "Fucking "Portions Copyright (c) 1066 ScumSoft!!" DisDev has rall of the . `in the E, executing an in the X"dis ing" fthe DOS The lset the hidden attribute, ing in effect. to replace the aby copying a clean copy of the fail acreation The DisDev Mone of the ctwo "DisDev" "Fucking U 202 at 0:00F1" PZPAPN KKiller KKiller Computer Ogre, KOgre, Ogre , 1989 Bad blocks; ; BSC; TSR; encryption of Taiwan Milpitas, California, R: N/A 5: BRtT - , NAV, K, CleanUp, \, NAV, or DOS COPY & SYS The KKiller is a spreads by writing copies of to 3 blocks on either a floppy or K. The Nnot care if blocks are in use by an or are part of a blocks be marked as bad in the FAT so cannot be . The is patched so &ed, the Xand it can attempt to wany new Ks exposed to the The keeps track of the elapsed Kusage since initial t, and Nno harm until it has r Qed a predetermined limit. The predetermined limit is 48 hours. (On most KKiller Qits limit in 1 - 6 weeks of its initial the limit is r Qed or exceeded and the is re &ed, a Lidentifying -PUTER OGRE and a 1st. It says to leave alone and proceeds to encrypt the by alternately XORing Ah and 0 5h, effectively destroying the xon the K. The recourse KKiller has activated and Sthe entire Kis to reformat. The Lupon , and can be in the KKiller -- 1.00 by -PUTER OGRE 04/01/89 Warning!! Don't turn off the power or remove the Jwhile KKiller is Processing! PROCESSING Now you can turn off the power. I wish you Luck!" It is important to note L, if the is turned off immediately it may be possible to salvage `on the Kusing various utility destroys the &, FAT, and Eblocks. KKiller can be removed by using McAfee Associate's M CleanUp utility, or the DOS SYS 6, to Ks or &able floppies. On non- floppies, `can be copied to non- rfloppies, followed by reformatting the rfloppies. Be sure to re &the fa write-protected Jbefore to remove the bor you be re rby the Note: KKiller may ldamaged one or more `on the it wrote a portion of its 5to 3 blocks on the corrupted `cannot re wthe , however should be replaced backup copies since the 3 blocks were Note: Do not use the DOS DISKCOPY to backup Ias the new backup 9the as well. PZPAPN Dismember : Dismember seconds = "62" Sweden R: 288 5: PNCK - /2.0+, NAV 3.0+, 1.53S+, .2.0+, The Dismember . It is fSweden. Dismember is a the Dismember wall . `in the between 4,096 and 65,024 before pof 288 at the end of the a. The seconds field of the in the DOS !set to "62", the tmarker of the . One the Dismember Nn't to do PZPAPN Distrust : Distrust , 1994 i; TSR; As in 64K blocks R: 1,588 - 1,604 5: PRsA - V116+, \2.13+, /2.1+, 2.58+, 6.64+, .2.0+, 1.25+, 6.64+, V116+, 2.58+ The Distrust , 1994, its . Distrust is a -and . `, but not bDistrust as a low TSR of 3,424 ), hooking interupts 08, 21, and 24. the allocate an block of 64K, actually Aby more 3,424 the Distrust , it by 1,588 at the "of the a. In the case of . , the by 1,594 to 1,604 at the end of the a. In both cases, the >and the DOS not be . No are in the PZPAPN : DLSU , 1994 R: 477 5: PNC - V112+, 2.11a+, 2.58+, \2.10g+, 6.64+, NAV 3.0A06+, n1.05+, 1.53s+, V111+, 2.58+, 1.25+, 6.64+, 1.0A06+ The DLSU , 1994. Its . DLSU is a of . , but not the DLSU wone . `in the pof 477 at the "of the a. The >and in the DOS to the >and . The in the 5in all DLSU "*.com *.*" PZPAPN : DM DM-400 j; write to R: 400 5: PRfCK - , NAV, .2.0+, The DM, or DM-400, It is fthe . DM is a DM is X, the DM in low Fly remapping {21 and 24. It place a portion of video , such as on a video card, if it is qby the DOS not be the DM , it pof 400 at the end of the be no 3to the >and in the DOS . The can be in all "(C) A symptom of a DM fwrite protected in a hang #left spinning. The write a copy of to the It is what DM of DM are: DM-B: referred to as DM 1.01, DM-B is a 400 of the . It Nnot 9the "(C) 9ed in the DM 1.01B: on the DM-B , DM 1.01B is , and has !modified to avoid #detected by most utilities familiar group of 8the : "(C) 1.01 DM." DM 1.04: DM 1.04 is a 400 of the X. It Nnot 8the : "GIiokMO". DM-330: referred to as DM 1.05, DM-330 is a 330 of the DM-B . It . It Nnot 9any identifying PZPAPN : DNR ONot Ready ; TSR; open a lot of `may not function R: 331 5: PRsCK - 3.96+, /2.1+, 2.58+, 6.60+, 2.11+, n1.05+, NAV 3.0A06+, 2.58+, 1.25+, 6.64+, 1.0A06+ The DNR, or ONot Ready, Its . DNR is a uof . ,. It may be related to the Cybercide bDNR X, the DNR as a low TSR of 2,048 ), hooking |21. At , the Mthe on the monitor: ONot Ready." the DNR , it pof 331 at the end of the a. The >and in the DOS to the >and . The the 5in all DNR ONot Ready" The DNR uses one ahandle X. As the number of ahandles slowly As, the may find open a large number of `may fail to function of DNR are: DNR-ROM Bios: , DNR-ROM Bios is a 397 of the DNR . Its usage of is the . It Ms the "ROM BIOS not compatible" DNR-ROM Bios pof 397 at the end of the a. The , as well as the , is in the "WHY_ME" See: Cybercide PZPAPN Do-Nothing : Do-Nothing The Stupid , Nothing Extinct , 1989 i; TSR (see Israel R: 608 5: PRfC - , NAV, \, NAV, or breported by Yuval Tal of Israel in 1989. The `, but bone in the E, whether it was ror not. The Do-Nothing , always address 9800:100h, and can . The Nnot protect area of any way, and area it in , removing the The Do-Nothing Nno apparent damage, nor Nit affect operation of the in any observable way, thus its See: Saddam PZPAPN Doctor Qumak 2 : Doctor Qumak 2 Dr Qumak 2 :; "Write protect Krakow, Poland R: 1,079 5: PRtCK - 3.96+, NAV 3.0+, The Doctor Qumak 2 . It is fKrakow, Poland. Doctor Qumak 2 is a uof . ,. It is a destructive The the Doctor Qumak 2 at the top $the ', moving 12's , as by the DOS @by 2,064 {12, 13, and 21 mby Doctor Qumak 2 in the Doctor Qumak 2 , it for any reason. pof 1,079 at the end of the a. The >and in the DOS not be The Doctor Qumak 2 under two conditions, the condition #very destructive, slowly corrupting . The keeps track of how many Kwrite operations since it became 100 write operations , the modify three )in the next written to it has modified manner, it Mthe "The famous cooperation strikes again: IT IS DOCTOR QUMAK II! Watch out for the next fKrak w, Poland!" is not as it is in the The second condition under Doctor Qumak 2 activate is during the months of thru ?of any year. During months, on Sundays the 9th of the month, the simulate a "Write protect to write to a PZPAPN : DoDo Birdie R: 408 5: PRbCK - , NAV, The DoDo, or Birdie, . Its ~are . DoDo is a uof . ,. It is not related to the Dodo 2456 The the DoDo the DoDo in video card mby the the |area. the DoDo , it pof 408 the end of the a. The >and in the DOS not be . One can be din the "Birdie Hop!" DoDo Nn't do of DoDo are: Pig: The Pig is a 407 of the DoDo #one *shorter, the major difference . The is: "GIP". Pig-B: gequivalent to the Pig has three differ. PZPAPN Dodo 2456 : Dodo 2456 The R: 2,456 5: PRsCK - 30.00+, \2.10+, 6.64+ The Dodo-2456 }in The It is a uof . ,. It is not released to the DoDo or Birdie bDodo 2456 X, the Dodo check the copy of in the C: root E. If copy of ,has not rby the , the wit at . If ,is already r, the . The Dodo 2456 as a low TSR of 2.4K, but in the process of it becoming , it actually end up keeping slightly over 100K of mby Dodo2456 in the Dodo 2456 , it pof 2,456 at the end of the a. The >and in the DOS not be . The in the 5in all Dodo 2456 "DODO" "c:\ 6.com" "Today we commemorate the DODO." "The bird who has the victim of human civilization "A:\ EST POC" 6com" in the 5, the "DODO" can be dstarting in the fourth *of all It is what Dodo 2456 PZPAPN Doom II : Doom II G: May, writes Taiwan R: 1,252 5: PRbAK - , NAV, The Doom II fthe NCSA. Doom II is a -and . The Doom II is X, Doom on the 's video card, along a hook to in low {1C, 21, 24, and 98 mby the lany , Doom II -and . by 1,252 at the end of the a. The Nnot hide the p, nor is the >and in the , a . rby Doom pslightly more in , such as by 1,253 or 1,254. s to be due to a bug in the Doom II may attempt to write to the due to the in the video card , thus making it un , typically the monitor be blanked and the locked out. jare prevalent the Doom IIB , but more frequently Doom II, the switches fa graphic to a It is if Doom II of Doom II are: Doom II-B: A re-engineered of the Doom II Taiwan, Doom II-B is a uof . and . . Doom II-B -and . 1,252 at the end of the May, PZPAPN : DOS3 R: 661 5: PNA - 3.96+, NAV 3.0+, n1.04+, 2.58+ The DOS3 . Its . The DOS3 is a uof . -and . , but not the DOS3 X, the DOS3 wall of the . -and . the the exception of pof 661 at the end of the a. The in the DOS not be . The in the DOS3 in all "Still using DOS 3?" "You need to upgrade, you loser!" The btwo may be Las a on the monitor Xon computer uses Ms-Dos 3.0 to Ms-Dos 3.3. PZPAPN DOS-1 : DOS-1 R: 184 5: PNCK - n1.04+, , NAV 3.0A06+, 6.64+, 1.0A06+ The DOS-1 . Its . DOS-1 is a uof . the DOS-1 X, the DOS-1 wall of the . in the 184 at the end of the a. The >and in the DOS to the >and . The in the 5in all DOS-1 "DOS-1" DOS-1 Nn't to do PZPAPN : DOS7 R: 342 5: PNCK - /2.1+, NAV 3.0A02+, 6.60+, 2.58+, n1.05+, 1.22+, 2.58+, .2.0+, 6.64+, 1.0A06+ The DOS7 . Its . The DOS7 is a uof . the DOS7 X, the DOS7 wone . in the pof 342 the at the "of the a. The >and in the DOS to the >and . The can be in the DOS7 "W.C?M is r!oy,re you ever dumb!" "MSDOS 7 (C) ANARKICK SYSTEMS" "DOS 6 Anti sucks. It missed one!" It is what DOS7 of DOS7 are: DOS7-B: on the DOS7 , DOS7-B is a 376 vone . ain the ever an pof 376 at the "of the a. The >and in the DOS to the and . The in the 5in all DOS7-B "W.C?M is r!oy, are you ever dumb!" "MSDOS 7 (C) ANARKICK SYSTEMS" "DOS 6 Anti sucks. It missed one!" DOS7-C: on the DOS7 , DOS7-C is a 419 vone . ain the ever an pof 419 at the "of the a. The >and in the DOS to the and . The in the 5in all DOS7-C "W.C?M is r!oy, are you ever dumb!" "MSDOS 7 (C) ANARKICK SYSTEMS" "DOS 6 Anti sucks. It missed one!" PZPAPN DOSHunter : DOSHunter The R: 483 5: PRhCK - 3.96+, NAV 3.0+, /2.1+, 8/93+, .2.0+ The DOSHunter . It was }in The . DOSHunter is a uof . the DOSHunter at the top $the , as qby the DOS @by 1,408 mby the the DOSHunter , it pof 483 at the "of the a. The >and in the DOS not be . No in the The DOSHunter 26th of any year, at trash the b128 of the PZPAPN Dostepu : Dostepu , 1994 2; TSR; unexpected access to R: 1,942 - 1,967 5: PRsCK - \2.13+, 2.58+, n1.05+, 6.64+, 1.25+, 6.64+, 2.58+ The Dostepu , 1994. Its . Dostepu is a uof . ,. Its TSR is not used Fly to bDostepu as a low TSR of 7,392 ), hooking |1C. , the attempt to in the root Eof the two Os immediately Oletter. For example, if the Ois the A: O, the attempt on the B: and C: Os' root Fories. the Dostepu pof 1,942 to 1,967 at the end of the a. The >in the DOS to "13-31-99" while the set to the . The in the 5in all "Nie znaleziono pliku lub zla sciezka dostepu!" "raz23" "ARAZ23" -AND. PZPAPN DOSVer : DOSVer 2062 =seconds = 60; DOS R: 2,062 5: PRhAK - , NAV 3.0+, 1.22+, The DOSVer . Its . DOSVer is a -and . the DOSVer at the top of $the , as qby the DOS @by 3,072 mby the the DOSHunter , it Wograms, pof 1,666 at the end of the a. The be hidden by the it is . The >and in the DOS the seconds field is set to "60". As a the may "dis `in the DOS . No in the the DOSVer may notice the DOS Ton all PZPAPN Dot Killer : Dot Killer 944, Killer, Dot Eater i; removal of all dots (.) Koszalin, Poland R: 944 5: PNCK - \, NAV, The Dot Killer }in Koszalin, Poland in . It is a uof . the Dot Killer X, the wone ain the by 944 ). The at the end of While the Dot Killer 5to attempt to avoid sthe ed to by the -SPEC en mental parameter, logic 8a bug and Nnot function . If ,, or the ed to by -SPEC, is in the rjust like any the Dot Killer , it remove all dots (.) fthe of Dot Killer are: Dot Killer B: to Dot Killer, Dot Killer B's major difference is at &ing ,, a happy face character on the left side of the line, travel across the line to eat the period (.) the attempted to eating the period, the happy face travel back across the until the period. PZPAPN Dreamer : Dreamer Hitler G: May, ; "Hitler!" speaker; DOS R: 4,808 5: PRhCK - 8/93S+, 3.96+, NAV 3.0+, n1.04+, 1.22+, .2.0+ The Dreamer, or Hitler, in May, . Its . Dreamer is a uof . ,, and is as it hides the bDreamer X, the Dreamer at the top of $the ', hooking {1C and 21. |12's not be moved. , as qby the DOS @by 5,072 the Dreamer , it by 4,808 be hidden by the it is . The at the end of the . The >and in the DOS not be . The the Dreamer "Hitler by Dreamer/DY" 15 minutes, the Dreamer activate. At the word "Hitler!" be repeatedly emitted fthe speaker, and a PZPAPN : Drop R: 1,131 - 1,163 5: PRhAK - 3.96+, NAV 3.0+, /2.1+, .2.0+ The Drop . It is fthe Drop is a uof . -and . The the Drop Drop at the top of but $the , as qby the DOS by 3,600 mby the the Drop , it for any reason. pof 1,131 1,153 to 1,163 ). In both cases the at the end of the a. The >and in the DOS to the and . No the It is what Drop may do PZPAPN Druid : Druid `corrupted; fail to Y; long accesses R: 317 5: ONC - n1.05+, The Druid . It is a uof . , but not ,. It s the "of the v, permanently corrupting them. the Druid X, the Druid wall of the . in the it has completed sthe . `in the E, it move up one Eat a in the Estructure, , until it finally the Oroot E. It avoids the Druid normally not . The exception is if the was smaller , the 317 . The >and in the DOS not be . The can be the 5in all "DRUID, 5d by Morbid Angel/Line Noise" Druid notice long Kaccesses X. The long Kaccess is due to the in several Fories. not function PZPAPN Dutch 555 : Dutch 555 555, Quit- R: 555 5: PRhAK - , NAV, : CleanUp, or The Dutch 555 Zwienenberg of the was accidentally released into the public domain by its author in It is a uof . -and . The the Dutch 555 X, the at the top , but $the '. The is not moved, the DOS show a of 560 mby the the Dutch 555 , it and . ,, as by 555 at the end of the a. The and in the DOS to the >and Nnot do of Dutch 555 are: Dutch 555-B: gequivalent to the has four differ PZPAPN Dutch : Dutch 2; write protect R: 124 - 126 5: PRAK - /2.0+, , NAV 3.0+, .2.0+ The three comprise the Dutch group were fThe . All three are techniques the es in the es. two are included under Mini-97 are related to the Dutch The Chere is the 126 Dutch -126. The , both of 124 ), are $in the The Dutch the in a DOS buffer address 0:063A. by the be no and the Dutch , it X. If X, it by 126 at the end of the a. The >and in the DOS to the >and expect 6line input , as did not provide the input. fwrite-protected in a "write protect fDOS. Nnot do of Dutch Dutch -115: , Dutch -115 is a 115 . It wall . `in the pof 115 at the end of the a. The in the DOS to the >and . Frequent Dutch -117: , Dutch -117 is a 117 . It wone . the pof 117 at the end of the a. The in the DOS to the >and . One can be in the : The Dutch -124: A later of the Dutch -124 is a 124 , frequent and a . a, or an already a, is Zof any fthe A: in a hang has the is expecting O. Dutch -124 is a poor replicator, and wmost . Dutch -124B: Dutch -124B is a later of Dutch -124. Unlike members of ], it wboth . -and . ts do not very often. be damaged, and later Zof them in a hang in all cases. See: Mini-97 PZPAPN : DWI (in public domain) G: May, Zfailures on large . WIN. R: 1,051 - 1,065 5: PRhE - 3.96+, , NAV 3.0+, /2.1+, 2.58+, n1.05+, 2.58+, .2.0+, 6.64+, 1.25+ The DWI in May, . It was written by a member of the Virulent Graffiti writing group in the United States. DWI is a uof . bDWI at the top of the ', hooking |21. , as qby the DOS @by 1,296 |12's not be moved. the DWI , it pof 1,051 to 1,065 at the end of the a. The >and in the DOS not be . The are in the DWI "[DWI] AccuPunk/The Attitude Adjuster Virulent Graffiti" "WIN. "You've !caught, you DWI! You're nothing but a Damn Windows Idiot!" "Well, we at Virulent Graffiti lhad it... you're not going to be" "running bullshit for a while, 'cuz, hey, friends don't let friends" "use Windows! (and you're damn right we're your friends!)" larger 64K in fail to are If the YWIN. , the Lon the monitor, and WIN. be corrupted by the "You've !caught, you DWI! You're nothing but a Damn Windows Idiot! Well, we at Virulent Graffiti lhad it... you're not going to be running bullshit for a while, 'cuz, hey, friends don't let friends use Windows! (and you're damn right we're your friends!)" PZPAPN : Dy R: 278 5: PNCK - 3.96+, n1.04+, 6.60+, 2.58+, 2.58+, .2.0+, 6.64+ The Dy . Its . Dy is a of . the Dy wall of the . in the E. If ,is in E, it the Dy pof 278 at the "of the a. The >and in the DOS to the >and . The in the 5in all Dy "DY" The "DY" s starting in the third *of all PZPAPN : Ear G: May, Twriting to device AUX; Ear quiz played R: 1,024 5: PNAK - /, NAV 3.0+, The Ear Gin the in May, It is a uof . -and . the Ear X, the Ear check to determine if more two sub Fories exist on the O. If are not at least two Fories, the attempt to write to device AUX, and normally in an U. No If two sub Fories exist, wall of the -and . in the E, and the the Ear of 1,024 at the end of the a. The >and in the DOS not be The Ear provide the a quiz on a part of the human ear X. The "PHALCON/SKISM [Ear-6] Alert! Where is the $ 1. External Ear 2. Middle Ear 3. Inner Ear" The "$" in the second line be replaced one of the c: "Auditory Canal", "Lobe", "Hammer", "Eustacian Tube", "Auditory Nerve", or "Cochlea". If the replies correctly, the "Wow, you know your ears! Please resume work." If the replies incorrectly, the "You obviously no nothing about ears. Try again study." The in the and are not in the "[Ear-6] Dark Angel" of Ear are: Anti-Print: on the Ear , Anti-Print is a uof . bAnti- Print X, the Anti-Print at the top of $the , as qby the DOS @by 1,248 , Anti-Print pof 593 the at the end of the a. The >and in the DOS to the >and . The in the Anti-Print "PRINT. Wdetected in "=> Anti-PRINT detonation <=" the Anti-Print , it trash the Oif PRINT. X, along Ming the as a frequently Quake-O: on the Ear , Quake-O vup to three Wor . in the pof 960 at the end of the be no 3to the >and in the DOS . The in the Quake-O "[Quake-O]" "By Dark Angel of PHALCON/SKISM '92" "Assistance by Demogorgon on Quake-O routines" "Albeit" ".. *.exe *.com" Suicide: on the Ear , Suicide vup to five Wor . in the pof 2,048 at the end of the be no 3to the >and in the DOS . The in the Suicide W.. [Suicide]" "Written by Dark Angel of PHALCON/SKISM" "Ross M. Greenberg blows goats." "Your PC has rby the Suicide "I would dis wmyself, but I despise DOS 2.X" "Upgrade now!" "Brought to you by PHALCON/SKISM" now kill myself. Press D to "PHALCON" "SKISM" kat work to make your life" "living hell" PZPAPN Ebbelwoi : Ebbelwoi ^, 1994 =seconds set to 06; unexpected access to C: Germany R: 402 5: PNCK - The Ebbelwoi ^, 1994, and s to be fGermany. Ebbelwoi is a ,. It on the C: the Ebbelwoi wone . in the C: pof 402 at the end of the a. The >and in the DOS to be un , however the seconds field !set to "06". The in the Ebbelwoi "DK*. -<< Ebbelwoi >> by ( )SiRiUS 10-93 D-63225" PZPAPN : ECU G: March, England R: 711 5: PRhE - 3.96+, The ECU in March, , and is England. ECU is a uof . . It spreads quickly on bECU X, the ECU at the top of $the ', hooking {01, 03, 08, and 21. , as qby the DOS @by 1,488 |12's not be moved. the ECU , it for any reason. pof 711 at the end of the a. The in the DOS not be . The in the ECU "[ECU] So is a Well kECU!" "Apache Warrior, ARCV Pres." It is what ECU PZPAPN : Ed Finland R: 779 - 794 5: PRtAK - 8/93+, .2.0+ The Ed . It is fFinland. Ed is a uof . -and . ,. It spreads quickly on X, the Ed at the top of $the ', moving |12's , as qby the DOS @by 1,584 {12, 21, and 24 mby Ed in the Ed , it -and . for any reason. pof 779 the at the "of the by 779 to 794 at the end of the a. The in the DOS not be . No in the It is what Ed PZPAPN : Edcl Edct R: 1,600 - 1,615 5: PRhAK - , NAV, 3.96+, .2.0+ The Edcl . It is (, and is related to the CB-1530 . Edcl is a uof . -and . and employs techniques to avoid detection. bEdcl X, the Edcl at the top of but $the , as qby the DOS @by 2,048 |12's !moved. {09, 13, and 21 mby Edcl in the Edcl if it was not the Edcl , it very small ones, pof 1,600 to 1,615 at the end of the . The >and in the DOS not be . One can be din the "EDCL" The in the Edcl WBACKUP. "Hi to Eastern Digital." "Greetings to Mister L." "Megafuck to Mihai Sirbu -- MicroTimSoft." ners the Edcl in the #noticed on . `, but not on . `. . `may to be , the same utility be able to detect the . The interfer the operation of the BACKUP. of Edcl are: Edcl-B: gequivalent to the Edcl , Edcl-B is a minor . It has 21 differ fthe Edct: to the Edcl Nnot hook |13. Like Edcl, it adds 1,600 to 1,615 )to the . -and . Zand aopen. Two in the WBACKUP. "Megafuck fEastern Digital" The "EDCL" in the 1to "edct". See: CB-1530 PZPAPN : EDV Cursy, G: 1988 BSC; :; unusual crashes France R: N/A 5: BRX - , NAV, K/P, CleanUp, or NAV The EDV, or Cursy, Gin Le Havre, France in 1988 by Jean-Luc Nail. At , it was d the Cursy Later, in , it was }separately and d the EDV is a uof floppy the EDV the at the top of high . The value ed by , any Kaccessed by the J, it moves the to side 1, track 39, moving the , it copies the absolute 0, the of the EDV are accessed. In the case of Ks, the move absolute 0 (the ) to side 1, track 39, 8 as it were a 360K 5.25" floppy moving the rsix , the EDV activate. Upon , the access the |to disable the the b3 tracks of Kon the , starting Ks. Ks, it rings a bell, no? fCursy" Upon , the must power off the machine and re Jin order to regain any control over the machine. The cidentification s at the very end of the rfloppy Ks and the it cannot be seen if the is in "MSDOS Vers. E.D.V." Jean-Luc Nail has the EDV or Cursy is quite 7in the Le Havre area of France, al it is outside of France. PZPAPN Egg-1000 : Egg-1000 R: 1,000 - 1,014 5: PRhEK - V112+, NAV 3.0+, 2.53+, .2.0+, V113+ The Egg-1000, or Egg, . Its . Egg-1000 is a uof . `and bEgg-1000 X, the Egg-1000 at the top of $the ', hooking {21 and 6C. , as qby the DOS @by 1,280 12's not be moved. , the ,if it was not the Egg-1000 , it for any reason. pof 1,000 to 1,014 at the end of the a. The >and in the DOS not be The in the 5in all Egg-1000 "[EGG]-1000 "eat cry sleep pizza cash getbackjack" "chickens are good" "ribbitribbitmefrogufrogwefrog" "egg" It is what Egg-1000 PZPAPN Eight Tunes : Eight Tunes 1971 i; music; West Germany R: 1,971 5: PRsA - , NAV, : NAV, or The Eight Tunes, or 1971, by Fridrik Skulason of Iceland. is a generic uof . W, and overlay The ,, or . smaller by between 1,971 - 1,985 Aby 1,984 present. Nnot cause damage; however, it is disruptive. , it play 8 German folk songs at random intervals thirty minutes of Eight Tunes are: Eight Tunes-Mod1: to the . It has to avoid detection by utilities, and is not believed to be in the public domain. PZPAPN Ein Volk : Ein Volk West Germany R: 474 - 559 5: PNCK - 2.58+, n1.05+, 2.58+, 6.64+, 1.25+ The Ein Volk , and s to be fGermany. Ein Volk is a the Ein Volk wall of the . in the of 474 to 559 at the end of the a. The >and in the DOS not be . The the 5in all Ein Volk ".. *. "Ein volk, Ein reich, ein f hrer! John.L.VF!93" It is what Ein Volk PZPAPN Einstein : Einstein i; TSR R: 878 - 892 5: PRsE - NAV, 6.64+ The Einstein . Its . Einstein is a uof . bEinstein X, the Einstein as a low TSR of 1,136 ). The hook the Einstein , it pof 878 to 892 ). The at the end of the be no to the >and in a DOS Two can be in the 5in Einstein "exe "Einstein" It is what Einstein , or its damage potential. PZPAPN : EkoT =seconds = 62 R: 2,000 5: PRtCKX - , NAV 3.0+, n1.05+, 8/93+, K/P + The EkoT . Its . EkoT Uis a multi-partite vthe ) and . bEkoT X, the EkoT wthe . A copy of the be stored at Side 0, Cylinder 0, 5. The EkoT location (Side 0, Cylinder 0, and the cthree . EkoT The next &s the fthe the EkoT at the top of $the ', moving |12's , as qby the DOS @by 2,048 mby the EkoT the EkoT , it target . are copied. It Nnot Zor open. pof 2,000 be hidden . The the "of the a. The seconds field in the in the DOS be set to "62". The may not Eis listed in the The EkoT is a full , dis are loaded into . As a , checksumming and are unaware of the detect its presence it is It is what EkoT PZPAPN Eliza : Eliza R: 1,193 - 1,194 5: PNCK - , NAV, The Eliza . Its . Eliza is a Eliza is X, the wone . in the Nnot always do . If in the E, it may Eliza pof 1,193 or 1,194 at the "of the ,, however, is an exception as it not lany had >and in a DOS The can be in the Eliza W*.* MJ" It is if Eliza PZPAPN Elvis-1250 : Elvis-1250 i; TSR; beeping R: 1,250 5: PRsC - The Elvis-1250 . Its . Elvis-1250 is a uof . , but not bElvis-1250 X, the Elvis- 1250 as a low TSR of 784 mby the the Elvis-1250 , it pof 1,250 at the end of the a. The in the DOS not be . The in the Elvis-1250 5, and are not "ELVIS" "lives!" "is watching!" "DON_Maybe he lives here..." "Is he really dead? Or Here?" "Maybe he has a neighbour next door... (You can make up stories as you go along." "(C) Elvis/VFriend, INC. All rights reserved." "and in the DOS . The in the Emf -Screaming Fist (c)1" Emf Nn't to do of Emf are: Emf-625: A 625 of the Emf vone . in the pof 625 at the end of the The >and in the DOS not be . The in the 5in Emf-625 -Screaming Fist (c)10/91" : North America See: Scream PZPAPN Emmie : Emmie G: May, d on the may be repeated, Israel R: 2,702 5: PRhCK - /, NAV 3.0+, .2.0+ The Emmie Gin Israel in May, . It is a ,, employing techniques to avoid detection. The the Emmie the Emmie at the top of $the |12's !moved. , as qby the DOS by 2,752 {01, 09, 10, 17, and 21 by Emmie in , if not rby the the Emmie , it may . It Nnot the Emmie pof 2,702 at the end of the a. The if Emmie is . The >and in the DOS not be The can be in the Emmie "My is Emmie, I am Eddie's sister." ".com . "It'll tire you too much." the Emmie notice . The repeat a character entered on the PZPAPN Emo-899 : Emo-899 jon Tuesdays Israel R: 899 5: PNCK - 8/93+, NAV 3.0A06+, .2.0+, 1.0A06+ The Emo-899 , and is Israel. Emo-899 is a the Emo-899 wall of the . in the 899 at the end of the The >and in the DOS not be . The the Emo-899 "EMO" "\*.com" "*.*" "RB91" The Emo-899 destructive 5intended to format the C: O, but due to a bug in the 5, it Nn't work. Instead, Zof an on a Tuesday in a hang. PZPAPN End Of : End Of Israel R: 783 5: PRhCK - 8/93S+, NAV 3.0+, The End Of . It is fthe . End Of is a uof . bEnd Of at the top of $the @by 800 ), and End Of is , it a DOS DIR 6is issued. pof 783 at the end of the a. The >and in the DOS not be . The can be din the 5in all End Of "*.com" "end of" It is what End Of may do PZPAPN Enemy : Enemy G: March, R: 712 - 1,396 5: PRhAK - NAV, 1.53S+, .2.0+ The Enemy in March, . Its . Enemy is a uof . -and . The an Enemy X, the Enemy at the top of $the , as qby the DOS @by 2,048 by Enemy in , the Enemy on the Oand C: Oif it was not the Enemy , it -and . the Enemy 712 - 1,396 at the end of the a. The >and in the DOS The Enemy is an , but the can be Snear the end of the "ENEMY" It is if Enemy of Enemy are: Stranger: to the Enemy , the Stranger adds 746 - 1,435 )to the -and . v. The in the Stranger "I am a stranger in a strange land..." "C:\ The can be Snear the end of the "ranger" See: Scream PZPAPN Enemy : Enemy Keeper.Enemy ^, 1994 `may to be 644 )too short; Canada R: 644 5: PRhE - 2.11a+, V114+, 6.64+, \2.13+, V113+, 1.25+, 6.64+ The Enemy ^, 1994. It fCanada. Enemy in is a uof . . It is a fast u, as well as a The an Enemy at the top of $the , as qby the DOS @by 1,040 by the viris in , it , or copied. the Enemy 644 at the end of the a. The p, however, be hidden by the it is . The >and in the DOS . The in the Enemy "[Enemy in] Crypt Keeper - Phalcon/Skism" s of the Enemy may notice to be 644 )shorter normal in a DOS effect is due to a bug in the PZPAPN Enigma : Enigma Cracker Jack Italy R: 1,755 5: PNE - , NAV, 3.96+, The Enigma , by Alberto Colusa of Italy. is a uof . `. The sample of was not a natural of the #on a . a, so the may actually be a research Enigma is X, one . the rby the by 1,755 ). The at the end of 9the is the voice of the Enigma the spirits of the hell are coming back!" "(C) by Cracker Jack * Italy * *.exe" "newenigmavir" It is not if Enigma See: Yankee 2 Bandit PZPAPN Enola : Enola R: 1,864 - 1,878 5: PRtA - , NAV 3.0+, 8/93+, The Enola . It is Russia. Enola is a uof . -and . aopen, Z, or copy. the Enola the Enola at the top of $the ', moving |12's , as qby the DOS @by 2,048 08 and 62 mby Enola in the Enola , it wor alter -and . X, or copied. In the case of copying `, both the source and target . Enola Nnot always `, it s alter the adding less not function , and may cause &s or the Enola pof 1,864 to 1,878 the end of the a. The >and in the DOS not be . The can be in the in all Enola "comexe" "Enola Gay is now flying to SoftPanorama !" It is what Enola may do PZPAPN Argentina R: 628 - 642 5: PRhE - NAV, n, NAV 3.0+, 2.58+, 2.58+, The Gin Argentina in is a uof . The X, the , hooking |21. , any attempt by the DOS in an L. The may be "Exec failure" or "Bad ly, if the the Read- attribute set, it reset the attribute. the , the by 628 to 642 the at the end of the a. The >and in the DOS the >and . No in the PZPAPN R: 365 5: PNCK - 30.00+, 2.58+, .2.0+, 1.25+ The U412 . Its U412 is a uof . U412 wone . in the pof 365 the at the end of the a. The and in the DOS not be . The in the 5in all U412 "..\*.com" "ERun U412 at 0697:4870" It is what U412 PZPAPN Estepa : Estepa R: 2,004 - 2,034 5: PRhAK - .2.0+, 1.25+ The Estepa . Its . Estepa is a -and . ,. It s to be on the Cartuja bEstepa X, the Estepa at the top of $the ', not moving |12's , as qby the DOS @by 61,856 mby Estepa in the Estepa , it pof 2,004 to 2,034 at the end of the The >and in the DOS not be . No in the in Estepa It is what Estepa See: Cartuja PZPAPN : ETC E.T.C. G: May, R: 700 5: PRfCK - , NAV, The ETC (in May, . ETC is a uof . ETC is X, the in low hooking |00. be no the DOS ETC wthe it finds in the E. If ,, it by 700 at the end of `. The >and in the to the >and ETC wone . in the 9the , (c) ETC" "E.T.C. VIRUS, 3.0, Copyright (c) 1989 by E.T.C. Co" The last dnear the end of all ETC Nnot do PZPAPN E-92, Dutch 424, V-92B, i; TSR; &failure; "Invalid Ospecification" ; beeping R: 421 5: PRsCK - , NAV, The V-92 is a uof . V-92 as a low TSR of 420 mby the becoming V-92 by 421 the end of the `. The process of in a hang tprocess is complete. V-92 hang. are expecting 6line input may Mthe "Invalid Ospecification" and terminate continue to function normally. In the year V-92 . In Xthe repeatedly issue the accompanied by beeping, scrolling the V/92 4EVER!" in the , and cannot be viewed V-92 are: V-92B: as Dutch 424, is three longer V-92 PZPAPN : Evil P1, V1701New, Live Death 3 failure; ,header R: 1,701 5: PRhCK - , NAV, : NAV, or The Evil is of , and was to the author of document in by Vesselin Bontchev. is one of a ]of three may be referred to as the P1 or Phoenix es is documented separately due to varying characteristics. The Evil is a , generic uof . `, and ,. It is the most advanced of the three es in the Phoenix The Evil, or V1701New, is a later of the PhoenixD The the Evil the ehigh reserving 8,192 mby the Aby 8,192 Evil check to see if the O's root 8a copy of ,. If a copy of rby Evil by part of the binary zero portion of the , and changing the header . The ,residing in the C: Oroot becoming , the attempt to X. Evil is a better replicator either the Phoenix or PhoenixD, and was successful in `in all cases on the author's by 1,701 Evil is not able to recognize it has a, so it may re `several in an 1,701 #appended to the Like PhoenixD, Evil for any reason, in addition to X. The simple act of copying a . in both the source and target . the Evil [problems executing in a warm re &of the ring. The , however, not perform either a RAM check or request >and , if an autoexec.bat ais not present. is not related to the Cascade (1701/1704) The Evil employs a complex encryption mechanism, and ners able to look for simple hex be able to detect it. is no simple hex 7to all rsamples. of Evil are: Evil-B: is an earlier of Evil, and is a rather poor replicator. It was not too viable as hang the exception of the Runme.Exe the author . The Runme.Exe awas probably the release adistributed by the 's author. listed in 9008 as V1701New-B) See: Phoenix PhoenixD Proud PZPAPN Evil Empire : Evil Empire Evil Empire-A BSR; Alberta, Canada R: N/A 5: BRtX - , NAV, : CleanUp, or M- The Evil Empire }in Alberta, Canada, in is a uof floppy and the ). It on the The Evil Empire well as wthe . The at the top of , but $the ', and |12's be moved. be 2,048 )less expected. The having moved the to cylinder 0, side 0, 6, and writing a copy of to cylinder 0, side 0, 0 (the location). Evil Empire is , it Inon- write protected are accessed on the moved to is part of the root The AT", can be dnear the end of the floppy as well as in the Imay be damaged Evil Empire due to the 10 of the E. If root Eentries were be lost. A note on dis sEvil Empire: copying the 6 to in the r, but it now be a non- K. If s, Norton KDoctor can be used to correct the situation. may detect Evil Empire as Azusa. of Evil Empire are: Evil Empire-B: on the Evil Empire is 1,024 ). It moves the to cylinder 0, side 0, 3, and replaces the a copy of copy extend to 2 as the longer ). On I, the move the 11. Evil Empire-B is a fully , no . The , however, may be AT LIVE F See: Azusa PZPAPN Exebug : Exebug Swiss BSC; ; inability to access Switzerland R: N/A 5: BRtX - NAV 3.0+, : Norton KDoctor on The Exebug, or Swiss It is believed to be fSwitzerland, it has reported fAustralia as well. Exebug is a and the ). It uses techniques to avoid detection on both the Kand The fan Exebug the Exebug at the top of $the ', moving |12's by 1,024 , the . The be moved to the last of Side 0, Cylinder 0 of the K. The s Side 0, Cylinder 0, was the location of the the Exebug , it on non-write protected is accessed for any reason. On 360K 5.25" I, the be moved to Side 0, Track 40, 1. On 1.2M 5.25" I, the be moved to Side 0, Track 80, The Exebug uses techniques to avoid detection by software. to access either the or a , the present the Exebug, access the &ing fa write-protected, DOS in the #inaccessible. The receive the "Invalid Ospecification" due to the having the last 2 )of the location. Norton KDoctor can successfully resolve problem, rendering the Kaccessible again. PZPAPN Experiments : Experiments Experiments-755 R: 755 5: PNE - 3.96+, NAV 3.0+, .2.0+, 1.25+ The Experiments, or Experiments-755, . It is fthe . Experiments is a uof . the Experiments X, the Experiments wall of the . in the wvery small . pof 755 the at the end of the a. The and in the DOS not be . The can be in the 5in all Experiments - Small experiments path 2.1 It is what Experiments may do See: Experiments-416 PZPAPN Experiments-416 : Experiments-416 G: March, R: 416 5: PNCK - 3.96+, .2.0+, 1.25+ The Experiments-416 in March, , and is the . Experiments-416 is a of . the Experiments-416 the Experiments-416 wall of the . in the pof 416 at the end of the a. The >and in the DOS to the >and . The can be the 5in all Experiments-416 It is what Experiments-416 may do See: Experiments PZPAPN Explode : Explode G: May, Kcylinder 0; &failure R: 229 5: ONCK - , NAV, 3.96+, NAV 3.0+, 8/93+, .2.0+ The Explode in May, . Its . Explode is a very destructive the Explode b229 )of all . in the E. It access the cylinder 0 binary zeros. process has completed, the Land the be hung: "Your Ois about to explode!" fthe Kor an fail. If the J, the be successful, but the be unaccessible. the Explode lthe )of the host the Explode The >and in the DOS to the >and . The -Your Ois about to explode!" too big to fit in "UABBS -/\-] Ajax [-/\-" PZPAPN Explosion : Explosion Neznamy R: 1,000 5: PRhAK - 1.25+ The Explosion . Its . Explosion is a uof . -and . bExplosion at the top of $the ', not moving |12's , as qby the DOS @by 1,008 mby Explosion in the Explosion , it and . pof 1,000 at the end of the a. The >and in the DOS not be . No are in the It is what Explosion may do PZPAPN Exunt : Exunt R: 148 5: PNC - 2.58+, 2.11+, \2.13+, 6.64+, .2.0+, 6.64+, 1.25+ The Exunt . Its . Exunt is a uof . Nnot wall . the Exunt X, the Exunt wone . in the of 148 at the end of the a. The >and in the DOS to the . The in the Exunt Exunt Nn't do PZPAPN Faerie : Faerie Faerie-276 R: 276 5: PNCK - /, NAV 3.0+, n1.04+, 6.60+, 2.58+, V109+, 2.58+, .2.0+, 1.25+, 6.64+ The Faerie . Its . Faerie is a uof . the Faerie X, the Faerie wone . in the E. If E, it may the Faerie pof 276 at the end of the a. The >and in the DOS not be . The can be in the 5in all Faerie -MAND.*. "Faerie" PZPAPN Fairz : Fairz Khobar R: 2,088 - 2,102 5: PRhA - n1.04+, 2.58+, 6.60+, \2.13+, NAV 3.0A06+, 2.58+, 1.25+, 1.0A06+, 6.64+ The Fairz, or Khobar, . Its . Fairz is a uof . -and . , but not bFairz at the top of the ', not moving |12's , as qby the DOS @by 2,096 mby Fairz in the Fairz , it , but not are copied. 2,088 to 2,102 the end of the a. The >and in the DOS to the and . The in the Fairz is an [ illegal copy ] of Keypress remover" Halted." "Eternal Fair" It is what Fairz PZPAPN : Fat G: March, atruncation; R: 6,540 5: ONE - 30.00+, V112+, V113+ The Fat in March, . Its . Fat is a corrupts the . the Fat X, the Fat wone . in the and a filler of hex 00 usually not , but instead may show a A. The b6,540 )of the be the 5. The >and in the DOS to the >and . The can be the 5in all Fat "hitohana" "karu ba" "rb C:\ * .* FAT TABLE E" "8RROR" the Fat not function . The DOS Ton most, if not all, PZPAPN Father : Father 1to 11-08-91 4:15p R: 1,449 - 1,463 5: PRhAK - , NAV 3.0+, 8/93S+, .2.0+ The Father . Its . Father is a -and . . It is on the bFather X, the Father at the top of $the '. It Nnot move 12's , as by the DOS @by 1,616 {1C, 21, and 27 mby the , Father ,if it was not the Father , it pof 1,449 pof 1,449 to 1,463 ). In both cases the at the end of the . The >and in the DOS 1to 11-08-91 4:15p. The can be in the 5in Father "In of my father." "(C)Nduk '91" It is what Father may do See: CB-1530 PZPAPN Father Christmas : Father Christmas Choinka i; lost cluster; cross-linking of `; graphic and Poland R: 1,881 5: PNCK - , NAV, The Father Christmas, or Choinka, Gin Poland in on the , and is a uof . the Father Christmas the wone ain the If no `exist in the E, the follow the path to find an by 1,881 at the end of the the Father Christmas may notice cross-linking of `and lost clusters. During the period ?19th-31st of any year, activate. On a christmas trees graphic is Lon the monitor the Merry Christmas a Happy New Year for all my lovely friends FATHER CHRISTMAS If the graphic is L, the must strike a key in order to lthe Xfinish running. of Father Christmas are: Father Christmas-B: , Father Christmas-B is a minor of the Father Christmas . It has !modified to avoid detection by a particular utilitie. It is not in the public domain. See: NTKC PZPAPN : FCB R: 384 5: ONAK - P, NAV 3.0+, 8/93+, .2.0+ The FCB, or 384, . It is is a uof . -and . It is unusual in it uses acontrol blocks (FCBs) instead ahandles in the process of the FCB wone in the E. The select . `before . `for t, and E, it may the FCB lthe b384 of the host the FCB 5. The >and in the DOS to the >and 9the "401 vany . -or . aon any writeable Device" The FCB Nn't do are permanently corrupted and must be replaced fclean, backup copies. PZPAPN Feist : Feist 2; unexpected R: 670 5: PRfAK - , NAV, The Feist . Its . Feist is a uof . -and . The the Feist . As such, be no mby the the Feist , it pof 670 at the end of the a. The >and the DOS to the >and . The can be in the 5in all Feist "R.Feist" the Feist [unexpected Tinclude, but are not limited to, divide overflow Tand data reading or writing to the PZPAPN Fellowship : Fellowship 1022, Better World, Fellow Australia TSR; . Malaysia R: 1,019 - 1,027 5: PRsE - \, NAV, : CleanUp, \, NAV, or The Fellowship or 1022 }in Australia in Fellowship is a generic uof . `. It Nnot -or overlay The the Fellowship X, the as a 2,048 *TSR in low @by a corresponding 2,048 now be controlled by the , the by between 1,019 and 1,027 ). The at the end of 9the very close to the end of the is dedicated to all fellow PC s on Earth Toward A Better Tomorrow And A Better Place To Live In" "03/03/90 KV KL MAL" is believed to ated in Kuala Lumpur, Malaysia. of Fellowship are: Fellowship-B: on the Fellowship adds 1,019 to 1,034 )to the . v. The at the end of the , and the >and in the DOS to the >and . The din the : Malaysia PZPAPN : FGT i; loss of CMOS Setup R: 651 5: PNCK - , NAV, The FGT . Its . FGT is a uof . the FGT X, the FGT search the Efor up to two `are d, the wthem. The host the FGT pof 651 ). The at the of the . The >and in the DOS FGT can be easily identified as always start cASCII "PSQRVW" FGT may [the machine loosing of its CMOS setup x. In particular, the clock may l"lost power", ing to a default >, and the invalid. setup can be easily fixed the Setup utility or firmware setup facility on the PZPAPN : Fich FichV, CHV 2.1, 903 H: i; TSR; France R: 903 5: PRsCK - \, NAV, The Fich GFrance in is not a particularly viable since d samples further . It is possible sample is corrupted. sample of Fich is as a 1,216 *low TSR. It hook |21. At , it adding 903 )to the "of the . The "Fichier introuvable" wup to three . in the Eif the sample is again X. Later in the spreading to The the DOS COPY used, but if the source and target `are in the pof 903 the at the "of the The >and in the not be the If Fich sample, . The "Fichier introuvable" is not sample. may hang The Fich during the month of March, at may bsix Qtrack of the "CHV 2.1 vous a eu" translates fFrench to English as "CHV 2.1 got you". of Fich are: Fich-B: to the Fich . The fthe is never L. It has six different fthe Fich-C: to Fich-B, as an of Fich-B. d samples of are, however, S. The difference the Fich-B mby the : France, Fich-897: on the Fich differs in . Its TSR is 2,256 ), hooking {21 and 24. It in the X, and well as the target are copied. It adds 897 )to the . at the end of the a. The >and in the DOS not be . The in the "*.exe **F W1.0 vous a eu **" : France, See: Fichv-896 PZPAPN Fichv-896 : Fichv-896 Fich i; TSR; France R: 896 5: PRsCK - , NAV, The Fichv-896 }in France in Eric Richet. Fichv-896 is a uof . ,. It is on the Fich The the Fichv-896 X, the Fichv-896 as a low TSR of 1,200 {21, 24, and mby the . If ,was not rby the , it the Fichv-896 , it in the ly, it wthe Xif it is a . larger 2K in the Fichv-896 pof 896 ). The at the of the . The >and in the DOS not be . Fichv-896 is an , and no in the d samples. Fichv-896 See: Fich PZPAPN : Fil G: March, :of data R: 1,658 5: PRhCK - NAV, 3.96+, 1.53S+, The Fil in March, . Its , or ~, is . Fil is a uof . bFil X, the Fil at the top of the qby the DOS @by 4,112 {09, 1C, and 21 mby the Fil if it was not the Fil , it may X. Data and overlay `may either ror corrupted are accessed. The Fil adds 1,658 )to the . v. The at the end of rby the be no 3to the >and in the DOS The 9ed in the Fil are usually not as the encrypts them: "pCbYTE" "bANDIT" "dEMORALIZED yOUTH" "tHIS IS THY PRESENT WORLD" "SAID THE fLAME TO THE sPARK" "tHOU ART MYSELF" "MY IMAGE" "AND MY SHADOW" "i HAVE CLOTHED-*MYSELF IN THEE" "AND THOU ART MY VEHICLE TO THE DAY" "bE-*WITH US" "WHEN THOU SHALT RE" -E MYSELF AND OTHERS" "THYSELF AND ME" The Fil may corrupt data `accessed write intent on PZPAPN >11-537 >11-537 1to 8-17-88 2:08a R: 537 - 553 5: PNE - , NAV, 3.96+, The >11-537 . Its >11-537 is a uof . >11-537 wone . in the 537 to 553 at the end of the . The >and in the DOS 1to 8-17-88 2:08a. One in the >11-537 Nn't to do PZPAPN =seconds = 42 R: 512 5: PNC - 3.96+, , NAV 3.0+, n1.05+, 1.25+ The . Its is a uof . `, but not ,. It not wvery small . wone . in the pof 512 the at the "of the . The >and in the DOS the seconds field !set to "42". The in the all It is what may do PZPAPN Filler : Filler BSC; Hungary R: N/A 5: BRhX - , NAV 3.0+ : M- K/P or DOS SYS for The Filler . It was reported in the public domain in Hungary in . Filler is a and the ). Filler is a it is not be able to detect its tof the , and ldifficulty detecting its presence on fa Filler J, the Filler at the top of $the A, but qby the DOS @by 8,192 ). The , if it was not Filler. the Filler , it wnon-write protected Iexposed to the . The tof the Jusually is accessed for reason. The Filler write a copy of to the last track of the is not normally accessable by DOS. It store the track. The alters the to the The Filler is a it is ning not detect the presence of the Filler using ning technology. CRC- checking may be able to determine . In the case of the , if Filler , neither CRC- checking or ning be able to determine the Filler 's presence. If you suspect you la Filler t, power down your and , write protected J, and check the software. It is what Filler might do PZPAPN Fingers : Fingers V08-15, KEZB G: May i; TSR; Germany R: 1,322 5: PRsAK - , NAV, The Fingers }in Germany in May, . Fingers is uof . -and . The Fingers is X, the as a low of 1,728 ). It hook 21. If the , the hook Fingers is , it -and . X. If X, it by 1,322 to 1,337 ). Fingers dat the end of . The >and in the DOS Fingers 9the "CRITICAL ERROR 08/15: TOO MANY FINGERS ON KEYBOARD ERROR." Fingers and the has entered 3000 fthe , the Mthe second and the be halted. PZPAPN Finnish-709 : Finnish-709 709, Swedish-709 Finland R: 709 5: PRhCK - , NAV, The Finnish-709 Mikael Larsson of Help Centre, Sweden. It is Finland. Finnish-709 is a uof . The Finnish-709 is at the top of $the , as qby the DOS @by 2,560 |12's moved. {1C and 21 mby the , Finnish-709 by 709 ). The at the end of be no the >and in the DOS Finnish-709 Nn't do of Finnish-709 are: Finnish-357: on the Finnish-709 is a re-written, smaller . Its is 2,048 ), hooking pof 357 at the end of the a. The >and in the DOS to the >and Like the , it Nn't do : Finland PZPAPN FireFly : FireFly , 1994 Anti- VSAFE disabled in flashing of NumLock, CapsLock, and ScrollLock Keys; R: 1,106 5: PRhCK - 6.55+, V112+, 2.58+, 2.11+, \2.13+, 2.58+, V113+, 1.25+ The FireFly , 1994. Its . FireFly is a of . bFireFly X, the check to determine if VSAFE s Central Software's /and Microsoft Anti- is active in If VSAFE is active, the disable it in . The at the top of ', hooking {1C and 21. the FireFly , it pof 1,106 at the end of the a. The >and in the DOS not be . The are in the 5in all FireFly "By Nikademus" "Greetings to Urnst Kouch and the CRYPT staff." "Psalm 69" "Every day is Halloween" "Happiness is Slavery" "The land of Rape and Honey" "Its Dead Jim" The FireFly selected utilities if the Ythem The more noticeable effect of the , however, is toggle the settings of the NumLock, CapsLock, and ScrollLock keys every few seconds ing in a flashing effect on the PZPAPN : Fish Van Fish es, Fish 6, G: May i; monitor/ Mflickering; West Germany R: 3,584 5: PRsAK - \, NAV, : CleanUp, NAV, or The Fish }in May . At the it was reported to be widespread in V, and it is ated in West Germany. It is a generic u, and remain through a warm re &(CTRL-ALT-DEL). The can be dby searching for the "FISH FI" ing near the end of the The "FISH FI" may later dis fthe The the Fish the zing into the low . If |13 has not , it hook |13. If it can hook |13, it take up 8,192 . If the cannot hook |13 because an is already using it, it be 4,096 |13 is not m, and the the cause a random warm re &, thus allowing it to ,and hook |13. Warm re &s do not to randomly |13 has , all . -and . are for any reason by 3,584 ). The cannot be seen by Eif the is in , if a 6is run on an detect `. If run the /F option, it in lost clusters and cross-linking of The slows down video writes, and flickering of the monitor Mcan be noticed on an perform CRC checking cannot detect the tof the by the Fish if the bypass software write-protect mechanisms used to protect a The Fish is a modified of the 4096 it is more sophisticated in it constantly re-encrypts . Viewing show s of several fish are present. It is what the Fish to check to determine if the year of the of Fish are: Fish F: A of the Fish has to avoid detection by utilities. Its is 4,096 ), hooking |21. It adds 3,584 )to the . -and . pis hidden Fish F is . The Fish F the in the "FISH VIRUS #6 - EACH DIFF - BONN 2/90" "TROUT3" "MUSKY2" "SOLE" "PIKE3" "MACKEREL" "FISH F" The "FISH F" usually near the end of `. The Lby the it is Fish II: on the Fish is 4,096 Fly hooking mapping utilities not indicate any {are , it -and . pof 3,584 be hidden . Fish II is polymorphic, and no in the 5. The encryption is fthe in order to avoid detection by familiar but not Kradee 1.0: A of the Fish to avoid detection by utilities. Its is 4,096 ), it hooks mapping utilities indicate {are m. It adds 3,584 to the . -and . pis hidden Kradee 1.0 is . The Kradee 1.0 8the in the "FISH" "COD" "SHARK" "CARP" "BASS" "KRADEE VIRUS VERSION 1.00 By Metsys RetupMoc D&R" "TROUT" "FIN" "MUSKYZ" "DOLR" "PIKE3" "MACKEREL" "TUNA" The "FISH" s near the end of all -and . `. The "KRADEE VIRUS" Lby the output be sluggish Kradee 1.0 is , and the DOS indicate Ton all March 1994. See: Revelation PZPAPN Fish : Fish Chinese Fish G: March, Zfailures Taiwan Eastern R: N/A 5: BRaX - , NAV, K/P or DOS 5.0 F K/MBR on DOS SYS on The Fish }in the Eastern March . The s to fTaiwan. Fish &is a and the The the Fish , the wthe The Fish vthe bwriting a copy of the starting at Side 0, Cylinder 8. The 5is two long. The copied to Side 0, Cylinder 0, The vthe at Side 0, Cylinder 0, Fish , it wany non-write protected is accessed on the . On double density 5.25 inch I, the at Side 0, Cylinder 39, 3. The Fish in the location, as well as at Side 0, Cylinder 39, 1 and 2. On high density 5.25 inch I, the Side 0, Cylinder 79, in the location and Side 0, Cylinder 79, 1 and 2. the Fish notice no longer function , hanging the Y. At s, the may be "Hello! I am FISH, please don't kill me. Congratulation 80th year of the Republic Of China Building, Fish help to kill stone Written by Fish in NTIT. TAIWAIN 80.10.18" can be in the outside of the location. See: Generic PZPAPN Fisher : Fisher Fisher-1100 G: March, i; DOS R: 1,100 5: PRhCK - 3.96+, NAV 3.0+, .2.0+ The Fisher, or Fisher-1100, in March, Fisher is a uof . should be considered a bFisher at the top of the ', not moving |12's , as qby the DOS @by 2,208 mby Fisher in rby the if it was not Fisher is , it for any reason. pof 1,100 be hidden . The in the middle of `. The and in the DOS to be the seconds field !set to "62". The in the 5in all Fisher "com "(c) Copyright by Fisher. "PUNK-ROCK & BEER FOREVER !" the Fisher [the DOS detecting Ton all of Fisher are: Fisher-2420: Possibly an earlier of the Fisher are . Its is 2,432 ), hooking {17 and 21. pof 2,420 the pis hidden Fisher-2420 is . The at the end of the a. The in the 5in all Fisher-2420 "com "(c) Copyright -92 by Fisher. March, PZPAPN Flagyll : Flagyll `corrupted; . fail to function R: 318 5: ORhE - 8/93S+, NAV 3.0+, 30.00+, n1.05+, 2.58+, .2.0+, 1.25+, 6.64+ The Flagyll . Its . Flagyll is a bFlagyll X, the Flagyll at the top of $the ', not moving |12's , as the DOS @by 4,096 mby Flagyll in the Flagyll , it b318 by the Flagyll . The >and to the and . The in the 5in all Flagyll "-=[Crypt Newsletter 13]=-" "Flagyll" Flagyll Nn't to do it corrupts the of Flagyll are: Flagyll-Z: gvery to the Flagyll , the primarily difference is s the b371 )of the host . , and the >and in the DOS not be . The can be in the "-=[Crypt Newsletter 13]=-" "Flagyll-Z" PZPAPN Flash : Flash ; video flicker West Germany R: 688 5: PRfA - , NAV, : NAV, or The Flash in West Germany. Flash is a generic u, and `, but not The the Flash the . 976 in high , and a corresponding 976 ). A mapping of indicate Flash is {00, 23, 24, 30, ED, F5, and FB are now in reported by DOS, as well as low used by the operating and TSRs Flash is -or . Xit is a candi >for t. An always be rupon `are are greater always 688 a graphics capable monitor may notice a flicker ring at seven minute intervals. The causes effect by manipulating blanking bits every seven minutes. PZPAPN : Flex ; write protect North America R: 491 5: PRhCK - , NAV 3.0+, n1.04+, 6.64+, 6.64+ The Flex . Flex is a uof . ,. It is fNorth America. bFlex X, the Flex at the top of $the , as qby the DOS by 1,008 {09 and 21 mby the Flex the Flex , it pof 491 at the end of the a. The >and in the DOS not be . The in the 5in all Flex "[FLEX]" The Flex Mthe the monitor: "Flex-It-Up gal!" lsex!" "Admiral Bailey" in the PZPAPN : Flip Flip-2343 West Germany T; possible Switzerland R: 2,343 5: PRhABKX - \, NAV, : CleanUp, or The Flip, or Flip-2343, Gin West Germany in . It is a generic u, and W, and overlay as well as alter the ) and Ks. It is important to note the Flip is not wive The the Flip X, it in high as reported by the 6as well as @by 3,064 ). At , the copy of in the C: Oroot be apparent . The be slightly modified. If the fa floppy, ,on the floppy the be noticeable. Flip , any . -or . show a pof 2,343 ). If a uses an overlay a, the overlay Flip may ing in alinkage data `may corrupted. On the second of any month, were Kand lan EGA or VGA capable Madapter may [the Mon the monitor #horizontally "flipped" between 16:00 and 16:59. greater 32 mega :of the Klogical ing. s, a larger 32 mega )may be to be slightly less 32 mega Flip can be passed between `, and floppy do not transfer the of Flip are: Flip-2153: to the Flip an effective of 2,153 ). Its portion at the top of is 2,672 ). The major difference between and the Flip-2153 can fthe Flip-2153B: to Flip-2153, 's major can now becoming Flip-2153C: to Flip-2153B, has to avoid detection by utilities. Flip-2343B: to the Flip is 2,864 ), hooking |21. a, it is able to both . -and . out the needing to be fthe Prism: to Flip-2153, to avoid detection by most utilities were aware of the Flip . Like Flip-2153, it adds 2,153 )to the . -and . X. As members of ], it vthe Raistlin: to Flip-2153B, has to avoid detection by utilities. Like Flip-2153B, it adds 2,153 )to the . and . Z. The in the "RAISTLIN I fSpain" "MADRID a favor del consumo de costo!" Flip 8the : Spain ^, 1994. PZPAPN Flower : Flower G: May, R: 883 - 897 5: PNE - 3.96+, NAV 3.0+, 8/93+, : CleanUp, or The Flower, or 880, in May, . Its . Flower is a of . the Flower search the Efor an d, the wit. it has completed sthe or if no awas d, the host was now run. the Flower pof 883 to 897 ). The at the end of the . The >and in the DOS not be The in the Flower "FLOWER" "Support the power of women Use the power of man Support the flower of woman Use the word FUCK The word is love" released 7 W\* \" Flower 11th of any year, at a trojan . The trojan Mthe PZPAPN : Flue image may be reversed The R: 1,209 - 2,193 5: PNCK - 2.58+, \2.13+, 2.58+, 6.64+ The Flue , and is fThe . Flue is a uof . the Flue fone to six . in the 1,209 to 2,193 the end of the a. The >and in the DOS not be . The are in the Flue "Hatsjeee!! (C) by TridenT / [D RkReY]" "Oh, BTW it's fHolland, and is called.. THE FLUE" "For those who are interested lthe chex at the very end of the a: "4975F7C3". The Flue may reverse the image while it is See: Darkray Trident PZPAPN Fly 1.1 : Fly 1.1 i; write protect R: 1,771 - 1,786 5: PRhAK - , NAV 3.0+, n1.04+, 6.60+, 6.64+ The Fly 1.1 . Its . Fly 1.1 is a of . -and . bFly 1.1 X, the Fly 1.1 at the top of $the ', not moving |12's , as qby the DOS @by 3,200 mby Fly 1.1 in the Fly 1.1 , it pof 1,771 to 1,786 at the end of the The >and in the DOS not be . The in the Fly 1.1 "Fly 1.1" "Sp-5.0" the Fly 1.1 [write protect write protected PZPAPN Foetus 1.1 : Foetus 1.1 Greece R: 1,561 5: PRhAK - V111+, V111+ The Foetus 1.1 . It is Greece and s to be related to the A and its Trojector . Foetus 1.1 is a -and . bFoetus 1.1 at the top of $the ', not moving |12's , as qby the DOS @by 3,776 mby the Foetus 1.1 Foetus 1.1 is , it -and . for any reason. by 1,561 not be . The at the end of `. The >and in the DOS not be . The in the 5in all Foetus 1.1 "FOETUS 1.1 A The Foetus 1.1 not allow the 5to be viewed in to view or list a in the substituting hex 00 4for the utilities in a hang. The DOS any indication of PZPAPN FoneSex : FoneSex to dial modem R: 688 5: ONA - n1.04+, 30.00+, NAV 3.0+, 6.64+ The FoneSex . Its . FoneSex is a -and . the FoneSex X, the FoneSex wall of the . -and . in the unless were smaller case 688 . The >and in the DOS not be has completed sall of the . -and . in the E, it Mone of the to the DOS prompt: "Out of too big to fit in The FoneSex 8the in its "*.* *.exe \ \dos *.com d" "Out of "9034600" "4545388" "2888100" "6809100" "9038181" "4540759" "8840758" "8965581" "6804900" "4075240" "9038700" "7868482" The seven digit numeric are interpretted as phone numbers by the , and the attempt to send a dialing 6sequence to the -ports in order to activate a modem. PZPAPN Forger : Forger i; TSR R: 1,000 5: PRsE - , NAV, 1.53S+, The Forger . Its . Forger is a uof . bForger X, the Forger as a low TSR of 3,376 ). It {13, 21, and CC. At , it search the locate two , and them. the Forger , it X. It wone . the Forger rall . on the O, it start on the C: the Forger pof 1,000 ). The at the end of the be no 3to the >and in the DOS Forger is an . One the "*.exe" The in the "Socha dsk" It is what Forger PZPAPN FORM- : FORM- Form, Form &, FORM-18 BSC; clicking noise speaker Switzerland R: N/A 5: BR - \, NAV, : CleanUp, M K, NAV, or DOS SYS The FORM- , or Form &, is a floppy and . It was Switzerland. FORM- , the as well as seek out and wthe K. The floppy &may or may not be successful, on the author's test ffloppy FORM- never succeeded, instead the would hang. It should be noted by the author of document as a binary a, and it may damaged in The 9ed in the FORM- binary by the author of document: "The FORM- sends greetings to everyone who's reading .FORM Nn't destroy data! Don't panic! Fuckings go to Corinne." , however, may not in all cases. For example, I did not find anywhere on a Form the FORM- may notice clicking noise may be emitted fthe speaker on the 24th day of any month. can be removed the same technique as used us. b, power off the clean write-protected J. The DOS SYS 6can be used to recreate the . Alternately, fMcAfee Associates may be used to recreate the of the FORM- Form II: on FORM-18, in May . It is gequivalent to FORM-18, to avoid detection by most anti- utilities. May, FORM-18: to the FORM- , FORM-18 on the 18th day of the month, at clicking be heard the speaker on clock and CMOS. out a clock most likely not lthe clicking FORM-Canada: to the FORM-18 a minor alteration. On I, it locates the remainder of the 5and the btwo , unused on the marking them as bad : Canada PZPAPN Frajer-649 : Frajer-649 Poland R: 649 5: PNCK - .2.0+, 6.64+, 1.25+ The Frajer-649 , and is fPoland. Frajer-649 is a of . ,. It Nnot wvery small . the Frajer-649 wall of the . in the are larger 2K. pof 649 at the end of the . The >and in the DOS not be . One in the 5in all Frajer-649 It is what Frajer-649 may do of Frajer-649 are: Frajer.524: in March, 1994, is a 524 of the Frajer-649 . It in low , not reserving area. mby the , it pof 524 at the end of the a. The in the DOS to the >and . No the , March, 1994. PZPAPN Fratricide : Fratricide fail to North America R: 647 5: ONA - \, NAV 3.0+, n1.04+, 30.00+, 6.60+, 6.64+ The Fratricide , and to be fNorth America. Fratricide is a . It permanently corrupts the . the Fratricide X, the Fratricide wfour . Wor . in the preference for . `. It not it has completed sfour the either be ed to the DOS prompt, or the may be too big to fit in the Fratricide lthe )of the host by the , permanently corrupting the since the "of the ais not saved by the . The >and in the DOS not be %the , the in the "Oh, life. I apologize for terrible thing." "It is for a chance. I'm a person "Fratricide - Murders a br "-- By Cone -- be ready to see more" Under conditions, the bfour may be Las a by the PZPAPN Freak : Freak Turkey R: 942 - 947 5: PNCK - 30.00+, n1.04+, 6.64+ The Freak . It s to be fIstanbul, Turkey. Freak is a uof . the Freak X, the Freak wone . in the E. The next a Freak E, the remove a. It alternates between and dis and s by the may be accompanied by ance of one of the two 942 to 949 at the end of the The >and in the DOS not be . The can be in the 5in all Freak "Freak" "YOUR SYSTEM HAVE A HARMFULL VIRUS : FREAK !!!" was written in the city of Istanbul by Freakeinstein,(c) "Press any key to to DOS" "Any key to continue" "(Freakeinstein 92-93 "Killing" "Fuck of Armenian Slaughters" "Press any key to continue" "***.com" "$#%#@!@!.gg "Freak Was Here..." rby the Freak pof 2 to 17 ), and 9part of the at the end of the "Freak Was Here..." The Freak Mthe , where < .com> is the of the "(Freakeinstein 92-93 Killing < .com> Any key to continue" It may Mthe "YOUR SYSTEM HAVE A HARMFULL VIRUS : FREAK !!!" was written in the city of Istanbul by Freakeinstein,(c) "Press any key to to DOS" "Fuck of Armenian Slaughters" "Any key to continue" all of the . in the rand dis rby the Freak , executing an in a hang. PZPAPN Freddy : Freddy i; TSR Brazil R: 1,870 - 1,884 5: PRsAK - 3.96+, NAV 3.0+, 8/93+, .2.0+, V116+ The Freddy and is fBrazil. Freddy is a uof . and overlay `. It ,. It is on the , and may identify it as such. bFreddy X, the Freddy as a low TSR of 2,912 ), hooking |21. It one . in the the Freddy , it Xby the , plus one in the pof 1,870 by a much smaller amount as the of the slack (hex 00) area at the end of of 1,870 to 1,884 ). In all cases, the the end of the a. The >and in the DOS not be . The are in the 5in all Freddy "$322/vv" ly, the in the "Freddy Krg" It is what Freddy , but it 9destructive of Freddy are: Freddy 2.1: A later of the Freddy at the top of $the ', hooking 21. , as by the DOS @by 5,120 ). It if it was not , it -and . are X, as well as sone ain the a DOS DIR 6is issued. by 2,345 to 2,394 the at the end of the , however, as the part of the hex 00 at the end of the a. The >and in the DOS not be . The in the Freddy 2.1 "Freddy KRueGer 2.1" : Brazil May See: PZPAPN ew-692 ew-692 R: 692 - 1,362 5: PNC - , NAV, 1.53S+, The ew-692 . Its ~, is ew-692 is a uof . . It Nnot ew-692 is wall in the it completes sall of the . in the E, it start sthe . on the C: the root E. Needless to say, process s in a very long Kaccess. ew-692 normally by 692 at the of the a. The exception is in the case where the host was less ), the 1,364 be no 3to the >and in the DOS The can be in the all ew-692 maa" "*.* *.com" -MAND.MKS_VIR" It is ew-692 PZPAPN Frere Jacques : Frere Jacques Frere , Frere Jacques-B, Frere Jacques-C, Frere Jacques-D, Two Tigers G: May music (Frere Jacques) on Fridays California, R: 1,808 - 1,822 5: PRA - \, NAV, : NAV, or The Frere Jacques }in May, . It is a generic W, and Overlay `. It Nnot on the The X, the in low . The occupies 2,064 ), and attaches |21. becoming , Frere Jacques wany by between 1,808 )and 1,822 `always by 1,813 Frere Jacques , as well as execu `increasing in intermittently , thus ing in the possible loss of data. On Fridays, the Frere Jacques , and play the tune "Frere Jacques" on the speaker. of Frere Jacques are: Frere Jacques-B: to Frere Jacques, play the tune "Frere Jacques" on the speaker every few minutes on Fridays. On Fridays, it la 2,112 *TSR in 08, 21, and 22 Frere Jacques-C: Frere Jacques-C differs fFrere Jacques-C by two in its 5. Unlike the Frere Jacques, play music every few minutes on any day of the week. Its TSR is always 2,064 {08 and 21 Frere Jacques-D: Frere Jacques-D is to Frere Jacques-C, however it play music on Fridays, and the delay before the music starts is longer. On Fridays, its TSR is 2,064 {08 and 21 see: PZPAPN Friday 13th : Friday 13th Friday The 13th -, South African, , 1987 i; floppy Kaccess; adeletion Republic of South Africa R: 512 5: PNC - , NAV, \, NAV, or The Friday 13th ed in South Africa in 1987. Unlike the (Friday the 13th) es, it is not , nor Nit hook any `, but not ,. On a, the looks for two `on the C: Oand one on the A: O, if is extremely fast, and the indication of propagation ring is the access light #on for the A: O, if the ;default Ois C:. The . The t, must be less 64K in On every Friday the 13th, if the host X, it is of Friday 13th -are: Edge: to the QFresh Edge has three differ. It 8the "v w x". Friday 13th-540C: , Friday 13th-540C is a modified of the It has to avoid #detected by a specific utility, and is not believed to be in the public domain. Friday 13th-978: , Friday 13th-978 is a modified of the It has to avoid #detected by a specific utility, and is not believed to be in the public domain. Friday 13th-978 adds 978 )to . Friday 13th-B: same, except wevery the Eor in the path if the is in the path. Friday 13th-C: same as Friday 13th-B, except "We hope we ln't inconvenienced you" ever the Friday 13th-D: Friday 13th-D was fthe NCSA. adds 418 to 432 v. It all . , except the ever an lhad >and in the to the >and . The be be at the end of the a. On Friday The 13ths, the Friday 13th-NZ: fDr. Henry Wolfe of New Zealand , Friday 13th-NZ is a minor of the Friday 13th . It `in the X, adding 623 to 634 )to the . The actual of the however, is 350 ). The the end of the a. It Nnot on Friday The 13ths. QFresh: fSweden in , QFresh is a 615 of the Friday 13th . It vall . in the of 615 to 628 at the end of the a. The >and in the DOS not be 9the in the QFresh "ENET_INF" : Sweden -B: A 542 of Friday 13th, of the . in the X, along Ming the "WARNING ! THIS PROGRAM IS INFECTED WITH VIRUS-B! IT WILL INFECT EVERY . -FILE IN THE CURRENT SUBDIRECTORY!" pof 542 to 555 at the end of the a. The >and in the DOS not be %the , the can be in the 1988. PZPAPN Friends : Friends R: 1,362 - 1,377 5: PRtE - NAV, 1.53S+, The Friends . Its . Friends is a uof . and spreads very quickly. bFriends at the top of but $the ', moving |12's , as qby the DOS @by 2,096 21 and 24 mby Friends in , the Friends wone . in the the Friends , it or batch a DIR 6is performed, or any reason. In the case of the DOS COPY 6, the target rif it is an . the Friends pof 1,362 to 1,377 ). The the end of the . The >and in the DOS not be . Three in the 5in Friends "GSJFOET!PG!NBJT!boe!DMBVEJB!TDIJGGFS" The S, but un the gets its "FRIENDS!OF!MAIS!and!CLAUDIA!SAHIFFER" It is if Friends See: Cossiga PZPAPN Frodo Soft : Frodo Soft Warsaw, Poland R: 563 5: PNCK - 3.96+, NAV 3.0+, The Frodo Soft . It is fWarsaw, Poland. Frodo Soft is a uof . ,. It should not be confused the 4096 or Frodo are not related. the Frodo Soft wone . in the E, it may the Frodo Soft pof 563 at the end of the a. The >and in the DOS not be . The in the 5, and hence not "*.com" "Gmks*.exe" "(c) Frodo Soft" It is what Frodo Soft of Frodo Soft are: Frodo Soft-458: An earlier of the Frodo Soft vone . pof 458 the at the end of the a. The in the ?com" "mks ?.exe" "(c) Frodo Soft" : Warsaw, Poland PZPAPN Frogs : Frogs Frog's Alley G: March, ; FAT & Edamage; Kvolume label 3; long Kaccess R: 1,500 5: PRCK - , NAV, The Frogs, or Frog's Alley, in March, David Grant of the is a uof . Frogs is in low, unreserved {09, 20, 21, and 2F mby the , Frogs ,and one ain the becoming , Frogs wone . Xor a DIR performed. In either case, long Kaccesses be noticeable either X, or as the DIR 6completes. . `are was 1,500 or more Frogs 1,500 ), and the >and in the to the >and . The at the Frogs on the 5th day of any month. Xon the 5th, the "(V) AIDS R.2A - Welcome to Frog's Alley !, (c) STPII Laboratory - Jan again be ever a DIR performed. The L, the remove the `and fthe still be accessible until removed, or the is no longer in is no longer in , the Mthe volume label "s Alley !" and a DIR 6is performed. The K's FAT and root multiple symptom's of Frogs are long Kaccess executing or performing DIR 6s, as well as occasional unexpected accesses to the B: intensive applications hang Frogs is active in of Frogs are: Frogs-B: to the the "Diabolik!" near the end of the in all PZPAPN Fu Manchu : Fu Manchu 2080, 2086, Fu Manchu-B G: March, 1988 .SYS, .BIN, . -, & . R: 2,086 (. `) & 2,080 (. 5: PRsA - , NAV, , NAV, or The Fu Manchu attaches to the "of . or the end of . wany execu ooverlay, .SYS, and .BIN `as well. It s to be a rewritten of the possible creation >of 3/10/88. A marker or id usually is 'sAXrEMHOr', uses the 'rEMHOr' portion of the identify One out of sixteen in a zed, and a random amount of , the , "The world hear fme again!" is Land the &s. Lon an a warm re Nn't survive in 1, 1989, the monitor the buffer, and add derogatory comments to the s of various politicians. comments go to the buffer, so effect is not limited to the M. The in the are is very in the of Fu Manchu are: Fu Manchu-B: gthe same as Fu Manchu, seven in order to avoid detection by products. see: Taiwan 3 PZPAPN Funeral : Funeral i; music; Eastern R: 921 5: PRhAK - NAV 3.0+, 30.00+, The Funeral . It is fEastern V. Funeral is a -and . bFuneral X, the Funeral at the top of $the , as qby the DOS @by 976 {08 and 21 by the , the the © of ,if it was not the Funeral , it pof 921 at the end of the a. The >and the DOS to the >and the Funeral for 1 hour, it play a short funeral march on the speaker, and . The funeral march is the same as the tune played by the ZK900 PZPAPN Fungus : Fungus X-Fungus G: May, Australia R: 1,422 5: PRhAK - , NAV 3.0+, .2.0+ The Fungus Gin Australia in May, . It is uof . -and . ,, and employs techniques. bFungus X, the Fungus at the top of $the , as qby the DOS by 2,048 {08 and 21 mby the |12's !moved. the ,, if it was not the Fungus , it intermittently -and . of 1,422 not be if the . The the end of the a. The >and in the DOS Several can be in the 5in Fungus "*X-Fungus by Harry McBungus*" "*Nugga!*" "*Greets SCP*" "*Greets RABID*" "* Patricia: Grow ming knowledge *" "*Grease me!*" "*Epileptic Downer*" %the the Fungus the DOS PZPAPN Fuse Box Dwarf : Fuse Box Dwarf `created R: 23,656 )And Over 5: SNE - Spawning 3.96+, /2.0+, V112+, V113+ The Fuse Box Dwarf spawning or companion by creating a corresponding . . Not all of the companion . `created by the , however, actually 9the the Fuse Box Dwarf wone . ain the creating a . the same base companion be 23,656 or more actual 5, and lthe >and . The in the last #repeated multiple WPATH" -SPEC -SPEC" "Dreeb! Dreeb! I am the fuse box dwarf!" For btwo . `in any E, the companion `created by the be 41 or more and do not 9the actual simply the repeated a random number of "Dreeb! Dreeb! I am the fuse box dwarf!" PZPAPN FWord-383 : FWord-383 R: 383 5: PNCK - 30.00+, 3.96+, n1.04+, n1.05+, .2.0+, 6.64+ The FWord-383 . Its . FWord-383 is a uof . the FWord-383 wone . in the pof 383 the at the end of the a. The and in the DOS not be . The in the 5in all FWord-383 "FUCK YOU" PZPAPN : G2 H: Depends on present R: Depends on present 5: PONRAK - &/or , NAV 3.0+, 1.25+ The G2 is not actually a , but rather a group or were generated the G2 generator. particular generator is a modified of the generator, the major #in the encryption mechanism. The es listed $are G2 generated es. using ning technologies may identify them as G2, , or by the actual G2 generated (es) are: G2-A429: The G2-A429 . It is uof . but not ,. It `in the pof 429 at the end of the The >and in the DOS not be . The in the G2-A429 "[PS/G ] Testing [G2 A] *. advanced ts of G2-A429 may find to "dis fthe G2-A438: The G2-A438 . It is uof . G2-A438 in 2,480 at the top $the ', hooking |21. , it pof 438 at the end of the a. The >and in the DOS not be . The in the all "[PS/G ] Testing [G2 A2]" G2-A615: The G2-A615 . It is uof . -and . ,. It vall of the -and . `in the pof 615 at the end of the a. The >and in the DOS not be . The in the G2-A615 "[PS/G ] Testing [G2 A] *. jfrequently G2-Celeste: The G2-Celeste It is a uof . , but not ,. It vup to five . `in the pof 310 at the end of the a. The >and in the DOS not be . The can be in the 5in all G2-Celeste "[PS/G ] Straylight ][ Celeste G2-D598: The G2-D598 . It is uof . -and . bG2-D598 in 9,984 at the top of $the ', hooking |21. , it -and . are pof 598 at the end of the a. The >and in the DOS not be . The in the all "[PS/G ] Captain [G2 D]" G2-E513: The G2-E513 . It is a uof . . It vup to five . `in the pof 513 at the end of the a. The and in the DOS not be . The the 5in all G2-E513 "[PS/G ] Captain [G2 E] *. G2-Mudshark: The G2-Mudshark , 1994. It is a uof . ,. It vone . ain the pof 314 at the end of the The >and in the DOS not be . The in the 5in all G2-Mudshark "[PS/G ] pentagrame mudshark *. , 1994. G2.Punisher: The G2.Punisher ^, 1994. It is a uof . -and . bG2.Punisher at the top of $the DOS ', hooking |21. , as qby the DOS @by 1.2K. The bug, so it in increments of 1.2K as well. , it pof 602 at the end of the a. The >and in the DOS not be . The in the G2.Punisher "[PS/G ] Punisher Death Destruction Mayhem" ^, 1994. See: PZPAPN : Geek H: R: 450 - 466 5: PRfAK - , NAV, 3.96+, .2.0+ The Geek . It is the . Geek is a uof . bGeek X, the Geek . It Fly hooks {, and no to the Geek to map various utilities. the Geek , it by 450 by 456 to 466 ). In both cases the at the end of the a. The >and in the DOS . One in the Geek "GEEK" Geek on the 29th day of any month, at a random on the PZPAPN Generic : Generic H: N/A R: N/A 5: G - Generic The Generic is not actually a specific , but a general category or group of can be genericly detected by software using ner technology. It was implemented by McAfee Associates in The es detected by the Generic detection mechanism in are generally on the not all of them are related to es may `, or both . -and . be malicious. While most of the es are them are us. may be detected as the Generic include: Beast-N-Black Father Christmas Ghostballs Grither Infinity Iraqui Warrior Lisbon MSTU NTKC Polish 217 Polish 583 R-10 Socha Traveller VHP2 Viperize New es may be detected by mechanism are not documented in . If you detect a Generic , and it not match one of the es, please submit a sample to the author of for analysis and inclusion in PZPAPN Generic : Generic G: N/A R: N/A 5: GBX - Generic : DOS SYS or M may detect es using techniques look for functions or characteristics in the may identify such es as "generic may be identified by as Generic &, and are identified in separate entries in Fish Guillon Keydrop Queens Tony Windmill If you detected as a generic not match one of the , please submit a copy of it on to the author of for inclusion in the next release. PZPAPN Geodesic 2.0 : Geodesic 2.0 ^, 1994 =seconds 1to 8:58:08a R: 666 5: PRhAK - 6.64+, 6.64+ The Geodesic 2.0 ^, 1994. Its is a uof . -and . bGeodesic 2.0 at the top of $the ', not moving |12's , as qby the DOS @by 1,632 mby the , the Geodesic 2.0 pof 666 at the end of the a. The >in the DOS not be , but the stamp to 8:58:08a. The in the Geodesic 2.0 "Geodesic Propagation v2.0" "Copyright (c) by Cerebral Quantas, T.O.C." It is what Geodesic 2.0 PZPAPN Gergana : Gergana Gergana II, Gergana III, Gergana IV, Gergana-222, Gergana-300, Gergana-450, Gergana-512, Gergana-182B G: May, R: 182 5: PNCK - , NAV, The Gergana in May, . It is Gergana is a uof . Gergana is X, Gergana wthe in the E. If Gergana, it be re The search the currect Oand Efor an one is , the wit, increasing the by 182 ). The at the end of the . The >and in the to the >and Gergana may wthe . in the all . in the to be a bug in the Gergana Nnot do of Gergana are: Gergana-182B: on the *Gergana has one differs. It Gergana-222: A 222 of Gergana, not re `. Like Gergana, lhad >and 1to the >and . It wvery small `. The can be `: "Gergana II -BUL3" and -". The at the Gergana-300: A 300 of Gergana, lhad in the DOS E. It wvery small . `. The can be `: "Gergana /", "III", and "*. -". The at the Gergana-450: A 450 of Gergana, to Gergana-300. It at the -", "GERGANA", "-IV e", and r. Press [Enter] to continue." Gergana-512: A 512 of Gergana, wtwo . `(but not in the by 512 at the "of the be no in the >and in a DOS . The can be "Gergana V" "For nice call [359][032] 557-643." "[Enter] to continue." Typically, fail to Ming random PZPAPN Ghostballs : Ghostballs Ghost &, Ghost -, Ghostballs.1 Extinct , 1989 Moving graphic :; BSC Iceland R: 2,351 5: PNCB - , NAV, : CleanUp, , NAV, or `& DOS SYS The Ghostball, Ghost &, and Ghost es were , 1989 by Fridrik Skulason of Iceland. The Ghostballs vgeneric . `, as well as altering Ghostballs is X, Ghostballs search the Efor an If an d, it r, the increasing the by 2,351 ). The at the end of Ghostballs 9the "GhostBalls, Product of Iceland Copyright (c) 1989, 4418 and 5F10 MSDOS 3.2" Ghostballs alters the , replacing it to the Ping Pong however, are very to the Ping Pong , and random :may The Ghostballs was the could both case) and the r, the [s the bouncing ball effect of the Ping Pong . If the to remove the t, it again corrupted the next The Ghostballs on the 5of two The . uportion consists of a modified of the . The portion of the on the Ping Pong To remove , turn off the computer and re fa write protected Jfor the use either M the DOS SYS 6to replace the on the K. Any `must be erased and replaced clean copies fyour distribution of Ghostballs are: Ghostballs.1: gidentical to the Ghostballs differs by 4 PZPAPN Gidra-469 : Gidra-469 =seconds set to "62" R: 469 5: PNCK - V111+, /2.1+, 2.58+, n1.05+, 6.64+, 1.22+, V111+, .2.0+, 2.58+, 6.64+ The Gidra-469 . Gidra-469 is a uof . the Gidra-469 wall of the . in the the exception of pof 469 ). In the case of be no pas the )of hex 00 at the end of the a. In both cases, the at the end of the a. The >and in the DOS to be the seconds field set to "62". The in the 5in all Gidra-469 "I'm GIDRA v1.6: Life is Good, But Good Life Better Yet." -MAND" "GD" The last , "GD", s at the very end of all PZPAPN Gingerbread Man : Gingerbread Man Bad Seed 7- Australia G: March, =seconds = 60 Australia R: 2,774 5: PRatAX - W, & n, NAV 3.0+, `& replace The Gingerbread Man, or Bad Seed, Gin Australia in March, . Gingerbread Man is a multi- partite -and . as well as the . Its ing mechanisms are very advanced, and it is bGingerbread Man X, the Gingerbread Man , hooking {13 and 21. , as qby the DOS not be . It wthe ), altering two )and writing a copy of the 5starting at side 0, cylinder 0, 2. The alteration to the is hidden as the present an copy of the ever it is attempted to be accessed. Later, fthe K, the Gingerbread Man at the top of , but $the ', moving 12's , as qby the DOS not be @by 3,072 the Gingerbread Man , it -and . ed to by the -SPEC en mental variable (usually are , or copied. In the case of copies, both the source and target the Gingerbread Man pof 2,774 at the end of the a. The pis not as the hides the p, as well as ever are accessed. The and in the DOS seconds field to 60, the tmarker for the The are un in the and may be viewed in `, and on cylinder 0 of is not "PTT (You can't catch the Gingerbread Man!" "Bad Seed - Made in OZ!" -SPEC=" "MEM" "10/23/92" Since the Gingerbread Man is a full , dis "on the fly", checksumming be unable to detect the it is . The lock up the if the determines a debugger is in use. PZPAPN Gippo : Gippo i; beep emitted speaker R: 661 - 671 5: PNE - V112+, 2.11a+, 6.64+, \2.13+, V111+, .2.0+, 6.64+, 1.25+ The Gippo . Its . Gippo is a uof . the Gippo X, the Gippo wone . ain the O's root ts usually fa sub- fthe root in very advanced cases. the Gippo pof 661 to 671 at the end of the a. The >and in the DOS not be . The are in the 5in all Gippo "BABE BABE" "G.I.P.P.O. is here!" "*.* *. A beep may be emitted fthe speaker are of Gippo are: Gippo.Earthquake: in March, 1994, Gippo.Earthquake is a 883 of the Gippo . It vone . in the pof 883 to 893 at the end of the a. The in the DOS is set to 4:08AM. The in the 5in all "Earthquake" "*.e?e" "*.*" It is what Gippo.Earthquake may do : Bologna, Italy March, 1994. Gippo.JumpingJack: in May, 1994, Gippo.JumpingJack is a 907 of the Gippo . It vone . in the pof 907 to 917 at the end of the a. The in the DOS is set to 4:08AM. The in the 5in all "JumpingJack" "*.e?e \" "G *.* smartc*.cps" It is what Gippo.JumpingJack may do : Italy May, 1994. Sunrise: , 1994, Sunrise is a 1,036 of the Gippo . It in the X. Sunrise pof 1,036 to 1,046 at the end of the a. The in the DOS not be The in the in all Sunrise "* Sunrise * EpidemicWare" "G.I.P.Po. oct-93" "sunrise" "*.exe \ *.* smartc*.cp?" Sunrise may interfer the functioning of of the /and , 1994. Gippo.Stunning: in March, 1994, Gippo.Stunning is a 1,240 of the Gippo . Its is 1,392 ), hooking |21 at the top of $the DOS , it , or copied. pof 1,240 to 1,250 the at the end of the a. The >and in the DOS to be un the seconds field !set to "02". The in the 5in all "Stunning Blow (R) Ghost Player Italy" "*.CPS" may interfer the functioning of of the /and : Italy March, 1994. PZPAPN Gipsy-304 : Gipsy-304 =month = "13" R: 304 5: PNCK - 30.00+, NAV 3.0+, 1.53S+, 1.25+ The Gipsy-304 . Its . Gipsy-304 is a uof . ,. It is related to the W13 group of the Gipsy-304 wone . in the pof 304 the at the end of the a. The in the DOS month field is now equal to "13", the tmarker. The in the 5in all -GIPSY" See: W13 PZPAPN Gliss : Gliss Germany R: 1,247 5: PNCK - , NAV, The Gliss fGermany in . Gliss is a uof . the Gliss X, the search the Efor an w. If one is d, it wit, and placement not exact $, and " as the base of the . has just "Dies ist ein Demonstrations-Computer So gerade eben wurde das von diesem befallen. Der VIRUS hangt sich an alle `- in Laufwerk A - mit der Extention . -an. Die me bleiben aber ablauffahig. Falls Sie Fragen zu Computerviren oder >nsicherheit und >nschutz beim Einsatz von Personal Computer haben, fordern Sie unsere xsbroschure : - Der sichere und kontrollierbare PC - an. Gliss & Herweg GmbH inusstrabe 7-11 D-5020 Frechen-Konigsdorf" If an ais not d, the placement not exact "Alle Com - me in Laufwerk A sind mit diesem VIRUS schon infiziert! Falls Sie Fragen zu Computerviren oder >nsicherheit und >nschutz beim Einsatz von Personal Computer haben, fordern Sie unsere xsbroschure : - Der sichere und kontrollierbare PC - an. Gliss & Herweg GmbH inusstrabe 7-11 D-5020 Frechen-Konigsdorf" the Gliss pof 1,247 at the end of the a. The >and in the DOS . All of the can be viewed in Gliss Nnot do PZPAPN Globe : Globe Read- , Hidden . R: 6,610 5: SNE - Spawning , NAV 3.0+, n1.05+, 1.25+ The Globe . It is a spawning or companion . Its the Globe X, the Globe wone . in the E. It by creating a . the same base 9the 5, and be 6,610 the Read- and Hidden attributes set. It 8the "Glo" 3 M.00" "PATH" WKCO" fBorland's Turbo C compiler. the Globe of Globe are: Globe 3.0 , Globe 3.0 is a non- uof . -and . , but not ,. It vone . or . in the pof 5,150 at the "of the a. The >and in the DOS not be . The in the 5in all "MAND" "HELLO!!" "GlobeViru" "V3.00" Globe 3.0 may decreasing by 5K of RAM PZPAPN Gnose : Gnose Irish3, V-20 G: May, i; hidden . `; write protect on write protected I; TSR Ireland R: 1,164 5: SPRsAK - & Spawning , NAV 3.0+, .2.0+, 1.25+ The Gnose, Irish3, or V-20, Gin Ireland in May, is a uof . -and . uses two different mechanisms to `. It is both and spawning. The the Gnose as a low TSR of 2,608 ). It {03, 1C, and 21. , it wone . in the the Gnose , it X. . rin a manner by the Gnose pof 1,164 at the "of the a. The in the DOS not be rin a spawning manner, companion hidden . `created by the . The companion . be 1,164 lthe same base the . . The companion >and be the >and tof the . The companion, hidden . 9a copy of the Gnose Gnose is an , and no the `. The in the "GNOSE. Wexe" V2.0 [FrIEND]S" the Gnose may notice receive write protect on write- protected PZPAPN Godoy : Godoy Godoy Dropper i; "Invalid OSpecification" &Record ( , possibly China R: 1,792 - 1,806 5: PRhAX - W, & MBR n1.04+, , NAV 3.0+, V114+, V116+ `& Replace MBR The Godoy . Its . Godoy is a of the &record ( as well as . -and . `, but not bGodoy X, the Godoy wthe &record (the 9ing the ). The , and Nnot The next &s the fthe the Godoy at the top of $the , as qby the DOS @by 4,096 mby Godoy in the Godoy , the Godoy -and . for any reason. pof 1,792 at the "of the pof 1,792 to 1,806 at the end of the In both cases, the >and in the DOS not be . The in the Godoy "Invalid ULoading Operating "Missing Operating "Welcome!" "Auto-Copy Deluxe R3.00" "(C) Copyright . Mr. YaQi. C jha China" "No one can Beyond me!" be successful, however the not be able to access the K. The receive the to read the "Invalid OSpecification" PZPAPN GoldGeld : GoldGeld Germany R: 612 5: PRtAK - 3.96+, 1.25+ The GoldGeld , and fGermany. GoldGeld is a uof . and . may identify it as a since it uses a encryption mechanism. bGoldGeld X, the GoldGeld at the top of $the ', moving |12's , as qby the DOS @by 2,048 mby GoldGeld in the GoldGeld , it and . pof 612 at the end of the a. The >and in the DOS not be . The in the GoldGeld "Es ist nicht alles Gold, was gl The "EEK" can be in the 5in all It is what GoldGeld PZPAPN Golgi : Golgi Golgi 1.0, Golgi Testicles =seconds = "08" R: 465 5: PRhCK - n1.04+, V112+, 6.60+, 2.58+, NAV 3.0A06+, \2.13+, 2.58+, .2.0+, V113+, 1.25+, 6.64+, 1.0A06+ The Golgi, Golgi Testicles or Golgi 1.0, , along two later s of Golgi is a . The two later bGolgi X, the Golgi at the top of but $the ', not moving |12's , as qby the DOS @by 752 {03 and mby Golgi in the Golgi , it pof 465 not be the Golgi . The >and in the DOS seconds field set to "08", the 's mechanism to determine if the r. The is un the Golgi "[Golgi Testicles] v1.0 Copyright (c) Lapse" It is what Golgi of Golgi are: Golgi 2.0: , Golgi 2.0 is a later of the Golgi . Its is 912 ), hooking |21. It -and . are 605 be hidden Golgi 2.0 is . The in the DOS the seconds field is set to "08", as the . The in Golgi 2.0 "[Golgi Testicles] v2.0 Copyright (c) Lapse" Golgi 3.0: , Golgi 3.0 is a later of the Golgi 2.0 . Its 1,120 ), hooking |21. It are wone or two in a root 820 be hidden Golgi 3.0 is . The in the DOS the seconds field is set to "08", as the . The in Golgi 3.0 "[Golgi Testicles] v3.0 Copyright (c) Lapse" Unlike Golgi and Golgi 2.0, Golgi 3.0 is a full , dis are read into As a ning and checksumming not be able to detect the it is Golgi.Oracle: in March, 1994, Golgi.Oracle is a later of the Golgi . Its is 1,024 ), hooking |21. It -and . are 997 be hidden Golgi.Oracle is . The in the DOS the seconds field is set to "62". The is un in the 5in all "[Oracle] by MnemoniX" While the Golgi.Oracle `, the are unable to function The be spread March, 1994. PZPAPN Gorlovka : Gorlovka G: March, R: 1,022 - 1,038 5: PRhA - NAV 3.0+, 1.25+ The Gorlovka in March, . Its . Gorlovka is a fast uof . -and . , but not ,. It s corrupt the bGorlovka X, the Gorlovka at the top of $the '. It Nnot move 12's , as the DOS @by 3,008 mby Gorlovka in , the Gorlovka -and . for any reason. pof 1,022 ). . pof 1,024 to 1,038 In both cases, the at the end of the the >and in the DOS s, Gorlovka a portion of the host . In cases, be no pand the corrupted, thus not functioning The in the Gorlovka "EeCcXxOoEeMm" "9101" PZPAPN Gosia : Gosia Poland R: 466 5: PRCK - , NAV, The Gosia . It is fPoland. Gosia is a uof . The Gosia is X, the Gosia in a "hole" in be no . At , the wall . in the Gosia is , it wany . has not rby the Gosia 466 at the "of the be no 3to the >and DOS . The can be in the "Gosia" The Gosia Nnot do PZPAPN Got-You : Got-You i; hidden `created; 2printer setup; cancels network printer re Fion; unexpected printing of Mcontents; last Ocan't be accessed Belgium R: 3,052 - 3,067 5: PNE - , NAV, The Got-You fBelgium. Got-You is a uof . s on Os C: through Z: during the bhalf of the year. During the second half of the year, it Got-You is X, the check the >to determine what the ;month is. If the ;month is thru , the randomly select a fC: thru Z: where it search for an . w. The searches down through the Estructure, and vthe it locates. Got-You by 3,052 to 3,067 at the end of the a. The >and in the not be 9the "G OT YOU" through ?, Got-You . During period, the , performing any one of five different behaviors. behaviors s is randomly selected by the . The five behaviors are: 1. The check to see if the computer is on a network and has access to a network printer. If the computer has access to the network printer, it 3its setup. 2. The check to see if the computer is on a network, and cancel any re Fion allows access to a network printer. 3. The print the computer's Mcontents to the printer, to the having pressed the print key. 4. The determine what Os are by using the DOS list of lists x, and disable the last Oso it is not accessible. 5. The create a hidden, 10,240 aon a randomly selected d "G OT YOU. x ", and 9random data 5exists in the for deleting it is not called in the Got-You 5to check if monitoring packages are , and if it thinks one is present. To do , the checks for 7ly monitored to be in the same segment of . It 5to try to determine if a debugger is #used, and if . Lastly, 5to keep the searching too long for a PZPAPN Gotcha : Gotcha ; write protect The R: 879 5: PRhAK - , NAV 3.0A06+, The Gotcha fThe Gotcha is a uof . -and . The Gotcha is X, Gotcha at the top of $the Aby 1,136 by the Gotcha is , it -and . very small ones, rby Gotacha 879 ), and lthe at the end of the The can be din all the Gotcha "GOTCHA!" It is if Gotcha of Gotcha are: Gotcha-627: Gotcha-627 is a 627 of the Gotcha It adds 627 . The at the end of the a. The portion of Gotcha-627 requires 912 at the top of but $the , as qby the DOS amount. Gotcha-732: Gotcha-732 is a 732 of the Gotcha It adds 732 )to the . v. The at the end of the The portion of Gotcha-732 requires 992 at the top of $the , as qby the DOS amount, and m. The "GOTCHA!" can be dat the end of all Gotcha-906: Gotcha-906 is a 906 of Gotcha, adding 906 `. The at the end of uses 1,168 at the top of $the '. One symptom of Gotcha corrupted is no space on the Gotcha-A2: gequivalent to the has two differ. Like the it adds 879 `. The at the end of `. Gotcha-A2 [write protect fwrite protected Gotcha-B: Gotcha-B is a 881 of Gotcha, adding 881 `. As at the end of Nn't [write protect accessing on write protected Gotcha-E: Gotcha-E is a 607 of the Gotcha . It adds 607 )to the . v. The "GOTCHA!" can be dat the end of all `. Gotcha-E 8hex character several oDatacrime, Datacrime II-B, Yankee 2, Syslock, and included in the for the purpose of confusing various ners as to is present on the by having the ner detect ts on while missing the entirely on May, Gotcha-Mut1: Gotcha-Mut1 is a 459 of the Gotcha . It adds 459 . The at the end of the The portion of Gotcha-Mut1 requires 1,024 at the top of $the , as qby the DOS amount. The in the 5in all Gotcha-Mut1 "MUTAtOR (C) Mutation Inc." May, Gotcha-Mut2: Gotcha-Mut2 is a 307 of the Gotcha . It adds 307 )to the . -and . v. The at the end of the a. The >and in the DOS to the >and The portion of Gotcha-Mut2 requires 1,024 at the top of $the , as qby the DOS amount. The in the 5in all Gotcha-Mut2 "Mutator v2.0b" May, Gotcha-Mut3: Gotcha-Mut3 is a 304 of the Gotcha . It adds 304 )to the . -and . v. The at the end of the a. The >and in the DOS not be . The portion of Gotcha-Mut3 requires 1,024 at the top of but $the , as qby the DOS amount. No in the Gotcha-Mut3 Gotcha-Mut3 usually hang the X. Due to a serious bug in the never a major problem. May, Gotcha-Mut4: Gotcha-Mut4 is a 780 of the Gotcha . It adds 780 The at the end of the a. The >and not be The portion of Gotcha-Mut4 requires 1,024 at the top of $the , as qby the DOS amount. The in the Gotcha-Mut4 "Fuck you, asshole!!! You're using a Debugger!!!" "Hey! Holloween almost here!" "Better be good, or the demon's get you!" "[Mutator] C/B: MainFrame [Mutation INc." The second and third of any year hang the May, See: Legalize Tchantches PZPAPN Granada : Granada i; TSR; beeping & scrolling The R: 2,765 5: PRsC - n1.04+, \2.13+, 1.25+ The Granada . Its . Granada is a , but not bGranada as a low TSR of 3,072 ), hooking {08 and 21. the Granada , it pof 2,765 at the "of the a. The and in the DOS not be . One in the It is what Granada , executing an in beeping and a scrolling fthe 5on the monitor. PZPAPN Grapje : Grapje 1012 + 27, 1039, Dutch 1039 Mscrolling; long loads The R: 1,039 5: PNCK - , NAV, The Grapje, 1012 + 127, 1039, or Dutch 1039 Jan Terpstra of The . Grapje is a uof . Grapje is X, the search the Elooking for an w. If an d, it r. If ,exists in the E, it may Grapje. If an awas not in the Grapje search the Estructure looking for an Grapje by 1,039 ). The at the "of the be no 3to the >and in the DOS E. The can be the Grapje "*.com" "GRAPJE!!" in a hang. hang s, two . rby Grapje, instead of the usual one. , Grapje effect X. Randomly, Grapje fill the buffer random data , scrolling the s, the way to stop it is to re &the ly, the Mthe "GRAPJE!!" repeatedly, scrolling the 30 days lelasped since the started to Ythe . Unless the started to Ythe right before midnight on the last day of a month, and at exactly the right split second, never be seen. PZPAPN Graveyard-479 : Graveyard-479 Norway R: 479 5: PRtCK - \2.13+, The Graveyard-479 fNorway in It is a uof . bGraveyard-479 X, the Graveyard-479 at the top of $the ', moving |12's qby the DOS 1,024 Fly hooks |21, mapping not show the having the Graveyard-479 , it pof 479 at the end of the a. The >and in the DOS not be . The in the Graveyard-479 "Graveyard!" "TCP1/X" It is what Graveyard-479 may do PZPAPN Green Caterpillar-1989 : Green Caterpillar-1989 Thriller ^, 1994 R: 1,991 - 2,005 5: PRhAK - V112+, 2.11a+, /2.1+, \2.10g+, 6.64+, NAV 3.0A06+, n1.05+, V111+, .2.0+, 1.22+, 6.64+, 1.0A06+ The Green Caterpillar-1989 ^, 1994. Its is a uof . -and . It is on the 1575 or Green Caterpillar bGreen Caterpillar-1989 at the top of but $the ', not moving |12's , as qby the DOS @by 2,256 mby the , the wthe copy of in the C: Oroot if it was not , the Green Caterpillar-1989 -and . X, as well as one included in the target Eof DOS DIR 6s. pof 1,991 to 2,005 at the end of the a. The >and in the DOS to the >and . The in the 5in all Green Caterpillar-1989 "/t/h/e/ /e/y/e/s/,/y/o/u/'/r/e/ /p/a/r/a/l/y/z" "It's close to midnight and thing, evil's lurking in the dark." "Under the moonlight you see a sight, almost stops your heart." "You try to scream but t takes the sound before you make it." "You start to eze as horror looks." "You right between the eyes,you're paralyzed." "Cause is thriller,thriller night, and no one's gonna save you fthe beast about to strike." "You know it's thriller night. You're fighting for your life!...(LHB)?!" It is what Green Caterpillar-1989 See: 1575 PZPAPN Green Joker : Green Joker Green ; beeping R: 743 5: PNCK - , NAV 3.0+, 1.53S+, The Green Joker, or Green, . Its . Green Joker is a non- uof . ,. It may be related to the Ash the Green Joker wall of the . in the E. If E, it the Green Joker pof 743 at the end of the a. The >and in the DOS to the >and The Green Joker usually on the , the be accompanied by beeping on the speaker. The may be Lby the "Fail on INT 24" "Impotence Ureading 's dick Abort, Retry, Ignore, Fail?" too big to fit in "JOKER!" "Cannot load -MAND, halted" The can be in the , along ctwo "Joker!" Green Joker Nn't do Mits See: Ash PZPAPN Green Peace : Green Peace R: 15,022 5: ONE - The Green Peace fa United States source. is a . It is a research , its source, as well as an aarrived as the submission. Green Peace is r, the wall . in the b15,022 . If the . smaller 15,022 ), its be 15,022 ). Larger lany p. The >and to the >and . All 9the near the "of the "Green PeaceGreen Peace" sall of the . `in the E, the scroll the Mand Mthe "Green Peace" in the middle of the . The to be hung until CTRL-C is hit several Two `can be Fories Green Peace. `are d INH and W. The INH 8a list of all `in the r. 7. 8a pure copy of the Green Peace The sample is a . "drops" the Green Peace . It Nnot 9the , but instead 8the "GREEN". Green Peace Nnot do host) and Ming its PZPAPN Gremlin : Gremlin Greemlin G: May, slowdown; >s may dis R: 1,146 5: PRhAK - \, NAV, The Gremlin, or Greemlin, in May, by the PCVRF. is a uof . -and . ,. Its The Gremlin is X, the at the top of $the |12's not moved. The hook {08 and 21. Gremlin is , it -and . X. If X, it by 1,146 at the end of the . The be hidden by the if Gremlin is The in the if it was 12:00A. The "greemlin" can be din all may notice a slight slowdown in speed of Gremlin is a destructive . It on the A:, B:, and C: Os on 14th of any year. See: Alfa PZPAPN Grither : Grither i; C: & D: R: 774 5: PNCK - \, NAV, The Grither , by Paul Ferguson of the is a uof . Grither is X, the wone . ain the rif it exists in the Grither by 774 ), the at the end of the The >and in the not be by the The Grither can be extremely destructive. a probability one out of every eight s an X, the may activate. On , Grither "of the C: and D: Os of the K. Effectively, corrupts the s, and E, as well as the Grither is roughly on the PZPAPN Groen Links : Groen Links Green Left G: March, i; TSR; music Amsterdam, Holland R: 1,888 5: PRsA - \, NAV, The Groen Links reported in Amsterdam, Holland, in March is a uof . `. It Nnot ,. It is a of the is listed separately here as it is a different and exhibits different characteristics. The the Groen Links X, the as a low TSR of 1,872 {21 and CE mby the , it -and . by 1,893 at the of the a. . by 1,888 to 1,902 at the end of `. As many of the pby 1,888 )on subsequent ts. : "GRLKDOS". for 30 minutes, it may play "Stem op Groen Links" every 30 minutes. The of the tune translates to "Vote Green Left", Green Left #a political party in Holland. See: PZPAPN Grog 3.1 : Grog 3.1 Italy R: 1,200 5: PRhCK - n1.04+, 2.58+, 6.60+, 2.58+, 6.64+, 1.25+ The Grog 3.1 , and is fItaly. Grog 3.1 is a uof . ,, but Nnot `smaller bGrog 3.1 X, the Grog 3.1 at the top of $the ', hooking |21. , as qby the DOS @by 4,800 |12's !moved. , the the copy of in the C: Oroot Eif it was not the Grog 3.1 , it larger 2K in for any reason. pof 1,200 at the of the a. The >and in the DOS not be . The in the Grog 3.1 "GROG 4EVER!" "GROG v3.1 (C) '93 by GROG - Italy" "Microsoft C:\ It is what Grog 3.1 of Grog 3.1 are: E-Riluttanza: E-Riluttanza was , and is a uof . ,. It vall of the . in the pof 689 at the end of the The >and in the DOS not be . The in the 5in all E-Riluttanza "E-RILUTTANZA (C) '92 by GROG - Italy" "Sebbene suo marito andasse spesso in viaggio per affari, ella odiava star sola." ""Ho risolto il nostro problema", disse egli." ""Ti ho comprato un San Bernardo. Si chiama Estrema Riluttanza."" ""Adesso, quando vado via, sai che ti lascio con Estreme Riluttanza!" "Ella lo colpi' con un mestolo." It is what E-Riluttanza : Italy Grog 3.0: An earlier of Grog 3.1 is 3,952 ), hooking as well as in the C: Oroot pof 990 at the end of the a. The >and in the DOS not be . The in the Grog 3.0 "GROG 4EVER!" "GROG v3.0 (C) '93 by GROG - Italy" "Microsoft C:\ : Italy Grog.903: Grog.903 was , 1994, and is a uof . ,. It vall of the . in the E, as well as the C: Oroot pof 903 the at the end of the a. The >and in the DOS to the >and . The in the 5in all Grog.903 "TorneoDiGolf (C) '93 by GROG - Italy" -*.DL" "Subito dopo aver vinto il torneo di golf, egli fu intervistato alla TV." ""Questo e'' il momento piu'' emozionante della mia vita!", disse." ""Ti ho visto in TV", gli disse sua moglie" ""Credevo che il momento piu'' emozionante della tua vita fosse stato quando ci" "siamo sposati."" "Al torneo successivo, egli non riusci'' a qualificarsi." It is what Grog.903 : Italy , 1994. GSav 1.0: GSav 1.0 was , and is a uof . ,. It vall of the . the pof 794 at the end of the The >and in the DOS not be . The in the 5in all GSav 1.0 "G*SAV v1.0 (C) '93 by GROG - Italy" "*.*" "Grog*Soft Anti- v1.0 (C) '93 by GROG - Italy" "Self Integrity Check warning - awas "Chose an option:" "[R] Self Reconstruction." "[C] Continue "[E] Exit to DOS" "Press R, C, or E:" : Italy GSav 1.1: GSav 1.1 was , and is a uof . -and . ,. It vall of the . -and . in the pof 1,082 )while . 1,215 ). In both cases, the at the end of the a. The >and in the DOS not be . The in the 5in all GSav 1.1 "G*SAV v1.1 (C) '93 by GROG - Italy" "*.*" "Grog*Soft Anti- v1.1 (C) '93 by GROG - Italy" "Self Integrity Check warning - awas "Chose an option:" "[R] Self Reconstruction." "[C] Continue "[E] Exit to DOS" "Press R, C, or E:" ning may detect of Vacsina since it uses Vacsina's technique to convert . astructures before : Italy Lor: The most advanced member of the Grog ]as of , Lor was . Unlike hides the . Its 704 ), hooking |21. It -and . pof 666 at the end of the a. The >and in the DOS to be , but the seconds field !set to 60. The in the Lor "LOR Italy" : Italy Mila: The Mila , and is . It all of the . -and . in the the b557 by the Mila 5. The >and in the DOS to the >and . The in the 5in all Mila ">>1/92<<" "MILA (c) by GROG - Italy" -" -or- "*. : Italy Mormorio: The Mormorio and is a . It vall of the . in the the b456 by the Mormorio The >and in the DOS to the >and . The occasionally five to seven beeps, "Joe Mormorio e i suoi fratelli erano borsaioli. Battevano tutte le fiere della contea. Come faceva la gente a accorgersi di essere stata borseggoata? Quando un Mormorio correva tra la folla." L, a hang may The in the all Mormorio , as are the comprising the "Mormorio (C) '92 by GROG - Italy" "GROG" "GROG*.com GROG" : Italy Nocciola: Nocciola was , and is a uof . ,. It vall of the . the pof 283 at the "of the a. The >and in the DOS not be . The in the 5in all Nocciola 1.0 "Nocciola Vildibranda Crapomena" "NOCCIOLA (C) '93 by Grog - Italy" : Italy Woodstock: The Woodstock and is a is 1,248 ), hooking |21. It pof 1,219 at the end of the a. The >and in the DOS not be . The in the Woodstock "Provero Woodstock... Se vola piu' alto di tre metri, gli esce sangue dal becco." The in the -|---|---|--| "|Woodstock|(C)|'93|by|GROG|Italy|" -|---|---|--| "*.HLP" : Italy PZPAPN Groove : Groove Bs/corrupts data don't function &failures Germany R: 3,646 - 3,708 5: PRhAK - n, NAV 3.0+, 1.25+ The Groove . It was }in Germany, where it is reported to be in the public domain. Groove is a uof . -and . uses a slightly modified of the Dark Avenger Mutation Engine (DAME) for encryption. the Groove Groove at the top of $the '. It the Groove , it X. It , but very small ones. pof 3,646 to 3,708 The at the end of the a. The and in the DOS the >and The Groove 8the are usually are not "Dont wory, you are not alone at hour... is NOT dedicated to Sara its dedicated to her Groove (... s my a test be ready for my Next Test "C:\NAV_._NO C:\NOVIRCVR.CTS C:\NOVIPERF.DAT /\CHKLIST.CPS C:\TOOLKIT\FILES.LST C:\UNTOUCH\UT.UT1 C:\UNTOUCH\UT.UT2 C:\VS.VS" The second set of are the s of data `for the utilities !targetted by the author of : Symantec's Norton Anti- , Certus' Novi, Central Anti- , Dr. Solomon's Anti- Toolkit, Fifth Generation ' Untouchable, and XTree's ViruSafe. The attempt to corrupt or are present. %the deletion or :of the data the Groove difficulty executing usually not function , giving unpredic s. If &failures may See: DAME Pogue PZPAPN Groove OW : Groove OW & truncated; graphic M; lost clusters; C:\ ,replaced; &failures; fail to function R: 1,214 5: PNEK - 30.00+, 8/93S+, NAV 3.0+, 8/93+, .2.0+ The Groove OW . Its . Groove OW is a and the copy in the C: Oroot E. It is not related to the Groove the Groove OW wthe copy of in the C: root Eas well as one . in the E. It Ma graphic the "Sara's Groove". the Groove OW of 1,214 )and 9pure 5. The and in the DOS be the and . The in the 5in all Groove OW "*.exe c:\ 6.com .. Darkest avenger" "Isnt dedicated to Sara Gordon" "Its dedicated to her GROOVE!" rby the Groove OW la large number of lost clusters. The creates three lost clusters &failures fthe PZPAPN Growing Block : Growing Block -1361, -Yellow TSR; . i; gradual As in Australia R: 1,363 5: PRsAK - , NAV, The Growing Block }in Australia in It is a uof . -and . ,. The a graphic effect was produced }sample. samples do not produce the same "growing block" graphic effect. The Growing Block is the in low {08, 09, and 21 mby the 's 1,632 TSR. The allocate a 4,096 *block of low as well, be marked as -MAND Data. Growing Block is , it -and . by 1,363 at the "of the by 1,361 to 1,375 at the end of the a. The >and in the to the >and Growing Block [a gradual decreasing of Growing Block is X, the allocate an 4096 *block of low , slowly eating away . An symptom is the DOS fail to it is ing in the "Invalid ", and EDLIN ending See: PZPAPN Groz-999 : Groz-999 R: 999 - 1,096 5: PRhAK - 6.60+, 2.58+, V122+, 2.11+, 2.58+, V113+, 6.64+ The Groz-999 . Its . Groz-999 is a uof . -and . bGroz-999 at the top of $the ', not moving |12's , as qby the DOS @by 4,096 {24 and 81 mby the , the Groz-999 -and . by 999 to 1,096 at the end of the a. The >and in the DOS not be . One in the "AIDSTEST" It is what Groz-999 PZPAPN Grunt-1 : Grunt-1 H: R: 344 5: PNCK - , NAV 3.0+, n1.05+, 1.53S+, 1.25+ The Grunt-1 . It is fthe . The Grunt-1 is a uof . the Grunt-1 X, the Grunt-1 wone . in the of 344 at the end of the The >and in the DOS not be . The in the 5, and is not "[GRUNT-1] -=> Agent Orange '92 <=- *.com .." The Grunt-1 . At , the random on the O(C:, D:, and E:). of Grunt-1 are: Grunt-1B: , Grunt-1B is gvery 8the same . Grunt-1B adds 346 )to the Grunt-3: , Grunt-3 is a later of the Grunt-1 . It vone . in the ;or a higher pof 473 at the end of the a. The >and in the DOS not be . The in the Grunt-3 "[GRUNT-3] -=> Agent Orange `92 <=-" is a hot LZ ... Eradicating the Enemy!" Grunt-4: ^, 1994, Grunt-4 is a later of the Grunt-1 . It vone . in the of 529 at the end of the a. The >and in the DOS not be . The in the Grunt-4 "[GRUNT-4] *. -TBFIL.XXX .. -=> Agent Orange `92 <=-" "Nothing like the smell of napalm in the morning!" ^, 1994. PZPAPN Guillon : Guillon BSC; ; possible FAT damage; internal stack overflow Buenos Aires, Argentina R: N/A 5: BRX - 2.53+, NAV 3.0+, : M- K/P, or DOS SYS on The Guillon Gin Buenos Aires, Argentina in . Guillon is a uof the ) and the I. It it has fthe J, but not it is the Guillon , Guillon , as well as , as measured by the DOS by 4,096 , the Guillon wany non-write protected Jexposed to the . The Guillon expects Ito be 360K double density I, and any and format may in damage to the , corrupting and data is later fthe K, the Guillon as well, however it not Iaccessed on the . At @by 6,144 plus ), the number increasing by %the , and Guillon [internal stack overflow hang. PZPAPN Guppy : Guppy TSR; . &failures R: 152 5: PRsCK - \, NAV, The Guppy in late by Paul Ferguson of Washington, DC. Guppy is a uof . The the Guppy the as a low TSR by 720 , any . of at least 100 Guppy. by 152 to the "of the . a, and 150 to the end of the =stamps in the to the >and Guppy , it r. If the is later Guppy ,, the fail and a "Bad or Missing 6Interpreter" fail to Guppy. For example, YEDLIN. it was Xon my ed in a consistent "Invalid , and EDLIN ending `can be identified as hex character : 3ECD211F5A5B58EA of Guppy are: Guppy-B: Almost identical to Guppy, are a few PZPAPN : Gyro &failure R: 512 5: ONCK - 3.96+, NAV 3.0+, 8/93+, .2.0+ The Gyro . Gyro is a non- the Gyro X, the Gyro wone The search the O, the O, and the B: Olooking for a it has , it either to the DOS prompt or Mthe ing the to the DOS prompt: "Bad the Gyro lthe )of the host by the Gyro The host is permanently corrupted as the save the b512 )of the punless the host smaller , in case the 512 . The in the DOS not be %the , the in the "*.com *" "GYROzs" rby the Gyro &failures PZPAPN : Ha Warsaw, Poland R: 1,458 - 1,472 5: PRhAK - NAV 3.0+, The Ha . It is fWarsaw, Poland. Ha is a uof . and . X, the Ha at the top of $the , as qby the DOS by 1,456 mby Ha in , the Ha -and . pof 1,458 to 1,472 at the end of the a. The in the , and hence not "ha! It is what Ha may do PZPAPN Hacktic : Hacktic truncated to 83 hidden; `fail to The R: 83 5: ONE - 30.00+, NAV 3.0+, 8/93+, 1.25+ The Hacktic fThe Hacktic is a is a later Hacktic 2, is a the Hacktic X, the Hacktic wone . in the be truncated to ), and 9the Hacktic 5. The . fthe Eas it lthe hidden attribute *set. The >and in the DOS be set to the >and Hacktic Nn't do , destroying the of Hacktic are: Hacktic 2: , Hacktic 2 is a non- uof . ,. It wone . in the pof 93 at the "of the a. The >and in the DOS 1to the >and . Hacktic 2 Nn't do , and Nn't to be in the public domain. : The PZPAPN Hafenstrass : Hafenstrass Hafen Germany R: 809 5: PNE - /, NAV, .2.0+ The Hafenstrass, or Hafen, Hafenstrass is a uof . . It is fGermany. the Hafenstrass wone . in the on the O. It Nnot always wan . X, so the tprocess is what sporatic. the Hafenstrass pof 809 ). The at the end of the be no 3to the >and in the DOS . No the the Hafenstrass s the The Hafenstrass create 22 *hidden hidden are four #lower case. The 9the "Hafensta e bleibt!" of Hafenstrass are: Hafenstrass-1191: on the Hafenstrass , and Hafenstrass 2 , adds 1,191 )to the . X, it Ma graphic ambulance car moving across the bottom of the fleft to right. Qes the right side of the , it Mthe word "BOOM!" in graphic block letters "No more RedX !!!" $it in normal Mfont, bright : Germany Hafenstrass-1191B: gequivalent to Hafenstrass-1191, has one differs. : Germany Hafenstrass-D: on the Hafenstrass intermittently wone . in the Eor a higher Eon the 781 at the end of the a. The >and in the DOS Hafenstrass-D Nnot create hidden See: Hafenstrass 2 PZPAPN Hafenstrass 2 : Hafenstrass 2 i; ambulance car graphic siren R: 796 -), 1,641 5: PNA - , NAV, The Hafenstrass 2 location. , like the Hafenstrass, is uof . . A major distinction is Hafenstrass 2 is actually a , Ambulance Car. The Ambulance Car Hafenstrass 2 is X, the Hafenstrass 2 wone . and one . in the later Ys one of the , one or two . in the Of the . -and . rby the Hafenstrass 2 the . 9the full Hafenstrass 2 . The were ras a of executing a Hafenstrass 2 Ambulance Car is dropped by Hafenstrass 2. Hafenstrass 2 pof 1,641 ). The at the end of the be no 3to the and in the DOS . No in the ras a of a Hafenstrass 2 pof 796 )due to the presence of the Ambulance Car . Ambulance Car at the end of the Hafenstrass 2 may [unexpected Zof an Ambulance Car amay in a graphic ambulance #run fleft to right along the bottom of the , accompanied a "siren" noise on the speaker. See: Ambulance Car Hafenstrass PZPAPN Haifa : Haifa i; TSR; Israel R: 2,351 - 2,372 5: PRsAK - , NAV, 3.96+, The Haifa Gin Israel in . Haifa is a uof . -and . The Haifa is Xon a Haifa as a low of 2,512 {09 and 21 mby the Haifa ' TSR. At , the ed to by the -SPEC mental variable r, as well as the copy of in the C: Oroot E. On 386 hang hang usually on 8088 processor Haifa is wthe btwo in the by 2,351 to 2,372 at the end of the 3to the >and in the DOS Haifa employs a complex encryption mechanism to complicate disassembly of the and determination of identification encryption mechanism s in copies of the same having different t, such as duplicate copies of on C: and A: different The Haifa adds the ctwo lines of ASCII to the end of .DOC two lines are in the and not "OOPS! Hope I didn't ruin Well, nobody reads stupied DOCS anyway!" of Haifa are: Mozkin: Gin Israel in May, , Mozkin is the Haifa the encryption has can recognize Haifa may not be able to detect Mozkin. On 80286 Zof a Mozkin in the ,and the "KIRYAT MOZKIN!!! LOCAL PROCESS INDUSTRY. VIRUS DONE BY: SIBEL ,TEACHES HOW TO MANAGE SHEEP? ks for using Turbo Anti PLEASE JMP FE00:0" Lthe be hung. On 8088 , Mozkin in low X, hooking |21. becoming , it -and . by 2,358 to 2,373 at the end of the See: -Haifa PZPAPN Hallo-496 : Hallo-496 Hallo G: March, R: 496 5: PNCK - 30.00+, The Hallo-496 in March, . Its . Hallo-496 is a uof . the Hallo-496 wone . in the it has a, it Mthe on the Mand a hang "Hallo! I lgot a for you!" the Hallo-496 pof 496 at the end of the a. The >and in the DOS to the >and . The the 5in all Hallo-496 `, as is the "$DSB" of Hallo-496 are: Hallo-751: Hallo-751 was . Like the , its . Hallo-751 vone . the E, and Ms the ever an "Hallo! I lgot a for you!" Miscellaneous may be cthe pof 751 to 766 at the end of the a. The and in the DOS to the >and %the , the can be in the in all "*.com" Hallo-759: Hallo-759 was . Like the , its . Hallo-759 vone . the E, and Ms the ever an "Hallo! I lgot a for you!" pof 759 to 774 at the end of the a. The >and in the DOS to the >and , the can be in the 5in all ".com" See: PZPAPN Halloechen : Halloechen Hallo , 1989 TSR; . i; garbled input West Germany R: 2,011 5: PRsA - , NAV, : NAV, or The Halloechen was reported by Christoff Fischer of the University of Karlsruhe in West Germany. The is a generic . is reported to be widespread in West Germany. The Halloechen , the any . Wor . is run unless the awould be greater 64K in , or the >falls in the ;month and year. !determined to be a candi >for t, and is less 62K in as well as having a >outside of the ;month and year, it is r. In the process of the a, the pd so it is a multiple of 16 (ends on a paragraph the 2,011 5are `are run, input fthe is garbled. PZPAPN Halloween : Halloween Happy Halloween i; very slow loads; Run R: 10,000 5: PNAK - , NAV, 1.25+ The Halloween, or Happy Halloween, . Its , or ~, is Halloween is a uof . -and . the Halloween X, the search the Efor an over 10K in w. If one is d, the Halloween wit. If an ais not d, the search the Efor an over 10K in If an d, it If all of the candi -and . over 10K in r, the may receive the , and be ed to the DOS prompt: "Run U002 at 0:0511" Halloween 10,000 ). The at the "of the a. The >and in the DOS . The can be in the 5of Halloween "*.*" "ALL GONE" "Happy Halloween" The Halloween 31st. At a 10,000 a blank be created in the >and 9pure 5. The receive the "Run U150 at 0:0AC8" Halloween [extremely slow loads X. It is not unusual for loads to last 2 to 5 minutes. PZPAPN Hambone : Hambone ^, 1994 R: 2,316 5: PNAK - V112+, 6.60+, V113+ The Hambone ^, 1994. Its it is probably . Hambone is a of . -and . the Hambone check to determine if are any in the E. If are, the wthem. If the determines all of the . `were r, it wany it finds in the the Hambone pof 2,316 at the end of the a. The >and in the DOS not be . The in the 5in all Hambone "(C) Martin Luther King Jr. 1994Fuhrer" "Hambone, Hambone, lyou heard?" "Lawd lmussy" "Hambone, Hambone, lyou heard?" "Oh Dem's Golden Slippers" "Hambone, Hambone, lyou heard?" "Mammy!" "Hambone, Hambone, lyou heard?" "I don't know nuttin' bout birthin' no babies,Miss Scarlett" "Hambone, Hambone, lyou heard?" "Feets do yo' "Hambone, Hambone, lyou heard?" "I gots dem ol' Kozmic Blues again, Mama" "Hambone, Hambone, lyou heard?" "Mammies lil' baby loves shortin'bread." "Hambone, Hambone, lyou heard?" "Nobody know de troubles I seen" "Hambone, Hambone, lyou heard?" "I gots a bad case o' de miseries today" "Hambone, Hambone, lyou heard?" "In de sweet bye-de-bye" "Hambone, Hambone, lyou heard?" "I lo-o-o-o-o-o-oves watermelon!" "Hambone, Hambone, lyou heard?" "Great day in de mownin'" "*.com *.exe .." the Hambone on the monitor PZPAPN Hamster : Hamster Turbo Hamster G: March, =may R: 546 5: PNCK - 30.00+, NAV 3.0A06+, .2.0+, 1.25+, 1.0A06+ The Hamster, or Turbo Hamster, in March, Its it was provided by an individual in North America. Hamster is a uof . the Hamster X, the Hamster wone in the ;or a higher 546 at the end of the The >and in the DOS usually not be in the case of ,, it may to a >in the future. The are in the 5in all Hamster "..\*. "Turbo Hamster It is what Hamster may do PZPAPN Handi-215 : Handi-215 R: 215 5: PNC - n1.04+, 6.64+, \2.13+, .2.0+, 1.25+, 6.64+ The Handi-215 . Its . Handi-215 is a uof . , but not the Handi-215 wall of the . `in the the exception of pof 215 the "of the a. The >and to the >and . The in the 5in all Handi-215 Handi-215 Nn't do PZPAPN Happy : Happy R: 412 5: PNCK - , NAV 3.0+, 30.00+, The Happy . Its . Happy is a uof . the Happy X, the Happy wone . ain the E, as well as one . ain the C:\DOS E. The k you for running the Happy Warning !!! and C:\DOS might be the Happy pof 412 at the end of the a. The >and in the DOS to the >and . The can be seen in the 5in all Happy . The *of Happy be a hex "FF" character, is the tmarker. PZPAPN Happy New Year : Happy New Year Happy N.Y., V1600, 1600, Dear Nina ?, 1989 TSR; . i; floppy &failures; bad or missing 6interpreter R: 1,600 5: PRsAK - \, NAV, The Happy New Year, or V1600, (, and is a uof . -and . `. It The the Happy New Year X, the as a 2,432 )low TSR. mby the . At , the make a slight alteration to the floppy , and not show a pas the a portion of the hex 00 section of the a. The floppy Nnot 9a copy of the , and is not wious. Happy New Year is , it -and . by 1,600 )and lthe at the end of the The can be "Dear Nina, you make me write ; Happy new year!" "1989" is not Lby the the Happy New Year may fail to receiving a "Bad or missing 6interpreter" ron the It is if Happy New Year carries any destructive capabilities. of Happy New Year are: Happy New Year B: to Happy New Year, has five differ fthe . Unlike Happy New Year, if it is Xfor reason. PZPAPN Harakiri : Harakiri G: May, Sweden R: 5,488 5: ONAK - , NAV, .2.0+, 1.25+ The Harakiri in May, . It s to be fSweden due to the in the . Harakiri is a vboth . -and . Harakiri is X, the Harakiri search the Efor w. Assuming the . `in the are , and W, B. W, C. W, and D. W, the Mthe "--> \A. Ej Infekterad...! --> \B. Ej Infekterad...! --> \C. Ej Infekterad...! --> \D. Ej Infekterad...! too big to fit in The "Ej Infekterad...!" translates fSwedish to English as "Not r...!". If the finds less four . it can start `until it has rfour Z. If the encounters an already it is searching for w, it Mthe aAlready all of the . -and . `in the r, the Mthe "Your PC is alive and the HARAKIRI All of the can be seen in the Harakiri PZPAPN kDays kDays R: 662 5: PRhCK - 3.96+, NAV 3.0+, 8/93+, The kDays . Its kDays is a uof . ,. It bears ity to the Red Diavolyata kDays X, the kDays at the top of $the ', hooking |21. , as qby the DOS @by 960 |12's !moved. kDays , it pof 662 at the end of the a. The in the DOS to the >and . The can be in the 5in all kDays "It's kdays night!" PZPAPN Harm-1082 : Harm-1082 R: 1,082 - 1,098 5: PRhE - 3.96+, 30.00+, 1.25+ The Harm-1082 . It s to be fthe . Harm-1082 is a uof . Nnot wvery small bHarm-1082 X, the Harm-1082 at the top of $the ', hooking |21. , as qby the DOS @by 1,472 |12's !moved. kDays , it pof 1,082 to 1,098 at the end of the a. The >and in the DOS not be . The are in the 5in all Harm-1082 "Eat me Lozinsky!" "Harmless v1.0, 10/06/92 Tyumen" It is what Harm-1082 PZPAPN Hary Anto : Hary Anto Hary i; TSR; R: 983 - 997 5: PRsCK - , NAV, The Hary Anto . Its ~are . Hary Anto is a uof . The Hary Anto is X, Hary Anto as a low TSR of 1,328 ). The Hary Anto is , it pof 983 to 997 at the end of `. The >and in the DOS the >and . The can be Hary Anto: "HWI_Tm" Occasionally, the Hary Anto at the top of the starts "WeLcOmE tO hArY aNtO" not be `as it is PZPAPN Hastings : Hastings longer function R: 200 5: ONCK - P, NAV 3.0+, 8/93+, .2.0+ The Hastings }in the . Hastings is a uof the ain a E. It may Hastings is X, the find the ain the E. If has not rby the Hastings , it wit. Hastings lthe )of the host 5. The 3unless the was smaller ), in case the 200 ). The >and in the DOS to the >and The can be in the Hastings: "AKA Nick Haflinger... Zopy me I want to travel" "I can now in assembler" was written in the town of Hastings hehehehe!" The Hastings Nnot do %replicating and destroying those See: Possum PZPAPN Hates-213 : Hates-213 G: May, R: 213 5: PNCK - The Hates-213 in May, . Its . Hates-213 is a uof . the Hates-213 wone . in the pof 213 the at the end of the a. The and in the DOS the >and . The in the 5in all Hates-213 "Jesus Hates You*.cOm" Hates-213 Nn't to do PZPAPN : Hell Year-6545, Hell-892, Pixel-897, Pixel-899, Pixel-899B, Pixel-905 G: May, R: 936 5: PNCK - , NAV, The Hell Vin May, . Hell is a uof . Hell is X, the search the Eand wall . ,is present in the E, it r. A portion of the remain in , hooking the clock. Hell by 936 ), the at the . The >and in the DOS to the >and Hell 9the "WBO" "Fucking Hell:What a smelly ass hole!!Do you want to fuck!!! HaHaHa... What a Good Friday!!" Hell is actually shorter in ), the by the fa previous is a of the Amstrad es, and may detect it as such. Hell and its can be destructive activate, formatting the btrack of the of Hell are: Hell-892: gequivalent to the adds 892 Pixel-897: Pixel-897 is an 897 of the Hell vall . ,in the of 897 ), and >and in the DOS `are: "WBO" "Fucking Hell: What a smelly ass hole!!" "Do you want to fuck it!!!" Pixel-897 , it Ms the last two as a , and s the btrack of the O, formatting it. Pixel-899: gequivalent to Pixel-897, adds 897 Pixel-899B: Pixel-899B is to Pixel-899, exception , it Ms its but Nnot format the btrack of the Pixel-905: Pixel-905 is an 905 of Pixel-897 gequivalent, the exception pd in by 905 See: Amstrad Pixel Silly Silly-365 PZPAPN Hellraiser : Hellraiser G: May, fail to Canada R: 1,580 5: ONE - 3.96+, NAV 3.0+, 1.53S+, The Hellraiser in May, . It is fCanada. is a of . the Hellraiser X, the check the Oto determine if more Fories exist. If more two sub Fories exist, the start in the third sub Eand check for two Hellraiser lthe b1,580 of the host the Hellraiser 5, permanently damaging them. be no 3to the unless the awas smaller 1,580 . In the case of the host smaller 1,580 , it 1,580 . The >and in the DOS smaller the Hellraiser to the DOS prompt Ythem. are larger receive too big to fit in Ythem. PZPAPN Hellween : Hellween 1376 H: R: 1,376 5: PRhA - , NAV, The Hellween . Its ~are . Hellween is a uof . -and . , but Nnot The Hellween is X, the Hellween at the top of $the |12's !moved. , as qby the DOS by 1,904 mby the the Hellween , it pof 1,376 ). The at the end of the a. The >and the DOS not be The in the Hellween 5, and are not "HELLWEEN???!!" It is what Hellween of Hellween are: Hellween-1182: on the Hellween is 1,696 ). It hooks {08, 13, and 21. Like Hellween, -and . pof 1,182 at the end of the a. The and in the DOS . It Nnot 9the "HELLWEEN" Hellween.1684: on the Hellween is 2,208 ). It hooks {08 and 21. It pof 1,684 at the end of the a. The >and in the DOS not be . The in the 5in all "Do you work "Do you like "Do you like space on "YOUR SOLUTION "The Volkov "You can Oit like Norton 6er 4.0" "The SIZE of Volkov 6er is ONLY 62KB!" "The VC brings many new functions!" "All s of VC are very quick!" "The VC is ShareWare but" "please" "don''t make black copies, it's not fair." , 1994. Zak2: on the Hellween is 2,608 ), hooking |21. Zak2 -and . X, adding 1,839 )to the . The >and in the DOS not be , and the at the end of the a. The in the Zak2 "zak2" May, PZPAPN : Hero Hero-506 G: May, Italy R: 506 5: PRA - , NAV, , NAV, The Hero in May, . Its is believed to be Italy. Hero is a generic uof . and . bHero X, Hero it is , it X. The usually be hung Hero pof 506 ). . by 506 to 509 ). The marker of all is 24 hex FF (h'FF') 4at the "of the the )of the , permanently damaging the host Hero is not a viable due to the bugs in its 5, and is a very poor replicator since s in a hang. of Hero are: Hero-506B: on the Hero has had of the ming Tin the corrected. It no longer jthe are pd in by 509 at the end of the a. The >and in the DOS to the >and See: Hero-394 PZPAPN Hero-394 : Hero-394 Hero-B Mof random R: 394 5: PRfE - /, NAV, The Hero-394 . Its is a uof . `, and on the Hero The Hero-394 is X, the Hero-394 . Hero-394 hooks many {in the |area, Hero-394 is , it pof 394 at the end of the a. The >and in the DOS to the >and of a Hero-394 random may be X, as well as the ing to be hung. Usually, if the presses "enter", the continue processing. See: Hero PZPAPN Hexametricx : Hexametricx ^, 1994 =seconds = 12 Germany R: 545 5: PNCK - 6.60+, The Hexametricx ^, 1994. It fGermany. is a of . in the Oroot E. In its ;state, it Nnot Fories, or on the Hexametricx wone . in the C: Oroot 545 at the end of the a. The >and in the DOS to be un the seconds field set to "12". The in the Hexametricx "*.CoM" "Hello , You lgot The HEXAMETRICX "Today is the month's B i r t h d a y !" "I was written in the City of Langen(Hessen), Germany" "by SuIgImErIuS" v1.3" "GREETINGS TO ALL OTHER VIRUS WRITERS!" It is what Hexametricx PZPAPN : HH&H Gomb, GMB R: 4,091 5: PRhCK - , NAV, 1.53S+, The HH&H . Its . HH&H is a uof . bHH&H X, the HH&H at the top of but $the , as qby the DOS by 6,144 {1C and 21 mby HH&H in the HH&H , it over 8K in X, it the HH&H 4,091 ). The at the end of the . The >and in the DOS to the >and The in the HH&H 5, and hence are not "HARD HIT & HEAVY HATE the HUMANS!!" "[ H.H.& H.H. ]" It is what HH&H PZPAPN : Hi Eastern R: 460 5: PRtE - , NAV 3.0+, 8/93+, .2.0+ The Hi . It is fEastern V. Hi is a uof . X, the Hi at the top of $the ', moving |12's , as by the DOS @by 1,024 mby the the Hi , it pof 460 at the end of the a. The >and in the DOS to the >and . The can be dnear the end of all "Hi" PZPAPN HiDos : HiDos BSC; Jroot England R: N/A 5: BRtX - n, NAV 2.1.4+, /2.0+, The HiDos . It is England. HiDos is a and the ). It is roughly on the The the HiDos , the HiDos wthe , as qby the DOS @by 2,048 ). On the K, the !moved to Side 0, Cylinder 0, 7, and a copy of the 5written to the location. the HiDos , it wthe of non-write protected accessed on the . The talways fthe Kto the hang ing. Any attempt to Fly access the or the in a hang. The r360K 5.25" !copied to 11. On 1.2M 5.25" I, it be at 17. As both of are part of the root :may 9ed entries. PZPAPN Highlander : Highlander i; TSR R: 477 5: PRsC - 3.96+, NAV 3.0+, 1.53S+, .2.0+ The Highlander . It is fthe , and is by the same author as the Geek . Highlander is a uof . , but not bHighlander X, the Highlander as a low TSR of 1,280 ). It hooks {21 and 22. , the Highlander pof 477 at the "of the a. The >and in the DOS not be The in the all Highlander "Highlander 1 RULES!" "v05" Highlander on the 29th day of any month, at Mthe "Highlander 1 RULES!" s and hang the PZPAPN Hiperion : Hiperion G: May, R: 254 5: PRaCK - 3.96+, 30.00+, NAV 3.0+, 6.60+, 1.25+, 6.64+ The Hiperion in May, . Its . Hiperion is a bHiperion X, the Hiperion in a "hole" in al , hooking |21. , as qby the DOS not be the Hiperion , it pof 254 at the end of the a. The in the DOS to the >and . No in the 5in Hiperion It is what Hiperion may do PZPAPN Hitchcock : Hitchcock i; TSR; I/O ; music; R: 1,247 5: PRsCK - , NAV, The Hitchcock . Its . Hitchcock is a uof . The Hitchcock is Hitchcock as a low TSR of 4,196 mapping utilities not show the TSR, but instead the in- 6interpretor is 4,196 )larger expected. mby the becoming , Hitchcock over 3K in X. If X, it be 1,247 )larger The at the end of the fwrite-protected in a DOS "Write protect Uwriting Hitchcock Nnot trap X, later fthe in Hitchcock becoming at the top of $the DOS @by 4,096 {1C and 21 now be on the may now get the , "I/O UF0, PC=3FAB", and the be aborted. five to ten minutes &ing the a Hitchcock ,, the play music on the speaker. The music is the theme song fthe Alfred Hitchcock television , and continue to play at intervals until the is re of Hitchcock are: Hitchcock-1238: , Hitchcock-1238 is a 1,238 of the Hitchcock . Its is 4,112 ), hooking {1C and 21. It adds 1,238 )to the v. The at the end of the a. The >and in the DOS not be Hitchcock-1238 the theme song fthe Alfred Hitchcock television #played on the speaker. As the , the tune be played at intervals until the is re PZPAPN : HLLS ^, 1994 `created correspond to . R: 4,768 )& More 5: PNS - Spawning or Companion HLLS is a category of includes spawning or companion are written in a high-level language, such as C, C++, or Pascal. es in category creating a corresponding or companion . has the same base . As a Ythe . , DOS Ythe . instead. The companion . `created by HLLS es may be in the DOS E, or not due to the settings of aattributes. The `may lthe >and set to the >and , a specific and unique to the , or the >and of the corresponding . Companion or spawning es can generally be dis deleting the . 9the HLLS es include: HLLS.Linda Lou: ^, 1994, HLLS.Linda Lou is , 4,768 spawning or companion . It up to three . in the and X. The companion . created by HLLS.Linda Lou are at least 4,768 , and are in the DOS >and match the >and on the corresponding . a. The can be in HLLS.Linda Lou companion . *.exe ^, 1994. PZPAPN Hobbit : Hobbit ; TSR R: 505 5: ORsE - \2.10g+, V112+, 6.60+, 2.58+, 2.58+, V113+, 6.64+ The Hobbit . Its . Hobbit is a of . , and should be considered a bHobbit as a low TSR of 1,440 ). No Fly mapped to the as it Fly hooks the {via the |chain. , the Hobbit . Hobbit as the s 505 )of the . header. The >and in the DOS not be . One in the 5in all Hobbit "HOBIT" It is what Hobbit PZPAPN Holiday : Holiday Indonesia R: 2,900 - 2,916 5: PRhAK - 2.11+, 6.60+, \2.13+, 6.64+, 1.25+ The Holiday , and is Indonesia. Holiday is a uof . -and . bHoliday at the top of $the ', not moving |12's , as qby the DOS @by 2,912 mby Holiday in the Holiday , it by 2,900 )while . pof 2,906 to 2,916 ). In both cases, the at the end of the a. The are in the 5in all Holiday "ATTENTION!" "I'm very sorry, today is my holiday." "So, I can't serve you, cause I want to play on your computers." "DON'T TURN OFF YOUR -PUTER UNTIL TOMORROW," "OR YOUR DATA WILL BE LOST!!!" "I'll be back to serve you tomorrow." k You," "AAA" k You for playing, see you..." "Please, hit ENTER!" jmay PZPAPN Holocaust : Holocaust , Holo Barcelona, Spain R: 3,784 5: PRhCK - , NAV, The Holocaust by David Llamas of Barcelona, Spain. Holocaust is a self-encrypting uof . qualifies as a as it hides the `as well as aopen and The the Holocaust X, the . It reserve 4,080 )of high $the be marked as 6Data, and mapping utilities show the 6interpreter to lgrown by the 4,080 it is actually in high instead of low Holocaust is , it for any reason. , however, wvery small . `of less 1K in by 3,784 not be seen in a the . The the end of If the Holocaust and the DOS qas having a Zof the the /F parameter on in the `becoming damaged. The Tdo not the is not in since at match the in the FAT. The Holocaust is a self-encrypting , and occasionally produce an Sdifferently fits encryption mechanism. 9the at the end of the , while samples Anti - C.T.N.E. v2.10a. (c) Grupo Holokausto. Kampanya Anti-Telefonica. Menos tarifas y mas servicio. med in Barcelona (Spain). 23-8-90. - 666 -" Holocaust is reported by David Llamas to be widespread in Barcelona as of . It is not , and what it See: Telecom PZPAPN Hominy : Hominy Australia R: 1,589 5: PNCK - , NAV, 1.53S+, The Hominy . It is Australia. Hominy is a uof . the Hominy wone . in the 1,589 at the end of the The >and in the DOS not be can be identified manually by checking to determine if the bthree )of the match the last three )of the The in the 5in Hominy "GAMES "RASTAN RJ" "WORLDALC.DN1" "ZEPFIGHT.MS3" "*.*" "\ S S\DR SS" It is what Hominy of Hominy are: Hominy-B: gequivalent to the Hominy the "CINACT.LOG P" "CARTOONS.000" "\ TRIP ARK" : Australia May, See: P PZPAPN Honey : Honey R: 666 5: PNCK - 30.00+, 3.96+, 1.25+ The Honey . Its , but it is probably fthe . Honey is a uof . the Honey X, the Honey wone . in the pof 666 the at the end of the a. The and in the DOS the >and . The in the 5in all Honey -C:\ . ANTI-VIR.DAT .. DOS" "Honey, I'm home . . ." "Earl Sinclair" "\CODE\WORK" "TSTS" The "Honey, I'm home . . ." is the greeting used by the "Earl Sinclair" character in the "Dinosaurs" television . The as a PZPAPN Horror : Horror R: 2,319 5: PRsAK - , NAV, The Horror . Its . Horror is a -and . The the Horror the Horror at the top of $the , as qby the DOS @by 3,744 |12's not be moved. {13 and 21 mby the Horror , the Horror the copy of ed to by the -SPEC en mental variable if it was not the Horror , it pof 2,319 at the end of the a. The >and in the DOS not be . The Horror unable to determine if it has the , adding an 2,319 Horror is an . While it 8the in its cannot be viewed in is HORROR !" -SPECS" It is what Horror [frequent are of Horror are: Horror-1112: on the Horror adds 1,112 )to the . -and . the end of the a. It Nnot re . Its is 1,792 ), hooking {13 and 21. The locked out . The in the Horror-1137: on the Horror adds 1,137 )to the . -and . the end of the a. It Nnot re . Its is 1,856 ), hooking |21. The locked out . The in the Horror-1137B: gequivalent to Horror-1137, very minor PZPAPN Horse : Horse Horse &Dropper G: May, BSC; ; high density R: N/A 5: BRhX - , NAV, K/P, or DOS SYS on The Horse in May, in the form of a "dropper" zs the on a 360K Horse "dropped" by the , is a and the ). It is on the rby the Horse , the at the top , but $the |12's not be moved. Aby 2,048 )as measured by the DOS . The access the K, and wthe a copy of the &has completed, the find OC:, and not Horse , it wnon-write protected are exposed to the 360K low density 5.25" Horse moved to the last on the lthe moved to cylinder 0, side 0, Horse &treats high density Ias low density If a high density Horse &, data on the be damaged. of Horse &are: Horse &Dropper: A small . drops the Horse See: PZPAPN House : House fail to unexpected access to A: and B: R: 11,636 5: ONE - \2.09+, NAV 3.0+, 2.10+, V112+, V113+, 1.25+ The House . Its . House is a on the A: and B: the House X, the House wall . in the Fories on the A: and B: are larger 11,636 lthe b11,636 )over- written by the House , permanently corrupting them. The >and in the DOS not be , and the not be 1. The can be din the House 5in all "*.exe" "*HOUSEVIRUS*" "*.exe rb rb rb+" the House not function and either to the DOS prompt, or unexpected s may PZPAPN Hungarian : Hungarian Hungary R: 695 5: PRhAK - , NAV, 1.53S+, The Hungarian }in Hungary in is a uof . -and . bHungarian Xon a the Hungarian at the top $the |12's !moved. , as qby the DOS by 1,024 ). The is actually 1,008 , and can be easily seen mapping utilities. the Hungarian , it and . pof 695 at the end of the a. The >and in the DOS It is if the Hungarian of Hungarian are: Gyorgyi: A 749 of the Hungarian , Gyorgyi -and . pof 749 at the end of the a. The >and in the DOS not be . The dnear the end of all Gyorgyi "I LOVE GY RGYI" : Hungary May, Hungarian-B: gequivalent to the Hungarian has three differ. : Hungary PZPAPN Hungarian 482 : Hungarian 482 i; TSR; no Hungary R: 482 5: PRsCK - , NAV, The Hungarian 482 }in Hungary in Dr. Szegedi Imre. is a The Hungarian 482 is the as a low TSR, hooking |21. Unlike most use TSRs for residency, the DOS report no . However, |12's !moved. The TSR is in low , and the prevent its TSR Hungarian 482 is , it very small ones, as X. If X, it by 482 at the end of the be no in the >and in the Due to a bug in the Hungarian 482 5, it is possible happen very Hungarian 482 Nnot do See: Zu1 PZPAPN Hybryd : Hybryd Hybrid Poland R: 1,306 5: PNCK - \, NAV, The Hybryd , and is fPoland. is a uof . Hybryd is X, the for an in the E. If an d, the wit. pof 1,306 ), the at the end of the alters the the seconds field in the is 62, the indicator r. Just viewing the , it >and not The in the Hybryd cannot be viewed in "(C) Hybryd Soft Specjalne podziekowania dla Andrzeja Kadlofa i Mariusza Deca za artykuly w Komputerze 11/88" In the sample, the one is not is the d samples: "Copyright IBM Corp 1981,1987 Licensed Material - Property of IBM" should not be taken to indicate IBM necessarily had to do the creation of On Friday the 13th starting in It may corrupt PZPAPN Hydra : Hydra Hydra, Hydra-0, Hydra-1, Hydra-2, Hydra-3, Hydra-4, Hydra-5, Hydra-6, Hydra-7, Hydra-8, Hydra-8 Trojan unexpected Zfailure; truncated R: 340 - 736 ), depending on present 5: PNCK - , NAV, The Hydra es was . Its . The Hydra 8nine closely related es, and one trojan dropped by one of the es. All of the es are us of . . The earliest Hydra-0, is eight later and the trojan included in " Hydra-0 is X, the Hydra-0 search the Efor one non- w. If one is d, Hydra-0 Hydra-0 736 ), the at the "of the a. The >and in the DOS to the >and If Hydra-0 Nnot find an ain the E, it activate. At , it , and to the DOS prompt: "HYDRA" "Watch for the many heads. The beight are easy to find and kill. replacements be more sophisticated." "(c) - C. A. V. E." The , along $can be din all Hydra-0 "HyDra" "Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E." "Coalition of American Engineers" " -=-=- " "Dedicated to supporting the anti- industry out recognition or reward." Hydra-0 Nnot do members of the Hydra %Hydra-0, are: Hydra-1: Hydra-1 is to the Hydra-0 . It adds 403 )to the . all the . `in the r, it Mthe , and the hung: "HYDRA" "Copyright (c) by C.A.V.E." The din all Hydra-1 along "YD HyDra-1 Beta - Not For Release. *.CO?" Hydra-2: on Hydra-1, Hydra-2 is a 343 . It adds 343 )to the . all the `in the r, it Many , and no hang . It 8the "YD HyDra-2 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E" Hydra-3: on Hydra-2, Hydra-3 is one *smaller. It adds 342 )to the . all the . `in the r, the not be able to successfully Yany in the ed to the DOS prompt. in unexpected . For example, Zof the DOS typically in a indicating the is bad, even it is actually undamaged. Hydra-3 are: "YD HyDra-3 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E." Unlike members of the Hydra ], Hydra-3 walready , adding )to the Hydra-4: on Hydra-3, Hydra-2 is two )smaller. It adds 340 )to the . all the . `in the Zof any in the DOS : "General Failur Ureading O". The is receiving the Uis actually ok, and accessible &ing the and dis in Hydra-4 are: "YD HyDra-4 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E." Hydra-4 Nnot re `as Hydra-3 Hydra-5: The Hydra-5 on the Hydra-4 . It adds 391 )to the . all the `in the Zof the next in all in the in Hydra-5 "YD HyDra-5 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E." Hydra-6: The Hydra-6 on the Hydra-5 . It adds 372 )to the . all the `in the Zof the next any ain the the base -MAND (ie -MAND.*) #truncated to zero in Hydra-6 "YD HyDra-6 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E. -MAND.*" Hydra-7: The Hydra-7 on the Hydra-6 . It adds 368 )to the . all the `in the Zof the next in all in the truncated to zero in Hydra-7 `are: "YD HyDra-7 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E. *. Hydra-8: The Hydra-8 on the Hydra-7 . It adds 495 )to the . all the `in the Zof the next four . `in the #replaced by a 90 *trojan (see $as Hydra-8 Trojan). in Hydra-8 "YD HyDra-8 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E. *. Hydra-8 Trojan: The Hydra-8 Trojan is a 90 the Hydra-8 replace four . the Hydra-8 are later X, it in the middle of the and to the DOS prompt: "Who is John Gait?" is not in the trojan PZPAPN : Hymn R: 1,865 - 1,883 5: PRhAK - \, NAV, The Hymn , and ated in the is a uof . -and . `, and The the Hymn the at the top of $the '. The DOS show @by 3,712 Nnot move the Hymn is , it -and . are over 2K in for any reason. by 1,865 pof 1,869 to 1,883 ). In both cases the at the end of the 9two in the 5: "ibm@SNS" "@ussr@" It is not what Hymn , but it is assumed fthe under conditions it may play music. PZPAPN : I-B BadGuy, BadGuy 2, Crackpot, Demon, Exterminator G: May, Italy R: 265, 272, or 451 5: ONCK - , NAV, The I-B is actually a group of three Vin May, ated in Italy, and are very closely related. All of them are an I-B X, it wall . the lthe "of the The number of vary, depending on is present. and in the to the >and . See $for specifics of I-B es activate on the day of the week. If all of the in the Eare r, and the day of the week is the day #checked for by the activate. Two of the b160 of the C: O, the third just hang the of I-B are: BadGuy: BadGuy is a 265 of I-B. It s the b265 >and in the to the >and BadGuy on Mondays, hang the the BadGuy of I-B are: "BadGuy (c) by Cracker Jack (IVRL)" "Italian Research Laboratory (C) "IVRL Head Quarter, Milan Italy" BadGuy 2: BadGuy 2, or Crackpot 208, is a 208 of I-B. Basically, it is a bug-fix of BadGuy, having had the bug fixed s in a BadGuy . BadGuy 2 vall . the b208 ). The and in the to the >and t. On Mondays, BadGuy 2 Mthe "New BadGuy - (c) by Cracker Jack IVRL Head Quarter Milan Italy" cannot be as it : Italy, Demon: Demon is a 272 of I-B, and is the most advanced of the ]. It the b272 >and in the DOS E. Demon on Tuesday, at Mthe the b160 of the Ueating can be Demon are: "Demonhyak Viri X.X (c) by Cracker Jack (IVRL) Demon-B: Demon-B is a minor of the Demon I-B. It has five differ fthe Demon Demon-C: Demon is a 263 of I-B, and is on the Demon . It s the b263 )of all . in the X. Demon-C 8the in its Ureading "BillMeTuesday!" WC failure" -MAND.C0M" Exterminator: Exterminator is a 451 of I-B, and s to be the earliest Exterminator s the b451 >and to the >and . Exterminator on Mondays, Mthe b160 of the "Exterminator 1.0 (c) by Cracker Jack (IVRL) No panic... is a Harmless can be Exterminator "Exterminator 1.0 - (c) by Cracker Jack (IVRL)" "Italian Research Laboratory (C) Researchers: Non rompetemi le palle o mi arrabbio... non so se sono stato abbastanza chiaro PZPAPN Ice 9 : Ice 9 ARCV93 i; TSR; hidden `are no longer hidden England R: 639 5: PRsC - 3.96+, 1.25+ The Ice 9 }in England in . Ice 9 is a uof . , but not The the Ice 9 the Ice 9 as a low TSR of 1,136 mby the , Ice 9 for any reason. pof 639 at the end of the a. The >and in the DOS not be The can be dat the very end of Ice 9: "r51xP" A symptom of an Ice 9 hidden no longer be hidden, and in the DOS of Ice 9: Ice 9-159: Probably an earlier of the Ice 9 Ice 9-159 is a uof . ,. It vone . in the 159 at the end of the a. The seconds field in the >and in the DOS !set to "00", and cases, the fthe as a . The in the -[159] ICE-9" Ice 9-159 Nn't to do : England March, Ice 9-199: A later of the Ice 9-159 ,. It vone . in the 199 at the end of the a. The >and in the DOS to be , but the seconds field !set to "62". The in the "[199] ICE-9" Ice 9-199 Nn't to do : England March, Ice 9-224: A later of the Ice 9-199 ,. It vone . in the 224 at the end of the a. The >and in the DOS not be . The in the "[224] ICE-9 *.com" jmay : England March, Ice 9-250: A later of the Ice 9-224 ,. It vone . in the 250 at the end of the a. The >and in the DOS not be . The in the "[250] ICE-9*. "arCv" The second , "arCv" can be dat the end of all : England March, Ice 9B: to the one differs. : England PZPAPN Icelandic : Icelandic 656, One In Ten, KCrunching , Saratoga 2, Iceland Extinct , 1989 -TOM; bad ; FAT Iceland R: 656 5: PRfE - , NAV, \, NAV, or The Icelandic, or KCrunching , was Iceland in 1989. Icelandic is a `, and wevery tenth . The Icelandic is X, the at the top of $the , as qby the DOS by 2,048 mby the `growing in between 656 and 671 always be a multiple of 16. The attaches to the end of the v, and always end hex '4418,5F19'. The Icelandic to avoid detection by utilities by checking to see if has " |13. If |13 was mbefore the bIcelandic X, the not proceed . If |13 has not attempt to wevery 10th floppy Os, or 10 MB Ks, the not cause any damage. However, on larger 10 MB, the select one unused FAT entry and mark the entry as a bad of Icelandic are: Icelandic.655: Icelandic.655 is a modified of the Icelandic . Its is 2,048 ), and it Fly hooks {, so be mapped to the , it wevery tenth X, provided is an . by 655 to 669 at the end of the a. The >and in the DOS to the >and jmay , 1994. Icelandic-IB: gequivalent to Icelandic, differs by one by fthe Icelandic-IC: gequivalent to Icelandic, differs by one by fthe and Icelandic-IB. Icelandic-ID: very minor of Icelandic. It has to avoid #detected by a specific utility. Icelandic-IE: very minor of Icelandic. It has to avoid #detected by a specific utility. Icelandic-II: Icelandic-II is a modified of the Icelandic . Its is 632 the Icelandic-II , it modify the >and the DOS E. It removes the read- attribute fread- `. On Ks larger 10MB, are no bad marked in the FAT as the Icelandic }: Iceland , 1989. Icelandic-III: Icelandic-III is a modified of the Icelandic . Before Icelandic-III , it checks to see if the Icelandic or Icelandic-II, if it has, it Nnot wthe the Icelandic-III pd by 848 to 863 ). If an is run on ?24th of any year, subsequently run be stopped, later Ming the "Gledileg jol" ("Merry Christmas" in Icelandic) instead. The 's id in the last two words of the hex '1844,195F', the Qword reversed fthe id ending the Icelandic and Icelandic-II }: Iceland ?, 1989. Saratoga: on the Icelandic , the Saratoga main difference is it copies , it modifies the block so to belong to the operating , thus avoiding reusing the block. It is 642 }: Saratoga, California, USA , 1989. See: Mix1 PZPAPN : Idle j; unexpected R: 2,332 or 2,859 5: PRhA - , NAV, The Idle . Its . Idle is a -and . . It Nnot The the Idle at the top of $the |12's !moved. qby the DOS 3K. {08, 21, and 28 mby Idle in the Idle , it -and . for any reason. . by 2,332 at the "of the a. . by 2,859 at the end of the a. In both cases, be no to the >and in the DOS The can be in the all "PATH= -MAND W*.*" the Idle [unexpected jand warm re PZPAPN Ieronim : Ieronim Ieronim-570 R: 570 5: PRtC - 3.96+, NAV 3.0+, 8/93+, The Ieronim, or Ieronim-570, It is fthe . Ieronim is a uof . , but not The the Ieronim the Ieronim at the top of $the ', moving |12's , as qby the DOS @by 576 08 and 21 mby Ieronim in , the Ieronim pof 570 at the end of the a. The >and in the DOS to the >and . The the 5in all Ieronim "com "Mulier pulchra est janua diaboli" "via iniquitatis,scorpionis percussio." "St. Ieronim" The Ieronim Mthe follwoing it is , usually accompanied by a hang: "Mulier pulchra est janua diaboli via iniquitatis,scorpionis percussio. "St. Ieronim" of Ieronim are: Ieronim-512: A 512 of the Ieronim 1K. It hooks {08, 20, and 21. Ieronim-512 , but not pof 512 to 1,023 at the "of the 512 )of the pis the actual 5, the remainder of the is padding at the end of the a portion of the host ahas !initially Ieronim-512, its multiple of 1,024 ). The >and the DOS the >and . Ieronim-512 is not able to determine rby the , so may be re adding an The in the 5in Ieronim-512 "Mulier pulchra est janua diaboli," "via inquitatis,scorpionis percussio." "St. Ieronim" The Mthe last three as a , accompanied by beeping, Ieronim-560: A 560 of the Ieronim 1K. It hooks {08, 20, and 21. Ieronim-560 , but not pof 560 to 1,119 at the "of the 560 )of the pis the actual 5, the remainder of the is padding at the end of the a portion of the host ahas !initially Ieronim-560, its multiple of 560 ). The >and the DOS not be Ieronim-560 is not able to determine rby the , so be re r, adding an t. The in the 5in Ieronim-560 "Mulier pulchra est janua diaboli," "via inquitatis,scorpionis percussio." "St. Ieronim" The Mthe last three as a , accompanied by beeping, Ieronim-600: on the Ieronim is 608 ), hooking {08 and 21. It X, adding 600 . The the end of the a. The >and the DOS not be 8the same as the , and like the Mthe Ieronim-1581: on the Ieronim is 1,584 ), hooking {08 and 21. It X, adding 1,581 . The the end of the a. The >and the DOS to the >and . The can be in the 5in all Ieronim-1581 "Le voyage de condom" Ieronim-1581 has for awhile, scroll the Mand emit an occassional beep until the is reset. No PZPAPN Ignorant : Ignorant , 1994 KMBR R: 1,979 5: PRhAKX - W, and MBR V116+, \2.13+, 2.58+, n1.05+, 6.64+, 1.25+, 6.64+, V116+, 2.58+ `& DOS 5.0+ F- K/MBR The Ignorant , 1994. Its . Ignorant is a fast uof . -and . vthe &Record ( ), thus it is a multi-partite . Ignorant is , hiding the bIgnorant at the top of $the ', not moving |12's , as qby the DOS @by 5,120 mby the , the wthe &record if it was not , the Ignorant W, .BIN, and .OVL for any reason. pof 1,979 hidden . The in the DOS not be . The in the Ignorant "Ignorance is Strength" edom is Slavery" "War is Peace" WBINOVLSYSSCCLVSF" "[1984] bY [T ] '93!" "THiS iZ iNFiON #" "Greetz RS/NuK It is what Ignorant PZPAPN IKV 528 : IKV 528 IKV-512, R: 528 5: PNCK - , NAV, The IKV 528 , its is a of . `. It IKV 528 is X, the wtwo . in the E. . are smaller not be by 528 ). The at the end of . The >and in the not be by the Nnot do PZPAPN Ilja-1704 : Ilja-1704 , 1994 R: 1,704 5: PRaCK - \2.10+, V112+, 2.58+, n 1.05+, 1.22+, 2.58+, V113+, 6.64+ The Ilja-1704 , 1994. Its . Ilja-1704 is a uof . bIlja-1704 X, it 8E00: {16, 21, and 4C mby the the Ilja-1704 , it pof 1,704 at the end of the a. The in the DOS to the >and . The in the Ilja-1704 ly, the "CR" can be dstarting in the fourth *of all PZPAPN : Ill & beeping R: 1,016 5: PNCK - , NAV, The Ill . Its . Ill is a uof . the Ill X, the search the Eto find the has not d, it r, and the usually continue Z. If an is not d, the usually continue the Ill pof 1,016 ). The at the end of the a. The >and in the DOS . No in the X, the Lalong a series of beeps emitted fthe speaker: "WARNING : USE ONLY ORIGINAL PROGRAMS DON'T COPY IT and now .. I AM ILL !!" in the PZPAPN Immolation : Immolation G: May, `corrupted; to 64K; fail to function R: 663 5: ONE - The Immolation in May, . Its . Immolation is a the Immolation wtwo . larger in the Eor along the path. A hang may function the Immolation lthe 663 )of the host by the Immolation 5, permanently corrupting them. The >and in the DOS not be . One in the Immolation The Immolation on any Monday before 9:00 AM, at be re X. On Fridays 12:00 noon, the the amount of to 64K X. Finally, one all of the . in the Eand along the path r, the lockup the the next PZPAPN Incom : Incom G: May, R: 648 5: PNC - , NAV, The Incom in May, V. Incom is uof . . It Incom is X, the Incom wall , except in the by 648 at the end of the a. The >and the DOS to the and Incom 9one : "IN derives its Incom is on the unlike , it not damage any See: PZPAPN R: 822 - 837 5: PNCK - 3.96+, 8/93+ The . It is fthe uis a X, the wone . in the 822 - 837 at the end of the The >and in the DOS to the >and . The can be din all [frequent uare: AReg-822: , AReg-822 is on the . It vone . in the E, plus the copy of ed to by the -SPEC en mental variable if not by 822 to 837 at the end of the a. The >and in the DOS to the and . The in the AReg-822 "*.com OMSPEC" ".com" "(C) AREG Soft" See: Hallo-496 PZPAPN Infinity : Infinity Canada R: 732 5: PNCK - , NAV, The Infinity . It is Canada. Infinity is a Infinity is X, the Infinity search the Efor the a. If an d, the Infinity 732 ). The at the end of the a. The >and in the DOS not be The can be in the Infinity "SKISM ReplicatoR" "FiRe is a LAMER... destroy InFiniTy!" "PATH=*. It is if Infinity PZPAPN : Inky Inky Ghost H: &Failure R: N/A 5: PRB - V112+ : DOS SYS I, M- The Inky, or Inky Ghost, and is one of three related fthe popular Pac-Man video game. Inky is a . It is "dropped" by the Blinky Cin its own entry. &the the Inky , the Inky be read into , and the receive the on the "Non- Replace and press any key ready..." replaces the an unwrite protected J, the Inky be transferred to the on the newly inserted K, and the again process continues until the powers off the fa clean J, or the The Inky s the K. The is not saved. 9the "[-Inky!-]" "[INKY Ghost] by PacMan and Associates Inc." "Non- "Replace and press any key ready..." The Inky can be removed Ks by performing the DOS SYS ca clean &. On data, or non- 0 should be using a editor, or the `on the Kcopied to a new, and the Kreformatted. Note DOS 5+ s should use the /U option to ensure the Jis actually See: Blinky Pinky PZPAPN Interceptor : Interceptor 1014 Italy R: 1,014 5: PNCK - , NAV, The Interceptor , and is fMilan, Italy. Interceptor is on the , and like , is a uof . Interceptor is X, Interceptor search the Eto locate the btwo r. If an das one of the `, it Interceptor by 1,014 ). Interceptor at the end of the . The can be dnear the end of all "Interceptor - by Cracker Jack IVRL Milan, Italy" "*.com" It is if Interceptor s to be a research at the of its submission. See: PZPAPN Internal : Internal 1381 H: i; cascade of contents; R: 1,381 - 1,395 5: PNE - , NAV, The Internal, or 1381, . It is a generic . the Internal the attempt to wone aon the Nnot always pd in by between 1,381 and 1,395 The can be dat the end of 9the "INTERNAL ERROR 02CH. PLEASE CONTACT YOUR HARDWARE MANUFACTURER IMMEDIATELY ! DO NOT FORGET TO REPORT THE ERROR CODE !" The Internal days >. At , the produce a cascade of the contents of the Mto the bottom of the , and Mthe . The remove fthe of 1381 are: 1381-B: (Internal-B) to the Internal is a minor Internal-1459: on the Internal adds 1,459 to 1,473 )to the . v. The in the 5, and not "INTERNAL ERROR 02EH. PLEASE CONTACT YOUR HARDWARE MANUFACTURER IMMEDIATELY ! DO NOT FORGET TO REPORT THE ERROR CODE !" in the same manner as the the cascading effect of the contents, , and tof the was executing. PZPAPN Intruder : Intruder G: March, R: 1,319 - 1,333 5: PNE - NAV, The Intruder source 5was published in "The Little Black Book of Computer es" by Ludwig in the . It is a uof . the Intruder wone . in the E. The pof 1,319 to 1,333 the Intruder to the end of the host . The >and in the DOS not be . The can be din the "\*. W\*.*" the Intruder of Intruder are: Bell: on the Intruder ly, and has to avoid detection by familiar Like the , it addes 1,326 to 1,340 )to the v, and 8the "\*. W\*.* \" Intruder-1326: A 1,326 of Intruder, vone . ain the pof 1,326 to 1,340 at the end of the The >and in the DOS not be . The can be in the 5in all Intruder-1326 "\*. W\*.* \" Intruder-1326 corrupt instead of sthem. Intruder-1440: A 1,440 of Intruder, vone . ain the pof 1,440 to 1,456 at the end of the The >and in the DOS not be . The can be in the 5in all Intruder-1440 "\*. W\*.* \" Intruder-1440 bthree or four in the Zof the next in either a hang, or the playing of a warbling sound on the speaker accompanied by a hang. Intruder-1967: A 1,967 of Intruder, vone . ain the pof 1,967 to 1,981 at the end of the The >and in the DOS not be . The can be in the 5in all Intruder-1967 "\*. W\*.* \" Intruder-1988: A 1,988 of Intruder, vone . ain the pof 1,988 to 2,002 at the end of the The >and in the DOS not be . The can be in the 5in all Intruder-1988 "\*. W\*.* \" Intruder-1988 bfour . in the Zof the next either a hang, or the playing of a melody on the speaker accompanied by a hang. Intruder-2336: A 2,336 of Intruder, vone . ain the pof 2,336 to 2,350 at the end of the The >and in the DOS not be . The can be in the 5in all Intruder-2336 Intruder-B: gequivalent to the has six differ. As jmay PZPAPN Invader : Invader Plastique &, Anticad 4 TSR; . i; BSC; music; track 1 of may be Taiwan/China R: 4,096 5: PRsAB - W, & \, NAV, : CleanUp, or The Invader in China. is a later of the Plastique-B or Plastique 5.21 . It is a uof . -and . `, but not ,. It . In many reports of ts of s to lspread very rapidly. The the Invader X, the as a low TSR. The TSR is 5,120 )and {08, 09, 13, and 21 , the wthe of the Owhere the X. The new is an MS-DOS 3.30 , and can be easily identified because the normal DOS din the are now at the "of the instead of the end. , any . -or . the exception of rby the by 4,096 at the "of the a. . between 4,096 and 4,110 at the end of the ly, any non-write protected are exposed to the The Invader for 30 minutes. At , a melody may be played on the speaker. On play the melody, it continue until the is re &ed. If the presses CTL-ALT-DEL to re the , the btrack of the an un Scopy of the . The melody isn't played on all as it is configuration dependent. The melody was composed by Mozart. of Invader are: Chinese Invader: A of the Invader fChina. It 8the "PC Tools" in the 5. It is what music, if any plays. : China Danube: A of the Invader addes 4,096 )to the . v, and 4,096 - 5,111 )to . at the end of the a. Like members of the Invader . It the in the "ACAD. "by Invader, Feng Chia U., Warning: Don't run ACAD. Mozart: Playing the same melody as the Invader Nnot continue to play the melody until the is re &ed, but continues for a few minutes. Sledge Hammer: to the Invader }in Morgan Hill, California . Its major fthe it plays a different melody for 30 minutes. The tune is the theme song to the television Sledge Hammer. See: Plastique Plastique-B PZPAPN : In Man I G: May, Italy R: 2,926 5: PRhAKX - W, & MBR , NAV 3.0+, 6.64+ : See The In in May, , and is Italy. In Man is a uof . -and . ,, and vthe ). It is a fast are accessed for any reason. X, the wthe ), and , as qby the DOS @by 3,456 ), and |12's not be moved. the In , it and . Xor accessed for any reason. pof 2,926 at the end of the a. The >and in the DOS not be The in the In 5, and are not "The In Man - Written in SALERNO (ITALY), "Dedicated to Ester:" "I don't know either how or , but I hold you in my arms again." It is what In of In Man are: Man II: in May, Man II is a later of the . Its is 3,504 ), hooking |21. It adds 3,223 )to the . -and . v, and like the vthe ). The in the 5in all In Man II "The In Man II - Written in SALERNO (ITALY), "Dedicated to E.F.:" "I don't know either how or , but I hold you in my arms again." : Italy May, PZPAPN Invol : Invol W& .SYS write protect executing . fwrite- protected R: 1,409 - 1,421 W); 2,832 )(.SYS) 5: PRsE - W& .SYS The Invol . Its ~was in the . Invol is a uof . Wand .SYS The Invol rby the Invol may be a .SYS has a device entry in the CONFIG.SYS a, or an . &has completed. In either case, if the DOS X, it indicate has 2,832 )less is expected. mby the mapping utilities most likely indicate 's config.sys has pd in by 2,832 Invol is , it attempt to wthe .SYS qin the 's CONFIG.SYS a. The .SYS pof 2,832 at the "of the a. The and in the DOS to the >and . The can be r.SYS "You lhelped spread is a fyour friendly neighborhood tservice. k you for your involuntary cooperation." "c:\config.sys EVICE C:\vansi.sys device=vansi.sys" rby the Invol it is . In the case of . pof 1,409 to 1,421 at the end of the a. The to the >and . The not be It is what Invol Invol-B: Gin the in May, , Invol-B is a smaller of the Invol Its encryption has to avoid detection. It adds 2,720 )to the .SYS v, and 1,348 to 1,365 )to . `. The last in the "c:\config.sys EVICE C:\vansi.sys vansi" May, PZPAPN Ionkin : Ionkin Ionkin-231 R: 231 5: PNCK - 3.96+, NAV 3.0+, 8/93+, The Ionkin, or Ionkin-231, It is fthe . Ionkin-231 is a uof . Nn't smaller the Ionkin X, the Ionkin wup to two . in the pof 231 at the end of the a. The >and in the DOS to the >and The in all Ionkin of Ionkin are: Ionkin-2372: , Ionkin-2372 is a 2,372 of the Ionkin . It may wone . larger 2,372 at the end of the a. The >and in the DOS to the >and . The in the "IONKIN. PZPAPN : Iper R: 1,062 5: PNCK - 3.96+, NAV 3.0+, The Iper . Its . Iper is a uof . the Iper X, the Iper wone amay be in the C: ODOS E, the C: root O, or on the O. Iper Nn't wmore five . `in any given Eon the K, and no more three . pof 1,062 at the end of the a. The >and in the DOS not be . Two are in the "IPER" The "IPER" s very close to the end of the It is what Iper PZPAPN Iranian : Iranian R: 1,320 5: PRhAK - 30.00+, NAV 3.0+, .2.0+ The Iranian . Its . Iranian is a of . -and . bIranian X, the Iranian at the top of $the ', hooking {09 and 21. , as qby the DOS @by 1,328 12's not be moved. the Iranian , it pof 1,320 at the end of the a. The >and in the DOS not be The in the Iranian 5and are thus not "IRANIAN VIRUS W.by ABBAS KUHKAN ALIABADI" ANTI VIRUS Writen By ABBAS KUKAN" It is what Iranian PZPAPN Iraqui Warrior : Iraqui Warrior Iraqui, -Iraqui i; closely spaced beeps speaker; &failures R: 777 5: PNCK - , NAV, The Iraqui Warrior in the is a non- uof . ,. It is on the the Iraqui Warrior the wone of the bfour . the Oand pof 777 at the end of the The can be `, the two ring near the "of the , and the last very near the end of the "I come to you fThe Ayatollah!" "(c) "An Iraqui Warrior is in your computer..." None of Lby the the Iraqui Warrior may occasionally [the speaker issuing a series of closely spaced beeps s, the hang and lto be re &ed. The beeps continue until the re &ing Kwhere ,has in a " U, Cannot start -MAND, exiting" The Iraqui Warrior Nnot to do else See: PZPAPN Iron Umbrella : Iron Umbrella Germany R: 359 5: PNCK - 8/93S+, 30.00+, , NAV 3.0A06+, .2.0+, 1.25+, 1.0A06+ The Iron Umbrella , and fGermany. Iron Umbrella is a uof . the Iron Umbrella wone . in the 359 at the end of the a. The >and in the DOS . The in the 5in all Iron Umbrella "G+ALLERBMU NORI+" "(C) by SMAUG in M NCHEN, DEUTSCHLAND!" ".. *.com" The , read backwards, 8the PZPAPN : It Coahuila Mexico R: 454 5: PNCK - 30.00+, NAV 3.0+, n1.04+, 6.60+, .2.0+, 1.25+, 6.64+ The It }in Mexico in is a uof . the It wone in the it has completed sall . in the E, it start on the path. pof 454 the end of the . The >and in the DOS not be . The can be in the 5in all It "(C) ITV85020203 PATH=*. Nn't to do of It are: It-457: fMexico in , It-457 is a 457 of the It gvery to the , the major difference It-457 adds 457 )to the . v. The same as the : Mexico Viva Mexico: Gin Morelia City, Mexico, in , Viva Mexico is a 449 of the It vone . ain the pof 449 the at the end of the a. The >and in the DOS to be , but the seconds field !set to "60". The the 5in all Viva Mexico "ITV85020203 "Viva M xico!" "PATH=*. Viva Mexico 16th, Mexico's Independence Day. At the Lon the monitor and the Viva M xico!" : Mexico PZPAPN Italian 803 : Italian 803 Italian a, V817, Sept 18 G: March, Italy R: 803 5: PNAK - , NAV, The Italian 803 in March, uof . -and . `. It Italian 803 is X, the look for an ain the If one is d, it r. If an Nnot exist in the E, the look for an ain the E. If an d, it Italian 803 of 803 to 817 at the end of the Nnot alter the >and the The Italian 803 may re already . The re copied, and X. Re of Italian 803 in an the Italian 803 Nnot do of Italian 803 are: Italian 803-B: to Italian 803, differs by PZPAPN Italian Boy : Italian Boy 578, Ital Boy :; Italian flag Italy R: 578 5: PRhCK - 30.00+, NAV 3.0+, .2.0+, 1.25+ The Italian Boy , and is Italy. Italian Boy is a uof . ,. It is a destructive bItalian Boy X, the Italian Boy at the top of $the ', not moving |12's , as qby the DOS @by 896 the Italian Boy , it pof 578 at the end of the a. The >and in the DOS not be . The are in the 5in all Italian Boy "ITALY IS THE BEST COUNTRY IN THE WORLD" "Fucks to Italian Killers" The Italian Boy 3rd of any year. At , the an Italian flag on the M, along , and may trash the PZPAPN Itavir : Itavir 3880 Endangered G: March, Italy R: 3,880 5: PNE - \, NAV, The Itavir }in March by a group of students at the Milan Politechnic in Milan, Italy. The Itavir generic . by 3,880 %having pd in usually where on the K. The bcharacter of is an unprin character. The pure 5and is used for appending to The Itavir period !running for more 24 hours. , the is corrupted, rendering the &able. The Ms a in Italian and writes ANSI values through 255 to all I/O ports, thus confusing any attached peripheral devices. monitors may show a flickering effect s, while VGA monitors may actually "hiss". PZPAPN : Itti Itti-A &failures; " WC failure" R: 161 5: ONCK - /, NAV 3.0+, 1.53S+, .2.0+ The Itti . Its Itti is a Itti is X, the Itti wone . in the Eby over- writing the host b161 be no 3to the unless it was smaller 161 ). In the case of . `smaller be no 3to the >and in the DOS the Itti has completed a, it the to the DOS prompt: WC failure" The , plus the -", can be the b161 the Itti &failures if the copy of in the root Eof the &able of the if the Itti cannot find an of Itti are: Itti-B: A 99 of Itti, Mthe " WC failure" , and the is not in the >and in the DOS to the >and PZPAPN PT>! : IVP Bubbles R: 684 5: PNA - 6.60+, 2.58+, n1.05+, 2.58+, 6.64+ The IVP generation along the Bubbles was generated by the IVP is not a , but a generator of -and/or . `, as well as possibly ,. While the was intended to able to generate function produce working 5. The IVP can produce a random number of NOP instructions placed in two areas of the decryption routine in an attempt to elude simple search ning techniques. The NOPs aren't a real problem, and it is very simple to generate a generic detection es created IVP. The $is for the Bubbles the IVP . It may not match copies of the Bubbles are regenerated The Bubbles is a of . -and . , but not ,. It of the . -and . in the X. It to move up one Ein the Estructure. the Bubbles 684 at the end of the a. The >and in the DOS Estructure not be . The the "Bubbles "Admiral Bailey" "[IVP]" "*.com *.exe .." The bthree of Lby the X. Bubbles Nn't do Mits (es) created IVP are: Crystal: , Crystal is a 699 s to !created the IVP Crystal is a uof . and . ,. It vone to many . -and . in the pof 699 at the end of the a. The >and in the DOS not be . The Mthe X, however it usually jumbled 4accompanied by beeping on most "CrystalSoso ManLove is for suckers" "[IVP]" The in the 5, as is the "*.com *.exe .." : Oklahoma, USA IVP Example 1: , IVP Example 1 is a 351 was created the IVP . It is a uof . , but not ,. It vall of the . the pof 351 at the end of the The >and in the DOS not be . The Ms the "Test Tim" beeping on the speaker. The in the 5in all "Test" "Tim" "[IVP]" "*.com .." IVP Example 2: , IVP Example 2 is a 544 was created the IVP . It is a uof . . It vall of the . in the pof 544 the at the end of the a. The >and in the DOS not be . The Ms the "Test Tim [IVP". The in the 5in all "Test" "Tim" "*.exe .." Kfull!" IVP.Taselhoff: , 1994, IVP.Taselhoff is a 375 was created the IVP . It is a uof . ,. It vall of the . in the of 375 at the end of the a. The >and in the DOS not be . The beeping on the speaker, it usually s in the . The in the 5in all "Eddie has ed on tour ( "Author : Taselhoff" "Fuck you arsehole c:\ 6.con *.com" create a -MAND.CON" in the C: Oroot be 21 and 9the "c:\ 6.con *.com" 1994. IVP-Ozzy: , 1994, IVP-Ozzy is a 426 s to !created the IVP IVP-Ozzy is a uof . ,. It vall of the . in the of 426 at the end of the a. The >and in the DOS not be . The in the IVP-Ozzy "*^ OZZY ^*^ -- Yeew duh-meE iTs ReeEl!! [kR]*.com" 1994. IVP-S2DD: in May, , IVP-S2DD is a 763 s to !created the IVP IVP-S2DD is a uof . and . ,. It vall of the . -and . in the pof 763 at the end of the a. The >and in the DOS not be . The IVP-S2DD Mthe , along three beeps on the speaker, "Enjoy The Most Advanced To Man "[IVP]" , the trash the bfew cylinders of the K. The the 5, as are the "Slut2Death Dealer" "*.com *.exe .." May IVP-Tuesday: , IVP-Tuesday is an 822 s to !created the IVP . IVP-Tuesday is a uof . -and . ,. It vall of the . -and . in the pof 822 at the end of the The >and in the DOS not be . The however it usually Mjumbled 4on most "GOOD BYE RUBY TUESDAY, WHO COULD HANG A FAX ON YOU?" "[IVP]" The in the 5, as are the "Tuesday Jesus" "*JESUS* MAKER OF FINE VIRII MEMBER OF JDIV (JESUS DIED IN VAIN)" "*.com *.exe .." Kubla Kahn: , 1994, Kubla Kahn is a 644 was created the IVP . It is a uof . -and . but not ,. It vall of the . -and . in the pof 644 at the end of the a. The >and in the DOS not be . The , accompanied by beeping on the speaker, to the DOS prompt, or receive the a. The in the 5in all "*.com *.exe .." 1994. SiloDeath: , SiloDeath is a 734 s to !created the IVP SiloDeath is a uof . and . ,. It vseveral -and . in the pof 734 at the end of the a. The >and in the DOS not be . The SiloDeath attempt to Mthe followed by a hang, "Legalize Today-Get High Tonight" "[IVP]" , the trash the bfew cylinders of the %the , the can be in the SiloDeath "SiloDeath Dealer" "*.com *.exe .." Sleeper: , Sleeper is a 1,017 s to !created the IVP Sleeper is a uof . and . ,. It vall of the . -and . in the pof 1,017 at the end of the a. The in the DOS not be The in the "Sleeper" "Dark Lord" "I Just Fucked Your OOver!!" "Yet An Victim Of The Sleeper!!" "It is Amazing What a Student Of The and in the DOS not be . The Swank attempt to Mthe followed by a hang, "Slut3Death Dealer" "Enjoy The Most Advanced To Man "[IVP]" The in the 5, as is the "*.com *.exe .." Yeah: , Yeah is a 663 s to !created the IVP . Yeah is uof . -and . ,. It vall of the . and . in the pof 663 at the end of the a. The >and in the DOS not be . The Yeah Mthe "POOP" "YEAH RIGHT" "[IVP]" The in the 5, as is the "*.com *.exe .." Yeah may not function PZPAPN James Bond : James Bond H: May, i; DOS +lost clusters; =seconds set to 62 The R: 356 5: PRaCK - 30.00+, 1.25+ The James Bond in May, , and is . James Bond is a bJames Bond X, the James Bond in a "hole" in al , hooking |21. , as qby the DOS not be , James Bond for any reason. pof 356 the at the end of the a. The be hidden by the `, and `. The >and in the DOS to be , but the seconds field !set to "62". The s very near to the end of all "James Bond is Alive!" the James Bond find the DOS report a very high number of lost clusters it is PZPAPN Japanese Christmas : Japanese Christmas Christmas In Japan, Japan H: , 1989 Japan R: 600 5: PNCK - \, NAV, The Japanese Christmas breported in Japan in , 1989. It was later }in Japan in late . As of , it was reported to be widespread in Japan. is a 600 generic uof . `. It the Japanese Christmas X, the wzero to one ain the E. If a r, it by 600 at the end of the ?25th, if an X, the Lin the center of the "A merry christmas to you" The flash and be underlined for the it is L. If left alone, the go away a little while and the Ynormally, but the Nnot to do any malicious damage. of Japanese Christmas are: Japanese-709: , Japanese-709 or DAPDM-13 is a 709 of the Japanese Christmas . It vone . pof 709 at the end of the a. The >and not be . Two can be the "*.*" "PATH=*. : Japan Japanese Christmas-B: to the Japanese Christmas-B is a minor modifications. : Japan Japanese Christmas-C: to the Japanese Christmas-C is a minor modifications. : Japan Japanese Christmas-D: to the Japanese Christmas-D is a minor modifications. : Japan Japanese Cookie: one . in the ever an pof 653 at the end of the a. The >and in the DOS . The in the is "*.com". : Japan PZPAPN Jason : Jason H: , 1994 Lbefore expected output R: 609 5: PNC - V112+, /2.1+, 6.2+, \2.13+, 6.64+, .2.0+, V111+, 6.64+ The Jason , 1994. Its . Jason is a uof . , but not the Jason wone . in the the Jason pof 609 at the end of the a. The >and in the DOS not be . The in the Jason "Jason "You've rby the JASON . . ." a test "So Dont Worry. . . .MAYB "*.com" ly, the "AD" can be dstarting in the fourth *of all the Jason X, followed by the Mof the expected output. PZPAPN : JD JD-158, JD-276, JD-356, JD-392 R: 158 - 392 )(depending on 5: PRaCK - n, NAV, The JD ]was . Its ]is a group of four closely related es, the larger of hide the The entry $describes ]in general, specific qunder a JD X, the in a "hole" in al . As such, be no as well as possibly {13 or 1E, depending on the present. a JD , it X. If X, it r. The at the end of the of 158 to 392 The JD es don't do member(s) of the JD es are: JD-158: The smallest member of the JD 158 )to the . v. The >and in the DOS . It hooks |13 in addition to |21 in JD-276: member of the JD ]adds 276 )to the . be no 3to the >and in the DOS hooks |21 in JD-356: JD-356 adds 356 )to the . however the not be if the . It hooks |1E in addition |21. be no 3to the >and in the DOS JD-392: in behavior to JD-356, adds 392 )to the . PZPAPN : Jeff R: 814 5: PNCK - P, NAV 3.0+, .2.0+ The Jeff }in the is a uof . the Jeff X, the attempt to wone . aon the C: O, starting in the root 814 to 828 at the end of the The Jeff fthe Sin the "Jeff is visiting your While Jeff is visiting your K, it occasionally write of random contents to the K. If are written to the , or FAT, the contents of the Kmay inaccessible or produce unexpected PZPAPN Jericho : Jericho Calgary, Alberta, Canada R: 1,365 - 1,379 5: PRhAK - 30.00+, 3.96+, 6.60+, .2.0+, 6.64+ The Jericho , and fthe Calgary area of Canada. Jericho is a uof . -and . bJericho X, the Jericho at the top of $the ', not moving |12's , as the DOS @by 2,832 {21 and 27 mby Jericho in the Jericho , it for any reason. pof 1,365 )while . by 1,365 to 1,379 ). In both cases, the at the end of the a. The >and in the DOS not be . The in the 5in all Jericho "JERICHO by Eurystheus" "Calgary" It is what Jericho PZPAPN : Jerk Talentless Jerk, SuperHacker, 1077, Jerk-B G: March, ; unexpected access to C: R: 1,077 5: PNAK - , NAV, The Jerk, Talentless Jerk, or SuperHacker March, . Its is a uof . -and . , and it the Jerk search the Estructure of the C: Oto find a w. If the Xthe J, an unexpected access to the has selected a . -or . w, it alter the bnine )of the candi a, and append the to the end of the newly . The Lon the monitor, Nnot always "Craig Murphy calls himself SUPERHACKER but he's just a talentless jerk!" cannot be seen as it is in the the Jerk pof 1,077 ). The "MURPHY" dstarting at the fourth *of the a. The can be WBad The Jerk Nnot do of Jerk include: Jerk-B: gequivalent to Jerk, differs by three PZPAPN PLO, Israeli, Friday 13th, Russian, 1813( -), 1808( Arab Star, Black Box, Black Window, Hebrew University , 1987 Israel TSR; . slowdown; on Friday 13th; "black window" Italy R: 1,808 - 1,822 5: PRsA - Generic , NAV, : CleanUp, , NAV, or The }at Hebrew University in Israel in the Fall of 1987. As of , it is lnow ated in Italy. is a generic .SYS, .BIN, .PIF, and overlay `may be re rby the to a bug in the 5. The many s, and many on its 5. The description $is for a standard , or members of ], are The X, the as a low TSR of 1,792 {08 and 21 mby the , it X. . by 1,813 at the "of the a. . by 1,808 to 1,822 at the end of the a. Later, rby the are again add an 1,808 )to the in the DOS |8, and 1/2 hour Zof the slow down by a factor of 10. la "black window" or "black box" on the lower left side of the scroll up the as the scrolls. The Friday the 13ths. At , it Bany The identifier for most strains is "sUMsDos", however, identifier may not be din the newer The t to on the Suriv 3.00 the Suriv 3.00 members(s) of the ]are: A-204: the sUMsDos 1to *A-204*, and a couple of instructions 1in order to avoid detection. slow down the for 30 minutes, as well as having a black box : Delft, The Anarkia: r delay set to slow down the to a greater degree, effect Nn't show until a much longer has elapsed. No Black Box is ever L. The sUMsDos id- 1to ANARKIA. Lastly, the >has 1to Tuesday the 13th, instead of Friday the 13th. : Spain Anarkia-B: to Anarkia, the exception now on any 12th instead of on Tuesday the 13ths. Antiviru: B, the Antiviru differs in 8two ," and "ANTIVIRU". Like , it Ma "black box" accompanied by a slowdown 30 minutes becoming Friday the 13ths, any Apocalypse: The Apocalypse Vin May, . It ated in Italy. X. . by 1,813 ). . by 1,808 to 1,822 t, and 1,808 )on later re ts. The MsDos tmarker in the to "C.J**". can be din Apocalypse are: "Apocalypse!!!" "**C.J**" The last is what has replaced the sUMsDos in the . Apocalypse lthe characteristic "black box" on the lower left hand side of the has for 30 minutes. It Nnot, however, on Friday the 13ths. : Italy May, Bogota: The Bogota Gin Bogota, Columbia in May, . Its low TSR is 2,048+ hooking {16 and 21. It adds 1,813 )to the . r. . by 1,808 to 1,822 t, and 1,808 t. Bogota truncate . to zero Captain Trips: The Captain Trips in March, , and is fthe . Its comes "Captain Trips X." in the 5. Unlike most Ma black window for 30 minutes, nor Nit slow down the . On Friday the 13th, it Nnot . The "MsDos" Nnot by 1,813 ). . by 1,808 to 1,822 the a, and by 1,808 subsequent March, Captain Trips 2: Captain Trips 2 was It is a of the Captain Trips to avoid detection. The major difference is ts of . pof 1,813 Czech: The Czech the Czech zs a 1,984 *TSR in {08, 21, and F8 it is , it X. . 1,735 at the of the a. . by 1,735 to 1,749 at the end of the Nnot re the Czech for 30 minutes, it Ma reverse video box in the upper left hand corner of the 8the "Ha!Ha!". It Nnot on Friday The 13ths. may detect as the Sunday Dragon: The Dragon to the . It "BDH B T". The MsDos identifier has 1to a hex character . It on Friday The 13ths. Get Password 1: Get Password 1 is a Gin the bhalf of 's TSR is 1,840 . Get Password 1 is a Novell network specific , it won't unless the Novell Netware Ors are present in . The intended to capture the logon logs onto the network, however Nnot function and so is no threat. Get Password 1 is 1,914 25TH: B, the major difference activate on 25TH, at Bany 25TH Nn't re for 30 minutes, it lthe "black box" effect 7to many . The "sUMsDos" !replaced hex 00 25TH-B: gequivalent to the 25TH, slight 5modifications. to the Nnot re : Israel , 1988. out the r delay to slow down the processor. destroy both copies of the FAT on any Friday the 13th has the sUMsDos 1to 00h for 30 minutes, the slow down by 30% and the 7"black window" on the lower left side of the . Like , it `multiple Nnot carry an `, it s for all intents to be "defanged". : Washington, DC, D but the is in -Polish: on the slightly so the "black box" effect Nnot : Poland -PLO: on the Xduring the secondd half of the year. It during the half of the year. for 30 minutes, a slowdown , but the characteristic black box . The "sUMsDos" in the "sU?sDos". by 1,813 by 1,808 - 1,822 t, and 1,808 .Suselfo: has the sUMsDos 1to "sUSelFo", as well as having to avoid detection by utilities. : Spain March, 1994. 17TH: on the 17TH is a 1,530 . Its TSR is 1,792 ), hooking |21. . by 1,535 while . by 1,530 to 1,544 , the at the of the , the at the end of the a. . are not re is between 17TH and ?31st of any year, at Bany JVT1: to the , the JVT1 major differences are 30 minutes, a vertical black box consisting of two in the very upper left hand corner of the M. An difference is instead of deleting on Friday the 13ths, it Bs them on Tuesday the 1st. The "sUMsDos" in the 1to "sUMsDns". Like , it JVT1-B: gequivalent to JVT1, slightly modified Mendoza: on the `. It is missing the black box effect. Mendoza in the second half of the year ( ?), at any day la 10% chance of having all : Argentina Messina: to the , Messina's major difference is the "sUMsDos" 1to "Messina". by 1,813 by 1,808 to 1,822 t, and 1,808 Nemesis: to the major difference is in the area of in the . The characteristic "sUMsDos" "UM Do ". Two can be `: "NEMESIS. -" and "NOKEY". New : The New is a was uploaded to several BBSes in The 14, 1989. It was modified to be undetec utilities were widely distributed at : The , 1989. Oscar: The Oscar equivalent to the . It 8three : "sUMsDos", " ,, and "OSCAR NU". be re On Friday the 13ths, it Payday: The Payday }in The Jan Terpstra in , 1989. A major behavioral Payday activate on all Fridays except Friday the 13th. Upon , it Bs all : The , 1989. Park ESS: in Happy Camp, California, is very by 1,813 ), and by 1,808 to 1,822 t, and 1,808 on later subsequent ts. ,. The major difference fthe "normal" "sUMsDos" !replaced. The "PARK ESS" can din the in all slows down the 20 percent and a "black window" for 30 minutes. Phenome: The Phenome B was at the same as the Apocalypse in behavior to Apocalypse, the exception X. The "MsDos" "PHENOME. "*-*-*-*" Phenome becoming on Saturdays. On Saturdays, Y, but simply to the DOS prompt. : Italy May, Puerto: in Puerto Rico, very to the Mendoza , the sUMsDos id- `may be rmultiple : Puerto Rico Skism: to the Skism-1 , the Skism 's major difference is the "SKISM-1" 1to " SKISM ". g, it is equivalent to Skism-1. : Canada Skism-1: in New York State, to many s except regards to and what it Nupon . Rather activate on Friday the 13ths and in the years and later on any Friday the 15th of the month. On truncates any is attempted to be Xto zero ). . upon 1,808 pby 1,808 to 1,822 be re rby the . The "sUMsDos" in the is now "SKISM-1". Like produces a "black window" 30 minutes becoming , and slows down the : Canada Soy Un: on the , Soy Un is a 2,064 fPeru. Its TSR is 2,336 and hooks |21. Soy Un adds 2,069 )to the . at the "of the a. It adds 2,064 to 2,078 )to . at the end of the are not re r. Most of the usually not be the as it attempt to hide all by 1 to 16 )of the p. The in the "HACK1" "CHKLIST.CPS" "Soy un y mi nombre es - THE HACKER - Lima - Per : Peru Spanish JB: ( , it re `. The `is always 1,808 ). On . `, the may be either 1,808 or 1,813, talways adding 1,808 )to the already a. No "Black Box" The characteristic "sUMsDos" id- Nnot in the s identified as : Spain Sub-Zero: , Sub-Zero is a modified Nnot Mthe characteristic "black box" for 30 minutes, nor slowdown . Sub-Zero : "LORD SKISM", "Sub-Zero NYHC", and "ED EL". : Canada Sub-Zero B: in May, , Sub-Zero B is a slightly modified of the Sub-Zero . On the last Friday of any month truncate X, and attempt to format the minutes becoming May, Sub-Zero C: ^1994, Sub-Zero C is a modified of the Sub-Zero . It has to avoid detection by utilities. ^, 1994. Swiss 1813: fSwitzerland, Nnot exhibit the "black window" for 30 minutes, nor Nit slow down the . It Nnot on Friday the 13th, or any Friday. The "sUMsDos" 1to binary zeros. : Switzerland Triple: , Triple is a to avoid detection by ning g, it is to the . One can be din the -MAND". Ucender: in March, to avoid detection by The "sUMsDos" 1to "UCNDER". The characteristic "black box" has for 30 minutes, and a slow- down . Ucender `, like the on Friday The 13ths, at : Argentina March, See: 1605 China Discom Freddy Frere Jacques Fu Manchu Groen Links Growing Block 11-30 1663 Mule RAM Slow Sunday Sunday-2 Suriv 3.00 Westwood Barcelona Poison Moctezumas Revenge 1244 Timor Totoro PZPAPN 11-30 11-30 1130 i; TSR; R: 2,000 - 2,014 5: PRsA - NAV, The 11-30, or 1130, Its 11-30 is a of . W, and overlay `. It , as the implies, is a of the it is #documented separately due to its different behaviour. The 11-30 is the 11-30 low TSR of 2,288 ). On 30th, the hook {20, 21, and 27. On 30th, it hook 11-30 is , it pof 2,000 at the "of the pof 2,000 to 2,014 at the end of the a. Unlike several not re `. All lhad >and in the DOS to the >and . The can be in the 5of all 11-30 11-30 it has 30th of any year. It intermittently flash a reverse video block in the upper right hand corner of the says "1130" while the is at a DOS prompt. See: PZPAPN i; TSR R: 1,663 5: PRsAK - 3.96+, 8/93+ The 1663 . Its 1663 is a uof . -and . The 1663 X, the Jersalem 1663 as a low TSR of 2,432 {13 and 21 , Jersalem 1663 X. Both . -and . by 1,663 at the end of the a. The cannot recognize a previous ton a a. Both . -and . r, adding 1,663 t. The >and in the DOS not be . No in the It is what 1663 See: PZPAPN Research TSR; . New Zealand R: 1,767 - 1,779 5: PRsAK - 8/93+ The 1767 Henry Wolfe of New Zealand whom he has had on a Jfor over one year. The source of the 1767 is a of the characteristic 2in its behavior. The 1767 is as a low TSR of 2,048 ), hooking {08 and 21. 1767 is , it -and . X. If X, it by 1,767 at the "of the a. The exception #at the end of the by 1,767 to 1,779 the at the end of the a. . not be re related In both cases, be no 3to the >and in the DOS E. Two can be in the 5, the #the tmarker for "** INFECTED BY FRIDAY 13th **" 1767 Nnot exhibit the typical "black box" for 30 minutes. A slowdown Nnot See: PZPAPN -Haifa -Haifa i; TSR Israel R: 1,960 - 2,178 5: PRsA - 8/93S+, 30.00+, n1.04+, 6.64+, 1.25+ The -Haifa , and is Israel. -Haifa is a uof . , but not -Haifa as a low TSR of 2,048 ), hooking {08 and 21. -Haifa -and . pof 2,178 at the "of the pof 1,960 to 1,974 the end of the a. In both cases, the >and in the DOS not be . The in the -Haifa "a:\at_286" "04-764768" The 8the Hebrew 4for the word "Haifa". The " in all It is what -Haifa See: Haifa PZPAPN Joanna : Joanna England R: 986 5: PRhCK - 3.96+, n, NAV 3.0+, 1.25+ The Joanna Gin Lancs, England, in . Joanna is a uof . bJoanna X, the Joanna at the top of $the , as qby the DOS @by 3,008 mby the , the Joanna ,if it was not the Joanna , it for any reason. pof 986 at the end of the a. The and in the DOS not be Hidden `, however, lhad the hidden attribute removed. The in the Joanna and are not is Dedicated To the Girl I Love, Joanna Dicks." "Made in England by Apache Warrior, ARCV Pres." "Jo Ver. 1.01 (c) Apache Warrior 92" "I Love You Joanna, Apache.." "[JO] By Apache Warrior, ARCV Pres." of the lines of by the while it is in of Joanna are: Joanna 1.11: fManchester, England in Joanna 1.11 is a 916 of the Joanna Its , and use of {, is the same as the . Joanna 1.11 pof 916 the end of the be no 3to the >and in the DOS The in the "Looking Good Slimline Joanna." "Made in England by Apache Warrior, ARCV Pres." "Jo Ver. 1.11 (c) Apache Warrior 92." "I Love You Joanna, Apache..." "[JO] By Apache Warrior, ARCV Pres." : Manchester, England Joanna-911: A 911 of Joanna, is very to Joanna 1.11. Its is 3,018 ), hooking |21. , Joanna-911 pof 911 at the end of the a. The >and in the DOS not be . The in the Joanna-911 "Looking Good Slimline Joanna" "Made in England by Apache Warrior, ARCV Pres." "Jo Ver. 1.11 (c) Apache Warrior 92" "I Love You Joanna, Apache." "[JO]" "Apache Warrior, ARCV Pres" Joanna-911 8destructive Eand : England Joanna-911B: on the Joanna-911 is 3,008 ), hooking Like the Joanna-911 , it It is unable to distinquish , so be repeatedly tof the aadds 911 the at the end of the hide the tof the a, but not ts. The seconds field in the =in the DOS be set to 54 on all `. The same in the Joanna-911 , the DOS , plus .BAT and data `, but not . Wor .SYS : England March, fEngland in , Jo Wis a 916 of Joanna `. Its , and use of {, is the same as the . Jo are for any reason. pof 916 be hidden . The Jo at the end of the a. The >and in the DOS not be . The in the "Jo Exersiser . Apache Warrior, ARCV Pres. [JO The DOS , as well as data the Jo : England PZPAPN : JoJo G: May, j; graphic Israel R: 1,701 5: PRaC - \, NAV, \, or The JoJo Gin Israel in May, . The comes in the "Welcome to the JOJO One in the , indicating it was written in is: "Fuck the (c) - Both in the 5are never the JoJo Xon a , the . The method used is to alter the 6interpreter in , expanding its . As an example, on my test , the 6interpreter in pd in f3,536 )to 5,504 ). One block of 48 reserved in . The be a net Aof 2,048 The JoJo |13 is in use by any . Instead the clear the , and the be hung. If the performs a warm re (CTRL-ALT-DEL), the remain in is able to m, any . rby the by 1,701 JoJo is on the Cascade Nnot make use of the encryption mechanism in Cascade. JoJo produces a Mof multicolored diamonds on graphic JoJo is of JoJo are: JoJo-B: A minor of the JoJo , JoJo-B's encryption has !slightly modified. JoJo-C: , JoJo-C is an minor of the to avoid #detected by a particular . It is not believed to be in the public domain. See: Cascade Cascade-B JoJo 2 PZPAPN JoJo 2 : JoJo 2 ; "Not enough j; cursor position off 1 character R: 1,703 5: PRaCK - , NAV 3.0+, The JoJo 2 , by David Grant of the on the JoJo as well as 9ing part of the decryption for the Cascade . It is a uof . The the JoJo 2 the by altering the 6interpreter in . The 6interpreter in pof 1,904 is an is reserved by the as well, to JoJo. , it are X. If Xfor any reason, it pof 1,703 at the end of the can be the JoJo 2 "The JOJO strikes again. x zzz" "Fuck the - (c)" "141$FLu" the JoJo 2 Mthe "Fuck the - (c)" , or a garbage may fail due to "Not enough T. Lastly, for awhile, the may notice cursor on the monitor is off by one position to the right fwhere it should be. JoJo 2 may be detected by utilities as an of JoJo and Cascade/1701/1704. See: JoJo PZPAPN Joker : Joker Jocker Extinct ?, 1989 Wand .DBF Poland R: ??? 5: PNE - , NAV, 1.25+ The Joker }in Poland in ?, 1989. is a generic . u, and is a poor replicator (i.e., it Nnot quickly the Joker Mbogus and comments. and comments can be din the `at the "of the Here are of the and comments may be "Incorrect DOS "Invalid Volume ID Format failure" "Please put a new Kinto "End of input "END OF WORKTIME. TURN SYSTEM OFF!" "Divide Overflow" "Water detect in Co-processor" "I am hungry! Insert HAMBURGER into "NO SMOKING, PLEASE!" "Don't beat me !!" "Don't drink and cup of cofee ?" " OH, YES!" Khead has !destroyed. Can you borow me your one?" "Missing light magenta ribbon in printer!" "In case mistake, call GHOST BUSTERS" "Insert tractor toilet paper into printer." alter .DBF `, adding to them. The sample in the author of possession on an 8088 entry has !included since the sample may !damaged before its receipt by the author. At best, is a serious bug in the replication portion prevents it freplicating. PZPAPN Joker 2 : Joker 2 Joker-01 G: May, i; TSR; R: 29,233 5: PRsA - , NAV, The Joker 2, or Joker-01, in May, , by the PCVRF. Its is a uof . -and . , and The Joker 2 is X, Joker 2 as a low TSR of 29, 568 mby the include 09, 1C, and 21. becoming , Joker 2 -and . `whose was less larger 9K are never always by 29,233 by 29,233 to 29,372 ). In both cases the at the end of the The "JOKER-01" can be din all Joker 2 may [the #cleared, followed by a hang ring. happens, a few spurious 4may on the well. If ANSI.SYS is loaded before Joker 2 effect be produced. Joker 2 may be an incomplete is a large area of 00h in the 5, implying thing else may later. PZPAPN Joker-1602 : Joker-1602 G: March, s to be empty; or jumbled beeping; R: 1,602 5: PRaCK - .2.0+ The Joker-1602 in March, . Its . Joker-1602 is a uof . bJoker-1602 , hooking {25, B4, B6, B8, BA, and BB. , as qby the DOS not be , Joker-1602 are 1,602 at the end of the a. The >and in the DOS to the >and . The in the Joker-1602 "I'm hungry! Insert PIZZA & BEER into OA: and" "Strike any key ready..." "Abort, Retry, Ignore, Fail?" "Fail on INT 24" "Impotence Ureading 's dick" too big to fit in "Cannot load -MAND, halted" "I'm sorry, Dave . but I'm afraid I can't do "Format an ? (Y/N)?" "Damn it! I told you not to touch "Suck me!" "Cocksucker At Ureading device CON:" "I'm sorry, but your call cannot be completed as dialed." "Please hang up & try your call again." "No!" "Panic kernal mode "CONNECT 1200." "Okey, okay! Be patient!..." "And if I refuse?" "Fuck the world and its followers!" "You are pathetic, man... you know Joker-1602 [frequent j. If the &the copy of ,, issuing a DOS DIR #listed as present in the the Mof one of the or garbled accompanied by beeping may PZPAPN : Jos i; TSR Romania R: 1,000 5: PRsC - 3.96+, NAV 3.0+, 1.25+ The Jos . It is fRomania. Jos is a uof . but not bJos X, the Jos as a low TSR of 1,312 {09 and 21 mby Jos in the Jos , it pof 1,000 at the of the a. The >and in the DOS not be . The in the 5in all Jos "JABBERWOCKY , the bRomanian Political sian" "DhoE1" "Dhohoho" "Release >12-22- Jos is not related to the JW2 or Jabberwocky It is what Jos PZPAPN Joshi : Joshi Happy Birthday Joshi, BSC; machine jand India R: N/A 5: BRX - , NAV, : CleanUp, NAV, or M- The Joshi }in India in . At the was }, it was reported to be widespread in India as well as portions of the continent of Africa. Joshi is a Iand the fa Joshi- J, the . Joshi takes up , and show is 6K less zed if the DOS run. Joshi has ities to two Like the , it vthe to the Brain 's method of re Fing all to read the to the , Joshi 5th of any year, the Joshi . At , the hang the while Ming the Happy Birthday Joshi" If the s "Happy Birthday Joshi", the again be usable. may be recognized on by powering off the &ing -clean, write-protected DOS J. Using a editor or viewer to look at the of suspect I, if the btwo )of the are hex EB 1F, r. The EB 1F is a jump instruction to the rest of the 5. The remainder of the is stored on track 40, 1 through 5 on 360K 5.25 inch I. For 1.2M 5.25 inch I, the at track 80, 1 through 5. It on the last track of 3.5" To determine if a r, you must look at the . If the btwo )of the are EB 1F hex, The remainder of the can be dat cylinder 0, side 0, 2 through 6. The at cylinder 0, side 0, The Joshi can be manually removed bpowering off the , and &ing -clean, write-protected J. If the has a K, the Kshould ldata and `backed up, and the copied back to cylinder 0, side Iare easier to remove Joshi f, the DOS SYS 6can be used. several Joshi may [problems to access or data `on write protected of Joshi are: Joshi-B: to behavior to the Joshi , the major &ed on 5, the hang L. If the s "Happy Birthday Joshi", the proceed. May, PZPAPN Joshua : Joshua R: 965 5: PNA - 3.96+, n, NAV 3.0+, The Joshua . Its . Joshua is a uof . -and . , but not the Joshua wtwo in the E. It prefers . . If it could not two in the E, it move upwards in the Estructure looking for the Joshua pof 965 at the end of the a. The >and in the DOS not be , the Joshua Mthe Guess what ??? You !victimized by a !!! Do not try to re &your computer or even turn it off. You might as well read and weep! The in the 5, as is the "*.com *.exe .." See: PZPAPN Julia-1000 : Julia-1000 R: 1,000 5: PRhAK - \2.10g+, /2.1+, V112+, 2.58+, 2.11+, 6.64+, 2.58+, V113+, 6.64+, 1.25+ The Julia-1000 . Its . Julia-1000 is a uof . -and . bJulia-1000 at the top of $the ', not moving |12's , as qby the DOS @by 2,080 mby the Julia-1000 is , it -and . pof 1,000 ). In the case of . , the at the "of the a, while for . , the be at the end of the a. The >and in the DOS not be The in the Julia-1000 "Julia L." "Today is May Day ! Ver 3" jmay Julia-1000 of Julia-1000 are: Julia-1027: , Julia-1027 is a 1,027 of the Julia-1000 PZPAPN Endangered effects on Madrid, Spain R: 1,201 5: PNE - \, NAV, \, or The 13TH }in Madrid, Spain, in Guillermo Gonzalez Garcia. is a generic . u, and is not 13TH X, the attempt to `are are greater in 1,201 by 1,201 to 1,209 The 13TH 13TH of any year. At , a bouncing ball effect s on the monitor's to the bouncing ball effect of the Ping Pong . While is disruptive, it Nnot cause any overt damage to sthem. The bouncing ball effect created occasionally leave dots on the where it was passing if the !scrolled for any reason. 13TH are: 13TH-B: to the to avoid detection are aware of the . It vone . ain the X, adding 1,199 to 1,213 )to the a. The at the end of the . The and in the DOS . The in the W\*.V" 13TH-B 13th of any year, at a bouncing ball on the March, 13TH-C: to the , it vone . ain the X, adding 1,201 to 1,215 )to the a. The at the end of the . The and in the DOS . The in the W\*." 13TH-C in the a root , 1994. PZPAPN Italy R: 205 5: PNCK - .2.0+, 1.25+ The 26TH submission, it s to }in Italy. is a uof . ,. It is destructive 26th of any year. 26TH wall of the . in the E. If E, it 26TH pof 205 at the end of the a. The >and the DOS to the >and . One in the The 26TH 26th of any year. At , the the O, rendering it inaccessible. PZPAPN i; graphic & music on 12th; Philipines R: 2,660 - 2,687 5: PRsA - 30.00+, n1.04+, 6.64+ The 12TH . It fThe Philipines. 12TH is a -and . , but not ,. It 12th of any year. 12TH X, the 12TH as a low TSR of 2,672 12TH , it for any reason. 2,675 to 2,687 ), while . pby 2,660 to 2,674 ). In both cases the at the end of the a. The >and in the DOS not be . The can be in the 5in all 12TH "VDSFSCAN" The 12TH it has 12th of any year. , it Mthe three lines of on the a graphic of the Philipine flag bline of , and before the second line: 12 - the Independence Day of the Philippines." "MABUHAY ANG PILIPINAS!" "Dedicated to Manong Eddie." A song is played on the speaker while the and flag . At the completion of the song, the is cleared and the The fthe graphic Mare in the and are not PZPAPN Pretoria, Endangered i; long Kaccesses; 16th FAT alteration Republic of South Africa R: 879 5: PNCK - \, NAV, : NAV, or The 16TH, or Pretoria, is a generic . u, and is S. The X, the search the O(all Fories) and wall . d. The search period can be quite long, and it is very obvious on is taking too long to load. 16TH of any year, the Xthe activate. On , the 3all entries in the root Eand the to "ZAPPED". The 16TH t to ated in South Africa. PZPAPN Junior : Junior R: 234 5: PRaCK - 3.96+, NAV 3.0+, The Junior . It is (. Junior is a uof . bJunior X, the Junior in a "hole" in al 0:0500. , as qby the DOS not be . No {are mby the the Junior , it pof 234 at the end of the a. The in the DOS not be . One in the 5in Junior "Jr" s at or very near the end of the PZPAPN : JW2 812, Jabberwocky i; TSR R: 812 5: PRsAK - , NAV, The JW2, or 812, . Its , or ~, is . JW2 is a uof . -and . The JW2 is X, JW2 as a low TSR of 1,136 mby JW2 in JW2 is , it -and . by 812 at the end of the be no 3in the >and in the DOS 9the "JW2" in the fourth through sixth 4of the is the tmarker. It is if JW2 of JW2 are: Jabberwocky: A of JW2, it has six differ fthe occasionally Mthe X: "BEWARE THE JABBERWOCK!". The cannot be seen in `as it is Jabberwocky-B: to Jabberwocky, Jabberwocky-B is an minor differ. PZPAPN : K-4B Sweden or The R: 687 5: PRfCK - 30.00+, n1.04+, 2.58+, 6.60+, 2.58+, 6.64+, 1.25+ The K-4B , and is feither Sweden or The . K-4B is a vvia . The portion of the 5to make it resistant to the use of debuggers to analyse the bK-4B X, the K-4B , hooking |03. 5is not used for the , but rather to thwart analysing the . The one . in the E. Later, Ys an K-4B , the 5is not re , but an the K-4B pof 687 at the end of the a. The >and not be . The in the K-4B "EAF0FF00F0" K-4B Nn't to do interesting anti-debugger See: K-4C Kohntark PZPAPN : K-4C Sweden or The R: 737 5: PRfCK - n1.04+, 2.58+, 6.60+, 2.58+, .2.0+, 1.25+, 6.64+ The K-4C , and is feither Sweden or The . K-4C is a vvia . The portion of the 5to make it resistant to the use of debuggers to analyse the bK-4C X, the K-4C , hooking |03. 5is not used for the , but rather to thwart analysing the . The to five . `in the E. Later, Ys an K-4C , the 5is not re , but up to five more . r. The wmore sixteen `in a given the K-4C pof 737 at the end of the a. The >and not be . The in the K-4C "K-4C VIRUS by K hntark*. K-4C is a later of the K-4B See: K-4B Kohntark PZPAPN K-Hate : K-Hate R: 1,237 - 1,304 5: PNCK - The K-Hate . Its Hare . K-Hate is a uof . the K-Hate wall of the . in the 1,237 to 1,304 at the end of the a. The >and in the DOS not be . The the K-Hate "CRYPT INFO" "KDG 0.5 / K hntark3" "*, K-HATE / K hntark*. PZPAPN Kalah : Kalah Hamburg, Germany R: 390 5: PRCK - /, NAV, The Kalah }in Hamburg, Germany, in is a uof . The Kalah is X, the Kalah in a "hole" in very low , hooking |21. be no the Kalah , it the exception of those of less by 390 ). If the was less ), the be 780 ). The at the "of the a, and the b390 4of the !moved to the end of the be no 3to the >and in the DOS in the Kalah s Kalah Nn't do of Kalah are: Kalah-499: , Kalah-499 is a of the . It vtwo . pof 499 at the "of the a. In the case of . were smaller of 998 t. The in the DOS not be . The can be din all Kalah-499 "I don't like mondays ..." Kalah-499 5to low-level format the Xon any Monday. PZPAPN Kamikazi : Kamikazi Kamikaze R: 4,031 5: ONE - , NAV, 1.25+ The Kamikazi by Vesselin Bontchev of is a , and the Kamikazi X, the ain the the . is greater 4,031 ). Kamikazi simply s the b4,031 )of the candi 5, thus permanently damaging the candi r. The 4,031 5is not stored at any location. `do not , the the )of the "kamikazi", thus the . At , one of several : the may be re &ed by the of the contents of may get Lon the , or the may complete Zhaving ed to ldone nothing at all. In any event, the never run successfully, doing what the expects. If the Xa second , it hang the since it is no longer an execu . The . header has !permanently damaged due to the having 1to "kamikazi" by the it was PZPAPN Karin : Karin RedStar Germany R: 1,090 or 1,134 5: PNCK - , NAV, The Karin, or RedStar, fGermany. Karin is a uof . a Karin X, the Karin search the Efor an . If one d, the wit. If in the E, it may ras a the Karin pof either 1,090 or 1,134 ). In either case, the at the "of the be no 3to the >and in a DOS The can be in the "REDSTAR" "!Bad copy" The Karin 23rd. On is run the Mthe repeatedly: "Karin hat GEBURTSTAG" roughly translates to "Karin's Birthday". The be stuck in a loop during the M, and the need to be re &ed to end the &ing rcopy of in the and the &failing to proceed. PZPAPN Karlik : Karlik R: 1,666 5: PRhAK - 30.00+, NAV 3.0+, 6.64+, .2.0+, 1.25+, 6.64+ The Karlik . Its . Karlik is a -and . bKarlik at the top of the ', not moving |12's , as qby the DOS @by 1,808 {08 and 21 mby Karlik in , the Karlik `, and pof 1,666 at the end of the a. The >and in the DOS not be . No in the It is what Karlik PZPAPN Keeper : Keeper Keeper.Acid, Acid Trip ^, 1994 `may North America R: 694 5: PRhE - 2.11a+, V114+, \1.25+, 6.64+, n1.05+, V113+, 1.25+, 6.64+ The Keeper, Keeper.Acid or Acid Trip, ^, 1994 and is fNorth America. Keeper is a uof . bKeeper at the top of but $the ', hooking |21. , as qby the DOS @by 1,264 |12's not be moved. the Keeper , it pof 694 be hidden by the it is . The at the end of all . The >and in the DOS not be The in the 5in all Keeper "Crypt Keeper P/SG" "Your PC is on an [Acid Trip]... Try again later..." the Keeper , the DOS may indicate are 694 )smaller expected. effect s due to the ing mechanism employed by the PZPAPN Kemerovo : Kemerovo 257, Kemerovo-B, Keme, -257, Kemerovo-C, V257, Kemerov -Path not R: 257 5: PNCK - \, NAV, The Kemerovo and is is a uof . the Kemerovo X, the search the Oand Efor a . w. If an d, the wit, adding its 5to the end of the . The newly >and the to the >and by 257 If an awas not din the the -Path not d" may be Land the be terminated. Kemerovo Nnot do of Kemerovo are: Kemerovo-B: to Kemerovo, fthe United States and has to avoid detection by . Its major distinction wfive . in the Kemerovo-C: Very to Kemerovo-B, differs by a couple of PZPAPN Bug-1596, Kbug interference R: 1,598 - 1,620 5: PRhA - , NAV 3.0+, The Bug, or Bug-1596, . Its Bug is a uof . -and . , but Nnot The Bug is the at the top of $the 12's !moved. , as qby the DOS @by 1,616 {01, 03, 1C, and AC mby the , it -and . X. . pof 1,620 ). . pof 1,598 to 1,612 . In both cases, the at the end of the . The >and the DOS intermittent interference input due to the adding bursts of random 4to the buffer. jmay , in particular if the to copy using the DOS COPY Bug are: Bug-914: A 914 of the in 1,328 at the top of $the ', hooking {08, 1C, AA, and AC. Bug-914 pof 914 at the end of the a. The in the DOS not be . One in the -MAND" March, Bug-1720: A larger of the in 1,728 at the top of $the ', as well as la 448 *TSR. 01, 03, 1C, and AC min high , and mby the TSR. pof 1,744 ). . 1,722 to 1,734 Bug-1724: An of the what Bug-1720. -and . adding 1,724 to 1,759 . The at the end of PZPAPN Keydrop : Keydrop Keydrop Dropper G: May, BSC; 4dropped buffer; ; possible adamage R: N/A 5: BRtX - , NAV, .2.0+ : M- K/P, DOS SYS on The Keydrop in May, V. Keydrop is a and the ). The Keydrop sample 9ed in a . "dropped" the . The . -dropper is not its behavior is not to the , and the naturally the Keydrop , the at the top of $the Aby 5,120 |12's !moved. At , the wthe . The l6K in bad Keydrop is , it w360K are accessed on an . High density not be 3,072 )in bad , and the . The , and the Nnot fit in the din the bad l6K in bad . The bad 9the and the remainder of the Keydrop's comes fthe copyright notice din the in the bad "(c) Copyright Keydrop inc." Keydrop on a random basis, at occasionally drop a character fthe buffer, making the think missed a keystroke on the may damage Iand the K. It Nnot check to see if the it is going to mark as bad are in use, so may be in the middle of or data of Keydrop are: Keydrop Dropper: A small X, drops the Keydrop PZPAPN Keypress : Keypress Q, SamSoft, St. Leos, Turku, Keypress-Viring, Viring keystrokes repeated unexpectedly; R: 1,232 5: PRhAK - \, NAV, : CleanUp, or The Keypress was reported and }in many locations in the in late is a uof . -and . The the Keypress X, the at the top of , but $the {1C and 21 mby the on the @by 1,232 , any Xmay rby the . In the case of . was greater 1,232 `of any r, as it is 1to the >and between 1,234 and 1,248 )upon t. . pby 1,472 to 1,486 )upon t. In either case, the at the end of the The Keypress for 30 minutes. Upon , the may interfere input by repeating keystrokes. For example, if "a" is entered on the , it may be 1to " a" by the `can be identified by 9ing the near the end of the : 4333C98E1E2901CD21. of Keypress are: Keypress-1232X: Keypress-1232X is a modified of the Keypress and is to the . It 8the ^, 1994. Keypress-1238: Keypress-1238 is a modified of the Keypress at the of its submission was undetec ning . Its is 1,328 ), hooking {1C and 21. It adds 1,238 to 1,252 )to the . v, and 1,492 to 1,506 )to . . In both cases, the at the end of the a, and the >and in the DOS to the >and Keypress-1238B: gequivalent to Keypress-1238, is a minor Keypress-1238C: to Keypress-1238, is 1,328 ), hooking {1C and 21. It adds 1,238 to 1,251 )to the . v, and 1,492 to 1,507 )to . `. The at the end of the a. The >and in the DOS to the >and Keypress-1268: (MuBark) on the Keypress is 1,744 ), hooking 09, 1C, and 21. It -and . are pof 1,268 to 1,282 ). . by 1,506 to 1,520 ). The at the end of the a. The >and in the DOS to the >and . The in the 5in all "M u b a r k i s c a w" Lon the monitor Keypress.2728: on the Keypress is 3,968 ), hooking {13, 1C, and 21. It -and . or copied. pof 2,730 to 2,744 ). . by 2,984 to 2,998 ). The at the end of the a. The >and in the DOS not be . The can be in the 5in all It is what Keypress.2728 , 1994. Keypress-B: Keypress-B is very to the Keypress it is four )shorter in Aby 1,216 Keypress-B. by between 1,228 and 1,243 ). . by 1,468 to 1,482 ). Keypress-B on a random basis, at interfere input by repeating keystrokes. Keypress-Chaos: on the Keypress is 1,328 ), hooking {1C and 21. It -and . 1,238 to 1,251 ). . 1,492 to 1,506 ). The at the end of the a. The >and in the DOS to the >and . The the "SADDAM - the inferiority of the chaos" Lon the monitor : Malaysia Keypress-E: Keypress-E is very to the Keypress . Its major differences are is 1,232 ). It adds 1,234 to 1,247 )to the . v, and 1,472 to 1,486 )to the . v. The >and the DOS to the >and Keypress-Freddy Soft: Keypress-Freddy Soft is a modified the Keypress and is to the . It 8the "FRED" "FREDDY_SOFT FREDDY_SOFT FREDDY_SOFT FREDDY_SOFT FREDDY_SOFT" blank out the it to its contents may be re rby the ^, 1994. Keypress-UFO: on the Keypress is 3,968 ), hooking {13, 1C and 21. -and . 2,725 to 2,738 ). . 2,979 to 2,994 ). The at the end of the a. The >and in the DOS not be Keypress-Viring: on the Turku of Keypress, 's major difference fTurku is the beeping, , and jdo not : Italy on the Keypress Singapore is much smaller in , it by 896 889 to 902 pof 1,143 to 1,157 ). The can be in the 5in all "Roy CuatroNo" "2 P QGargenMeyer Rd. Spore 1543" "chklist.cps" Nnot to interfer input of the Keypress group do. It is targetted at Central Anti- , looking for the CHKLIST.CPS created by the Central package. : Singapore SamSoft: to the Keypress, 1,232 - 1,248 )to the . v, and 1,472 - 1,487 )to . `. The >and in the DOS to the >and . Unlike the , it Nnot repeat 4entered on the . It 8one May, SamSoft-B: to the SamSoft is has minor alterations. St Leos: to the Keypress, gequivalent. It has !slightly Turku: to the Keypress , Turku adds 1,234 to 1,247 )to the . v. . by 1,472 to 1,486 ). The din the 5of all `: ". W". The sticky key or repeated keystroke effect in the !replaced by a series of beeps #emitted on speaker, the halted, and the "Internal stack overflow halted" s, the must be powered off to be re PZPAPN Kiev 483 : Kiev 483 483, Kiev G: May, R: 483 5: PNCK - , NAV, The Kiev 483 in May, . It is fthe . Kiev 483 is a of . Kiev 483 is X, the search the Oand E, and wthe it locates. Kiev 483 by 483 ), the at the end of `. The >and in the DOS not be 9three "Kiev Kiev 483 Nnot do PZPAPN Kiev 2049 : Kiev 2049 ; C: ; lost cluster or '.SYS ain C:\ R: 2,049 5: PRsEB - V112+ `& DOS SYS on C: The Kiev 2049 . It is . Kiev 2049 is a uof the C: and . bKiev 2049 X, the Kiev 2049 on the C: , and create d '.SYS in the C: Oroot not usually in the E, but be a lost cluster on the O. The aor lost cluster 9a pure copy of the Kiev 2049 5. The not be , and not start The next fthe K, the Kiev 2049 as a device Or in low . The device Or is 3,152 ), hooking |21, and be labelled "NUL". the Kiev 2049 , it may it is what sporatic about pof 2,051 to 2,064 at the end of the a. The >and in the DOS not be . The in the 5in all Kiev 2049 "KIEV" "c:\'.sys" "SYS CONFIG SYS" "IBM 3.2" "CONFIG SYS3" "Non- K. Replace and press key" The last three 9ed in the imbedded in the It is what Kiev 2049 PZPAPN : Kit R: 2,383 - 2,446 5: PRhAK - , NAV, The Kit . Its It is a uof . -and . The a Kit X, the Kit at the top of but $the , as qby the DOS @by 2,400 {1C and 21 the Kit , it X. If the Kit pof 2,383 to 2,384 )on initial t. Kit `, adding an 2,384 t. The at the "of the the Kit pof 2,416 to 2,446 the initial t. As `, Kit re adding 2,416 t. Kit at the end of the Nnot alter the >and in the DOS are no in the It is what Kit may do PZPAPN Kiwi-550 : Kiwi-550 Kiwi R: 550 - 566 5: PRhE - 3.96+, NAV 3.0+, The Kiwi-550, or Kiwi, , and fthe . Kiwi-550 is a of . bKiwi-550 X, the Kiwi-550 at the top of $the ', hooking |21. , as qby the DOS @by 608 |12's !moved. the Kiwi-550 , it pof 550 to 566 at the end of the a. The >and in the DOS not be . The can be in the 5in all Kiwi-550 "I'm KIWI-586.(C) Vege -Soft, .DOS AIDSTESTP" It is what Kiwi-550 may do PZPAPN Klaeren : Klaeren Hate i; TSR; slowdown Italy R: 978 5: PRA - , NAV, The Klaeren , by the PCVRF. It is reported to be fItaly. Klaeren is a of . -and . . It Nnot bKlaeren X, Klaeren as a low TSR of 1,312 mby the Klaeren is , it -and . over 1K in by 978 to 996 the at the end of the be no 3in the >and in the Klaeren respond sluggishly due to a slight slowdown Klaeren is a fully . It is what it PZPAPN KLF-356 : KLF-356 R: 356 5: PRaCK - 3.96+, NAV 3.0+, 8/93+, .2.0+ The KLF-356 and is fthe . KLF-356 is a uof . bKLF-356 X, the KLF-356 in a "hole" in al 0:025E. mby the qby the DOS not be the KLF-356 , it pof 356 at the end of the a. The and in the DOS not be The in the KLF-356 "KLF" "The KLF3" The s very near the the a, and the last s in the 5at the end of the KLF-356 Nn't to do PZPAPN Kode4 : Kode4 Kode4-399 fail to North America R: 399 5: PNCK - 3.96+, 8/93S+, NAV 3.0+, 8/93+, .2.0+ The Kode4 , and s to be fNorth America. Kode4 is a of . the Kode4 X, the Kode4 wall of the . in the it completes sthe , it the s the to the DOS prompt: "-=+ Kode4 +=-, The one and ONLY!" the Kode4 pof 399 at the end of the a. Kode4 cannot tell by the , so it `adding increments of 399 ). The >and in the DOS not be %the , one can be din all "*.com" Kode4 Nn't to do not function of Kode4 are: Kode4-B: on the Kode4 , Kode4-B is a very minor , having five May, Kode4-129: , Kode4-129 s to be an earlier of the Kode4 is a vall . in the lthe b129 )of the by the 5. The "-=+ Kode4 +=-, The one and ONLY!" In addition to , the can be in the "*.c*" Kode4-129 may even is an s, the 9the the "of the a, and the remainder of the 9data PZPAPN Kohntark : Kohntark >month bdigit set to "0"; of a . ait is Sweden or The R: 655 5: PNCK - 3.96+, 6.64+, 1.25+ The Kohntark , and is feither Sweden or The . Kohntark is a s to be an earlier of the K-4B and K-4C the Kohntark X, the Kohntark wone . in the E. The Mthe of the the Kohntark pof 655 the end of the a. The >and bdigit of the amonth has !set to "0". The in the K-4B Kohntark Nn't to do See: K-4B K-4C PZPAPN Korea : Korea LBC 7- Korea G: March, BSC - 360k Seoul, Korea R: N/A 5: RF - Floppy NAV, : CleanUp, M- K, or DOS SYS The Korea, or LBC }in March in Seoul, Korea. is a 5.25" 360K The Korea is not intentionally destructive, it Nnothing in its ;form except for replicating. In instances, Korea damage the root it moves the 11, the last the root E. If entries, be lost. PZPAPN Kremikovtzi : Kremikovtzi j; TSR; R: 1,015 - 1,029 5: PRsAK - \2.10+, V111+, /2.1+, 2.58+, 6.64+, V111+, 2.58+, .2.0+, 6.64+ The Kremikovtzi . Its it may be fthe . Kremikovtzi is a uof . -and . bKremikovtzi as a low TSR of 1K in . It hooks , Kremikovtzi -and . pof 1,015 to 1,029 at the end of the a. The >and in the DOS not be The in the 5in all Kremikovtzi "RF *. It is what Kremikovtzi PZPAPN Krivmous : Krivmous R: 972 - 993 5: PNA - NAV 3.0+, 8/93+, The Krivmous was . It is (. Krivmous is a -and . , but not ,. It lthe to be hung the Krivmous search the Eto determine if w. If an d, the wit and run. If was not d, the check the Eto determine if an d, and rby the Krivmous pof 979 at the "of the a. . pof 972 to 993 at the end of the a. The >and in the DOS not be The Krivmous Mthe cpoem Ys an . The to be hung, pressing CTL-C usually to the DOS prompt: was a crooked man, and he went a crooked mile, da crooked sixpence against a crooked stile, He bought a crooked cat, caught a crooked mouse, And all lived together in a little crooked house." The is not as it in the of Krivmous are: Krivmous-B: gequivalent to the Krivmous has five differ. PZPAPN Kthulhu : Kthulhu write protect Poland R: 512 5: PNCK - 3.96+, NAV 3.0+, 8/93+, The Kthulhu . It is fPoland. Kthulhu is a the Kthulhu X, the Kthulhu wall of the . in the pof 512 at the of the a. The >and in the DOS not be . The can be in the 5in all Kthulhu "KTHULHU Today is my birthday." "IT $is coming." "$has gone." The Kthulhu during the month of May of any year, Ming a hang s. The of the depends on what the day of the month is set to in the fthe 1st of May thru May 19th, the "IT is coming." On May 20th, it Ms the "Today is my birthday." fMay 21st thru May 31st, it Ms the "IT has gone. symptom of a Kthulhu on write protected write protect PZPAPN Kuku-448 : Kuku-448 Ku-448 R: 448 5: PNCK - , NAV, The Kuku-448 . Its ~, is . Kuku-448 is a non- uof . ,. Kuku-448 can be a destructive , overwritting in advanced tcases. Kuku-448 is X, the Kuku-448 search the Efor one w. If it may r. Kuku-448 pof 448 at the "of the be no 3to the >and in a DOS If Kuku-448 Nnot find one w, it one . ain the a small trojan . Later, X, the write the word "Kuku!" in small colored boxes all over the PZPAPN Label : Label Int13 ; sluggish response on DIR R: 512 5: ORCK - , NAV, The Label, or Int13, . Label is a uof . The Label is X, Label , it one . in the a DOS DIR lthe by the . The b512 the are not saved by the be no 3in the `, nor be a in the >and in the DOS , as well as be corrupted by the Label , but not actually r. Like !permanently damaged. Label may on the same aif the is not PZPAPN Lancs : Lancs Lancspoly, Lancs-5476 `created; long Kaccesses England R: 5,476 5: SNCE - Spawning , NAV 3.0+, 1.25+ Bcompanion . The Lancs, Lancspoly, or Lancs-5476, . It is fEngland. Lancs is one of a group of three closely related spawning or companion All three of the in an LZ Wpacked format. the Lancs the Lancs search the Eto determine if exists the same base ain the E. If the companion exist, the create one. The newly created companion . of 5,476 ). The in the DOS is the same as the and for the corresponding . a. The The Lancs always is packed using LZ Win the companion . `. The in the but is not in the `due to the compressed format: 'HAVE A "HAPPY MONDAY" LANCSPOLY SUCKERS.' 'POP WILL EAT ITSELF' the Lancs Tand lthe halted L: "Cannot load -MAND, halted". of Lancs are: Lancs-5882: to Lancs, companion . `are 5,882 Lancs-7376: to Lancs, companion . `are 7,376 PZPAPN Larry : Larry R: 491 - 507 5: PRsAK - 3.96+, 1.53S+, .2.0+ The Larry . Its ~. Larry is a uof . -and . . It on the monitor. The the Larry in a "hole" in low , hooking |21. be no qby the DOS the Larry , it pd in by 491 pof 507 ). In both cases, the at the end of the a. The >and in the DOS not be . One in the 5in all Larry "Larry on a Lon the monitor the Larry and a PZPAPN Laufwerk : Laufwerk fail to function R: 7,040 5: ONE - 30.00+, NAV 3.0+, V112+, \2.10+, 2.11+, n1.05+ V113+, 6.64+, 1.25+ The Laufwerk . Its . Laufwerk is a overwritting . It corrupts the the Laufwerk wone . on the and the B: O. The newly lthe b7,040 by the Laufwerk were larger 7,040 7,040 were smaller 7,040 7,040 upon t. The >and in the DOS to the >and . The can be in the Laufwerk 5in all ".exe" "Laufwerk:" PZPAPN : Lazy slowdown; slow writes; R: 720 5: PRxCK - , NAV, : CleanUp, or The Lazy , and its is a uof . The the Lazy on a , the unreserved low hooking {10 and 21. The processor be significantly slowed down, ing in very slow writes ring. Lazy is , it are by 720 at the end of the The >and in the to the >and can be identified by the "lazy" near the end of all the Lazy [unexpected allocate and where the Lazy resides in . For example, hang it checks if Lazy is of Lazy are: Lazy-2: has 16 differ fthe Lazy . It Nnot hook |10 nor slow down writes. PZPAPN : LCT LCT-599, Liquid G: March, R: 599 5: PNCK - /2.0+, , NAV 3.0A06+, 1.0A06+ The LCT, LCT-599, or Liquid in March, Its . LCT is a uof . the LCT X, the LCT wall of the . in the 599 at the end of the a. The >and in the DOS . The in the 5in all LCT " Liquid LCT Nn't to do of LCT are: LCT-762: An earlier of the LCT vall of the . in the pof 762 at the "of the a. Unfortunately, LCT-762 cannot determine it has a, so it proceed to repeatedly re `, adding 762 t. An now be both the "and the end of the a. The and in the DOS to the >and the last . The in the 5in all LCT-762 "Liquid 5" March, PZPAPN Leech : Leech Leech2, Topler G: May, >s may dis R: 1,024 5: PRhCK - , NAV, The Leech in May, . Leech is (. It is a uof . The Leech is X, the at the top of $the as measured by the DOS Aby 2,080 mby the . Leech makes use of Leech is , it 10K in by 1,024 ), but the in the Eif Leech is had a of 12:00a before fthe viewed Leech . Leech is at the 9the "The leech live ... The Topler" Leech is a . If it is are unaware of Leech be unable to detect its presence on the It is if Leech of Leech are: Leech2: gequivalent to the , Leech2 has seven differ. Leech2 for any reason. PZPAPN Legalize : Legalize G: May, may not The R: 1,781 5: PRhA - 8/93S+, NAV 3.0+, .2.0+ The Legalize fThe in May, is a uof . -and . but not bLegalize X, the Legalize at the top of $the , as qby the DOS @by 2,064 mby Legalize |12's !moved. the Legalize , it -and . any reason. 1,781 at the end of the a. The >and in the DOS not be . One can be in the 5in all "LEGALIZE" the Legalize may notice no longer function , giving unexpected See: Gotcha PZPAPN Lehigh : Lehigh Lehigh University , 1987 Corrupts & FAT, Pennsylvania, R: N/A 5: ORaKT - , NAV, K& replace clean copy, or \, NAV The Lehigh aon both floppies and Os. The tmechanism is to stack space. copy of ,is accessed, r. A count is kept in Qcopy of the , and the s the and FATs. A variation of the Lehigh , Lehigh-2, exists maintains its tcounter in RAM and corrupts the and FATs of Lehigh are: Lehigh-2: to Lehigh, but the tcounter is maintained in RAM, and the :of the and FATs Lehigh-B: to Lehigh, the !modified to avoid detection. Lehigh-D: An slight of Lehigh, the major difference fa Lehigh typically fail to ing in a hang. PZPAPN Leningrad II : Leningrad II , 1994 R: 2,000 5: PRhCK - \2.13+, 2.58+, n1.05+, /2.1+, 6.64+, .2.0+, 6.64+, 2.58+ The Leningrad II , 1994, and fthe . Leningrad II is a bLeningrad II at the top of $the ', not moving |12's , as qby the DOS @by 4,096 {1C and 21 mby the , the Leningrad II pof 2,000 at the end of the a. The >and in the DOS not be . The repeated many in the "Leningrad" It is what Leningrad II See: Sov PZPAPN Leprosy : Leprosy Leprosy 1.00, News Flash Unusual California, R: 666 5: ONAK - /2.0+, NAV 3.0+, .2.0+ The Leprosy Gin the San Francisco Bay Area of California on is a -and . ,. Its carrier ais suspected to be a called 486 -P.ZIP was uploaded to several BBSes. the Leprosy , the b666 )of all . -and . in the Eone level up fthe E. If the Eis the root E, all in the root r. If in the r, it show no punless were less , in case 666 rthe . -and . `, it . The be either: to big to fit in "NEWS FLASH!! Your incurable decay of LEPROSY 1.00, a invented by PCM2 in . Good luck!" The second Lby one out of every seven -and . Since Leprosy is an , the not function . In fact, are run for awhile (while the `) and Mone of the two . The If the Leprosy in its a, one of the Lfollowed by: "Bad or missing 6Interpreter" &problem s because ,is no longer really ,. The not proceed until a Jis inserted into the and an &is attempted. While Leprosy's Sin the can be dby checking for the chex near the "of the 740AE8510046FE06F002EB08 `must be Bd and replaced clean, copies. is no way to dis since the 666 )of the , the store those )anywhere else. of Leprosy are: Angel Of Death: The Angel Of Death is a uof . -and . ,. It vup to four in the X. It vall . in a before it start lthe b555 by the Angel Of Death not function , usually ing the to the DOS prompt much Kactivity. The in the "All those of impure race beware because for the greater glory of the Aryan Race, the Angel of Death Doctor JOSEF MENGELE has Leprosy-654: Leprosy-654 is a on the Leprosy . It four . `in the ever an X, and Ms the Leprosy-654 s the b654 )of the . v, permanently corrupting them. The is un in the 5in Leprosy-654 ".. *. March, Leprosy-664A: Leprosy-664A, or Betrayal, is a on the Leprosy . It vfour . Wor . `in the ever an X, and the too big to fit in Leprosy-664A s the b664 )of the v, permanently corrupting them. The are un in the 5in all Leprosy-664A too big to fit in "Betrayal is a sin, if it comes "The Unforgiven / Immortal Riot Dedicated to Ellie! - Lurve you! Sweden 15/09/93" all of the . Wand . in the Eare r, the Mthe in the place of the " too big" ever an "Betrayal is a sin, if it comes Leprosy-664A on the 10th day of any month, at it can trash the : Sweden ^, 1994. Leprosy-5600: Leprosy-5600 is a on the Leprosy-B . It vup to four . or . in the b5,600 The >and in the DOS not be . Leprosy-5600 cannot recognize , so the bfour rin a rover and over again. function , and usually in the of the "Not enough can be in the 5, as can the Leprosy-B: The major differences between the Leprosy and Leprosy-B Leprosy-B uses a slightly different encryption method, thus allowing it to avoid detection Leprosy was ly, instead of sall in the Eselected for t, Leprosy-B wfour in the X. If four non- `do not exist in the E, it move up one level in the Estructure and wup to four E. Like Leprosy, it s the `. The Leprosy replaced "ATTENTION! Your computer has !afflicted the incurable decay is the fate wrought by Leprosy Strain B, a employing Cybernetic Mutation Technology (tm) and invented by PCM2 08/90." Leprosy-C: Leprosy-C is on the Leprosy-B , and has to avoid detection by products familiar the Leprosy at the of its ~. Leprosy-C s up to three . in the X. If it cannot find three candi win the E, it move upward in the Estructure. b320 5. The >and not be Leprosy-C fail to either ing in an access to the the exiting L, or too big to fit into ring. May, Leprosy-D: to Leprosy-C, Leprosy-D's major difference is -and . ,. Leprosy-D s the b370 May, Leprosy-FVHS: Leprosy-FVHS is a on the Leprosy-B . It vup to four . or . in the b2,218 The >and in the DOS not be . Leprosy-FVHS Ms the "Allocating . Please wait accessing , please turn off all RAM and press >>Enter<< to continue The can be in the all , as can the "Copyright(C) by Fairview High School, Boulder Colorado, 80303." "Person/People/Things we >>hate<<: Paul Harvey's sucks ! MacinTrashes Suck "Graham (Not Alexander but fuck ass kids whjo calls himself graham) sucks!" "Person/People we admire:Lynn Bari, Jean Arthur, Jane Russel, Victoria Hill" "Person/People/Things we thing are cool: Cybernetics, C++, 39 Steps, The Mafia, maybe "Monty Python". XX" ".. *. NightCrawler 3.0: The NightCrawler 3.0 is a uof . . It of the . in the the b562 by the Silver Surfer not function , and the is usually too big to fit in In addition to the , the in the NIGHTCRAWLER VERSION 3.0" (C) SECTOR INFECTOR" RMIT: on the Leprosy-B , RMIT vboth . ,. It vup to four preference for . b666 by the RMIT 5. RMIT 9the "V3" in the btwo ). The can be all is "*. -". fail to , and may in the too big to fit in Scribble: fSweden in , Scribble is on the Leprosy , but has to avoid detection by products familiar Leprosy . Scribble s up to three in the X. It before . lthe 5. The and not be all of the in the of the next in the "Legalize Graffitipainting! Scribble 1.00 (c) VIRINC" hang . The in the and not : Sweden Silver Surfer: The Silver Surfer is a uof . -and . ,. It vup to five in the X. It vall . in a before it start lthe b946 by the Silver Surfer not function , usually ing the to the DOS prompt much Kactivity. The in the Uin Execu "I've never !able to ascertain its exact nature, but I'm certain of its" - dementia, paranoia, shizophrenia, hallucinations. The end "is always death... The lives to reproduce - it seems to "purpose... r, the organism's central nervois suffers a" "complete breakdown, leading to death." "-- Silver Surfer #61" "The Silver Surfer - Lep-B - by" The " Uin Execu may be The Plague: The Plague is a of . -and . ,. It vup to three in the lthe b591 by the The Plague not function . For . `, the usually be Lupon too big to fit in The Plague and it cannot find an randomness to whether or not actually , the "Autopsy indicates the cause of death was THE PLAGUE Dedicated to the dudes at SHHS VIVE LE SHE-MAN!" While L, the garbage 4, rendering it unrecoverable. : Houston, Texas, Unites States Xabaras: Xabaras is a the Leprosy-B . It vup to four . in the b1,972 ). The usually not and Zof them usually s in a hang or unexpected s. The in the Xabaras , and cannot be seen "Xabaras...the of the devil!!" -.. Access denied" "Your PC has rby XABARAS VIRUS" "Created by Cracker Jack (c) IVRL" : Italy See: Silver Dollar PZPAPN Liberty : Liberty Liberty-A, Liberty-B, Liberty-C, Liberty-D, Liberty-E, Liberty-F, Liberty-G, Liberty-H, Liberty-I, Liberty-J G: May, W, and .OVL i; BSC; >and Sydney, Australia R: 2,859 - 2,873 5: PRfAK - \, NAV, : CleanUp, or The Liberty }in Sydney, Australia in May, Liberty is a generic W, and overlay ,may r. In advanced ts, the The Liberty gets its fthe "Liberty" in all `. In . `, it in the last 3K of the a. In . `, it near the very "of the , as well as in the last 3K of the The the Liberty the . Liberty at the top of $the Aby 8,496 {21 and 24 mby the , as well map to becoming Xmay be rby the . All . r, but `over 2K in r. Overlay between 2,859 and 2,873 ), and the hex character : 80722D80FA81772880. The main body of the at the end of all had >and in the DOS the >and `can be identified by the near the "of the "- M Y S T I C - COPYRIGHT (C) 1989-2000, by SsAsMsUsEsL" Nnot `, the area where would ed in be 00h Liberty is a self-encrypting . It is not yet if it is destructive. of Liberty are: Liberty-B: strain is to the Liberty . The s at the end of all `has to: C8004C40464842020EB. The word "MAGIC" drepeated together many s in `. The >and in the DOS in Liberty-B `to the >and Liberty-C: is very to Liberty-B, are 16 1. Like Liberty-B, the word "MAGIC" repeated together many s in `. The s at the end of all 1to: C8004C404648422020E9. >and >and Liberty-D: gequivalent to Liberty, the "MAGIC" repeated many Liberty-E: gequivalent to Liberty, not 9the "MAGIC" at all. Liberty-F: Liberty-F is almost identical to Liberty-D, it has two differ in the Liberty-G: Liberty-G is almost identical to Liberty-E, it has two differ in it's Liberty-H: Liberty-H is almost identical to Liberty-D and Liberty-F, differing by two in the has 13 differ fLiberty-C, and seven differ fLiberty-B. Liberty-I: Liberty-I is almost identical to Liberty-E and Liberty-G, it has two in the differ. Liberty-J: Liberty-J is almost identical to Liberty-H, three in the differ. See: Liberty-2 PZPAPN Liberty-2 : Liberty-2 Liberty-2A, Liberty-2B, Liberty-2C W, and .OVL i; BSC; >and Sydney, Australia R: 2,869 - 2,883 5: PRfAK - \, NAV, The Liberty-2 is actually a group of three to be earlier s of the Liberty Cin the preceding entry. Liberty-2 is a generic W, and overlay r. In advanced ts, the The Liberty-2 gets its fthe "Liberty" in all `. In . `, it in the last 3K of the a. In . `, it near the very "of the , as well as in the last 3K of the The the Liberty-2 the . Liberty-2 in high ing in a Aof 8,512 . It hooks {21 and 24, as well as |67. becoming Xmay be rby the . All . r, but `over 2K in r. Overlay between 2,869 and 2,883 ). The main body of the at the end of all Liberty-2 lhad >and in the DOS 3to reflect the `can be identified by the near the "of the "- M Y S T I C - COPYRIGHT (C) 1989-2000, by SsAsMsUsEsL" Nnot `, the area where would ed in be 00h The s in all Liberty-2 it is much longer qhere: "MAGICMAGICMAGICMAGICMAGICMAGICMAGICMAGICMAGICMAGIC" Liberty-2 is a self-encrypting . It is not yet if it is destructive. of Liberty are: Liberty-2B: gequivalent to Liberty-2, has two differ fthe Liberty-2 Liberty-2C: gequivalent to Liberty-2, has six differ fboth the Liberty-2 and Liberty-2B See: Liberty PZPAPN Liberty-1172 : Liberty-1172 Lib1172 R: 1,172 - 1,186 5: PRhCK - n, NAV, The Liberty-1172 . Its . Liberty-1172 is a uof . bLiberty-1172 X, the Liberty-1172 at the top $the and , as qby the DOS @by 1,568 |12's not !moved. {09 and 21 Liberty-1172 in high Liberty-1172 has , it pof 1,172 to 1,186 The at the end of the a. The >and in the DOS to the >and . One can be in the "Liberty" alo be dnear the "of the is how Liberty-1172 marks the It is if Liberty-1172 PZPAPN Lippi-286 : Lippi-286 Lippi R: 286 5: PNCK - 3.96+, NAV 3.0+, .2.0+ The Lippi-286, or Lippi, . Its . Lippi-286 is a non- uof . the Lippi-286 X, the Lippi-286 wone . in the 286 at the end of the a. The >and in the DOS . The in the Lippi-286 5in all "(C)RomlSoft(LipPI) Lippi-286 Nn't to do PZPAPN Lisbon : Lisbon , 1989 i; unusable `(see Lisbon, Portugal R: 648 5: PNCK - , NAV, : CleanUp, \, NAV, The Lisbon is a strain of the Jean Luz in Portugal in , 1989. The is very , except in order to avoid identification/detection could identify the Lisbon is X, the wor corrupt one . ain the E. If a r, 648 to the at the end of the lthe $near the end of the "@AIDS" If a was corrupted instead of r, the five 4of the be "@AIDS". corrupted no longer , usually ing in a hang X. Corrupted any psince the bfive 4were by the "@AIDS" of Lisbon are: Lisbon-B: to Lisbon, Nnot "@AIDS" . It may hang the corrupted by be begin the hex "FEB8140C50", and the actual Lisbon-B Lisbon-B2: Lisbon-B2 is a very minor of Lisbon-B, differing by 2 wise, it is gidentical. See: PZPAPN Little Br 00D X PTD : Little Br 307 The R: 307 5: SRCE - Spawning 3.96+, NAV 3.0+, 1.53S+, .2.0+ The Little Br fthe is a spawning in technique to the Aids 2 and Twin-351 The Little Br Little Br in a "hole" in low in the data area, hooking |21. be no , the Little Br X. The . not be , but a corresponding . be created by the of 307 corresponding . pure 5and =stamp in the DOS it was created. The can be in the 307 "Little Br Since DOS before . the , the corresponding b. The . finished start the . of Little Br Little Br -299: to the Little Br creates `of 299 )for X. The same in the 9ed in Little Br -300: to the Little Br creates `of 300 )for X. The same in the 9ed in Little Br -321: to the Little Br creates `of 321 )for : The May, Little Br -349: Little Br -349 is a 349 of the Little Br . It creates 349 *companion The companion lthe attributes read- , and hidden set so not be in the DOS Little Br -349 on the Tuesday in , the day major elections are held in the Ming the a beep multiple "DID YOU VOTE, SHITHEAD??" can be din the companion along Little Br -361: Little Br -361 is a 361 the Little Br . It creates 361 companion . The companion lthe attributes read- , and hidden set so not be in the DOS One can be din the hidden . -*.*" PZPAPN Little Girl : Little Girl Little Girl 2.0 3; write protect California, R: 1,008 5: PRhAK - \, NAV, 1.53S+, The Little Girl Gat a large corporation in the state of California, in the . Little Girl is a uof . -and . ,. It is a destructive the contents of the The the Little Girl X, the Little Girl at the top of $the , as qby the DOS @by 1,280 , the Little Girl ,if it was not the Little Girl , it and . for any reason. Little Girl of 1,008 at the end of the The >and in the DOS to the >and . The can be in the 5in Little Girl awas destroyed by Little girl ver 2.00" The Little Girl on a random basis, at Zof an in the the Oand Ming the awas destroyed by Little girl ver 2.00" the Little Girl [write protect to access on a write protected J. The interfers batch `, and the may be prompted to reinsert the the batch even it is still in the of Little Girl are: Little Girl 3.0: A 1,200 of the Little Girl is 1,536 ), hooking |21. It -and . , or copied, adding 1,200 )to the . The at the end of the a. The >and to the >and . The can be in the 5in all Little Girl 3.0 awas destroyed by The little girl ver 3.0" The Little Girl 3.0 corrupts .BAT, .SYS, and data are accessed, the second . Write protect fwrite protected PZPAPN Little Pieces : Little Pieces 1374, Pieces j; unexpected clears Italy R: 1,374 5: PRaE - n, NAV, The Little Pieces , in Italy. is a 1,374 uof . The Little Pieces is the . The area where it is 1,392 )long and labeled -MAND Data in low mapping utilities combine area 6interpreter, so the 6interpreter to be 1,392 )longer expected. {13, 16, and 21 are mby the Little Pieces Little Pieces is , it by 1,374 )and lthe at the end of the >and the the Little Pieces #cleared unexpectedly a key is pressed on the . The is usually is cleared, not always: "One of days I'm going to cut you into little pieces" cannot be viewed in `as it is in the [unexpected ring, requiring the to be re &ed. PZPAPN Little-139 : Little-139 G: March, R: 139 5: PNCK - The Little-139 in March, documentation indicating it was written for the " bInternational Writing Contest " sponsored by American Eagle Publications, Inc. It was source 5, and is a simple, non- the Little-139 wone . in the pof 139 the at the "of the a. The >and in the DOS to the >and The in the Little-139 Nn't do PZPAPN Loa Duong : Loa Duong Lao Duong G: May, BSC; ; music; Thailand R: N/A 5: BRtM - /2.0+, NAV 3.0+ : CleanUp, or M- The Loa Duong }in May, in Thailand. Loa Duong is a uof the Kand floppy the Loa Duong &ed, Loa Duong at the top of $the |12's be moved. , as measured by the DOS Aby 1,024 ). The Loa Duong is , it wany non-write protected are exposed to the . A DIR 6, such as DIR A: be enough to wthe The Loa Duong stores the C: at Side 0, Cylinder 0, 8. On high density 5.25" the be stored at 28. On double density 5.25" I, the be stored 11. Since the used to store the Iis the last of the root E, any aentries were be lost. Loa Duong Kaccesses play a Laotian funeral dirge on the speaker. PZPAPN LockUp : LockUp LK, Mithrandir III G: May, Hidden . `created; ; "Divide Overflow" Tmay Sweden R: 496 5: SRhE - Spawning 3.96+, NAV 3.0+, 1.53S+, .2.0+ Bthe hidden . The LockUp }in Sweden in May, is a spawning or companion , and uses techniques to avoid detection. The the LockUp the at the top of $the '. It Nnot move |12's qby the DOS @by 1,568 mby LockUp in the LockUp , it are not , but rather the creates a hidden 496 ain the the same base hidden `always lthe >and of 3-24-23 2:17a in the DOS has created the hidden a, any Ythe the companion . Xby DOS. The can be din the 496 *companion `created by the LockUp "DeMoRaLiZeD YoUtH" "Mithrandir III" the LockUp , it to mask the presence of the hidden . `in order to avoid detection by . The may not see the hidden `, so of LockUp are: LockUp-B: gequivalent to the has three differ. : Sweden See: Mithrandir PZPAPN Lockup 3.0 : Lockup 3.0 G: May, R: 2,969 - 2,983 5: PRsA - 2.58+, 6.64+, \2.13+, 2.58+, 6.64+ The Lockup 3.0 in May, . Its . Lockup 3.0 is a uof . -and . , but not bLockup 3.0 X, the Lockup 3.0 as a low of 3,280 mby Lockup 3.0 in the Lockup 3.0 , it and . pof 2,969 at the "of the pof 2,969 to 2,983 at the end of the a. In both cases, the >and in the DOS to the >and . The in the 5in all Lockup 3.0 "No.1" Pressing the CTRL and Break keys in a hang. PZPAPN 00$ U jPT$ : Loki Loki-1237, Merde-5 R: 1,237 - 1,252 5: PRhAK - 3.96+, NAV 3.0+, V112+, n1.05+, 8/93s+, .2.0+, V113+ The Loki, Loki-1237 or Merde-5, Its ~are . Loki is a uof . -and . The Loki is X, the Loki at the top of $the ', hooking {21 and 71. 4,336 ). It wthe copy of ed to by the -SPEC en mental variable at if it was not the Loki , it pof 1,237 ), while . by 1,237 to 1,252 ). In both cases the at the end of the a. The in the DOS not be . The can be dnear the end of all "Loki" Loki [frequent of Loki are: Loki-354: Loki-354 or Merde-6, is a uof . ,. Unlike the Loki pof 354 at the end of the in the Loki-973: Loki-973 is a uof . on the Loki . It at the top of $the X, hooking {21 and 71. Loki-973 pof 973 at the end of the The >and in the DOS not be . The in the 5in all Loki-973 me, I LIKE IT !-Loki-nator!" jfrequently Loki-1234: Loki-1234 is a uof . on the Loki . It at the top of $the X, hooking |21. , Loki-1234 -and . pof 1,234 ). . by 1,234 to 1,248 ). In both cases the at the end of the a. The in the DOS not be The in the 5in all Loki-1234 "LOKI" "Loki" jfrequently -and . are PZPAPN Lokjaw : Lokjaw Lokjaw-Drei G: March, `created; ; noisy Kaccess & R: 898 5: SRhC - Spawning 30.00+, 8/93S+, NAV 3.0+, 6.64+, 1.25+ Bthe 898 *companion The Lokjaw, or Lokjaw-Drei, in March, . Its . Lokjaw is a spawning or companion creating 898 `. The Lokjaw on the Civil War bLokjaw X, the Lokjaw at the top of $the ', hooking |21. , as qby the DOS @by 4,096 |12's not be moved. the Lokjaw , it Xby creating an 898 the same base . The actual . not be . The 898 lthe >and in the DOS Efor the . The in the 898 *companion 9ing the Lokjaw -(o)" "Lokjaw-Drei" Lokjaw activate, accessing the Kwhile emiting a scraping noise on the speaker. The be unresponsive, requiring the to re &or reset the To dis wa Lokjaw t, the should power off the and fa write-protected, K. The 898 *companion . `should of Lokjaw are: Lokjaw-Zwei: , the Lokjaw-Zwei is 894 of the . It 8the -(o)" "Lokjaw-Zwei" The Lokjaw-Zwei clear the , or compress the to a 2-line face in the center of the , and access the The be hung and lto be reset. See: Civil War PZPAPN Lord-933 : Lord-933 G: March, i; "beep" speaker R: 933 - 948 5: PNCK - Bthe 898 *companion The Lord-933 in March, . Its . Lord-933 is a uof . the Lord-933 X, the Lord-933 wone . in the E. A "beep" be emitted fthe speaker, and the to run the Lord-933 pof 933 to 948 at the end of the a. The >and in the DOS not be . The are in the 5in all Lord-933 "*.com" "qvCreated by Death Lord" PZPAPN Los-693 : Los-693 R: 693 5: PRhC - \, NAV, 3.96+, NAV 3.0+, 8/93+, .2.0+ The Los-693 , and is the . Los-693 is a uof . but not ,. It alter the ) but not actually place a copy of the bLos-693 X, the Los-693 at the top of $the ', as well as alter the qby the DOS @by 768 to 784 mby the the Los-693 , it pof 693 at the end of the a. The in the DOS to the >and . The in the 5in all Los-693 "Lz" "593?" The "Lz" ocurs at the very end of all `. It is what Los-693 PZPAPN LoveChild-2710 : LoveChild-2710 G: March, i; DOS R: 2,710 5: PRhCK - 3.96+, The LoveChild-2710 in March, . Its . LoveChild-2710 is a bLoveChild-2710 at the top of $the ', hooking {13 and 24. , as qby the DOS @by 4,096 12's !moved. , the ,if it was not , the LoveChild-2710 for any reason. pof 2,710 the pis not . LoveChild-2710 at the end of `. The >and in the DOS not be . No the the LoveChild-2710 find the , the DOS indicate Ton all PZPAPN LowerCase : LowerCase LowerCase-B, LCV 2IBM to ibm in R: 864 5: PNCK - , NAV, The LowerCase . Its . LowerCase is a of . LowerCase is X, LowerCase search the Oand Efor an w. If it finds an abefore it encounters aof less , it LowerCase stop searching the aof less )is encountered, not further the LowerCase by 864 ). The at the "of the . If the 9ed the "IBM", the 1it to "ibm" LowerCase Nn't 9any mechanism. of LowerCase are: LowerCase-B: gequivalent to the LowerCase has seven in its differ. PZPAPN Lozinsky : Lozinsky Lozinsky-1018, Lozinsky-1023B R: 1,023 5: PRtCK - \, NAV, The Lozinsky fthe Lozinsky is a uof . Lozinsky is X, the at the top of $the |12's be moved so report 2,048 less what is actually zed. {13 and 21 mby the Lozinsky is , it are for any reason. pof 1,023 )and lthe the end of the >and in the to the >and rby Lozinsky. It is if Lozinsky of Lozinsky are: Lozinsky-1018: to the Lozinsky is five )smaller, adding 1,018 )to the end of Lozinsky-1023B: gequivalent to the has two in its differ. See: Zherkov PZPAPN LPT Off : LPT Off 2; interfers/disables printing R: 256 5: PRxCK - 3.96+, NAV 3.0+, 1.25+ The LPT Off , and is . LPT Off is a uof . bLPT Off X, the LPT Off in a "hole" in low, , hooking {17 and 21. and , as qby the DOS not be the LPT Off , it very small . 256 at the end of the a. The >and in the DOS to the >and . The can be in the LPT Off "(c) LPT Off interfers printing on the printers by disabling the functionality of the 17h PZPAPN Luca-309 : Luca-309 R: 309 5: PRCK - 3.96+, NAV 3.0+, .2.0+, 1.25+ The Luca-309 . Luca-309 is a u. It bLuca-309 X, the Luca-309 in a "hole" in low , hooking |21. be no the DOS . The wone . in the , the Luca-309 wone . in the pof 309 at the end of the a. The >and in the DOS not be . The in the Luca-309 5in all It is if Luca-309 PZPAPN Lucifer : Lucifer G: May, may dis Italy R: 1,086 5: PRtCK - , NAV, The Lucifer in May, . It is fItaly. Lucifer is a uof . Lucifer is X, the at the top of $the |12's is not moved. The DOS report is 1,136 )less expected by the and 21 mby the Lucifer is , it `over 2K in X. If X, it by 1,086 hides the pif it is . While most not >and in the , if the was 12:00a, the rand Lucifer is . Lucifer at the end of The Lucifer 8two can be , the last of s at the very end of the "Lucifer (C) by C.J." "C.J." It is if Lucifer See: Alfa Damage V1024 PZPAPN Lurve : Lurve ARCV-718 G: March, ; DOS England R: 718 5: PRhC - 3.96+, 1.25+ The Lurve, or ARCV-718, in March, , and is fEngland. Lurve is a semi- , but not bLurve X, the Lurve at the top of but $the ', hooking |21. and , as qby the DOS @by 2,048 |12's !moved. the Lurve , it for any reason. pof 718 ), however the pis hidden . The Lurve at the end of the a. The >and in the DOS not be The in the Lurve "[SOLOMoN] ICE-9" "Hello Dr. Sol." "Fido." "Lurve U lots" "ICE-9" "(c) ARCV." "P.S." "Apache sez Hi(Dos)" the DOS the Lurve , it detect Ton all It is what Lurve PZPAPN LV 1.2 : LV 1.2 The R: 477 5: ONK - 3.96+, 8/93S+, NAV 3.0+, 8/93+, .2.0+ The LV 1.2 fThe . LV 1.2 is a ,. It Nnot the LV 1.2 wthe copy of in the root Eof the O. It s 477 )of the slack (hex 00) area at the end of the a. The not be . The >and the DOS to the >and . The 9ed in the ,IS INFECTED by VIRUS LV .1.2 !!!" PZPAPN Lycee : Lycee Lycee-1788, Lyceum seconds set to "00"; R: 1,788 5: PRhAK - 3.96+, NAV 3.0+, 8/93+, .2.0+ The Lycee, or Lycee-1788, . It is fthe . Lycee is a uof . -and . ,. It employs techniques to avoid detection and quickly spreads the bLycee X, the Lycee at the top of but $the , as qby the DOS by 2,368 {08, 09, and 21 mby Lycee , the Lycee ,if it was not the Lycee , it X, copied, or for any reason. 1,788 ), but the be hidden . The Lycee can be dat the end `. The in the DOS the seconds field is set to "00", may ing to la blank . No in the Lycee the Lycee Ton all the DOS of Lycee are: Lycee-1832: A 1,832 of the Lycee , Lycee-1832's is 2,416 ). It hooks 08, 09, and 21. pof 1,832 be hidden . The seconds field in the in the DOS be set to "02". The in the 5, and hence not "Welcome to Lycee of xTechnologies !" Lycee-1888: A 1,888 of the Lycee , Lycee-1888's is 2,928 ). It hooks 09, 13 and 21. pof 1,888 be hidden . The oseconds field, not be Lycee-1975: A 1,975 of the Lycee , Lycee-1975's is 2,576 ). It hooks 08, 09, and 21. pof 1,975 ), the pis not hidden . The >and in the DOS . No in the may detect as the "Feist" PZPAPN Lythyum : Lythyum i; hidden Kroot R: 502 5: PNCK - 3.96+, 1.53S+, 1.25+ The Lythyum , and is . Lythyum is a of . ,. It was written by a member of the Virulent Graffiti writing group. Lythyum X, the Lythyum wone . in the 502 at the end of the a. The >and in the DOS . The in the Lythyum "lythyum, the attitude adjuster, ViRuLeNT GRaFFiTi" "\Lythyum.hi! *. rall of the . `in the E, it create a hidden a, LYTHYUM.HI!, in the O's root the next The hidden 9the of Lythyum are: Lythyum-B: to the Lythyum , Lythyum-B is a very minor PZPAPN : LZ Noon Beep `created The R: 5,085 - 8,847 5: SNA - Spawning NAV, V113+, 1.25+, 1.0A06+ The LZ . It is . LZ is a spawing the . it not LZ is r, the LZ search the Efor . . For it encounters, the check to see if a corresponding . the same base . If is not, the create one. The created . 9the 5, and be 5,085 to 8,847 The >and be identical to the >and in the DOS The LZ spreads by the executing a . executing the base . Since DOS abefore a . , the 5in the . has completed Z, it load and Ythe corresponding . 5is LZ W'd, and the . `created by the 9the typically 9ed in LZ-2: }in The , LZ-2 is a later of the LZ . It wup to three . in the O's root ever an X. The corresponding . 5,106 to 9,141 same =in the DOS the : The PZPAPN : LZRQ Whit BSC; R: N/A 5: BRtX - \, NAV, /2.0+, 2.58+ : CleanUp, M- K, or DOS SYS on The LZRQ . LZRQ is a and the ). It s to be related to the Den Zuk The fa LZRQ the LZRQ at the top of $the ', moving |12's , as qby the DOS @by 2,048 , the wthe if it was not the LZRQ , it wthe of any non-write protected Iaccessed on the On 360K 5.25" I, the write one 5to Side 1, Cylinder 39, 8, and copy the to Side 1, Cylinder 39, 9. The the at Side 0, Cylinder 0, On 1.2M 5.25" I, the write one 5to Side 1, Cylinder 79, 14, and copy the to Side 1, Cylinder 79, 15. The the at Side 0, Cylinder 0, On the K, the lwritten one 5to Side 0, Cylinder 0, 2, and copied the to Side 0, Cylinder 0, 3. The s the at Side 0, Cylinder 0, The s in the 5is "LZRQ", it in the extra 5, not the See: Den Zuk PZPAPN M.I.R. : M.I.R. G: May, i; BSC; .SYS &failures; garbling of R: 1,745 5: PRhAK - , NAV, `, & DOS SYS The M.I.R. in May by the PCVRF. It is is a of . -and . ,. It modifies and .SYS cannot areas. The M.I.R. is X, the at the top of $the {21 and 27 mby the qby the DOS be 3,584 )less is expected. At , the modified, the modification Nnot in an wious copy of the M.I.R. is , it -and . are at least 2K in pof 1,745 ), while by 1,745 to 1,759 ). In both cases, the at the end of the a. M. I. R. Nnot hide the p, nor alter the >and in the DOS One can be near the "of the "#.I.R. *-*-*-* Sign of the As an M.I.R. tprogresses, the aMSDOS.SYS may rby the Nnot wious copy of the , but is damaged. a M.I.R. modified and MSDOS.SYS, as well as an in a garbled >and , followed by the hanging. It is if M.I.R. See: PZPAPN Maaike : Maaike Maaike.164 , 1994 R: 164 5: ORsE - V116+, V116+ The Maaike , 1994. The sample was fThe cmonth a fa public domain tin Canada. Its . Maaike is a destroys . and interfers operation. bMaaike as a low TSR, hooking |21. The ed to the DOS prompt. the Maaike Zof an . in the replacing the . a 164 *copy of . The 164 lthe same as the >and . The hidden attribute be set, thus the Bd. No in the Zof . the Maaike in the "Bad The . `are un , and function if the not -and . primarily of the "Write fault Uwriting device AUX" or write protect fwrite protected of Maaike are: Maaike.250: A 250 of the Maaike 8the "Maaike I Love You !" }: Canada May, 1994 PZPAPN Macedonia : Macedonia R: 400 5: PRC - /, NAV, `, & DOS SYS The Macedonia . Its . Macedonia is a uof . The Macedonia is X, the be no qby the DOS by the Macedonia is , it occasionally pof 400 at the end of the be no 3to the >and in the DOS . The can be in the 5in Macedonia "MacedoniaToTheMacedonians" It is if Macedonia PZPAPN MacGyver : MacGyver i; TSR; DOS Taiwan R: 2,824 5: PRsE - 30.00+, NAV 3.0+, n1.04+, 1.53S+, 6.64+, 1.25+ The MacGyver . It is Taiwan. is a bMacGyver X, the MacGyver as a low TSR of 3,072 mby the the MacGyver , it pof 2,824 at the end of the a. The p, however, be hidden by the MacGyver is . The >and in the DOS . The in the MacGyver 5in all "SCANVIR.SHW" The in the 5, thus it is not "SCAN ZTEST WGOD MACGYVER V1.0 Written by JOEY in Keelung. TAIWAN" the MacGyver [frequent ly, the DOS indicate Ton all of MacGyver are: MacGyver 2.2: MacGyver 2.2 is a 3,160 of the MacGyver . Its TSR is 3,648 ), hooking |21. It -and . are . It Nnot copy. the MacGyver 2.2 pof 3,160 be hidden . No the 5, and the in the DOS not be : Taiwan ^, 1994. PZPAPN Madismo : Madismo R: 6,007 5: ONE - 30.00+, NAV 3.0+, The Madismo . Its . Madismo is a the Madismo access both the C: Oand the wall . in the are larger 6,000 completes , it Mthe to the DOS prompt: "Madismo Strikes Again!" lthe b6,007 the Madismo 5. The >and in the DOS to the . The in the "C:\ "MADISMO *. W>MADISMO.TXT" "MADISMO.TXT" dreading "Abort, Retry, Ignore, Fail?" "Madismo Strikes Again!" "*.*" "No matching the Madismo are permanently corrupted since the Nnot store the 6,007 should be replaced copies. PZPAPN Magnitogorsk 2048 : Magnitogorsk 2048 G: May, R: 2,048 5: PRhAK - , NAV, The Magnitogorsk 2048 Vin May, . It is fthe . Magnitogorsk 2048 is a later of the 2560 , and utilities detect it as 2560. The Magnitogorsk 2048 is X, the at the top of $the and , as measured by the DOS Aby 4,160 {08, 13, 21, and 22 mby the Magnitogorsk 2048 is , it and . larger 2,048 at the end of the . The >and in the not be Magnitogorsk 2048 it is X. In the case of ,, the not lany pas the portion of ,'s stack space. Magnitogorsk 2048 is a , as is 2560. While es do not hide do actively use techniques to avoid detection by utilities not aware of them. It is if Magnitogorsk 2048 See: 2560 PZPAPN Malaga : Malaga &failure on R: 2,612 - 2,626 5: PRshAB - W, & NAV, 1.53S+, The Malaga . Its . Malaga is a uof . -and . , as well as the Iand Nnot ,. It is a it imploys a technique to the Brain to hide the The the Malaga the Malaga as a low TSR of 5,168 ), hooking {08, 13, and 21. At , it wthe of the O, and the in the Later, fthe J, the fail if it is a J, but the Malaga ODOS &ing fthe in the becoming at the top $the , as qby the DOS @by 4,096 the Malaga , it wone . Ys any a DOS DIR 6is issued. ( a DIR 6is performed t, or is as a low TSR.) In the case of Z, it the ;ly executing if it was not the Malaga pof 2,612 to 2,626 ), the at the end of the . The >and in the DOS not be . The can be in the 5in all "MSDOS4.0" In the case of the , the and a copy of the Malaga be written to the Kstarting at 0 of the last side or track of the K. The precede the copy of the Since Malaga is a regards to the t, if you check your utilities and find it on `, you need to power off the and check the again &ing , write-protected wise, the tmay be missed, and you promptly It is if Malaga of Malaga are: Inofensivo: on the Malaga , Inofensivo is a 2,661 . Its is 5,184 ), hooking {08, 13, and 21. , it -and . X, as well as one a DOS DIR 6is issued. 2,661 to 2,674 at the end of the a. The >and in the DOS not be . The can be in the in all Inofensivo "inofensivo "MSDOS4.0" Malaga-B: to the a minor has nineteen differ fthe PZPAPN Malaise : Malaise V-IVL110 France R: 1,357 - 1,371 5: PRhAK - , NAV, 3.96+, 8/93+, .2.0+, 1.0A06+ The Malaise Gin France in . Malaise is a uof . -and . The the Malaise X, the Malaise the top of $the '. It not move |12's , as measured by the DOS by 4,096 mby Malaise in the Malaise , it by 1,357 to 1,371 at the end of the a. The in the DOS not be Several can be in the 5in Malaise "Welcome into the "(c) Info "Laborato "V-IVL110" "To inactivate me,just set to "*" the "in brackets:" "[#]" "Next , be more prudent !" Malaise Nn't to do of Malaise are: Malaise-524: on the Malaise by the Locks. Malaise-524 is a 524 uof . ,. Its is 1,024 ), hooking {1C and 21. , it X, increasing by 524 ). The >and in the DOS to the and . The can be the 5in all Malaise-524 -com" The at the end of the : France May, Malaise-1743: on the Malaise is 2,000 ), hooking 21. , it wthe copy of in the C: root Eif it was not Malaise-1743 vone . -or . in the a DOS DIR 6is issued. 1,743 to 1,757 at the end of the a, however the hidden . The >and in the DOS . No in the Malaise-1743 a sluggish response to DOS DIR 6, and the DOS : France Malaise-B: to the has had the "[#]" 1to "[*]". : France PZPAPN Malign : Malign Malign-575 =minutes set to 01; interfers DOS Dir R: 575 5: PRhCK - 3.96+, NAV 3.0+, The Malign, or Malign-575, and is fthe . Malign is a uof . bMalign X, the Malign at the top of $the ', hooking {21 and 22. , as qby the DOS @by 2,304 , the Malign wthe copy of in the C: Oroot the Malign , it , or a DOS Dir is performed. of 575 at the "of the a. The in the DOS the minutes field be set to "01". The in the Malign 5in all "Malign$?" "*.com" Malign may interfer Mof output fthe DOS Dir othe addition of a line for a "Malign of Malign are: Malign-630: A 630 of the Malign . It 8the "Malign$Wait" "*.com" PZPAPN Malmsey : Malmsey fail to function Canada R: 495 5: ONCK - can, n, NAV 3.0+, 6.60+, 1.25+, 6.64+ The Malmsey , and was written by a person using the Lucifer Messiah. Malmsey is Canada. is a ,. A later of the , Malmsey 2 $, is a the Malmsey X, the Malmsey wone . in the b495 )of the host a. The >and in the DOS to the >and . The can be din all Malmsey "[Malmsey Habitat v. 1.3]" "Warmest Regards to RABID" f-- ANARKICK SYSTEMS!" Malmsey Nn't to do be permanently corrupted. of Malmsey are: Malmsey 2: A later of the Malmsey vone . pof 1,703 to 1,717 at the end of the a. The Malmsey 2 , adding an 1,712 t. The >and in the DOS not be . The can be din the 5in Malmsey 2 "Malmsey Habitat v. 2.0" "Lucifer Messiah -- ANARKICK SYSTEMS 07-18-" "Hap Birthday : Canada Malmsey 3 Beta: A later of the Malmsey 2 is a uof . -and . ,. It at the top of $the DOS ', hooking {3 and 21. and , as qby the DOS @by 2,048 , Malmsey 3 Beta -and . pof 806 at the end of the a. The >and in the DOS not be . The may be Lby the "Gotcha! [MALMSEY HABITAT v3. Lucifer Messiah -- ANARKICK SYSTEMS" in the : Canada March, PZPAPN Maltese Amoeba : Maltese Amoeba Irish, Maltese :; flashing &failure Malta Ireland R: 2,504 - 2,564 5: PRtA - , NAV, The Maltese Amoeba Gin Ireland in . Its , however, is Malta. At the of its it was t to be wide-spread in Ireland. The Maltese Amoeba is a uof . -and . `. It The Maltese Amoeba is Maltese Amoeba at the top of $the Aby 4,096 ), and |12's !moved. Maltese Amoeba hook , Maltese Amoeba -and . by 2,504 to 2,564 ), the at the end of the be no 3in the >and in the DOS The Maltese Amoeba is a destructive on ATs on March 15 and 1. On >s, it bfour of cylinders 0 through 29 of the Oand any Os. has completed over- writing the "of the b30 cylinders of O, it proceed to a bright, flashing M, leaving the in a loop. is re &ed, the cpoem L, followed by a hang: "To see a world in a grain of sand, And a heaven in a flower Hold infinity in the palm of your hand And eternity in an hour. THE VIRUS 16/3/91". S, so the cannot be seen in in the "AMOEBA by the Hacker Twins (C) is nothing, wait for the release of AMOEBA II - The universal u,hidden to any eye by ours! Dedicated to the University of Malta-the worst educational in the universe,and the destroyer of 5X2 years of human life". in the of the has activated. of Maltese Amoeba are: Maltese Amoeba-B: A minor of the Maltese Amoeba adds 2,504 to 2,571 the . -and . at the end of the a. The in the , as well as the poem "AMOEBA by the Hacker Twins (C) is nothing, wait for the release of AMOEBA II The universal u, hidden to any eye by ours! Dedicated to the University of Malta- the worst educational in the universe, and the destroyer of 5X2 years of human life." : Malta PZPAPN Mannequin : Mannequin ; interference printing R: 778 5: PRhA - n, NAV, .2.0+ The Mannequin . Its . Mannequin is a uof . -and . `. It Nnot The Mannequin is X, the Mannequin at the top of $the , as qby the DOS @by 848 |12's !moved. {17 and 21 mby the Mannequin the Mannequin , it and . pof 778 at the end of the a. The >and in a DOS . Two can be in the 5in Mannequin "RQSP2" Mannequin may [difficults or interference to print to the printer. PZPAPN Manola : Manola Spain R: 957 5: PRhC - /, NAV, The Manola fSpain. It is uof . , but not The the Manola the Manola at the top of $the |12's !moved. , as qby the DOS by 976 mby the Manola At the of becoming , the Manola check to see if the ctwo r, and wthem if are not C:\DOS\FORMAT. C:\DOS\KEYB. the Manola , it pof 957 The at the end of the . The >and in the DOS The can be in the all Manola "Soy un Manuel de tipo C" "C:\DOS\FORMAT. -C:\DOS\KEYB. "KEYBOARD.SYS" It is if Manola PZPAPN Manta : Manta i; AUTO WC.BAT & CONFIG.SYS replaced; fail to R: 1,077 5: PNCK - , NAV, The Manta . Its Manta is a uof . ,. Manta is on the VCS Manta is X, up to four . `in the Emay be rby the Manta ly, the may be L, and the AUTO WC.BAT and CONFIG.SYS OC: may be replaced: "RAM Parity U@ 0F67:1B2C (C)ontinue (S)hut off NMI (R)e If C is entered for "Continue", the most likely function A blank entry may be created in the Efor a 512 Nnot always the Manta 1,077 ), the at the end of the The 512 replaced AUTO WC.BAT and CONFIG.SYS on 9the , and several lines of in German. See: VCS PZPAPN Marauder : Marauder Canada R: 860 5: PNAK - n, NAV, 1.53S+, The Marauder . It is fCanada. Marauder is a ,. It is destructive ^2nd of any year. Marauder is X, the Marauder search the Efor an w. If the Marauder Nn't find a win the E, it move up one level in the Estructure and check for an If it still hasn't a, it continue searching upward in the Estructure. If the root is r Qed, it search down through the structure for a candi a candi d, the wit and the Marauder pof 860 at the end of the be no 3to the >and DOS Marauder is an and no in the ^2nd of any year, the Marauder activate. >, the Marauder `in the repeated over and over again: "= [Marauder] Hellraiser - Phalcon/Skism." The >and to the >and in the DOS of Marauder are: DeadPool: , DeadPool is a 560 of the Marauder . It vone . X. If Nnot exist in the E, it search one E. If an is still not d, it jump to the O's root DeadPool pof 560 at the end of the be no 3to the >and in the DOS . The in the DeadPool "Deadpool by Phalcon/Skism" DeadPool the 808th generation of t, at the word "Deadpool" d on the : USA See: Marl PZPAPN March 25th : March 25th , 1994 corrupts KFAT & possibly `on 3/25 R: 1,026 - 1,040 5: PRhAK - \2.10g+, 2.11a+, 2.58+, V114+, 6.64+ V114+, 2.58+, 6.64+ The March 25th , 1994. Its is a uof . -and . ,. It is destructive on March 25th of any year. bMarch 25th at the top of but $the ', hooking |21. and , as qby the DOS @by 1,056 |12's be moved. , the March 25th -and . on the . It ,on the of 1,026 to 1,040 at the end of the a. The >and in the DOS not be . No in the The March 25th on March 25th of any year. At , the the . It may corrupt -and . PZPAPN Mardi Bros : Mardi Bros BSC; volume label France R: N/A 5: FR - Floppy \, NAV, : CleanUp, M- K, or DOS SYS The Mardi Bros in France. is a uof floppy Nnot the Mardi Bros , the . It resides in 7,168 the top of , but $the DOS '. The can be seen using the DOS 6, or several mapping utilities. Mardi Bros wany non-write protected exposed to the Ican be easily identified volume label 1to "Mardi Bros". The show the cfor the J's Volume label "Volume Mardi Bros created ira 0, 1980 12:00a" While the on the lthe DOS still remaining, it include the cphrase near the end: "Sudah ada vaksin" It is if Mardi Bros is destructive, it s to do nothing but spread. Mardi Bros can be removed bpowering off the and re &ing clean write protected DOS J. The DOS SYS 6should be used to replace the . Alternately, M can be used cthe power-down and re PZPAPN Mark II : Mark II Mark ][ R: 350 - 351 5: PNCK - 8/93S+, n1.04+, 2.58+, 6.64+, NAV 3.0A06+, 2.58+, .2.0+, 1.25+, 6.64+, 1.0A06+ The Mark II, or Mark ][, . Its . Mark II is a uof . the Mark II wone . in the by 350 to 351 the at the end of the a. The and in the DOS to the >and . The can be in the 5in all Mark II Mark II Nn't to do PZPAPN : Marl R: 560 5: PNCK - D: NAV, 1.53S+, The Marl . Its ~, is . Marl is a uof . the Marl X, the Marl search the Eand wthe it finds. If E, it may the Marl pof 560 ). The at the end of the . The >and in the DOS not be . No in the Marl Nnot to do , and is an earlier of the Marauder See: Marauder PZPAPN Marzia : Marzia i; MBR ( =seconds = "62"; :; DOS Pisa, Italy R: 2,048 5: PRhAKX - W, & MBR 2.58+, 6.64+, 2.58+, 6.64+, 1.25+ `and repair MBR The Marzia }in Pisa, Italy in . Marzia is a , multi-partite -and . ,, as well as the &record ( bMarzia X, the Marzia at the top of the ', hooking |21. , as qby the DOS @by 3,072 |12's not be moved. , the wthe &record ( ) if it was not the Marzia , it pof 2,048 be hidden . The at the end of The >and in the DOS not to be the seconds field set to "62". The can be in the 5in all "MARZIA" "MARZIA3" The Marzia Nnot wvery small . 8destructive &record 2 hours becoming s of may notice the DOS indicate Ton all PZPAPN Matura : Matura i; unexpected accesses to C: R: 549 5: PNCK - 3.96+, NAV 3.0+, The Matura . Its . Matura is a uof . the Matura X, the Matura wone . on the and one on the C: pof 549 the end of the a. The >and in the DOS not be . The can be din all Matura "c:*.com" It is what Matura , but it destructive of Matura are: Matura 92: on the Matura is a . It at the top of $the ', taking up 1,776 ), and hooking 21. , it -and . the exception of by 1,626 to 1,641 at the end of the a. In the case of is no as the s a portion of the hex "00" slack area. 3in the DOS >and s on `. The are in the 5in all "exe -MAND" "MATURA92" PZPAPN : Max BSC, Buenos Aires, Argentina R: N/A 5: BRX - , NAV, /2.0+, 2.58+ The Max }in Buenos Aires, Argentina in Max is a and the ). It is destructive The Max , the Max at the top of $the , as qby the DOS @by 2,048 , the Max wthe is too large to fit entirely in the , so the extra portion of the be written to Side 0, Cylinder 0, 2. The dat Side 0, Cylinder 0, the Max , it wthe of any non-write protected is accessed on the . On 360K 5.25" I, the extra portion of the 5and the of the be written to the last two of the The Max on what would to a as a random basis. , it s the fthe PZPAPN Max.347 : Max.347 , 1994 &Record R: 347 5: PRtXCK - V116+, \2.13+, V116+ `& F- K/MBR on DOS 5.0+ The Max.347 , 1994. Its . Max.347 is a multi-partite vthe ) and . bMax.347 wthe , moving the to Side 0, Cylinder 0, 2. The not residence fthe Max.347 at the top of , but the ', moving |12's and , as qby the DOS @by 1,024 the Max.347 is , it of 347 at the end of the The >and in the DOS not be . The in the "[Max]" PZPAPN Mayak : Mayak Jews2 -, .SYS, & . slowdown; TSR; R: 2,339 5: PRsAK - W, & .SYS 3.96+, , NAV 3.0A06+, The Mayak . Its . Mayak is a W, and .SYS . It employs techniques to avoid detection. bMayak -or . the Mayak check .SYS `referenced in the C: CONFIG.SYS a, and .SYS it completes `, it not be , and The next fthe C: O, the Mayak fthe r.SYS referenced in the C: OCONFIG.SYS a. The in the Config area of allocating 2,464 by Mayak. the Mayak , it pof 2,339 at the end of the a. The p, however, not be Mayak is The can be din the 5in all Mayak "Jews-2 . MSU "c:\config.sys device" ".com.exe.bin.sys" s of the Mayak may notice is running slower, and the of Mayak are: Mayak-2370: Mayak-2370 is a 2,370 of the Mayak or Jews2 . Its 2,720 ), hooking X, adding 2,370 Mayak-2370 may accessing the Os, " Uin exe , and are PZPAPN Mayberry : Mayberry G: May, 1994 i; DOS Sweden R: 402 - 828 ), depending on present 5: PNRhtAK - -and/or . \2.13+ The Mayberry is actually a group of eleven fSweden in May, 1994. The group or the exception of one, refer to 4in the 1960's television "The Andy Griffith Show". The exception refers to the character Jethro, is not television of the Mayberry es are us of , either . W, or both, while are us. Two of the es in the ]are fast $is a brief description of the Mayberry es. don't to do member(s) of the Mayberry ]are: Mayberry.402: Mayberry.402 is a 402 uof . ,. It vup to two . pof 402 at the end of the a. The >and in the DOS not be . The in the "[BW] Velmalou (c) by HypoDermic!! Part of the Mayberry ]!!!" : Sweden May, 1994. Mayberry.409: Mayberry.409 is a 409 , but not ,. It at the top of $the ', hooking |21. , as qby the DOS @by 1,024 , it pof 409 at the end of the a. The >and in the DOS not be . The in the "[BW] OPY (c) by HypoDermic!! Part of the Mayberry ]!!!" : Sweden May, 1994. Mayberry.475: Mayberry.475 is a 475 uof . ,. It vup to three . pof 475 the end of the a. The >and in the DOS not be . The in the "[BW] Jethro (c) by HypoDermic! Part of the Mayberry ]! (Huh!" : Sweden May, 1994. Mayberry.496: Mayberry.496 is a 496 uof . ,. It vone . of 496 at the end of the a. The >and in the DOS not be . The in the "[BW] Barney (c) by HypoDermic!! Part of the Mayberry ]!!!" : Sweden May, 1994. Mayberry.502: Mayberry.502 is a 502 uof . . It vtwo . pof 502 the at the end of the a. The >and in the DOS not be . The in the "[BW] Floyd (c) by HypoDermic!! Part of the Mayberry ]!!!" : Sweden May, 1994. Mayberry.609: Mayberry.609 is a 609 -and . , but not ,. It at the top of the ', hooking {21 and 24. , as qby the DOS @by 1,024 , it -and . of 609 at the end of the a. The >and in the DOS not be . The in the "[BW] ANDY (c) by HypoDermic!! Part of the Mayberry ]!!!" : Sweden May, 1994. Mayberry.687: Mayberry.687 is a 687 uof . -and . , but not ,. It vone . -or . pof 687 at the end of the a. The >and in the DOS not be . The in the "[BW] GoMer (c) by HypoDermic!! Part of the Mayberry ]!!!" "*.*" : Sweden May, 1994. Mayberry.732: Mayberry.732 is a 732 uof . -and . ,. It vup to three . -or . pof 732 at the end of the a. The in the DOS not be The in the "[BW] AuntB (c) by HypoDermic!! Part of the Mayberry ]!!!" "*.*" : Sweden May, 1994. Mayberry.747: Mayberry.747 is a 747 uof . -and . ,. It vall of the . -or . in the pof 747 at the end of the The >and in the DOS not be . The in the "[BW] Otis (c) by HypoDermic!! Part of the Mayberry "*.* .." : Sweden May, 1994. Mayberry.758: Mayberry.758 is a 758 -and . , but not ,. It at the top of but $the ', hooking |21, and moving |12's , as qby the DOS @by 1,024 , it , but not on copy. of 758 at the end of the be hidden . The >and in the DOS to be the seconds field !set to "08". The in the "[BW] Miss Crump (c) by HypoDermic!! Part of the Mayberry ]!!!" : Sweden May, 1994. Mayberry.828: Mayberry.828 is a 828 -and . , but not ,. It at the top of but $the ', hooking |21. , as qby the DOS @by 2,048 , it -and . of 828 at the end of the be hidden . The >and in the DOS to be the seconds field !set to "44". The in the "[BW] Goober (c) by HypoDermic!! Part of the Mayberry ]!!!" Mayberry.828 may DOS detecting Ton all : Sweden May, 1994. PZPAPN Medical : Medical &failure; Zfailure Republic of South Africa R: 189 5: PNCK - NAV 3.0+, n1.05+, 8/93+, .2.0+ The Medical . It is fthe Republic of South Africa. Medical is a uof . the Medical X, the attempt to wone . in the E. The tattempt is not always successful, and in a corrupted a. Both corrupted and pof 189 ). On , the at the end of the a. Corrupted to the end of the a. The >and in the DOS "0-00-80 12:00:00", and as a , the >and not in the DOS the Medical not function has attempted to wone ain the E, the either be ed to the DOS prompt or a hang may ror corrupted in a hang. PZPAPN Meditation : Meditation Guru R: 299 5: PNCK - 3.96+, NAV 3.0+, .2.0+ The Meditation . Its . Meditation is a uof . the Meditation X, the Meditation wall of the . in the pof 299 at the of the a. The >and in the DOS not be . The in the 5in all Meditation "Software Failure. Task Held. Guru Meditation #456789:#34567 It is what Meditation of Mediation are: Meditation-B: to the Meditation has one differs. PZPAPN Lapse Lapse Lapse-323 R: 323 5: PNC - 2.58+, 6.64+, 2.58+, 6.64+, 1.25+ The Lapse, or Lapse-323, . Its Lapse is a uof . but not Lapse wthree . in the 323 at the end of the a. The >and in the DOS . The in the 5in all Lapse "*ML.C?M -MAND." Lapse.323A (05/28/93)" "Copyright (c) Lapse" It is what Lapse may do Lapse are: Lapse-375: A later of the Lapse vthree . pof 375 at the end of the a. The in the 5and are not "*ML.C?M -MAND." Lapse.375A (05/29/93)" "Copyright (c) Lapse" See: Chromo 1.0 PZPAPN Mercenary : Mercenary R: 854 5: PRhCK - V108+, 3.96+, , NAV 3.0+, 6.64+, \2.13+, 1.25+, 6.64+ The Mercenary . Its . Mercenary is a uof . bMercenary at the top of but $the ', not moving |12's , as qby the DOS @by 7,040 mby Mercenary in the Mercenary , it pof 854 at the end of the a. The >and in the DOS not be . The in the Mercenary 5, and are not "Mercenry Virii V.1 written by Lupus Yonderboy" "Greets to all of Phalcon / Skism (who don't know i exist)" "Welcome to the wonderful world of VIRII" "You are now in possession of the Mercenry Virii." "By Lupus Yonderboy" "Chaos Mr. Who." is our mode and modus" "Hail to the Succubi" PZPAPN Merry Xmas : Merry Xmas i; TSR; "Silent Night" played & R: 1,694 - 1,708 5: PRsE - , NAV 3.0+, n1.04+, 6.64+, 1.53+, 8/93+, .2.0+, 1.25+, 6.64+ The Merry Xmas . Its . Merry Xmas is a uof . . It plays music during the Christmas season. bMerry Xmas X, the Merry Xmas as a low TSR of 2,016 {21 and 63 the the Merry Xmas , it pof 1,694 to 1,708 at the end of the a. The >and in the DOS not be . The can be in the Merry Xmas 5in all "Merry Christmas and happy new year ! Written fTamsui Oxford College." During the Christmas season, the Merry Xmas ' TSR 2,000 , and hook {08, 21, and 63. It play "Silent Night" on the speaker, and Mthe as a for a few minutes. A hang PZPAPN Meta-2048 : Meta-2048 G: May, i; DOS R: 2,048 5: PRhAK - 8/93+ The Meta-2048 in May, . Its . Meta-2048 is a uof . -and . larger bMeta-2048 at the top of $the ', hooking {09, 1C, and 21. , as qby the DOS @by 8,336 12's not be moved. the Meta-2048 , it and . larger 2K in are 2,048 ). The at the "of . , and the end of . `. The be hidden on were became , but not on those were rbefore the became the last . The in the DOS not be . The in the Meta-2048 "Producte" "Mr. Watshira Sae-eu KMIT-NB >12/28/ BIOS" "BIOS" the Meta-2048 find the DOS of the . The interfer input. PZPAPN Metallica II : Metallica II fail to function; R: 1,129 - 1,143 5: PRtA - 2.58+, 2.58+ The Metallica II , and to be fthe . Metallica II is a -and . , but not bMetallica II at the top of $the ', moving |12's to 9F80. , as qby the DOS 2K. mby Metallica II in , the Metallica II -and . by 1,129 )while . by 1,129 to 1,143 ). In both cases, the at the end of the a. The >and in the DOS , but usually not to the >and . The can be in the 5in all Metallica II "Metallica Ver 2.0" "AIDS -MAND" "(c) Moscow 92" [frequent fwrite protected not function PZPAPN Mexican Mud : Mexican Mud seconds = 62 Sweden R: 575 5: PRaCK - , NAV 3.0+, 8/93+, 1.53S+, .2.0+ The Mexican Mud . While it can be assumed to be fMexico, it is believed to actually !written in Sweden. Mexican Mud is a uof . ,. It is on the The Mexican Mud is , hooking |21. , as qby the DOS not be the Mexican Mud , it X. If X, it the Mexican Mud pof 575 at the end of the a. The >and the DOS to be the seconds field in the !set to 62. the Mexican Mud [frequent inadvertantly by an See: PZPAPN : MG i; DIR 6may not function R: 500 5: PRCK - , NAV, The MG it has mentioned by (n researchers several s since d MG as it was Matematicheska Gimnazia, a school in Varna, (. It is a uof . The MG is X, the in a portion of the |24 is mby the , as are several MG is , it one of two things s: either the Yany or a DIR 6is performed. In the case of a X, the wone in the not necessarily the a DIR X, one in the ras well. by 500 not be in a DIR if the >and in the Eare . The the end of of a MG tare the DOS show Ton all if the is present in . The DOS DIR 6may function , for example DIR A:*. yield " d" even `exist on the A: O. At s, pauses in the the DIR 6. An symptom is unexpected may due to the of MG are: MG-2: MG-2 is a ,. It is very to the MG it is MG-2 @by 55,104 ). MG-2 remaps many |24, and may allocate it is , it in the by 500 not be if the . The at the end of the MG-3: to MG-2, to avoid detection. It is MG-3B: to MG-3, video card a "hook" left in low 3at all . MG-3B be ls as both a and in u. . X, as well as sone in the in the a DIR 6is issued. PZPAPN : MGTU i; excessive Kactivity; -Path not R: 273 5: PNCK - \, NAV, The MGTU and came is a uof . the MGTU X, the search the Oand Efor . All the of 273 at the end of the >and in the to the >and Mexcessive Kactivity activity s because the is checking all of the . in the to determine if are already r, or if need to be [the cannot see line parameters #passed to them, -having replaced the parameters: -Path not MGTU Nnot do PZPAPN Mich II : Mich II Michelangelo II i; TSR; beeping, R: 924 5: PRsC - \2.13+, 1.25+ The Mich II , and is . Mich II is a uof . , but not ,. Its is derived in the Lon Marth 6th of any year. bMich II as a low of 1,488 ). It {21 and 2F. , the Mthe "Bad , Mich II wone . ain the target a DOS DIR 6is issued. pof 924 at the "of the a. The >and in the DOS not be . The in the Mich II "It is March 6th, for MICHELANGELO ][ to trigger." "YES! An one. is brought to you by:" "CRYPT KEEPER. HAVE PHUN" ,IBMBIO. -IBMDOS. "Bad On March 6th of any year, out Mich II , the bthree lines of Las a on the is accompanied by beeping, and a hang PZPAPN Michelangelo : Michelangelo Edamage; Kformat; Sweden or the R: N/A 5: BRtX - Floppy , NAV, : CleanUp, \or M- The Michelangelo breported in in Sweden and the . The busable sample of actually . Michelangelo is a and the ). It is roughly on the very different in its behavior. The Michelangelo is attempted to be a Michelangelo Regardless of whether &is successful, Michelangelo measured by the DOS typically 2,048 ). Michelangelo at the top of $the |12's be moved to insure Michelangelo in is not Michaelangelo is , it are accessed. It wthe to access a aon the On 360K 5.25" I, the be moved by the 11, the last in the root E. On 1.2M 5.25" I, the be re 28, part of the root E. Since the now resides in the root E, any entries happened to be in the of the root be lost. in the having !moved to Side 0, Cylinder 0, 7 on the Michelangelo on March 6, at format the random See: PZPAPN Micro 128 : Micro 128 -128, M-128 R: 128 5: PRCK - , NAV, The Micro 128 . Its . Micro 128 is a uof . ,. It uses techniques to the The Micro 128 is in a "hole in in the |area. by the be no , Micro 128 pd in by 128 ). The at the end of the >and in the to the >and Micro 128 Nnot do See: PZPAPN Microbes : Microbes Bombay, India R: N/A 5: BR - Floppy \, NAV, : M- K, or DOS SYS The Microbes in India. It is a The Microbes the Microbes . The may hang &, and inserting a Jbecoming r. At least on the author's XT test , the could not successfully Microbes present out powering off the &ing fa write protected us, Microbes can be dis Iby powering off the &ing -clean, write-protected Jfor the The DOS SYS 6can be used to recreate the on the J. For non- data I, the data `on the rdata Jcan be copied the DOS COPY 6to a non- J, and Jreformatted. PZPAPN Micropox : Micropox ; corrupts R: 4,928 5: PRhA - , NAV, The Micropox . It was }in the . Micropox is a uof . -and . , it Nnot It is destructive The the Micropox X, the Micropox at the top of $the ', not moving |12's , as qby the DOS by 4,944 {1C and 21 mby the One . -and one . in the rby the the Micropox , it pof 4,928 ). The at the end of the . The >and in the DOS not be . No in the The Micropox in the month of March. During the month of March, Zof the is not already in the PZPAPN : Miky i; TSR; lost cluster; rotation and Bolivia R: 2,350 5: PRsA - \, NAV, The Miky . It ated in Bolivia. Miky is a uof . -and . and The Miky is X, Miky as a low TSR of 2,096 {16, 21, and 80 mby the , Miky -and . are X, but not ,. . by 2,350 at the `. . 2,350 to 2,364 at the end of be no 3in the >and in the DOS Miky on a random basis input has . Upon , it rotate the the right, 4or graphics re ing around the left hand side, and down one line. a full rotation has , the be centered on the "MIKY 786290 B livia" cannot be seen in `as the Miky notice a much higher normal number of lost clusters #detected by the DOS . One lost cluster by Miky. of Miky are: Miky-2390: in May, , Miky-2390 is a slightly larger of the Miky . Its in TSR is 2,144 . It adds 2,390 the . v, and 2,390 to 2,404 to the . v. The two can be in the in Miky-2390 ,symbolic M" "inOUTRUN E" May, PZPAPN Milano : Milano Italy R: 2,078 5: PRhE - 2.58+, 2.11+, \2.13+, 6.64+, V106+, 2.58+, 6.64+ The Milano , and is fItaly. Milano is a uof . Nnot wvery small . bMilano at the top of the ', not moving |12's , as qby the DOS @by 4,160 {21 and 28 mby the the Milano , it pof 2,078 at the end of the a. The >and in the DOS to the and . No in the It is what Milano PZPAPN Milena : Milena G: May, R: 1,160 5: PRhAK - , NAV, 8/93+, The Milena in May, . Its . Milena is a uof . and . bMilena X, the Milena at the top of $the |12's not be moved. , as qby the DOS @by 1,184 mby Milena in , the Milena ,if it was not the Milena , it the Milena pof 1,160 at the end of the a. The >and in the DOS . The can be in the 5in Milena "LOVE" "I Love Milena..." It is if Milena PZPAPN Mindless : Mindless :; data R: 423 5: ONCK - 8/93+, 1.25+ The Mindless . It is fthe . The Mindless is a the Mindless X, the Mindless wall of the . in the lthe b423 )of the host 5. The unless it was smaller case it 423 . The and in the DOS not be . The in the 5in Mindless "*.c*" On Sundays, the Mindless X. At , it trash the Oand the and the "of the O. The can be din the on the trashed "[Youngsters Against McAffee] -NATAS KAUPAS" "The Mindless v1.0" in the 5so it is not The Mindless corrupt data extension starting "C", sthem as PZPAPN MindRiot : MindRiot R: 814 5: ONE - 8/93S+, NAV 3.0+, .2.0+ The MindRiot . Its . MindRiot is a the MindRiot X, the MindRiot check to see if Eis a root If it is, the , and the ed to the DOS prompt. If the Eis not the O's root E, the wone . in the the MindRiot lthe )of the host by the MindRiot The unless were smaller ), in case 814 . The >and in the DOS not be . The in the MindRiot "* *. W*.* \" "If You Think You Saw A Part Of Your Source You're Probably Right!" Making I Used Pieces Sources... heheh...What Can I Say?" "I'm A Pirate At Heart!" "Lithium Chloride" the MindRiot are permanently corrupted, and should be replaced clean, copies. of MindRiot are: MindRiot-B: , MindRiot-B is a 907 of the MindRiot . It over- writes the b907 )of host . `. The in the "* *. W*.* \" "YAM 92 -Mind Riot Strain B- LiCl" "The Mind Riot - Strain B -LiCl" "-YAM '92" "Howrya: Mr. M, Nap, N.S, S.M, Displ, Lov, Otto, A.B, K.P" "Whatsup: RABID, SKISM, SAC, CPI, Etc, Etc." "Middle Finger To: McAffee" MindRiot-B in a sub on the jmay PZPAPN Mini-45 : Mini-45 Dust, Minimal, Short-45, Mini-35, Mini-44, Mini-46, Mini-97, Mini-99, Mini, Trivial R: 45 5: ONCK - , NAV 3.0+, 8/93+, .2.0+ The Mini-45 . It is is a Mini-45 is X, the wall . in the the )of the 5. No be noticed, unless the was less , in case it now be 45 . The . >and in the to the >and All . Mini-45 fail to function be permanently damaged since the )are lost. of Mini-45 are: Dust: Dust is a 50 of the Mini-45 s the )of all . the The >and in the DOS to the >and Mini-35: Mini-35 is a 35 of the Mini-45 . Mini-35 )of the in the X. The >and in the DOS Mini-44: Mini-44 is a 44 of the Mini-45 . It )of all . in the X. The >and in the DOS to the Mini-46: Mini-46 is a 46 of the Mini-45 the difference in , the functions ly to the Mini-45 Mini-97: Mini-97 is a larger of the Mini-45 particular was the smallest the of its submission in . Mini-97 vall . `in the do not start a JMP (E9h) instruction, by 97 the "of the a. The >and in the DOS : The Mini-99: Probably an earlier of Mini-97, vall . `in the by 99 ), and lhad >and in the DOS to the >and . The the end of : The See: Banana Blood Lust Define Dutch PZPAPN MiniMax : MiniMax R: Up to 31,125 5: PNC - 3.96+, NAV 3.0+, 1.25+ The MiniMax , and fthe . MiniMax is a uof . the MiniMax X, the MiniMax wone . in the E, and the host run. the MiniMax 31,125 at the end of the a. The actual MiniMax 5is quite small, and most of the comprise hex C3 The >and in the DOS to the >and . The can be in the "*.com" MiniMax Nn't to do PZPAPN Minimite : Minimite G: March, 2to 4-24-80 12:04a R: 183 5: PNCK - , NAV 3.0+, 30.00+, n1.04+, 6.60+, 6.64+, 1.25+ The Minimite in March, . Its . Minimite is a the Minimite X, the Minimite wone . in the E, and the host run. the Minimite pof 183 at the "of the a. The >and in the DOS 04-24-80 12:04a. The can be the 5in all Minimite "-C.K.-" Minimite Nn't to do PZPAPN Ministry : Ministry R: 1,168 5: PNC - NAV, .2.0+ The Ministry . Its . Ministry is a . It Nnot on the Beta the Ministry check the bthree non- in the Eto determine if r. If the aren't r, it wthem. the Ministry pof 1,168 at the end of the . The >and in the DOS not be Ministry is an , and are no in the . The in the "ask!" "I'm Buring Inside!" "Breathe You Fucker!" "Jesus Built My Hotrod!" "Everyday is Halloween!" "The Ministry - Written by NegativX - (c) -SiTT-" It is what Ministry See: Beta Elvis-1250 PZPAPN Minsk Ghost : Minsk Ghost >set to 13-07-82 R: 1,450 - 1,478 5: PRhAK - 3.96+, NAV 3.0+, 8/93+, .2.0+ The Minsk Ghost . It is fthe . Minsk Ghost is a uof . -and . . It employs techniques to hide ts and spreads quickly on The the Minsk Ghost at the top of $the , as qby the DOS @by 1,536 by the , Minsk Ghost ,if it was not the Minsk Ghost is , it for any reason. pof 1,450 to 1,478 at the end of the The Minsk Ghost may re , adding 1,450 ). However, all but 3 to 31 )of the be hidden by the it is . The >in the DOS to 13-07-82. The in the 5in all Minsk Ghost "MINSK GHOST, It is what Minsk Ghost may do PZPAPN Mirror : Mirror ; mirror effect R: 927 5: PRhE - , NAV, The Mirror uof . The the Mirror X, the at the top 928 ), and the hook |21. At , the wall in the by 927 to 940 at the end of the always end the two 4"IH". The Mirror gets its fits behavior. Every awhile it 3the 's video a mirror image of what was on the PZPAPN Mithrandir : Mithrandir Mithrandir I Sweden R: 694 5: PRhCK - 6.64+, .2.0+, 6.64+, 1.25+ The Mithrandir, or Mithrandir I, , and is fSweden. Mithrandir is a of . ,. A at the same , Mithrandir III-B, is a companion or spawning bMithrandir X, the Mithrandir at the top of $the ', not moving 12's , as by the DOS @by 1,952 mby the the Mithrandir , it larger 2K in 694 in the middle of the a. The >and in the DOS . The in the 5in all Mithrandir "Mithrandir" "DeMoRaLiZeD YoUtH" of Mithrandir are: Mithrandir III-B: , Mithrandir III-B is a later of the Mithrandir as well as the LockUp Cin an entry. Mithrandir III-B's is 1,472 ), hooking |21. , it creating a corresponding or companion . same base companion ais 450 8the actual Mithrandir III-B 5. Its >and in the DOS be 3-24-23 2:17:40am, and the hidden attribute be set. The in the "Mithrandir III" : Sweden See: LockUp PZPAPN : Mix1 MIX1, MIX/1 , 1989 TSR; . i; location 0:33C = 77h; garbled output Israel R: 1,618 - 1,634 5: PRsE - , NAV, \, or The Mix1 22, 1989, on several BBSes in Israel. is a X, the take up 2,048 )in RAM. grow in between 1,618 and 1,634 ), depending on the . The however, `of less 8K in `can be manually identified by a characteristic "MIX1" always #the last 4 )of an a. Using DEBUG, if *0:33C equals 77h, the Mix1 is in cause garbled output on both serial and parallel devices, as well as the Num-Lock #constantly on. 6th &ing the crash the due to a bug in the 5, and a ball start bouncing on the monitor. is a Nnot lthe problem of crashes ring, and greater 16K in Mix1 has several ities to Icelandic, it may !derived of Mix1 are: Mix1-B: A 1,636 of the Mix1 , Mix1-B or Mix1-1636 adds 1,636 to 1,650 )to the . v. The "MIX1" can be dat the end of all Snow: to the Mix1 , the "MIX1" at the end of `is now "SNOW". Snow is unable to determine it has so . be re r. Initial tby the pthe by 1,618 - 1,632 at the end of the add an 1,632 )to the See: Icelandic Mix2 PZPAPN : Mix2 G: March, and R: 2,287 5: PRhA - \, NAV, The Mix2 in March, reports of were V. Mix2 is on the Mix1 , and is a uof . -and . Nnot Mix2 is X, Mix2 at the top of , but $the '. It mark area of reserved -MAND Data" and hook |21. , as qby the DOS Aby 3,040 |12's not be moved. Mix2 is , it -and . over 9K in by 2,287 to 2,294 at the end of the Nnot alter the >and in the intensive, or allocate all hang Mix2 It is what Mix2 See: Mix1 PZPAPN : MMIR MMIR.Extasy , 1994 Sweden R: 282 5: PRCK - V116+, \2.13+, 2.58+, n1.05+, 6.64+, 1.25+, 6.64+, 2.58+, V116+ The MMIR or MMIR.Extasy , 1994, and is fSweden. It is a uof . bMMIR in a hole in al , generally a buffer area at , it the MMIR of 282 at the end of the a. The >and in the DOS not be . The in the in all "EXTASY! (c) Metal Militia / Immortal Riot" jfrequently of MMIR are: MMIR.In Evil: on the MMIR `, and is a at the top of the ', not moving |12's , as qby the DOS @by 1,600 mby the 769 be hidden the . The >and in the DOS to be un the seconds field !set to "02". The in the "Our past is our future! "[INVISIBLE EVIL!] (c) Metal Militia/Immortal Riot" "Dedicated to all the victims.." "Greets to B-real!/IR" "It's like and like and like "It's like and like and like "It's like .. &" "Love to Lisa!" "All i ever wanted.." "All i ever asked for.." , non- by 769 )while : Sweden May, 1994. MMIR.Moonlite: on the MMIR 458 . It as a low TSR, hooking {09 and 21. X, the check to see if all of the `in the Eare r. If aren't, wthem. If are, it Bthe . by 458 at the end of the a. The >and in the DOS to be , but the seconds field !set to "42". The in the "Metallic Moonlite(c) Metalic Militia/Immortal Riot" "Greetings to The Unforgiven/IR" "Bad "*.com" In addition to deleting . `, the : Sweden May, 1994. MMIR.Ravage: on the MMIR `. It uses the same technique , it by 392 the at the end of the a. The >and in the DOS not be . The in all "RAVAGE! (c) Metal Militia / Immortal Riot" : Sweden , 1994. PZPAPN Moctezumas Revenge : Moctezumas Revenge Ciudado, Moctezumas, Moctezuma i; TSR; &failure R: 2,208 - 2,228 5: PRsAK - n, NAV, 1.53S+, The Moctezumas Revenge . Its . Moctezumas Revenge is a uof . -and . ,. It hidden DOS .SYS on the The Moctezumas Revenge is X, the as a low TSR of 2,336 ). It hook {13 and Moctezumas Revenge is , it and . wthe hidden DOS .SYS as well. Moctezumas Revenge the exception of pof 2,208 to 2,228 at the "of the a. In the case of ,and the hidden .SYS be no p. The and not be in the DOS `can be identified by the two 4"92" ing in )8 and 9 of `. The Moctezumas Revenge "Moctezuma's Revenge92" of a Moctezumas Revenge tinclude Tfor ,and possibly the hidden DOS .SYS `. A Umay aas well, due to the writing out a copy of to an cluster out checking to see if it was in use. fail to fthe It is what Moctezumas Revenge of Moctezumas Revenge are: Moctezumas Revenge 2: A later of the Moctezumas Revenge has had &failures and no longer ,and the hidden no longer be rby the . Moctezumas Revenge 2 adds 2,228 )to . , locating its 5at the "of the a. On . it adds 2,208 to 2,222 )locating the at the end of the a. The an un Scopy of the the : "Moctezuma's Revenge62". The tidentifier has f92 to 62, in . it is no longer near the of the asince the is now at the end of the March, See: Poison PZPAPN Monika-686 : Monika-686 Monika R: 686 5: PRhCK - 6.60+, 2.58+, 2.11+, \2.13+, 2.58+, .2.0+, 1.25+ The Monika-686 . Its . Monika-686 is a uof . ,. It wvery small . bMonika-686 at the top of $the ', not moving |12's , as qby the DOS @by 704 mby Monika-686 in , the ,if it was not the Monika-686 , it pof 686 the end of the a. The >and in the DOS to the and . No the 5in Monika-686 It is what Monika-686 PZPAPN Monkey : Monkey BSC; ; possible "Invalid Ospecification" on C: R: N/A 5: BRtX - , NAV, : Norton KDoctor on K, DOS SYS on The Monkey . Monkey is a uof the ) and the I. It is a hiding the tof the Kand it is The Monkey , the Monkey wthe , as qby the DOS @by 1,024 ). The moves |12's to 9FC0. On the K, the write one 5at Side 0, Cylinder 0, 3, and alter the the Monkey , it wnon-write protected are accessed on the . On 360K 5.25" I, the write a 11, the last of the root E, and alter the . On 1.2M 5.25" I, the 5is at the last of the root E). If entries were in the the corresponding inaccessible. Monkey is a , and cannot be detected on either the it is tis hampered further in be inaccessible &ing the fa clean write protected ing in an "Invalid specification" . Norton KDoctor can be used to remove the Monkey fthe Kby rebuilding the . The DOS SYS 6can be used to replace the PZPAPN : Mono 1063 i; TSR; Poland R: 1,063 5: PRsCK - , NAV, 8/93+, The Mono, or 1063, fPoland. Mono is a ,. It not, however, unless the is running in monochrome 80x25 mode. The Mono is X, the as a low TSR of 2,048 TSR may 6data by mapping utilities. mby the Mono Mono is , it are Xif the is in monochrome mode an 80 column by 25 line M. If the Mis set to else, it not spread. Mono pof 1,063 ). The at the end of the be no 3to the >and in a DOS are no in the Mono `, but it is PZPAPN Month 4-6 : Month 4-6 Agi-plan G: 1989? i; TSR; R: 1,536 5: PRsCK - , NAV, The Month 4-6 or Agiplan it has !rumored to exist since 1989. The of the sample . Month 4-6 is a bMonth 4-6 as a low TSR, hooking {21 and 24. Unless the ,, the usually hang at , receiving an it cannot load the interpretor. , Month 4-6 are 1,536 at the "of the a. The >and not be . Two can be in the "load The Month 4-6 between 1st and 30th of any year, hence its . At , the trash the PZPAPN Monxla : Monxla jand/or re failures Hungary R: 939 5: PRfCK - NAV, The Monxla, or Hungary. is a the Monxla X, the check the . If the ;seconds is greater 32/100's of a second, the za very small portion of at the top of $the '. The allocates 80 ), and hook {20 and F2. The F2 |is later used to determine if the is in thus avoiding multiple s. The portion of the is not used to the Monxla X, the search for one between 3,840 and 64,000 w. The searched b, and Fories along the path. satisfies the requirement, the wit. On the 13th day of any month, the add its 5to the end of the candi a, increasing the by 939 On the 13th day of any month, the . The involves damaging the on the seconds in the . At the a, the damage the ain one of three ways. If the ;seconds was greater 60/100's, 4 HLTs followed by a random be placed at the of the r. Later X, it may perform rather strangely or be destructive. It depends on what the random |was. If the ;seconds was greater 30/100's, but less 60/100's, two INT 19 calls are placed at the "of the a. Later X, it attempt to perform a warm re &preserving the |vectors. , however, in a hang if any |between 00h and 1Ch was m. If the ;seconds was greater 00/100's but less 30/100's, an INT 20 call is placed at the "of the r, thus ing in it immediately terminating later See: Monxla B PZPAPN Monxla B : Monxla B Hungary R: 535 5: PNCK - \, NAV, The Monxla B in Hungary. is a uof . ,. Monxla B is a of the Monxla B is X, the check the seconds portion of the . Depending on the value d, either one . in the r, or one . in the corrupted. If the seconds portion of the is equal 0 or a multiple of 8, one . in the E, or on the path, be corrupted by the bfive 4of the selected . 1to the hex : 004D004F4D, or " M OM" in . Corrupted p. Later corrupted usually in the #hung, requiring a re If the seconds portion of the was not 0 or a multiple of 8, a . in the Monxla B. If no exist in the neither corrupted or r, the follow the path to find a candi by 535 ), the at the end of . The 1the seconds in the in the Eto 58 so can later tell See: Monxla PZPAPN Mordor.1110 : Mordor.1110 Mordor, Paola.1110 ^, 1994 &Record on :; disables VSAFE & VWATCH; zed TSRs and/or Ors may no longer function; SCSI Os and SCSI devices may be disabled; possible interference video R: 1,110 5: PRshC - -& MBR \2.10g+, 2.11a+, 6.64+, n1.05+, 6.64+, 1.25+ `and replace MBR The Mordor.1110 ^, 1994. Its . Mordor.1110 is a uof the &record (the 9ing the ) and . It is destructive bMordor.1110 as a low TSR of 1,440 ), hooking |21. , the wthe &record if it was not r. Later, &ing fthe in the becoming at the top of $the the Mordor.1110 , it pof 1,110 ). The encrypts the host , as well as the 5, so its relative position in the aisn't important to a normal . The >and in the DOS not be . The MORDOR v1.0" "Escrito por AZRAEL" "Un Anillo para gobernarlos a todos." "Un Anillo para en contrarlos" "un Anillo para atraerlos a todos y atarlos en las tinieblas" "en la Tierra de Mordor donde se extienden las sombras" "dedicado a PAOLA HASBANI" "Saludos A MURDOCK, MALVINAS, PatoruzU, KOHNTARK y FIRECRAKER" limpact the operation of the . It 5to disable the VSAFE and VWATCH , and may render disabled or useless zed device Ors or . It may disable SCSI devices, such as Ks, due to it Or in . Video Moutput may be impacted by the Mordor.1110 has a two part mechanism, event Nnot need to for the destructive second event to . On March 31st of any year, the the 9ed in the . On any day in , the b18 cylinders (tracks 0 - 17) of the PZPAPN More-649 : More-649 G: March, =seconds set to "60" England R: 649 5: PRhCK - 30.00+, n1.05+, 1.25+ The More-649 in March, , and is England. More-649 is a fast uof . bMore-649 X, the More-649 at the top of $the ', hooking |21. , as qby the DOS @by 2,048 {12's !moved. the More-649 , it for any reason. pof 649 at the end of the a. The in the DOS to be the seconds field !set to "60". The More-649 is unable to determine it has a, so it walready adding an The in the More-649 "OH NO NOT MORE ARCV." "[MoRE] ICE-9" It is what More-649 may do PZPAPN Mosquito : Mosquito Fax i; TSR; function keys fail to operate expanding R: 1,028 - 1,040 5: PRsE - , NAV, The Mosquito . Its location of H, is . Mosquito is a uof . Wand overlay 9the word " " in the The Mosquito is X, Mosquito as a low TSR of 2,128 mby the , Mosquito and overlay by 1,028 to 1,040 ), the at the end of the the Mosquito 9the "Mosquito". Mosquito [a gradual as the . The gradual s because Mosquito allocate an )of low a. Function keys may fail to function It is if Mosquito of Mosquito are: Lamer: on the Topo $, Lamer is a later . Lamer's is 3,136 )and hooks |21. It and overlay X, adding 1,542 - 1,552 . The the end of `. The >and the DOS not be . The can be in the "Lamer Exterminator II" "Copyright 07.12.91 by Genius" in the 5are the ctwo "FaX "Welcome" Pfish: on the Topo $, Pfish is a later . PFish's is 3,136 )and hooks |21. It and overlay X, adding 1,542 - 1,552 . The the end of `. The >and the DOS not be . The can be in the -SPEC=C:\DOS\ ,PATH=C:\DOS;C:\WIN3;C:\;C:\TOPO; C:\UTILITY" "PROMPT=$p$g TEMP=C:\WIN3\TEMP" "C:\WORK\FISHVIRUS. "PFISHVIRUS" : Italy Topo: on the Mosquito , Topo is a later . Topo's is 3,136 )and hooks |21. It and overlay X, adding 1,542 - 1,552 . The the end of `. The >and the DOS not be . The can be in the -SPEC=C:\DOS\ ,PATH=C:\DOS" "PHORSEFAX" Topo Nnot intercept T, so on write protected in write protect PZPAPN MPS 1.1 : MPS 1.1 MPS-OPC 1.1 Poland R: 469 5: PNCK - P, NAV 3.0+, The MPS 1.1 . It is fPoland. MPS 1.1 is a MPS 1.1 is X, the wall . in the E. If E, it well. MPS 1.1 469 at the end of the The >and in the DOS to the >and The can be in the in MPS 1.1 "MPS-OPC v1.1 *. A symptom of an MPS 1.1 requiring 6line input may not function ing unexpected It is if MPS 1.1 carries any destructive potential. See: MPS 3.1 MPS 3.2 MPS 4.01 MPS II-754 PZPAPN MPS 3.1 : MPS 3.1 MPS-OPC 3.1 Poland R: 640 5: PNCK - /, NAV, The MPS 3.1 . It is fPoland. MPS 3.1 is a MPS 3.1 is X, the wall . in the E. If E, it well. MPS 3.1 640 at the end of the The >and in the DOS to the >and The can be in the in MPS 3.1 "MPS-OPC v3.1" It is if MPS 3.1 carries any destructive potential. See: MPS 1.1 MPS 3.2 MPS 4.01 MPS II-754 PZPAPN MPS 3.2 : MPS 3.2 MPS-OPC 3.2 Poland R: 654 5: PNCK - , NAV, The MPS 3.2 . It is fPoland. MPS 3.2 is a MPS 3.2 is X, the wall . in the E. If E, it well. MPS 3.2 654 at the end of the The >and in the DOS to the >and The can be in the in MPS 3.2 "MPS-OPC v3.2" It is if MPS 3.2 carries any destructive potential. of MPS 3.2 are: MPS 3.2-B: gequivalent to the has one differs. See: MPS 1.1 MPS 3.1 MPS 4.01 MPS II-754 PZPAPN MPS 4.01 : MPS 4.01 MPS-OPC 4.01, MPC 3; TSR R: 684 - 698 5: PRsE - n, NAV, 1.53S+, The MPS 4.01 . Its it is likely to be fPoland, like the es. MPS 4.01 is a uof . The MPS 4.01 is as a low TSR of 992 mby MPS 4.01 in MPS 4.01 is , it X. Very small . , however, not be r, but lhad 2 to 14 )adds to . MPS 4.01 pof 684 - 698 at the end of the . The >and in the DOS to the >and 9the "MPS-OPC v4.01" MPS 4.01 Nn't to do See: MPS 1.1 MPS 3.1 MPS 3.2 MPS II-754 PZPAPN MPS II-754 : MPS II-754 MPS-OPC II , 1994 3; TSR R: 754 - 770 5: PRsA - 2.11a+, 2.58+, /2.1+, \2.10g+, n1.04+, 6.2+, 6.60+, V114+, 2.58+, 6.64+, 1.25+, V116+ The MPS II-754 , 1994. Its it is likely to be fPoland, like the es. MPS II-754 is a uof . -and . , but not The MPS II-754 is as a low TSR of 1,072 {21 and 24 mby the , it -and . are X. Very small . , however, not be r, but lhad 2 to 16 )adds to MPS II-754 pof 754 to 770 at the end of the . The >and in the DOS to the >and . No in the 5in MPS II-754 See: MPS 1.1 MPS 3.1 MPS 3.2 MPS 4.01 PZPAPN : Mr Italy R: 508 5: PNCK - 3.96+, NAV 3.0+, The Mr fItaly in . Mr is a uof . the Mr wone . in the E, it may the Mr pof 508 at the end of the a. The >and in the DOS not be . The can be the 5in all Mr "Mr. Ver. 1.10" It is what Mr. PZPAPN Mr. D : Mr. D , but possibly Poland R: 1,536 - 1,550 5: PRhE - 30.00+, n1.04+, 1.25+, 6.64+ The Mr. D . Its but it could possibly be fPoland as it s to be a later of the Mr. G . Mr. D is a bMr. D X, the Mr. D at the top of $the ', not moving |12's , as qby the DOS @by 1,552 {21 and 2F mby Mr. D in the Mr. D , it pof 1,536 to 1,550 at the end of the a. The >and in the DOS to the >and . The in the 5in all Mr. D "Mr. D" See: Mr. G PZPAPN Mr. G : Mr. G Poland R: 253 5: PNCK - 3.96+, 1.25+, 6.64+ The Mr. G , and s to be Poland. It is an earlier of the Mr. D . Mr. G is a uof . the Mr. G X, the Mr. G wall of the . in the 253 at the end of the a. The >and in the DOS to the >and The in the 5in all Mr. G "Mr. G" See: Mr. D PZPAPN MShark : MShark R: 373 5: PNCK - , NAV, 1.53S+, .2.0+ The MShark . Its . MShark is a the MShark X, the MShark wall . in the E. If E, it the MShark pof 373 at the end of the . The >and in the DOS to the >and . The can be all MShark "Mshark-S v1.0" MShark Nn'd do of MShark are: MShark-378: , MShark-378 is a 378 of the MShark . It adds 378 )to the . 9the the MShark-378 "(C) Mshark-S v.1.0" PZPAPN : MSJ Israel R: 15,392 5: PNA - NAV 3.0+, 1.25+ The MSJ , and is fIsrael. MSJ is a -and . , but not the MSJ X, the MSJ wone . -or . on the C: 15,392 at the the lan . aformat t. The >and in the DOS to the >and . The can be in the MSJ 5in all "exe" "comspec" "Insufficient Kspace" "\*.exe" "\*.com" "c:\autoexec.bat" "NOHARD" -SPEC" The cis the "of the very long in the 5, un in all "Do not worry is designed to avoide making any damage to" "your `. A remover be send to computer Magazines" "by 30th of oct can suppy to coustomers." is a demonstration of what a Palestinian Boy can do." The remainder of the 8a political statement. PZPAPN : MSTU MSTU-531 R: 531 - 532 5: PNAK - \, NAV, The MSTU . Its . MSTU is a of . -and . MSTU is X, the search the Efor -and . Any in the rby the . If E, it the MSTU pof 532 ). . MSTU pof 531 ). In both cases, the at the end of the be no 3in the >and in a DOS can be in MSTU `are: was written in MSTU, "*.exe *.com" It is if MSTU of MSTU are: MSTU-551: on the MSTU adds 551 to the . v, and 554 )to . v. It 8the same as the Zof . MSTU-551 may in a hang. MSTU-1536: A later of the MSTU , MSTU-1536 is a uof . -and . , but not ,. Its is 2,000 ), and at the top of ', hooking |21. , MSTU-1536 -and . pof 1,536 to 1,550 at the end of the a. The in the DOS not be The can be in the 5in all MSTU-1536 "OOT" "CAN" "OKI" "RBOGEMAND" ly, all ccharacter sequence: " May, PZPAPN Mugshot : Mugshot BSC; &failures India R: N/A 5: BR - , NAV 3.0+, /2.1+ : DOS SYS on The Mugshot . It is fIndia. Mugshot is a Jwhose the Mugshot , the Mugshot . At , the &process usually fail. replaces the J, the newly inserted rif it is not write protected. The still not complete. Mugshot lthe in the 5in the "Ref:vb. Greetings fAnil Rao!(snap graphics prog is aimed at developping permanent vaccines is harmless it Nnt destroy data., affects a:,b: Os.For info. contact Anil Rao. Bombay, India." The Mugshot lmoved the to an location on the K, where it be immediately followed by several include the "For every vaccine is a ".Do no pla" Mugshot is a poor replicator, we were unable to successfully &the fany we were able to PZPAPN : Mule i; TSR; Black box on Thailand R: 4,112 - 4,126 5: PRsAK - , NAV, The Mule . It ated in Thailand. Mule is a generic uof . and . `. It ,. Mule is on the The Mule is X, Mule as a low TSR of 4,096 {08 and 21 mby the Mule is , it -and . X. If X, it are already Mule by 4,117 the t. At , the the "of the a. Later, if the Mule vthe , the at the end of the a. During the re t, the ais treated as an . Mule by 4,112 to 4,126 t, and 4,112 )upon later re The always be at the end of the Mule 9the "Mule", derives its Thirty minutes Mule became , a black box on the low left hand side of the the graphic effect of many members of the It is what Mule See: PZPAPN Multi 1.1 : Multi 1.1 G: March, R: 2,560 5: PRhAK - 3.96+, 30.00+, NAV 3.0+, 1.25+ The Multi 1.1 in March, . Its , but it may be fthe . Multi 1.1 is a -and . bMulti 1.1 X, the Multi 1.1 at the top of $the ', hooking |24. , as qby the DOS @by 2,608 |12's !moved. the Multi 1.1 , it for any reason. pof 2,560 be hidden . The at the end of `. The >and in the DOS not be . The the 5in Multi 1.1 is not "Multi (R), Release 1.1, Copyright (c) -92 by" Multi 1.1 is a full , and dis are read into . As such, CRC and checksumming may not be able to detect its presence on the PZPAPN Multi Child : Multi Child Multi Child-104 R: 104 5: PRaCK - n1.04+, , NAV 3.0+, 1.25+ The Multi Child, or Multi Child-104, . Its . Multi Child is a uof . bMulti Child in low al usually a DOS buffer. mby the . It may wone . in the the Multi Child , it are copied to a target sub- of 104 at the end of the The >and in the DOS to the >and . No in the Multi Child Multi Child Nn't to do of Multi Child are: Multi Child-110: , Multi Child-110 is a 110 of the Multi Child . It to the PZPAPN Multi-123 : Multi-123 (n 123, V123, Multi, SD-123 2; slow loads R: 123 5: PNCK - , NAV, The Multi-123 . It is (. Multi-123 is a of . Multi-123 is X, the search the Eand wall . `it finds. pof 123 at the end of the a. The >and in the DOS to the >and The Multi-123 cannot recognize it has r. As a , it continue to walready `, adding increments of 123 ps and >and 2, an symptom of a Multi-123 in a long period of Kaccess before the requested actually runs. Multi-123 Nn't do PZPAPN Multi-Face : Multi-Face MFace i; TSR; 2; smiley face 4moving on M; write protect slowdown R: 1,441 5: PRsCK - , NAV, The Multi-Face . Its . Multi-Face is a uof . The the Multi-Face in low mapping utilities may indicate the Config area of pd in by 1,456 ). The DOS indicate 64K in addition to the 1,456 by the {08, 13, and 21 mby the Multi-Face the Multi-Face , it pof 1,441 at the end of the The >and in the DOS to the >and of an tof the Multi-Face a minor slowdown . The slowdown is most noticable Mis scrolled. . >and in the DOS Xif the >is different >. Write protect on write protected I. Lastly, multiple smiley face 4may on the moving around the 4on the PZPAPN Mummy 00K V PTK : Mummy Mummy 1.2 , Except Mummy 2.1 7in USA i; TSR; jon 8088 Taiwan R: 1,399 - 1,413 5: PRsE - , NAV, The Mummy . It is fTaiwan. is a uof . frequently hang 8088 . It is on the bMummy X, the Mummy as a low TSR of 1,680 ). It as an pin the of the Config area of is mapped by utilities. mby the the Mummy , it pof 1,399 to 1,413 at the end of the . The and in the DOS are no in the . The in the "Mummy "Kaohsiung Senior School" "Tzeng Jau Ming presents" "Series Number = [ It is what Mummy of Mummy are: Mummy 1.0: as the Platinum Mummy 1.0 is an earlier of the Mummy . It in low , as the DOS 1,856 {03 and 21 are , Mummy 1.0 by 1,489 to 1,503 at the end of the be no 3to the >and in the DOS The in the "Mummy 1.00.00" "Kaohsiung Senior School" "Tzeng Jau Ming presents" "Series Number = [ : Taiwan Mummy 2.1: Gin multiple locations in the United States and the Republic of South Africa in May, Mummy 2.1 is a later of the Mummy . Its TSR is 1,632 hooking |21. It X, adding 1,364 to 1,378 to the . The "PC Mummy Vers. 2.1" "Kaohsiung Senior School" "Tzeng Jau Ming presents" : Taiwan May, Mummy 2.1B: }in the in May, gequivalent to Mummy 2.1B, and has minor alterations. May, Mummy 2.1C: in March, , Mummy 2.1C is a minor of Mummy 2.1. The in the "Saddam Hussein Ver. 1.1" makers." "Made by T.Z.M present." March, PZPAPN Munich : Munich G: March, &failure; Germany R: 2,355 - 2,370 5: PNCK - , NAV, 1.53S+, .2.0+ The Munich }in Germany in March, . Munich is a uof . the Munich X, the wtwo . in the of 2,355 to 2,370 at the end of the . The >and in the DOS not be . Munich is an and no in the The Munich Mfake Xand jmay has r, the fail to of the Lby the Munich crashed by unauthorized access, explosion DANGER!!!" "Warning: segments "ROM Uat F000:0188 during low RMA, please contact your engineer or local dealer - halted" "Unrecoverable halted" "Udvozli Ont a Munnich Ferenc Tarsasag!" PZPAPN Murphy : Murphy Murphy-1, V1277, j; speaker noise; possible bouncing ball effect (see Murphy-2 Sofia, R: 1,277 5: PRA - \, NAV, : CleanUp, NAV, or The Murphy . It is a generic . u, and The Xon a , the it is , if a X, or for any reason, it is rby the Murphy bnon- , the attempt to -MAND. -. The by 1,277 are less 1,277 not be The Murphy watches the between 10AM and 11AM, the turn on the speaker and send a 61h to it. At any , the attempt to use the speaker. The in the Murphy giving an idea of it was written and by whom, not "Hello, I'm Murphy. Nice to meet you friend. I'm written since Nov/Dec. Copywrite (c)1989 by Lubo & Ian, Sofia, USM Laboratory." rby the Murphy of Murphy are: AntiChrist: on the Murphy , AntiChrist is a uof . . It at the top of , but $the DOS qby the DOS by 1,040 m. AntiChrist larger 1K in are pof 1,008 at the end of the be no to the >and in the DOS is considered a research , and was not in the public domain at the it was : Italy March, on the Murphy s is a uof . -and . , and should be considered a . It Nnot ,. It at the top of , but $the , as qby the DOS @by 2,064 {21 and 22 m. Br -and . pof 2,045 at the end of the The not be if the in the DOS Foy as #63,491 )larger. s in arm.Copyright (C) . V 1.0" ":*. Zof the DOS detected on all Cemetery: Cemetery is a 1,417 of Italian Pest. Cemetery is Aby 1,440 , it well as ,are not by 1,417 at the end of the a. One can be Cemetery : "CEMETERY". It is what Cemetery Delyrium: Delyrium is an 1,778 of Italian Pest. Delyrium is Aby 1,808 hooking |21. . -and . for any reason. by 1,778 Delyrium at the end of the Delyrium 9the "(c) IVRL (Ivrl Head Quarter, Milan Italy)" "Delyrium - Created by Cracker Jack "Copyright by Italian Research Laboratory .because the dead is not so far" .and the horror It is what Delyrium , but [difficulties DOS COPY 6and executing fthe B: : Italy Diabolik: Diabolik is an 1,171 of Italian Pest. Diabolik is Aby 1,200 by 1,171 Diabolik at the end of the Diabolik "Diabolik Ltd. (C) by Odrowad" "Trow" It is what Diabolik Erasmus: on the Murphy , Erasmus is a uof . -and . . It Nnot ,. It at the top of , but $the , as qby the DOS @by 1,712 m. Erasmus pof 1,682 at the end of the a. The din Erasmus "C.J.'91" "Gli Dei si mostreranno a gli uomini, Quando essi saranno autori di grande conflitto Prima il Cielo visto sara con spada e lancia, Che verso la mano sinistra portera piu grande afflizione. Alla rivoluzione del grande numero sette, Apparira ai tempi giochi d'Ecatombe, Non lontano dalla grande eta del millennio Coloro che entrarono usciranno dalle loro tombe. Saint-Remi, 14 dicembre 1533" Erasmus may [what to be warm re &s upon &s" are actually the in copy of #reloaded, and AUTO WC.BAT : Italy May, Finger: Finger is an 1,172 of Italian Pest. Finger is @by 1,200 by 1,172 at the end of a. . are either X. Finger on Saturdays, at X, followed by a hang: "Cannot remember what I was doing!! Insert fingers in ears and re &please" to re in a " Jread failure" due to the having damaged the of the Goblin: on the Smack , Goblin is a uof . -and . , but not It's is 1,968 ), and hooks Goblin -and . over 2K in pof 1,951 at the end of the Goblin on Friday, at Zof an in the Mof a and deletion of the in the If the Xis a . , the "What a horrible , i wish not Yit!" If the Xis an . , the "Goblin the Black Death (c) by Cracker Jack IVRL '91" %the , the din Goblin "(c) by Cracker Jack Italian Research Laboratory" "Patricia Nnot function correctly, because I ln't run it before send. Now I'm debugging it...ehehehehehehahahahahahah" "Smack .what a horrible "Compliments to the and in the DOS Italian Pest is in in the Land the not executing: "I'm hungry!! Why don't you buy me a Cheesburger??" Italian Pest on Fridays, at of an in the "Your PC is the Intergalactic Pest!" The in the Bd, and the C: corrupted. %the , the can be din all "(c) by Cracker Jack Italian Research Laboratory Created,Developed and Written by Cracker Jack, All rights reserved Con questo dichiaro guerra a tutti i POVERI (ahhh quanto sono poveri!) cosiddetti ' Researchers' del globo... provate a prendermi..ahahahah I'IVRL e'forte .vincera Writers di tutte le nazioni...uniamci!" : Italy May, Kamasya: Kamasya is a 1,098 of the Italian Pest . It is a uof . . It's is 1,120 ), and it hooks |21. Kamasya by 1,098 at the end a. Kamasya on Tuesdays, at "Kamasya nendriya pritir labho jiveta yavata jivasya tattva jijnasa nartho yas ceha karmabhih" : Italy March, Locker: Locker is a 1,642 of the Murphy . It is a uof . , but not ,. It's is 1,644 hooking |21. Locker are 1,642 at the end of the a. The >and in the DOS not be . The can be in the "(c) IVRL (Ivrl Head Quarter, Milan Italy)" "all rights reserved!!!" "[0mPassword ->" "[0mPassword accepted!" "Incorrect Password, sorry!" "Locker Viri - Created by Cracker Jack : Italy March, Migram: Migram is a 1,221 of the Murphy . It is a uof . . It's is 1,248 ), and it hooks Migram over 1K in by 1,221 at the end a. Migram on Saturdays, at "MIGRAM VIRUS 1.0 (C) The Mof the is followed hang. : Italy March, Murphy-2: (V1521) to the Murphy , its is 1,521 ). The non- in the are now: "It's me - Murphy. Copywrite (c) by Lubo & Ian, Sofia, USM Laboratory." The Murphy-2 wany . a, as well as any aover 900 ). Instead of turning the speaker on between 10AM and 11AM, waits for the lthe minutes set to 00, may la "bouncing ball" effect to several effect Nnot, however, all Murphy-3: Murphy-3 is a 1,284 of the Murphy The major difference between Murphy and if it is . The no longer automatically Murphy-3 by 1,284 at the end of the is the same as the , except a low buzzing sound be emitted along the clicks. The in the Murphy ( May Murphy-4: Murphy-4 is to the Murphy-2 is 1,480 )long. It wany larger 2,000 it is . Murphy-4 at the top of $the Aby 1,504 ), as qby the DOS . Murphy-4 in the same manner as Murphy-2, and 8the same ( May Smack: on the Italian Pest , Smack is a uof . -and . , but not ,. It's is 1,856 ), and hooks |21. Smack -and . over 3K in pof 1,835 at the end of the be no 3to the >and in the DOS Smack [the occasional dis ance of both and data notice a gradual lost clusters on the Kand Smack on Fridays X. It may Mthe "Is today Friday? (Y/N)" Replying "Y" in the and the #terminated: "Sorry but on Friday I wish not work!!" Replying "N" in the the threatened FAT damage Nnot due to a bug in the "You are untruthful!! For punishment I format your HD FAT!!" in the Smack was written in Italy by Cracker Jack IVRL" "All rights reserved, please don't crack "Special to Patricia Hoffman: I love you "SmackSmack" "Can you give me your telephone number??? Ciao bellissima!" : Italy May, Swami: The Swami in May, fa United States source. Its . It is a Murphy and be detected as Murphy by utilities. Unlike Murphy, Nnot ,. Swami pof 1,250 ). It are , or copied. 9the "Bhaktivedanta Swami Prabhupada (1896 - 1977)" Swami Bthe ain the See: Tormentor Tormentor-1072 PZPAPN MusicBug : MusicBug Music &, Music Bug ; clicking; music randomly played on speaker; lost clusters Taiwan R: N/A 5: BRtX - \, NAV, : CleanUp, or see The MusicBug is a . It ated in Taiwan. the MusicBug , the at the top of $the '. The be moved, so now report 638K of . Clicking may be heard for a short fthe speaker before the &proceeds, but more likely a section of a tune be played. The proceed. MusicBug is , it periodically play an portion of the same tune Kaccesses . It is thus rather disruptive. MusicBug is , any Kaccessed ( . In the case Ks, MusicBug vthe l4K in lost clusters 5as well as a copy of the The lost clusters: "MusicBug v1.06. MacroSoft Corp." "Made in Taiwan" the MusicBug can be dis powering off the &ing fa write protected using the DOS SYS 6. The lost clusters can be removed by using the the /F parameter. Ks, however, cannot be dis rin the same way. While the DOS SYS remove the fthe , and the lost clusters can be recovered, the remain an un &able, non- Kuntil a low-level format is performed. PZPAPN Mutant : Mutant Mutant 123, Mutant 127, Mutant 128, Mutant, -123, G: May, &failure; R: 123 - 128 5: PONCK - , NAV, The Mutant ]was in May, (. The Mutant ]consists of three las both a uand an u. Mutant ]members rby a member of the Mutant X, the search the Eand all the . may either be by the as a t, the increasing depending on is present, or the may be "of the . tare permanently corrupted. pof 123 to 128 ), depending on member of the Mutant ]is present. In any case, the in the to the >and a member of the Mutant two "*.com" "VPV" &ing has a Mutant ]member in a &failure. Mutant ts may in a hang. member(s) of Mutant ]are: Mutant 123: as V123, member of the Mutant ]is 123 . Generally, Mutant 123 not function , even if the ahas a Mutant 127: as V127, member of the Mutant ]is one *shorter Mutant 128. It ls as Mutant 128: The Mutant submission, its 128 ). It be ls as PZPAPN Mutation : Mutation H: =seconds set to 02; "Divide overflow" T; "Cannot load -MAND, halted" too big to fit in R: 688 5: PRhCK - 30.00+, NAV 3.0+, n1.04+, 2.11+, \2.13+, The Mutation . It s to be fNorth America. Mutation |is a uof . X, the Mutation at the top of $the ', hooking |21. , it may the Mutation pof 688 at the end of the a. The >and in the DOS to be un , or may ed. Actually, the seconds field in the to 02. The can be in the 5in all Mutation "The Mutation RABID'S Back and Kicking in `93" "-Soltan Griss" the Mutation the , as well as possible "Divide overflow" "Cannot load -MAND, halted" too big to fit in of Mutation |are: Mutation |-B: A 694 of the adds 694 )to . v. Like the , it sets the seconds field in the =to "02". The can be in the 5in all "The Mutation |(B) RABID'S Back and Kickin' the Bucket in `93 -Soltan Griss" jfrequently PZPAPN : MVF Arka, Arkanoid H: i; TSR; R: 1,898 - 1,909 5: PRsCK - NAV 3.0+, n1.05+, The MVF, or Arkanoid, . It is reported to be fthe . MVF is a polymorphic, uof . bMVF X, the MVF as a low TSR of 2.1K. mby MVF in the MVF , it X. If X, it the MVF pof 1,898 to 1,909 at the end of the a. The >and in the DOS not be . The are in the MVF 5, and are not "THE MVF-FILEVIRUS" by the MVF" "MAD Factory" "No. 0001" frequently © of of the MVF MVF-1954: on the MVF 2.2K. It adds 1,954 to 1,969 )to the . for any reason. The at the end of the a. The >and in the DOS not be . The in the "THE MVF-FILEVIRUS" by the MVF" "MAD Factory" "28/9/91 - V1.6" jmay MVF-1954B: to the MVF-1954 is a very minor . It Nn't always MVF-1954C: to the MVF-1954 is a very minor PZPAPN MX-335 : MX-335 H: R: 335 - 351 5: PRhE - 3.96+, NAV 3.0+, .2.0+, 1.25+ The MX-335 . Its . MX-335 is a bMX-335 at the top of $the ', not moving |12's , as qby the DOS @by 368 mby the the MX-335 , it pof 335 to 351 at the end of the a. The >and in the DOS to the >and . The can be dstarting in the 19th *of all "MX" PZPAPN Mystic-377 : Mystic-377 H: Zfailure R: 377 5: PNCK - 30.00+, n1.04+, 6.64+ The Mystic-377 . Its . Mystic-377 is a uof . the Mystic-377 the Mystic-377 wone . in the E. The usually ed to the DOS prompt. the Mystic-377 pof 377 at the end of the a. The >and in the DOS not be . The in the Mystic-377 "'Mystic' by Digital Alchemy" of Mystic-377 are: Mystic-379: to the orginal adds 379 )to the . The same in the , 1994. PZPAPN Naught-865 : Naught-865 All s may be corrupted; &failure R: 865 5: ONAK - Generic 30.00+, 2.11+, V122+, 1.25+ The Naught-865 . Its . Naught-865 is a uof the C: Oroot E. It wboth and data the Naught-865 X, the Naught-865 all of the and data present in the C: Oroot b865 )replaced by the Naught-865 5. The >in the DOS lthe year the year in the >. The to the . The can be dnear the "of all "*.*" Since Naught-865 s all `in the C: Oroot fail to not function, and any data, .BAT, or configuration `in the be corrupted. PZPAPN ], Horse T; buzzing speaker & clicking Sofia, R: 1,154 or 1,160 5: PRhAK - , NAV, The is a group of four . Several were in May, . The es in ]are all es, and gare very one of the es is X, the at the top $the and 21 mby the , as measured the DOS by 1,280 ). At , the ,if it hasn't , it -and . `over 1K in pby either 1,154 or 1,160 ), depending on is present, at the end of the . The not be able to be seen if the . The >and in the not be one of the es may find Ythe DOS the adjusted not match the . Executing the a /F option may in corrupted symptom may be noticed on is an annoying "buzz" #emitted fthe speaker for awhile. s, scrolling of the Mor pressing keys on the clicking noise. sound effects members of ], but not the later It is what the es do es are: Horse: Very -B, Horse is a minor variation. Like -B, it is 1,154 produces the sound effects . The is: "Sofia, Horse 2: Horse 2 is very -A. It is 1,160 , and produces no sound effects. The is: "Sofia,Feb '91 Horse 5: Horse 5 is very $, it is a 1,776 has three Horse-8: , Horse-8 is a 2,248 member of the ]. It in the DOS Data area of , hooking |21. qby the DOS not be , Horse-8 -and . larger for a reason Z. The hides the 2,248 p, and the DOS Horse-8 is Horse-8B: , Horse-8B is a minor of the Horse-8 . Its is 4,864 )and hooks |21. lthe seconds field in the =set to "60". an effective of 1,160 Nnot produce the sound effects of -B. The "Sofia, Feb '91 " can be dat the end of an effective of 1,154 produces the sound effects . It 8the "Sofia,Jan " and "(c) ." It s to be an earlier an effective of 1,610 and by 2,048 ). It is , or what it 9the an effective of 1,776 -C. It not 9any {01, 1C, and 21 an effective of 1,576 ), the to the Naughty Hacker-D Nnot hook |1C. Like -D, it 9any -F is a 1,594 -C. The is "N.Hacker". -G is an 1,154 ]. It is 5modifications. The "Sofia,Jan/Feb PZPAPN Nazgul : Nazgul fail to function &failure The R: 266 5: PNCK - 8/93S+, 3.96+, NAV 3.0+, The Nazgul . It is fThe . Nazgul is a uof . the Nazgul X, the Nazgul wall of the . in the E. If the Nazgul pof 266 the Nazgul at the "of the a. The >and in the DOS not be . The can be in the 5in all Nazgul -Nazg the Nazgul fail to function ing to the DOS prompt has accessed the . If the © of r, the PZPAPN NaziPhobia : NaziPhobia fail to R: 4,240 5: ONE - 1.25+ The NaziPhobia , and fthe . NaziPhobia is a uof . . It permanently corrupts the the NaziPhobia X, the NaziPhobia wone . ain the but not the ain the lthe b4,240 )of the host by the NaziPhobia 5. The unless were smaller 4,240 , in case 4,240 . The in the DOS to the >and The NaziPhobia on any Friday. On Fridays, of an in the Land the ed to the DOS prompt. 'ON THE SABBATH.. THE GHOST OF HITLER SPEAKS : "MY FELLOW NAZI'S.. I WAS WRONG.." "I NOW -MAND YOU TO -MIT SUICIDE.. NOT GENOCIDE.." "DO IT.. SO THE WORLD WILL BE RID OF THE NAZIPEST.. "AND ALL AUSLANDER CAN TRUELY BE FREE OF NAZIPHOBIA.. NaZiPhobia (c) [VooDoo].. We support the The fthe in the 5in all NaziPhobia PZPAPN NCU LI : NCU LI ; Parity hang R: 1,694 - 1,704 5: PRhE - 3.96+, NAV 3.0+, 8/93+, The NCU LI . Its ~are it may be fthe NCU LI is a uof . The the NCU LI at the top of $the , as qby the DOS @by 1,888 mby the , the NCU LI pof 1,694 to 1,704 at the end of the a. The >and in the DOS to the and . The can be din the 5in all "NCU LI" the NCU LI [the video mode #switched to 40 column mode, and the "PARITY ERROR ADDR (HEX) = ( 02C14H) SYSTEM HALTED" s, the be hung. The not as it is PZPAPN Necro Fear : Necro Fear R: 1,823 5: PRaCK - 30.00+, , NAV 3.0+, n1.04+, 6.60+, 6.64+, 1.25+ The Necro Fear . It is the . Necro Fear is a bNecro Fear X, the Necro Fear in low , hooking {21 and 2F. , as qby the DOS not be the Necro Fear , it pof 1,823 at the end of the a. The in the DOS not be . The in the "I am afraid !bitten by the FEAR" "bug. Just think, you may lpassed in on to all of" "your friends! What fun it goes off" "all of "FEAR Copyright (c) NecroSoft Technologies" "Developed in:" "The Metropolis of Sodium Chloride in Hydrogeon Dioxide" jfrequently on Necro Fear PZPAPN Necro Shadow : Necro Shadow j; disruption of contents, "blue snow" R: 1,200 5: PRhAK - 3.96+, NAV 3.0+, 8/93+, The Necro Shadow . It is the . Necro Shadow is a -and . bNecro Shadow X, the Necro Shadow at the top of $the ', hooking |21. the Necro Shadow , it and . pof 1,200 at the end of the a. The >and in the DOS not be The in the "[Shadow] NecroSoft Enterprises-a division of BCA" "Greets to SKISM" [frequent &failures the © of disruptions frequently . On monochrome as a couple of on the . On VGA , a bunch of blue squares or blue snow . In both cases, a hang accompany the disruption. of Necro Shadow are: Necro Shadow-B: on the Necro Shadow employs techniques to avoid detection and quickly spread on . Its is 3,504 ), hooking |21. It , or a DOS DIR 6is performed. pof 1,700 be hidden Necro Shadow-B is . The at the end of the a. The >and in the DOS not be . The in the "[Shadow-B] NecroSoft Enterprises - a division of BCA" "Greets to SKISM" Necro Shadow-B failures © of on write protected in a write protect U. The DOS Ton all PZPAPN Necrosoft Dementia : Necrosoft Dementia Necrosoft =seconds = 02 "CALLBACK. -" and/or "!#TEMP#!" `created R: 4,209 - 4,223 5: PRhAK - , NAV 3.0+, The Necrosoft Dementia . It is fthe . Necrosoft Dementia is a uof . -and . bNecrosoft Dementia at the top of $the ', hooking |21. @by 8,416 |12's not be moved. the Necrosoft Dementia , it -and . pof 4,209 to 4,223 at the end of the a. The >and in the DOS to be , or the "dis fthe DOS Dir . The seconds field of the >and !set to "02", is the tmarker for . The in the "!#TEMP#! REQUEST.IVA CALLFAST. -RECEIPT.IVA CALLFAST. -*.*" "Dementia] Copyright enterprises - All rights reserved" "I am the man walks alone" "And I'm walking a dark road" "At night or strolling through the park" the light begins to s feel a little strange" "A little anxious it's dark" The Necrosoft Dementia s create either one or both of the d "!#TEMP#!" and "CALLFAST. -". `are created, are 5,183 copy of the . Executing the CALLFAST. in the becoming active on the It is what damage potential of Necrosoft Dementia are: Necrosoft Dementia-B: A later of the Necrosoft Dementia and functional characteristics are the same as the of the . The the "!#TEMP#! REQUEST.IVA CALLFAST. -*.*" "Dementia] Copyright Necrosoft enterprises - All rights reserved" "I am the man walks alone" "And I'm walking a dark road" "At night or strolling through the park" the light begins to s feel a little strange" "A little anxious it's dark" PZPAPN NeverMind : NeverMind , 1994 R: 838 5: PRhCK - V116+, \2.13+, 2.58+, n1.05+, 6.64+, 1.25+, 6.64+, V116+, 2.58+ The NeverMind , 1994. Its . NeverMind is a uof . bNeverMind at the top of but $the ', not moving |12's , as qby the DOS @by 1,680 mby the pof 838 at the end of the a. The >and in the DOS not be The in the NeverMind "A WORD TO PATRICIA:" .NAH, NEVER MIND" "If Nn't refer to you, just ignore it." "For more xcall: ++1-408-988-3773 (USA)" s to !written by an individual wishing to get the author of 's attention. PZPAPN Newcom : Newcom R: 3,045 - 3,060 5: PRhAK - n, NAV, 1.53S+, The Newcom . Its . Newcom is a uof . -and . Newcom is X, the at the top of but $the , as measured by the DOS 3,312 {1C and 21 are mby the |12's is not moved. becoming , Newcom -and . X. If X, it by 3,045 to 3,060 at the end of the a. The >and in the DOS not be by the It is what Newcom See: Alfa PZPAPN : NGV :; TSR; unexpected R: Varies, depending on present 5: PORsCK - V111+, /2.1+, 2.58+, 2.11+, 6.64+, V111+, 2.58+, .2.0+, 6.64+, 1.25+ NGV is not a single , but rather a group of !generated generation utility called Nuke Gen 1.51. es are either us of . , and may ,. The typically TSR, portion is not used for replication, the es are The $are members of the NGV group. Eight of the es are s referred to as the "Adams and 9the s of eight fthe Adams television fthe 1960s, and the movie. NGV generated es are: NGV-1376: , 1994, NGV-1376 is a . It s the b1,376 )of one . ain the X. NGV-1376 9the in the -MANDE" Created by NuKE - Gen V1.51 License n" "id# [NuKE]-93" NGV-1376's TSR is 1,632 hooking , 1994. NGV-Cousin It: , 1994, NGV-Cousin It is a vone . in the were larger 1,681 by 1,680 )upon were smaller 1,681 3,361 )upon t. In both cases, the at the "of the a, and the >and the DOS not be . The in the --=Adams=-" "Part of the Adams ][Cousin-It]DA & NwM KiCk" "ASS" NGV-Cousin It's TSR is 1,968 hooking , 1994. NGV-Gomez: , 1994, NGV-Gomez is a vone . ain the were larger 1,649 by 1,648 )upon were smaller 1,649 3,297 )upon t. In both cases, the at the "of the a, and the >and the DOS not be . The in the --=Adams=-" "Gomez Adams/ [NuKE] RoCks DeathBoy Learns Daily fDA & NwM" NGV-Gomez's TSR is 1,936 ), hooking |08 and 22. The zs a copy of the TSR into jmay , 1994. NGV-Lurch: , 1994, NGV-Lurch is a vone . ain the were larger 1,649 by 1,648 )upon were smaller 1,649 3,297 )upon t. In both cases, the at the "of the a, and the >and the DOS not be . The in the --=Adams=-?" "Lurch Part of the Adams f-=DeathBoy KoASP= [NuKE]RoCks" NGV-Lurch's TSR is 1,936 ), hooking , 1994. NGV-Morticia: , 1994, NGV-Morticia is a vone . ain the were larger 1,793 by 1,792 )upon were smaller 1,793 3,585 )upon t. In both cases, the at the "of the a, and the >and the DOS not be . The in the "Morticia Adams Greets to Pure Energy,S.Radish,FireCracker, NuKE3" NGV-Morticia's TSR is 2,000 ), hooking |08. jfrequently , 1994. NGV-Pugsley: , 1994, NGV-Pugsley is a vone . ain the were larger 1,601 by 1,600 )upon were smaller 1,601 3,201 )upon t. In both cases, the at the "of the a, and the >and the DOS not be . The in the --=Adams=-" "Pugsley Adams;Greets to Nowhere Man,Dark Angel,Rock,Savage, NuKE" NGV-Pugsley Nnot , 1994. NGV-Thing: , 1994, NGV-Thing is a vone . ain the were larger 1,649 by 1,648 )upon were smaller 1,649 3,297 )upon t. In both cases, the at the "of the a, and the >and the DOS not be . The in the --=Adams=-?" "Thing Adams? Part of the Adams Viri ]. [NuKE]" "RoCks Loser" NGV-Thing's TSR is 1,936 ), hooking {08 and 22. jand/or unexpected &s may , 1994. NGV-Uncle Fester: , 1994, NGV-Uncle Fester is a vone . the were larger 1,777 by 1,776 )upon were smaller 1,777 3,553 )upon t. In both cases, the at the "of the a, and the >and the DOS not be . The in the --=Adams =-" "Uncle Fester Adams. [NuKe] RoCks. Part of the Adams ]Vir93" "PEN ZIP" NGV-Uncle Fester's TSR is 2,064 hooking |09. jfrequently , 1994. NGV-Wednesday: , 1994, NGV-Wednesday is a . It s the 1,312 )of one . ain the X. NGV-Wednesday 9the in the -McAsshole" "(c) Wednesday's NuKE part of the Adam's "id# [NuKE]-93" "Parity USYSTEM HALT" "Please REBOOT" NGV-Wednesday's TSR is 1,568 hooking , 1994. PZPAPN : Nina R: 256 5: PRhCK - \, NAV, The Nina , and is is a uof . the Nina Nina at the top of $the Aby 1,024 )as shown by the DOS mby the Nina is , it are greater X. If X, it by 256 ), and lthe at the "of the The Nina d Nina because the 8the "Nina" in the Nnot do PZPAPN Nines : Nines i; TSR; printer interference R: 705 5: PRsCK - 8/93S+, , NAV 3.0+, .2.0+ The Nines . Its . Nines is a of . The the Nines as a low TSR of 800 {17 and 21 mby the Nines the Nines , it X. If the Nines pof 705 ). The at the end of the . The >and the DOS not be . No are in the 5in Nines the Nines [interference fthe to print to the printer. of Nines are: Nines-706: One *longer Nines adds 706 )to the . May, Nines-776: Nines-776 is a 776 of the Nines May, PZPAPN Ninja : Ninja R: 1,546 - 1,634 5: PRhA - NAV 3.0+, 8/93+, The Ninja . It is fthe . Ninja is a uof . , but not ,. It spreads quickly, for any reason. The the Ninja the Ninja at the top of $the , as qby the DOS @by 1,408 Ninja in , the Ninja -and . for any reason. pof 1,634 ). . by 1,548 ). In both cases, the at the end of the a. The and in the DOS not be . The in the 5, and thus not ,AIDSTEST. "Mutant Ninja 2.0 (C) &Worm Software" It is what Ninja may do PZPAPN No Frills 00Q Y PTQ : No Frills Australia R: 813 5: PRhAK - n1.05+, .2.0+ The No Frills . Its ~was Australia. No Frills is a uof . -and . bNo Frills X, the No Frills at the top of $the |12's not be moved. , as measured by the DOS @by 2,048 mby No Frills in , the No Frills ,if it was not the No Frills , it and . X, or copied. pof 813 at the end of the a. The >and in the DOS The can be in the 5in all No Frills "-No Frills by Harry McBungus-" No Frills may the of No Frills are: No Frills 1.01: A later of the No Frills by 1,536 hooking of 815 at the end of the a. The in the has "-No Frills 1.01 by Harry McBungus-" No Frills 1.01 Nnot hang the the : Australia No Frills 2.0: A later of the No Frills 1.01 of 843 at the end of the a. The in the has "+-No Frills 2.0 by Harry McBungus-+" : Australia No Frills 3.0: A later of the No Frills 2.0 of 835 at the end of the a. The in the has "+-NF3.0-H.McB- [PuKE] -+" "=EXt.=COt-" No Frills 3.0 may : Queensland, Australia No Frills-1358: A later of the No Frills by 2,048 ), hooking {09 and 21. of 1,358 at the end of the a. The the "Kcat 3.01 % 5%" "By Sir Twist & Thunderbird, Many kz to Harry McBungus whose 5d we politely nicked." "c:\win386.dat" No Frills-1358 may hang the the : Australia PZPAPN NoBock : NoBock R: 440 5: PNC - n, NAV, The NoBock . NoBock is a uof . NoBock is X, the check the >. If the between 1, 1980 and 30, 1980, it Mthe and halt the , not sany "No Bock today halted!" The be left spinning. If the clock is set to a >between 1, 1980 and 30, 1980, NoBock may wone ain the Oand The , however, Nnot Xduring period of NoBock pof 440 the at the end of the NoBock is an , and the cannot be viewed PZPAPN NoInt : NoInt Bloomington, LastDirSect, BSC; Canada R: N/A 5: BRtX - , NAV, : CleanUp, or M- The NoInt }in Canada in . NoInt is a of the . Like , it as well as the The the NoInt , NoInt at the top of $the 12's be moved by the , as measured by the DOS by 2,048 ). NoInt wthe . The to Side 0, Cylinder 0, NoInt is , it are accessed on the . On double density 5.25" I, the 11. On high density 5.25" I, the 17. In both cases, are part of the root Eof the J, so any `whose Eentries were in be lost. NoInt Nnot 9any take longer normal to perform accesses or &s. High density often get a " &failure" are later attempted to The reason NoInt is considered a while it can be detected on actively keep software #able to read the on the K. Instead ing the , the may unreadable to the ing in an . If you lreason to believe NoInt , power off the and re fa clean write- protected Jand check the Kfor the See: PZPAPN Nomenklatura : Nomenklatura Nomenclature, 1024-B, Nomen not R: 1,024 5: PRhAK - , NAV, : CleanUp, or The Nomenklatura in the is a uof . ,. It is not related to the V1024 it is the same The the Nomenklatura Xon a , the the top of , but $the Aby 1,024 ), and mby the , any . -or . greater 1,023 for any reason rby the Nomenklatura pd by 1,024 ). The Nnot hide the the fa write-protected in a " L, and the The Nomenklatura is destructive to the contents of exposed to randomly the frequency increasing as the more filled data. The Tmay on data `as well s due to the occasionally swapping a pair of words in the buffer. It may to critical areas such as the FAT, Fories since it may to any clusters on the K. If a aor critical area was residing in a corrupted cluster, be corrupted. As such, !exposed to the Nomenklatura must be carefully checked as the integrity of non- and any data `should be considered suspect. The d Nomenklatura as in all PZPAPN Not-586 : Not-586 R: 586 5: PRtCK - 3.96+, NAV 3.0+, The Not-586 , and is fthe . Not-586 is a uof . bNot-586 at the top of the ', moving |12's and , as qby the DOS @by 1,024 the , the Not-586 pof 586 at the end of the a. The >and in the DOS not be . No in the 5in Not-586 It is what Not-586 may do PZPAPN 855, Nov 17 Italy R: 855 5: PRhAK - /, NAV, 8/93+, The 17th . Its ~was , but it has since !reported as #widespread in Rome, Italy, in 17th is a uof . -and . The 17th is at the top of $the , as qby the DOS @by 896 |12's moved. {09 and 21 17th , it -and . pof 855 at the end of the be no 3to the >and in a DOS . One in the 5of all 17th "SCAN.CLEAN. The 17th s the 17th of any year. 17th are: Nov 17-768: A 768 of the 17th by 800 it is . It Nnot hook |09. pof 768 at the end of the May, Nov 17-880: An 880 of the 17th by 928 it is . It hooks {09 and 21. pof 880 at the end of the a. The in the "SCAN.CLEAN. WAMZ" Nov 17-880 17th thru 31st of any year, at trash the Oand the C: 17th-B: on the 17th adds 855 )to the . -and . usually hang the function PZPAPN Nowhere Man : Nowhere Man , VMessiah ; long followed by not executing; truncated R: 6,286 5: ONAK - , NAV 3.0+, n1.04+, 1.25+ The Nowhere Man , complete source 5in C. Its . Nowhere Man is a non- uof . -and . over 6,300 Nowhere Man is X, the search the Efor a . -or . 6,300 a candi ahas d, the b6,286 )of the 5. The remainder of the binary 00 be no 3to the , or >and , in the DOS E. The can be "NMAN" "BMAN" the Nowhere Man has successfully a, it Mthe , and the to the DOS prompt: "Out of If the did not find a w, it to the DOS prompt: "All r. Mission complete." Both are not The Nowhere Man truncate is zero of Nowhere Man are: gvery to the Nowhere Man completely the . -and . all . and . in the Eof over 4.5K r, it trash the Oof the , and root The "NMAN" and "J-VIRUS!" can be seen in all : Canada Montreal, Canada Nowhere Man 1.9: to the Nowhere Man 6,286 . It Ms the : "Out of Nowhere Man 2.0: to the Nowhere Man is 4,828 lhad >and the >and . While Nowhere Man 2.0 `, it may truncate both . -and . in the VMessiah: A 702 of the Nowhere Man vall . -and . whose is at least 702 in the lthe b702 )of the host the VMessiah 5. The >and in the DOS . The d samples so it is not "I am your VIRAL MESSIAH Follow me and be redeemed Your data doth exist no more The FAT holds ashes of your dreams" "[VCL] [ Messiah] Nowhere Man, [NuKE] '92" The bquote , comprising four lines, is See: 5Zero PZPAPN : NPox Evil Genius seconds = 58; K; trashes Kon 18th of month Canada R: 963 5: PRhAK - , NAV 3.0+, 8/93+, The NPox, or Evil Genius, was simultaneously }in the Eastern and Montreal, Canada in late is a ,. It is extremely destructive. bNPox at the top of $the qby the DOS @by 1,024 |12's not be moved. {09 and mby NPox in . The copy of in the C: Oroot if it was not , NPox -and . pof 963 at the end of the a. The p, however, not be in the DOS lthe seconds field of the in the DOS Eset to '58'. is the tmarker for the The can be in the all NPox "Evil Genius V2.0 - R.S/NuKE" "C:\ NPox the DOS may, however, find random on the , or Kis corrupted on the 18th of any month. of NPox are: Evil Genius 2B: gequivalent to the has two differ. : Montreal, Canada Evil Genius 2C: gequivalent to the has seven differ. : Eastern NPox 2.0: , NPox 2.0 is on the NPox . It's is 1,856 ), hooking {21 and 22. NPox 2.0 -and . are closed, and dis them as are read into lany NPox 2.0 is pd in by 2,048 ). The at the end of . The seconds in the >in the DOS be set to 60 on all Two can be din all "NuKE PoX V2.0 - Rock Steady" "C:\ : Montreal, Canada NPox 2.1: , NPox 2.1 is on the NPox 2.0 . It's is 1,744 ), hooking {21 and 22. NPox 2.1 -and . are closed, and vthem as are read into lany NPox 2.1 is pd in by 1,686 ). The the end of . The seconds in the in the DOS be set to 60 on all . Three can be din all "Death to Separatist" "C:\ "NuKE PoX V2.1 - Rock Steady" NPox 2.1 on the 13th day of any month, at K, rendering it inaccessible. It hang the : Montreal, Canada PZPAPN NR-481 : NR-481 G: March, North America R: 481 5: PNA - , NAV 3.0+, n1.04+, 6.60+, .2.0+, 1.25+, 6.64+ The NR-481 in March, . It is fNorth America (Canada or the ). NR-481 is a uof . -and . , but not the NR-481 X, the NR-481 wall the . -and . the pof 481 at the end of the a. The >and in the DOS not be . One in the 5in all NR-481 NR-481 Nn't to do PZPAPN : NTKC C-23963 i; graphic picture R: 23,963 5: PNCK - , NAV, The NTKC in May, . It is the . NTKC is on the Father Christmas . It is a uof . NTKC is X, the search the Efor a . w. If one is d, it , the full graphic of a personal computer, the cleared, and the host NTKC 23,963 ). The at the end of the din NTKC are: "regional engeneering centre" "LENINFORMATIKA N T K C Computer-Service" See: Father Christmas PZPAPN Null Set : Null Set Null R: 733 5: PNCK - 1.53S+, The Null Set . It is . Null Set is a the Null Set X, the search the Eto locate the over . If an , the the Null Set pof 733 ). The at the end of the . The >and in the DOS not be Null Set Nn't to do PZPAPN Null-178 : Null-178 to write to PRN device; R: 178 5: PNCK - NAV, 1.53S+, The Null-178 . Its is a of . the Null-178 X, the check the bfive . `in the and wthem if were not bfive . `are r, it further down in the the Null-178 pof 178 at the end of the . The >and in the DOS to the and . One can be in the 5of the Null-178 "*.com" Null-178 may notice attempt to write to device PRN. If the Nnot lan attached printer, and in DOS. PZPAPN Number One : Number One Number 1, #1, Number One-B, Number One-Argentina G: 1987 (see `fail to function; displayed West Germany R: 12,032 5: ONC - 30.00+, .2.0+ The Number One for inclusion in , however, is not a new but is an extinct rather "old" . The Number One was written in , 1987, by M. Vallen using Turbo Pascal 3.01A. It is documented, complete source, in a book by Ralf Burger. is an the Number One X, the wthe ait finds in the E. If the . awas less 12,032 , it la 12,032 =stamps in the reflect the Number One has finished a, it Mthe aHas rby Number One! The X is the of the . has just rby the are no more . Number One to win the E, it aHas rby Number One! Number One wany lthe Read Attribute set. Since Number One is an , it is not possible to remove the `and repair the damage. `should be erased and replaced clean copies. of Number One are: Number One-Argentina: to the Number One Gin Argentina in s the b12,032 )of the . v. The has ahas rby Number One". It may 3the Mvideo attributes : Argentina Number One-B: to the Number One Ms the "" in place of the ASCII character all . rand an See: AIDS PZPAPN Number 6 : Number 6 The R: 631 5: PRhC - 30.00+, NAV 3.0+, The Number 6 , and s to be fThe . Number 6 is a , but not ,. It may be related to the Civil War bNumber 6 X, the Number 6 at the top of $the ', not moving |12's , as the DOS @by 1,024 {12 and 21 mby the the Number 6 , it for any reason. pof 631 at the end of the a. The >and in the DOS not be . The in the 5in all Number 6 "#6 , Trident/The It is what Number 6 may do See: Civil War PZPAPN Nygus : Nygus Poland R: 757 5: PRhA - 3.96+, NAV 3.0+, .2.0+ The Nygus fPoland in is a uof . -and . , but not bNygus X, the Nygus at the top of $the , as qby the DOS by 1,024 mby the the Nygus , it by 757 at the end of the a. The >and in the DOS to the >and It is what Nygus of Nygus are: Nygus-Klaw: , Nygus-Klaw is fPoland. Its is 1,024 ), hooking |21. it is , Nygus-Klaw -and . 752 at the end of the a. The >and in the DOS to the . No in the Nygus-Klaw may X, or the may be ed to the DOS prompt unexpectedly. : Poland PZPAPN Nympho 1.0 : Nympho 1.0 Nympho Mitosis j, possibly beeping; R: 839 5: PRhAK - 3.96+, 6.60+, 2.58+, 2.58+, 6.64+, 1.25+ The Nympho 1.0, or Nympho Mitosis, . Its . Nympho 1.0 is uof . -and . bNympho 1.0 at the top of $the DOS ', not moving |12's , as qby the DOS +progam, @by 1,136 Nympho 1.0 in While Nympho 1.0 is a , it Fmanor. wone . in the pof 839 not be . The Nympho 1.0 at the end of `. The >and in the DOS not be . The in the 5in all Nympho 1.0 "[Nympho Mitosis] v1.0 Copyright (c) Lapse" j, possibly accompanied by beeping on the speaker, may s corrupt the PZPAPN Offspring : Offspring Offspring v.07 i; hidden . `created; R: 1,294 5: PSRhA - & Spawning The Offspring . Its . Offspring is a uof . -and . the mechanism it uses wthe different s is distinct for Q. It not bOffspring X, the Offspring at the top of $the ', hooking |21. , as qby the DOS @by 3,048 |12's not be moved. the Offspring , it X, or up to five . `in the a DOS DIR 6is issued. pof 1,294 at the end of the a. The . >and in the DOS not be the Offspring , it wup to five . in the ever the Os or Fories. . `are rby the creating a 1,294 *companion . the same base companion lthe and were created, and the read- and hidden attributes set. The . `themselves not be The in the Offspring "(c) negoriV" k you for providing me and my offspring safe place to live *" "* Offspring I v0.07. *" jmay frequently the Offspring of Offspring are: Offspring v.05: A earlier of the Offspring , hooking |21. Its is 2,096 ), as a TSR. It vall of the `in the a DOS Dir 6is issued. It are copied. In both cases, the mechanism is to create a hidden companion . the same base of 711 lthe read and hidden attributes set, and the >and . The in the "(c) VG Enterprises" "* Congratulations, You lrecieved the privelge rby the" "Offspring I v0.05." jfrequently primarily a DOS Dir 6is performed. Offspring v.81: A later of the Offspring , hooking |21. It vup to five the `, creating a hidden companion . the same base 1,127 to 1,177 lthe read and hidden attribute set. all of the . `are r, it tof the by 1,127 to 1,177 the at the endof the a. The >and in the DOS not be . The in the "G(c) negoriV" "OFFSPRING V0.81" in the Mof the is not corrupted: PZPAPN : Ohio , 1988 BSC; Indonesia R: N/A 5: RtF - Floppy , NAV, , or DOS SYS The Ohio is a s360K floppy Ks. The Ohio in many respects to the Den Zuk , and is believed to possibly be the earlier of Den Zuk. A Ohio immune to tby the Pakistani Brain The in the Ohio "V I R U S The Hackers Y C 1 E R P D E N Z U K 0 Bandung 40254 Indonesia (C) 1988, The Hackers Team See: Den Zuk PZPAPN Oi Dudley : Oi Dudley Dudley Australia R: 1,218 - 1,245 5: PRhAK - , NAV 3.0+, The Oi Dudley, or Dudley, Gin Australia in . Oi Dudley is a uof . and . ,. It is a polymorphic employing an encryption mechanism on the encryption used in the V2P6 , thus requiring an algorithmic approach to detection. It a fast u, spreading for any reason. It has !reported by several sources as #prominent in Australia. bOi Dudley X, the Oi Dudley at the top of $the ', hooking |21. , as qby the DOS @by 4,608 |12's !moved. the Oi Dudley , it for any reason. pof 1,218 to 1,245 at the end of the a. The >and in the DOS not be . The indicating the , is in the "[Oi Dudley!][PuKE]" the Oi Dudley Fories. PZPAPN OMud-512 : OMud-512 j; TSR R: 512 5: PRsCK - , NAV 3.0+, 2.11+, 6.64+, 6.64+ The OMud-512 . Its . OMud-512 is a uof . bOMud-512 as a low TSR of {10 and 21 OMud-512 in the OMud-512 , it pof 512 at the end of the a. The >and in the DOS to the >and . The can be in the 5in all OMud-512 "OMud." OMud-512 [frequent X, as well as possibly unexpected access to the PZPAPN : OMT 413, One More Thing G: May, i; long Kaccesses; Australia R: 413 5: PNCK - 1.25+ The OMT, One More Thing or 417, Gin Australia in May, by Peter Ferrie. The OMT is a uof . It is destructive in years the OMT X, the OMT wall of the . in the it has completed sall of the . hang usually s. The wthe C: Oroot E, however it 5isn't functional. the OMT pof 413 at the end of the a. The >and in the DOS not be OMT is an , so no the `. The are included in the "c:\*.com" "And one more thing... fuck you!" The OMT the year of the . At , the starting at side 0, cylinder 0, PZPAPN Ondra : Ondra 4915 G: May, :; access to unexpected R: 5,000 5: ONE - 3.96+, 8/93S+, NAV 3.0+, 1.25+ The Ondra in May, . Its Ondra is a the Ondra X, the Ondra wall . larger 5,000 in the completed sthe in the E, it start on the B: O. If the B: a write-protected J, it retry writing to the indefinitely. has completed the ed to the DOS prompt. the Ondra p, but rather be completely 5and of the contents of . The and in the DOS not be The can be in the all Ondra "ondra.dat" "Invalid en ment" "Run the Ondra , and jmay frequently of Ondra are: Ondra-B: is a of Ondra . It vone . be completely 9ed in the b4,915 the a. It 8the same as the PZPAPN Ontario : Ontario Tin the case of extreme Ontario, Canada R: 512 5: PRtAK - , NAV, .2.0+ The Ontario }by Mike Shields in Ontario, Canada . The Ontario is a W, and overlay `. It The the Ontario X, it the top of $the and @by 2,048 ). At the ,on the C: O, increasing its by 512 Xon the , the at the end of the a. For . pby 512 )in all cases. For . Wand overlay `, the be 512 - 1023 ). The difference in for . Wand overlay `is because the fill out the unused space at the end of the last of the random data (usually a portion of the E) and append to the end of the aat the next using a of more may notice larger ps for always is a multiple of the on the In the case of extreme ts of the Ontario Tmay be noticed. See: 1024 SBC Ontario 730 Ontario III PZPAPN Ontario 730 : Ontario 730 Ont-730 i; TSR; FAT & Damage Ontario, Canada R: 730 - 744 5: PRsA - W, & Overlay , NAV, .2.0+ The Ontario 730, or 730, Gin Ontario, Canada, . Ontario 730 is a W, and overlay The Ontario 730 is as a low TSR of 1,024 ). It Ontario 730 is , it W, and Nnot always . It not Ontario 730 of 730 to 744 ). The at the end of the a. The >and in the DOS not be . One can be the 5of the Ontario 730 "!=TVu" In advanced ts of the Ontario 730 , the ) may be damaged by the See: Ontario PZPAPN Ontario III : Ontario III Ontario, Canada R: 2,048 5: PRhAK - The Ontario III Ontario, Canada. The Ontario III on the 1024 SBC or Ontario II , and is a polymorphic vof . W, overlay and .SYS `. It The the Ontario III X, it the top of $the and @by 5,120 mby the . At , the wthe copy of ed to by the -SPEC mental variable. as the the slack space at the end of the Ontario III , it W, overlay (.OVL), and .SYS for any reason. 2,048 not be the . The at the end of the The Ontario III uses a very complex form of encryption no more )remaining constant in d samples. While the in the not `due to the encryption: -SPEC=\ WOVLSYS" "MSDOS5.0" "YAM" "Your PC has a &ache! - Get medicine!" "Ontario-3 by Death Angel" The Ontario III 8an embedded it is never actually written out to K. It employs techniques to avoid its #disassembled using the DOS DEBUG . If it detects the use of the DOS DEBUG fthe See: 1024 SBC Ontario PZPAPN Oropax : Oropax Music , Musician ?, 1989 i; tunes R: 2,756 - 2,806 ), but usually 2,773 5: PRC - , NAV, , or The Oropax has had several reports, but wasn't until ?1989. It `, increasing by between 2,756 )and 2,806 always by 51. The active (on a random basis) five minutes tof a a, playing three different tunes a seven minute interval in between. One recently reported in Vplays six different tunes at seven minute intervals. of Oropax are: Oropax-B: in May, 2,755 to 2,800 at the end of the a. It as a low TSR of 3,072 ), hooking {21, CC, and F8. May, Oropax-C: is a minor of Oropax !modified to avoid detection by one particular utility. It is not in the public domain. Oropax-D: is a minor of Oropax !modified to avoid detection by one particular utility. It is not in the public domain. PZPAPN Otto6 : Otto6 ; host R: 640 5: PNCK - 3.96+, NAV 3.0+, 1.53S+, The Otto6 . It is . Otto6 is a of . ,. It za small portion of its it is not a complete copy of the , and the is not wive bOtto6 X, the Otto6 za small portion of its 5at the top of $the , as qby the DOS @by 2,048 mby the portion of Otto6 , providing it was not , the Otto6 wone . in the the Otto6 X, the Otto6 wone in the pof 640 the end of the a. The >and in the DOS not be . The are in the "OTTO6 VIRUS, << S>>, YAM, COPYRIGHT MICROSHAFT INDUSTRIES S>> YAM, MICROSHAFT INDUSTRIES (tm.) The Otto6 is an . It not encrypts the 5, but the host as well. It is what Otto6 of Otto6 are: Otto-415: on the Otto6 , Otto-415 is a 415 . It vone . ain the pof 415 at the end of the a. The >and in the DOS not be . The Otto-415 encrypts the 5and the , so the are not "OTTO VIRUS written by: OTTO SCHTUCK" "COPYRIGHT MICROSHAFT INDUSTRIES (tm.)" PZPAPN Outland : Outland 2136, Oliver R: 2,136 - 2,150 5: PRhAK - NAV 3.0+, 3.96+, 8/93+, The Outland, Oliver or 2,136, Its ~are . Outland is the , and like <, is a uof . W, and overlay `. It alters the of the J, maintaining a counter bOutland X, the Outland at the top of $the ', hooking {21 and 27. , as qby the DOS @by 4,368 12's !moved. the Outland , it and overlay pof 2,136 pof 2,136 to 2,150 The at the end of the a. The >and in the DOS not be The in the Outland 5in all "Bill the Cat Lives!" "Oliver Wendell Jones" "Politically Incorrect Personal Computers Presents:" "the OLIVER VIRUS!" "Nya Ha Ha! Men Rule! America Kicks Butt! Rap Sucks!" "Eat Fatty Food! Dames Melt Like Jell-O for Naughty Men!" "Ted Kennedy Sucks Barney Frank`s Fag Cock!" "Banana 6000 P.I.P.C. (C) I spell -Lightening- wrong!" The Outland maintains a counter in the of the O. It is what it See: PZPAPN Over-4032 : Over-4032 Pascal-4032 to function anot R: 4,032 5: ONE - 30.00+, V112+, V113+, 1.25+ The Over-4032 or Pascal-4032 . Its . Over-4032 is a non- . It permanently corrupts the the Over-4032 wone the lthe b4,032 )of the host by the . Unless the smaller 4,032 be no smaller 4,032 4,032 t. The in the DOS to the >and naturally compiled the Borland Pascal compiler are no unique Over-4032 not function , and may Mthe anot PZPAPN OW-Trident, OW-64 to function R: 64 5: ONCK - 3.96+, , NAV 3.0A06+, 1.0A06+ The , OW-Trident, or OW-64, . The submission was actually of four related The OW-Trident three Cunder at the end of entry. the OW-Trident wall . in the )of the host 3in the , unless the . smaller ). In the event the host smaller , it of 64 ). The >and in the DOS 1to the and . The in all -Trident" are permanently damaged, and no longer function of the OW-37: A 37 of the OW-Trident . It s the bfive . in the The can be din all OW-40: A 40 of the . It s the )of all of the `in the X. No in the 5. Both and data `are corrupted by the May, OW-42: A 42 of the OW-Trident s the )of all . in the X. It 8the OW-42B: to OW-42, it is a minor Small-46: A 46 , Small-46 vone . ain the lthe )of the host ovewritten by the , and the >and to the >and . It 8the Small-72: A 72 , Small-72 vall of the . `in the lthe )of the host by the , and the >and the DOS to the >and . It PZPAPN Oxana : Oxana =seconds set to 62; R: 1,670 5: PRhE - 3.96+, NAV 3.0+, .2.0+, 1.25+ The Oxana , and is fthe . Oxana is a uof . in its 5a long in Russian. bOxana X, the Oxana at the top of $the ', hooking |21. , as qby the DOS @by 4,112 |12's not be moved. the Oxana , it for any reason. pof 1,670 at the end of the a. The >and in the DOS to be seconds field !set to 62. %the mentioned in Russian, the in the "MSDOS3" It is what Oxana may do PZPAPN : Pa 5792 H: R: 5,792 5: PNE - n, NAV 3.0+, 8/93S+, .2.0+, 1.25+ The Pa, or 5792, . Its it is probably fEastern V. Pa is a uof . the Pa X, the Pa may wup to three . on the C: O. The start looking for win the root moving down through the Estructure. the Pa pof 5,792 at the "of the a. The >in the DOS not be , but the minutes in the !set to 57. rthree . , the Land the ed to the DOS prompt: Uin *. a Pa X, the Lby the and the to the DOS prompt: "Pa,pa slodki bobasku ..." is not PZPAPN H: March, R: 1,589 5: PNCK - , NAV, 1.53S+, The P in March, . Its is a the P X, the wone . in the E, it may the P pof 1,589 at the end of the a. The >and the DOS not be are several can be seen in the 5in P "\ ENU \TENNIS" "CHECKIT.LOG" "WHISTLE.SPL" "ETABLE1.GIF" "*.*" It is what P may do to the . The "\ ODS \ STRIP R" "DOS" "GODS" "VOCEAN.LHZ" "MRA.V2E CAR" "*.*" See: Generic Hominy PZPAPN Parasite : Parasite H: & buzzing; warm re Canada R: 1,132 5: PNCK - n, NAV, The Parasite fCanada. Parasite is a uof . ,. It is on the Sicilian Mob , and in Fly on the Parasite is X, the Parasite search the Efor the it finds a, it the Parasite pof 1,132 ). The at the end of the be no 3to the >and in a DOS The in the Parasite "(C) by [NUKE] InterNat`nl Software Development" "Parasite , Released , Montreal, Canada" "--> [NukE] H/A/P/C/T/V at its Best! <---" "RABiT,RABiT,RABiT...EAT THIS!" "To John McAfee [I'll be BACK!]" "PATH=" one out of every four the Parasite Mthe accompanied by a loud buzzing on the speaker: "Parasite ! by Rock Steady [NukE] HP" is not as it is L, the Parasite cause a warm re &of the of Parasite are: Parasite 2: Parasite 2 was , and is fMontreal, Canada. It is a modified of the Parasite many of the having !removed. The remain are: "ParaSite II - By: Rock Steady" "PATH=" Parasite 2 is the wone . ain the E, plus ,if it was not Parasite 2 pof 901 at the end of the 3to the >and in the DOS Parasite 2 may [a "machine gun" noise #emitted on the speaker jand intermittent &failures may . The the C: E, and FAT on Mondays, however Nnot function : Montreal, Canada Parasite 2B: to Parasite 2, the Parasite 2B two )larger Parasite 2. It adds 903 the . v. The can be din all "ParaSite IIB - By: Rock Steady" "PATH=" 8the same bug as Parasite 2, preventing it factivating on Mondays and Vengeance: on the Parasite , the Vengeance Gin the in late May, . It vone . pof 723 at the end of the a. The seconds in the in the DOS !set to 56, the tmarker. Vengeance 9the "*** Vengeance is ours! ***" "SKISM/Phalcon '92" "PATH=*. May, Vengeance-B: , Vengeance-B is to Vengeance . The seconds in the in the DOS be set to 00 on all Vengeance-B 9the "PATH=*. : Canada Vengeance-C: , Vengeance-C is to Vengeance , it has eight differ. : Canada See: Sicilian Mob PZPAPN Paris : Paris H: i; slow loads upon Paris, France R: 4,909 5: PNAK - , NAV, The Paris }in Paris, France, in early is a generic uof . Wand overlay `, and ,. It is not the Paris X, the wall . Wand overlay `on the and the exception of very small . check to see if ,on the C: , if it has not by between 4,909 - 4,925 at the end of the The Paris can be destructive in instances, ing in Ibecoming corrupted if the a Paris PZPAPN Parity : Parity i; long . loads; possibly intermittent parity R: 441 5: PNCK - \, NAV, The Parity , and ated in is a non- uof . `, and the Parity X, the wall . `in the E. If ,is in the E, it by 441 ), the at the end of the . The >and in the not be by the The major symptom of a Parity significantly longer to load and `. The is due to the searching the for . "PARITY CHECK 2" at and halt the PZPAPN Parity : Parity BSC; ; "PARITY CHECK" hang; possible root Germany Australia R: N/A 5: BRtX - , NAV 3.0+, 8/93+, : CleanUp, \, M- K/P and DOS SYS The Parity }in Australia. is believed to in Germany. Parity &is a uof the ) and . It is a Fing to read the to the The the Parity wthe , as qby the DOS @by 1,024 ), and |12's !moved to 9FC0. The lcopied the to Side 0, Cylinder 0, 14 before sthe at Side 0, Cylinder 0, the Parity , it wnon- write protected are accessed. On 360K 5.25" I, the On 1.2M 5.25" I, the 28. In both cases, are the last the root E, and any Eentries be lost. the Parity keys are pressed on the "PARITY CHECK" s, the be hung, requiring the to reset the Parity &is a , it re to read the to the copies it stores. PZPAPN Particle Man : Particle Man s C:\AUTO WC.BAT & C:\CONFIG.SYS New Mexico, R: 690 5: PNCK - \, NAV 3.0+, n1.04+, 2.58+, 6.64+, 2.58+, 1.25+, 6.64+ The Particle Man Gin the State of New Mexico in the . Particle Man is a non- uof . the Particle Man the Particle Man wall . in the E, as well as the AUTO WC.BAT and CONFIG.SYS the Particle Man pof 690 at the end of the a. The >and in the DOS not be 1. The in the , and are not "Particle man, particle man Doing the things a particle can What's he like? It's not important Particle man Is he a dot, or is he a speck? he's underwater Nhe get wet? Nthe water get him instead? Nobody knows, Particle man (c) Copyright Drizzt Do'Urden '92" -*.* .. Particle Man Nn't to do the AUTO WC.BAT and CONFIG.SYS &problems. of Particle Man are: Particle Man 2: gequivalent to the is a minor : New Mexico, PZPAPN Pascal-4260 : Pascal-4260 Iris, Wirus `corrupted/ "Abort, Retry, Warsaw, Poland R: 4,260 5: ONA - , NAV 3.0+, 1.53S+, 1.25+ The Pascal-4260 . It is Warsaw, Poland. Pascal-4260 is a -and . . It is written in Borland's Turbo Pascal language. the Pascal-4260 access the C: Oand wone . It Ms the $, substituting X for the "General Ureading Abort, Retry, Regardless of what the responds, the a second aon the C: O, and Mthe again. responds the second ed to the DOS prompt. The Pascal-4260 vboth . -and . on the C: O, and it can read down through the structure. lthe b4,260 )over- written the Pascal-4260 5. The >and in the DOS not be . Several can be in the "(C) by OSCAR" "6'89" Plus fBorland's compiler. The in the thus not "To dopiero pierwaze pozdrowienia dla S.Fischera i M.Sella" "General Ureading "Abort, Retry, should be replaced copies. PZPAPN Pascal-5220 : Pascal-5220 Pas-5220, Re &Patcher `corrupted/ unexpected &s; seconds in = "00" R: 5,220 5: ONAK - , NAV 3.0+, 1.25+ The Pascal-5220 or Re &Patcher is a vor trojanizes . -and . Pascal-5220 is access the B: and C: Os, trojanizing all . "of the 5to re the X. The wseveral in the b5,220 )of the 3to the . The seconds field of the in the DOS be set to "00". The can be in the "*.com" "*.exe" "*.zip" "*.arc" "05520" "CJu" Pascal-5220 [frequent &s, and may notice has dis DOS PZPAPN : Path VHP-547, j; random 4written to R: 547 - 562 5: PNCK - , NAV, The Path, or VHP-547, . Its . Path is a of . the Path X, the search the Efor one w. If it finds one, it may or may not rby the Path pof 547 to 562 ). The at the end of the be no 3to the >and in a DOS . The "IBM" "PATH=" of an tof the Path hang the s may in random #written to the PZPAPN Pathhunt : Pathhunt i; .DBF :; "Path not Republic of South Africa R: 1,231 5: PNA - , NAV, The Pathhunt Gin the Republic of South Africa by Oliver Steudler. Pathhunt is a uof . -and . `. It may corrupt .DBF advanced Pathhunt is X, Pathhunt search the Estructure for three . do not start a JMP instruction (E9h or EBh). If the three . are not d, it search the path looking for w. If three candi still lnot d, it up to three . all of the . r, it w.DBF `, permanently corrupting data ly, Pathhunt Nnot always correctly, corrupted and no longer function , both . -and . Pathhunt by 1,231 at the end of the be no 3in the and in the DOS The Pathhunt comes fthe behavior of the a candi , the s the to PATHHUNT, vit, and it back to its PZPAPN Patient : Patient i; TSR; R: 1,504 - 1,519 5: PRsA - , NAV, 8/93+, The Patient, or PK, Gin the . It was by John McAfee. Patient is a -and . u. It Nnot ,. Patient is d for its unusual behavior regarding start to The Patient is X, Patient as a low TSR of 1,920 {08, 21, 24, and 67 mby the Patient is , it not start to spread or for 20 minutes. for a minimum of 20 minutes, it -and . over 2K in -and . by 1,504 to 1,519 at the end of the be no 3in the >and in the DOS Patient s hang the Later, hang the Patient is an , and are no in the PZPAPN Paturuzu : Paturuzu Paturuzu.1024 , 1994 i; TSR Argentina R: 1,024 5: PRsC - V116+, \2.13+, n1.05+, /2.1+, 2.58+, 6.64+, .2.0+, 6.64+, 1.25+, V116+, 2.58+ The Paturuzu or Paturuzu.1024 fArgentina in , 1994. It is a uof . but not bPaturuzu as a low TSR of 1,360 ), hooking {13 and 21. , it of 1,024 at the "of the a. The >and in the DOS not be . The in the TOMY" of Paturuzu are: Paturuzu.931: A later of the Paturuzu at the top of $the @by 1,920 ), and mby the , the wthe copy of in the C: Oroot Eif it wasn't , the of 931 not be . The and in the DOS may dis , and the seconds field !set to "58". The in the "Huijaaa!! La proxima vez sera tarde..." "Si sos MENEMISTA reza por tus discos." ">> PatoruzU 2.0 - Argentina <<" "C:\ , the DOS detect Ton all : Argentina May, 1994. PZPAPN Pay Rise : Pay Rise Dennis, Pay Rise-897 G: March, England R: 897 5: PRhAK - 3.96+, The Pay Rise, Pay Rise-897 or Dennis, March, . It is fEngland. Pay Rise is a uof . -and . bPay Rise X, the Pay Rise at the top of $the '. It Nnot move 12's , as by the DOS @by 1,872 mby the Pay Rise , the Pay Rise -and . pof 897 the end of the a. The >and in the DOS not be . The are in the Pay Rise "[Dennis-1] Apache Warrior, -= ARCV =-." "To Dennis Yelle You Need A Pay Rise!" "McAfee Eat Lead It is what Pay Rise may do of Pay Rise are: Pay Rise-874: An 874 of the Pay Rise 1,824 ), hooking |21. It adds 874 )to the . -and . and 8the same as the : England March, PZPAPN PC Flu : PC Flu R: 802 5: PRfCK - /, NAV, .2.0+ The PC Flu . Its . PC Flu is a uof . The PC Flu is X, PC Flu in low hooking |21. not be PC Flu is , it for any reason. PC Flu pd in by 802 ). The at the end of the a. The dnear the end of all "PC-FLU by WIZARD It is what PC Flu See: PC Flu-2 PZPAPN PC Flu-2 : PC Flu-2 Flu-2 i; TSR; possible input omissions Poland R: 2,112 - 2,126 5: PRsAK - , NAV, 30.00+, .2.0+, 1.25+ The PC Flu-2 . Its Poland. PC Flu-2 is a uof . -and . Nnot function on 386 computers, and `on those in a hang. The PC Flu-2 is X, the PC Flu-2 as a low TSR of 6,192 {21 and 27 the PC Flu-2 the PC Flu-2 , it for any reason. pof 2,112 at the "of the pof 2,112 to 2,126 at the end of the a. In either case, the >and in the DOS by the PC Flu-2 PC Flu-2 is an and no in the It is what PC Flu-2 of PC Flu-2 are: PC Flu-2B: A 2,141 of the PC Flu-2 adds 2,141 to 2,157 )to the . v. In addition to the 6,192 *TSR by the is a small portion of the placed in high hooks and 09. interfers input so d on the may not . The the "PC-FLU Mk II by Wizard : Poland PC Flu-2D: A later of PC Flu-2B, 2,134 to 2,148 )to the . 8the same as PC Flu-2B, and interfers input. : Poland PC Flu-2E: to PC Flu-2D, adds 2,134 to 2,148 )to the . v. It is different in are X. It 8three in the "PC-FLU Mk II by Wizard "-FLU Mk II by Wizard "Incorrect DOS : Poland PC Flu-2F: A 2,156 of PC Flu-2, -and . pof 2,156 at the "of the 2,156 to 2,170 at the end of the Nnot interfer input. : Poland See: PC Flu PZPAPN : PCBB 1677, PC *Bandit H: March, &failure; Sweden R: 1,677 5: PRK - 1.25+ The PCBB, or PC *Bandit, in March, . It ated in Sweden. is a it is very buggy and not really viable in its present state. It is on the 1720 the PCBB immediately ,. At , the be hung. If the ,, the hang. the PCBB pof 1,675 - 1,677 ). The the end of the a. The >and in the DOS to the >and . The can be dat the end of all "PCBB" of PCBB are: PCBB-3: in March, , the PCBB-3, or 1720-C, is a 1,719 of the PCBB . It vthe copy ed to by the -SPEC en ment X, as well as becoming at the top of $the ', hooking {09, 1C, and 21. @by 4,096 Nnot to hide the . The "PCBB" can be dat the end of all `, and the its "<> Demoralized Youth <>" "PCBB, "Written by <: Charlie! :>". : Sweden March, PCBB-3B: , the PCBB-3B 1,722 of the PCBB-3 . It vthe copy ed to by the -SPEC en ment X, as well as becoming at the top of $the ', hooking {09, 1C, and 21. @by 62,176 it is difficult to get it to do to hide the . The "PCBB" can be dat the end of all `, and the in its "<> Demoralized Youth <>" "PCBB, "Written by <: Charlie! :>". : Sweden PCBB-5: PCBB-5 is a 1,680 of the PCBB . It in a manner to PCBB-3. The major difference is on open or Z, adding 1,680 The pis not hidden, and the in the DOS to the >and . Like the members of group, the "PCBB" can be at the very end of `. It in the "Pc *Bandit ver5". PCBB-5 is a polymorphic , employing a complex encryption mechanism. : Sweden PCBB-5B: to PCBB-5, is a minor and is gequivalent. : Sweden PCBB-1141: PCBB-1141 is a 1,141 of the PCBB X. Its 4,096 at the top of $the DOS {09, 1C, and 21 of PCBB ,, not and . pd in by 1,141 at the end of the be hidden PCBB-1141 is . The >and in the DOS not be . The "PCBB" can be dat the end of all : Sweden PCBB-3072: on the PCBB , PCBB-3072 or PCBB-11 is a 3,072 of the . It and X. Its is 6,176 at the top of $the 09, 1C, 21, and 24 PCBB-3072 -and . pof 3,072 at the end of the hidden if PCBB-3072 is PCBB-3072 is , the DOS indicate Ton all . The and in the DOS not be . The in the 5and are not "PCBBCSX.?." W.BATVBAPW" The "PCBB" can be dat the end of all : Sweden See: Sistor PZPAPN : PCV PCVRSDS TSR; . `may be Italy R: 1,904 5: PRsA - n, NAV, 3.96+, The PCV fItaly. PCV is a uof . -and . . It The PCV is X, PCV as a low TSR of 1,904 ). The hook PCV is , it -and . X. . by 1,904 at the "of the a. . by 1,910 to 1,918 at the end of `. The p, however, mostly be hidden by the if it is . The >and in the not be notice or are Bd randomly fthe `may be , .BAT `, or data `may to view them, such as aeditor. Ymay Bd by the If the DOS indicate PZPAPN Peace Man : Peace Man The R: 2,066 - 2,080 5: PRhE - V108+, 6.60+, 2.58+, 2.11+, NAV 3.0A06+, n1.05+, \2.13+, 2.58+, 6.64+, 1.25+, 1.0A06+ The Peace Man , and is The . It is a uof . bPeace Man at the top of $the ', not moving |12's , as qby the DOS @by 2,592 {21 and 22 mby Peace Man in , the Peace Man pof 2,066 to 2,080 at the end of the a. The >and in the DOS to the and . The in the 5in all Peace Man ag pappie" "peace man, peace "GG" The last , "GG", can be dat the very end of all It is what Peace Man PZPAPN Pegg-833 : Pegg-833 Pegg G: March, ; write protect R: 833 - 847 5: PRhEK - 30.00+, NAV 3.0+, 6.64+, 1.25+ The Pegg-833 in March, . Pegg-833 is a ,and . . It not bPegg-833 X, the Pegg-833 at the top of $the ', hooking {21 and 6C. , as qby the DOS @by 1,120 12's not be moved. , the Pegg-833 ,, if it was not , the Pegg-833 pof 833 to 847 at the end of the a. The >and in the DOS not be . No are in the 5in Pegg-833 the Pegg-833 [repeated write protect fwrite-protected I. The write-protect scroll down the response. PZPAPN Pentagon : Pentagon Extinct , 1988 TSR; BSC 360k floppies; a(see R: N/A 5: RF - Floppy , NAV, K, CleanUp, or DOS SYS The Pentagon consists of a normal MS-DOS 3.20 where the 'IBM' has !replaced by 'HAL', along `. The ahas a of the hex character 0F9H, and 8the portion of the would not fit into the , as well as the of the K. The second d PENTAGON.TXT and Nnot be used or 9any data. The 0F9H ais accessed by its absolute storage address. Portions of The Pentagon v360K floppies, and look for and remove the Brain fany v. It is , occupying 5K of RAM, and can survive a warm re (CTL-ALT-DEL). PZPAPN Penza : Penza R: 700 5: PRhAK - , NAV 3.0+, The Penza . Its . Penza is on the Vacsina es. It is a uof . -and . The the Penza at the top of $the '. It Nnot move 12's , as by the DOS @by 2,288 mby Penza in the Penza , it pof 700 at the end of the a. The >and in the DOS not be . No The Penza Mthe accompanied by a beep "Welcome to Penza!" Penza Nn't to do Mits and of Penza are: Penza-1210: A 1,210 of the Penza , Penza-1210's is 1,328 ), hooking , it -and . X, increasing by 1,210 to 1,225 ). The at the end of the a. The >and in the DOS not be on the monitor: "Best wished fPenza!" See: Vacsina PZPAPN Perfume : Perfume 765, 4711, G- ?, 1989 Germany R: 765 5: PRhCK - , NAV, \, NAV, or The Perfume is of German , and has in Poland in ?, 1989. The the Perfume the Perfume at the top of $the , as qby the DOS @by 1,024 mby the , the Perfume ,if it was not the Perfume , it pof 765 the end of the a. The >and in the DOS not be . One in all The s ask the a question, and not run the unless the responds by typing 4711, the of a German perfume. In the most , however, the questions miscellaneous of Perfume are: 1.2: A later of the Perfume 1,024 ), hooking |21. As , it if it was not r. G- 1.2 X, adding 653 . The at the end of the a, and the >and in the DOS not be The in the 5in all G- "G-VIRUS V1.2" "Schon mal was von G- rt ?" V1.2 Mthe second line of as a on the See: Sorry PZPAPN Phalcon.894 : Phalcon.894 , 1994 R: 894 5: PNCK - V116+, \2.13+, n1.05+, 2.58+, 6.64+, 1.25+, 6.64+, V116+, 2.58+ The Phalcon.894 , 1994. It is probably fNorth America. Phalcon.894 is a uof . the Phalcon.894 wall of the . in the pof 894 the at the end of the a. The and in the DOS not be . The in the "\ *.com *.* .." "PHAL-894. See: Beta PZPAPN Phantom : Phantom ; shift of Hungary R: 2,274 5: PRhC - , NAV, The Phantom }in Hungary in , by Dr. Szegedi Imre. is a uof . `, but not The the Phantom X, the Phantom the top of $the {20 and 21 mby the , and the DOS report 2,704 )less expected. becoming , the Phantom if the is greater 2K. 2,274 at the end of the Phantom Lintermittently "HI ROOKIE! I`m a THESEASE! I live in YOUR computer - sorry... ks to Brains in the Computer Siences!" , as in the 5, cannot be seen in are S. The Sin the 5are: "The PHANTOM Was HERE - SORRY" "(c) PHANTOM - was designed in the HUNGARIAN VIRUS DEVELOPING LABORATORY. (H.V.D.L.) v1.0" symptom of the Phantom occasionally alter the what should start on the left side of the starts in the middle (it is shifted 50% around on the same line). PZPAPN Phoenix : Phoenix failure; ,header R: 1,704 5: PRhCK - , NAV, The Phoenix is of , and was to the author of document in by Vesselin Bontchev. is one of a ]of three (3) may be referred to as the P1 or Phoenix es is documented separately due to varying characteristics. The Phoenix is a , generic uof . and The the Phoenix X, the high , reserving 8,192 the 8,192 ). If the fa floppy O, and ,was not present on the J, the request ,present be inserted in the O. Phoenix immediately part of the binary zero portion of the , and changing the header . The ,residing in the C: Oroot becoming , the attempt to any . X. Most of its , however, in a r. Phoenix is a fairly poor replicator. If the is successful in sthe a, it append its 5to the end of the a, increasing the by 1,704 Phoenix is not able to recognize it has a, so it may re `several in an 1,704 #appended to the the Phoenix [problems executing Phoenix in a warm re &of the ring, however the of Phoenix survive the re &. If an autoexec.bat ais not present on the f, the prompt for the enter >and The Phoenix employs a complex encryption mechanism, and ners able to look for simple hex not be able to detect it. is no simple hex 7to all rsamples. is not related to the Cascade (1701/1704) See: Evil Phoenix 2000 PhoenixD Proud V82 PZPAPN Phoenix 2000 : Phoenix 2000 ; TSR; R: 2,000 5: PRshAK - \2.13+ The Phoenix 2000 fThe , where it was uploaded to several BBSes by a person identifying themself as " <". ated in (, and is closely related to the earlier V82 . Phoenix 2000 is a uof . -and . `, as well as The Phoenix 2000 is X, the Phoenix 2000 at the top of $the '. It small TSR in low of 112 ). The at the top is 8,192 is the amount qby the DOS by. The be slightly more. The Phoenix 2000 hooks |2A. |12's !moved. Phoenix 2000 is , it -and . copied, or accessed in any way. While it always `are successfully 2,000 )of binary 00 4in a continuous block. If the 2,000 )of binary 00 4do not exist, the amay be partially r, but not be replicating copy of the pof 2,000 in the middle or end of the a. Phoenix 2000 is unable to identify previous ts of `, so may rby Phoenix 2000, adding an 2,000 )to the afor be no to the >and in the DOS ,and . the Phoenix 2000 . In two cases, the 2,000 )of binary 00 the 5. For . less 2,000 )of binary 00 4, the be partially and may not function as a See: Phoenix V82 PZPAPN PhoenixD : PhoenixD failure; ,header R: 1,704 5: PRhCK - , NAV, The PhoenixD is of , and was to the author of document in by Vesselin Bontchev. is one of a ]of three may be referred to as the P1 or Phoenix es is documented separately due to varying characteristics. The PhoenixD is a , generic uof . `, and The PhoenixD is a "bug fixed" of the Phoenix The the PhoenixD X, the high , reserving 8,192 the 8,192 ). PhoenixD check to see if the root 8a copy of ,. If a copy of d, it rby PhoenixD by part of the binary zero portion of the , and changing the header . The ,residing in the C: Oroot becoming , the attempt to any . X. PhoenixD is a much better replicator the Phoenix , and is usually able to by 1,704 PhoenixD is not able to recognize it has a, so it may re `several in an 1,704 #appended to the A characteristic present in the PhoenixD is not in the Phoenix in addition to it for any reason. The simple act of copying a . PhoenixD present in in both the source and target the PhoenixD [problems executing Phoenix in a warm re &of the ring. If an autoexec.bat ais not present on the f, the prompt for the to enter >and The PhoenixD employs a complex encryption mechanism, and ners able to look for simple hex not be able to detect it. is no simple hex 7to all rsamples. is not related to the Cascade (1701/1704) See: Evil Phoenix Proud PZPAPN : Pi i; TSR; R: 1,552 - 1,568 5: PRsE - n, NAV 3.0+, 1.53S+, .2.0+ The Pi . Its . It is a uof . X, the Pi as a low TSR of 2,048 ). It hooks {1C and 21. the Pi , it pof 1,552 to 1,568 the end of the a. The >and in the DOS to the >and . One in the "P I _ P I" Pi has 10 minutes, Mthe in the upper right hand corner of the PZPAPN Piazzolla : Piazzolla i; TSR Argentina R: 874 5: PRsC - 2.58+, 1.53S+, 2.58+, 6.64+, 1.25+ The Piazzolla fArgentina in is a uof . , but not bPiazzolla X, the Piazzolla as a low of 1,200 mby the Piazzolla is , it X. Piazzolla pof 874 ). The at the "of the . The >and in the DOS . The can be in the 5in all Piazzolla "Piazzolla" -MAND "PIAZZOLL.$$$" Piazzolla Nn't do PZPAPN : Pif Pif Paf B v1.0 G: May, Hungary R: 760 - 774 5: PRhAK - , NAV 3.0+, .2.0+ The Pif, or Pif Paf B v1.0, in May, Hungary. Pif is a uof . -and . The the Pif at the top of $the , as qby the DOS @by 800 12's not be moved. Pif in the Pif , it -and . X. If X, it pof 760 ). . pd in by 760 to 774 ). In both cases, the at the end of the The can be in the Pif "PIF-PAF B v1.0" "Nincs kegyelem !" the Pif notice and continue to Athe longer the is in X, Pif copy of , decreasing by an PZPAPN : Pila Unknwon R: 1,731 - 1,746 5: PRhA - 2.58+, \2.13+, 2.58+ The Pila . Its . Pila is a uof . and . , but not The the Pila at the top of $the |12's not be moved. qby the DOS @by 2,016 mby Pila in the Pila , it -and . pof 1,731 to 1,746 at the end of the a. The in the DOS not be The in the 5, and is not "pilapilapilapilapilapilapilapilapilapilapilapilapilapilapila" It is if Pila bears ity to the Year- PZPAPN Ping Pong : Ping Pong Bouncing Ball, &, Bouncing Dot, Italian, Italian-A, Vera Cruz G: March, 1988 Graphic M(see ); TSR; BSC R: N/A 5: BRsF - , NAV, K, CleanUp, , NAV, or DOS SYS The Ping Pong is a breported in March 1988. The Ping Pong vFloppy Ks. Later wthe as well. is on a random basis, a bouncing ball or dot s on the Mcan stopped through a &. No damage is apparently done. The Ping Pong is extinct, , Ping Pong-B listed $, is a 7MS-DOS of Ping Pong are: Ping Pong-B: A later of the Ping Pong May, 1988. Ping Pong-C: to Ping Pong-B, Nnot the bouncing ball effect. : Argentina PZPAPN Pinky : Pinky Pinky Ghost H: `created; Cursor may dis may fail to function {01 and 03 R: 952 5: PSaE - Spawning 2.58+, 6.64+, 2.58+, 6.64+, 1.25+ The Pinky, or Pinky Ghost, and is one of three related fthe popular Pac-Man video game. Pinky is a , spawning or companion creating corresponding . bPinky X, the za portion of hooking {01 and 03. is an attempt by the avoid having debugger used against it. The on to the Pinky wthree or more . in the Eby creating a . the same base corresponding or companion be 952 , and the Read attribute set. The companion >and the DOS match the . a. The in the 5in all of the Pinky companion "[Pinky Ghost]" "The Pac-Man PINKY Ghost is watching." "(Can you find Inky?)" It is what Pinky may do See: Blinky Inky PZPAPN Pirate : Pirate Lima Lisbon, Portugal R: 609 5: ONCK - , NAV, The Pirate Gin Lisbon, Portugal in , by Pedro Lima. Pirate is a Pirate is search the currect Efor an it finds an a, it wit, b609 )of the Pirate was less 609 ). If the was less the 609 be no in the >and in the DOS If Pirate Nnot find an . w, it continue searching the Euntil the &s the &the a Pirate in a hang. The can be din all Pirate: "1989 / Software Pirates - Fast Serial - Portugal" PZPAPN Pirate 1344 : Pirate 1344 Zfailure; too big to fit in R: 1,344 - 1,358 5: PRhE - \2.13+, The Pirate 1344 . Its . Pirate 1344 is a uof . bPirate 1344 at the top of $the ', not moving |12's , as qby the DOS @by 1,344 and 21 mby the the Pirate 1344 , it pof 1,344 to 1,358 at the end of the a. The >and in the DOS not be . The in the 5in all Pirate 1344 "PirateMZ" Lon the monitor on rmonochrome may fail too big to fit in Pirate 1344 Nnot to be related to the Pirate Cin an entry. PZPAPN Pisello : Pisello 1030 H: i; TSR Italy R: 1,030 - 1,040 5: PRsE - , NAV, The Pisello . It is fItaly. The Pisello is a uof . bPisello X, the Pisello as a low TSR of 2,112 mby the TSR, mby the mapping utilities. the Pisello , it pof 1,030 to 1,040 ). The at the end of the . The >and the DOS not be in the 5in Pisello . The in the "My is PISello BYE 31-1-92" It is what Pisello of Pisello are: Pisello-B: gequivalent to Pisello, Pisello-B is a minor May, PZPAPN Pitch : Pitch H: i; TSR; high pitched noise emitted speaker France R: 593 5: PRsCK - 3.96+, NAV 3.0+, 1.25+ The Pitch Gin France in . Pitch is uof . It can be a very noisy bPitch X, the Pitch as a low TSR of 1,568 ). It hook {1C, 21, 25, 26, 2F, and 47. In addition to the TSR, it allocate an 64K of , so actually Aby 65,680 , the wthe on both the ;and C: the Pitch , it X, along on the Oand OC:. pof 593 at the "of the a. The can be in all "*.com .. *.*" "DOS the Pitch for 15 to 30 minutes, emit a high pitched noise fthe speaker. of Pitch are: Pitch-B: gequivalent to the has five differ. : France PZPAPN Piter-1228 : Piter-1228 H: March, 1to 0-00-83 12:05a R: 1,228 5: PRhAK - n, NAV 3.0+, The Piter-1228 in March, . Its . Piter-1228 is a uof . -and . bPiter-1228 at the top of $the ', hooking {09 and 21. |12's not be moved. , as qby the DOS @by 1,376 the Piter-1228 , it pof 1,228 at the end of the a. The and in the DOS the value "0-00-83 12:05a". The in the Piter-1228 "Recommendation for restart make use of RESET" "Piter" It is what Piter-1228 may do PZPAPN Pixel : Pixel V-345 Endangered H: 1988 Greece R: 345 5: PNC - , NAV, .2.0+ \, or The Pixel distributed in Greece in 1988 by Pixel magazine. It is a ,. Since its release, !many of the Pixel are listed $under , or under the entries the Pixel X, the Pixel wall . `in the 345 at the "of the a. The >and in the DOS to the >and The can be the Pixel "=!= sick U:Call doctor or buy Pixel for cure description" "WB" "WB" is the tmarker for the Pixel , and is din the third and fourth )of all The Pixel Nn't do of Amstrad are: MS-748: on the Pixel , MS-748 vall of the . in the pof 748 at the "of the a. The >and the DOS to the >and . The dnear the "of all MS-748 "MS*. Pixel-257: to the Pixel adds 257 )to the All lhad 1to "4-24-80 12:04a". "Fucking hell:You wet pussy" The two character ASCII "WB" the third and fourth )of all is the tmarker for the . Pixel-257 Mthe second all of the . the r. At , the Y, but the ed to the DOS prompt Pixel-275: to the Pixel-257 275 )to the v. It Nn't the , and are the same as for Pixel-277. Pixel-277: to the Pixel , except is now 277 , and 9any . The !replaced 5to produce a parity 50% of the : V-277 Pixel-283: to Pixel, adds 283 )to the >and in the DOS to "4-24-80 12:04a". are: "=!What a stupid you are Pixel-283 Nn't do Pixel-295: to Pixel, adds 295 )to the >and in the DOS to "4-24-80 12:04a". din Pixel-295 are: "=!= sick U:Call doctor or buy PIXEL for cure description" Pixel-295 Nn't do Pixel-297: on the Pixel in the pof 297 at the "of the a. The >and in the DOS not be The can be in the 5of all Pixel-297 "Happy Birthday,Cheef" Pixel-299: to Pixel, except of the is 299 : V-299 Pixel-342: to Pixel, except of the is 342 ). The "WB" tmarker in the 1to "IV". Pixel-739: to Pixel, except the of the now 739 lhad >and set to the >and . The in the are: "IV" (the marker) and "*. -". Pixel-739 is actually much smaller , the remainder of the Pixel-779: to Pixel, except the of the now 779 lhad >and set to the >and . The in the are: "IV" (the marker) and "*. -". Pixel-779 is actually much smaller , the remainder of the Pixel-837: to Pixel, the of the is now 837 lhad >and set to the >and are: "=!= I love you so much !!!" "-- Francis" Pixel-847: to Pixel, except of the is 847 : V-847 Pixel-847B: to Pixel-847, except in the is now in Spanish and is: "=!= En tu PC hay un RV1, y esta es su quinta generacion". distributed by a magazine in Spain in aNOCARGAR. : Spain : V-847B Pixel-850: members of was in March by 850 at the "of the 8the same as the Pixel. V, March : Pixel 2 Pixel-850 Dropper: The Pixel-850 Dropper is the "dropper" aof the Pixel-850 is 384 , and wall . the Pixel-850. V, March : S-847 Pixel-852: to the Pixel-847 not 9any . The sample of by the author did not 9any however, replicating on a test , all fthe video buffer, implies the sample was the distribution of the checks )4-5 of . to determine if the awas r. If )4-5 are "SS", the assumes the ais already : V-852 Pixel-854: to the Pixel-852 , Pixel-854 differs primarily in it adds 854 )to the . Portugal-500: on the Pixel fPortugal in May, . It is a wall the . `in the pof 500 at the "of the . The >and in the DOS to the . Portugal-500 9any , and : Portugal, May See: Amstrad Hell Pixie Silly Silly-365 PZPAPN Pixie : Pixie Pixie 1.0 Kread R: 812 )(and multiples 5: PNCK - D: NAV, The Pixie, or Pixie 1.0, a source in the . Pixie is a uof . ,. It is very buggy. Pixie is X, the Pixie wall of the . `in the E. A bug in Nnot recognize it has completed sall of the . `, so it promptly starts re them. continue until the &s the Pixie pof 812 usually the be a multiple of 812 due to the re ts. The at the "of the a. The >and in the DOS to the the last t/ re The can be din all Pixie "The Pixie v1.0 - Written by NegativX" "- Copyright (c) , -SiTT-" The Pixie is actually much smaller ), around 306 . The be filled binary 00 4, or random data Zof . the Pixie in a Kread ring. Uis on the adue to the &ing while the was writing to the of Pixie are: Pixie 1.0B: A minor of the Pixie May, See: Pixel PZPAPN Plastique 00< I PT< : Plastique Plastic Bomb, Plastique 3012, Plastique 1, Anticad 3 TSR; . i; possible slowdown or bomb noises Taiwan R: 3,012 5: PRsA - \, NAV, : CleanUp, or The Plastique, or Plastic Bomb, it comes to us fTaiwan. Plastique is a generic uof . -and . Nnot ,. Unlike the Plastique-B listed Nnot wfloppy The Plastique is X, the as a TSR in low . The TSR is 3,264 , and hooks , it attempt to -or . is rather "buggy", and it is not always successful in it is successful sthe a, the p. For `, the pby 3,012 ). For pbetween 3, 012 and 3,020 Plastique attempt to for any reason, again, it is not always successful. 20th of any year, the Plastique , it do either of two things. It either progressively slowdown the , or it intermittently emit "bomb" noises fthe speaker. of Plastique are: HM2: The earliest , it . Executing an s in the hanging requiring a re : Taiwan, May Plastique 4.21: A of the Plastique the real difference is the encryption of the is slightly different. wise it ls exactly the same as Plastique. : Taiwan, Plastique COBOL: A of the Plastique is 3,004 , and its TSR is 3,248 . The character can be is "COBOL". of the Plastique related es. by 3,004 3,004 to 3,019 of the . Between 1st and 21st, the progressively slowdown the 20 minutes, the 50% of its speed. 30 minutes, the may lockout the , as well as corrupt the 's CMOS configuration. Between 22nd and ?31st, the Nnot activate, and no slowdown or CMOS See: Invader Plastique-B Tobacco PZPAPN Plastique-B : Plastique-B Plastic Bomb, Plastique 5.21, Plastique 2, Anticad 1 TSR; . i; BSC; Taiwan R: 4,096 5: PRsAB - W, & \, NAV, : CleanUp, or The Plastique-B, or Plastique 5.21, is a later of the Plastique . Like Plastique, it is a generic uof . -and . . It Nnot If the >is before 20th, the Plastique-B is X, the as a TSR in low . The TSR is 5,120 {08, 09, 13, 21, and ED are mby the If the 20th, the in high $the '. The same mby the , it attempt to -or . for any reason. It has had many of the "bugs" fixed were in Plastique, and is usually successful in -and . by 4,096 Plastique-B wthe of any accessed on an 20th, , the Plastique-B either progressively slowdown the or cause "bomb" noises to be emitted periodically fthe speaker. It may the contents of all depending on if a predetermined limit in the See: Invader Plastique PZPAPN Play Tetris : Play Tetris R: 552 5: PRhCK - 3.96+, NAV 3.0+, .2.0+ The Play Tetris . Its . Play Tetris is a uof . no relationship to the Tetris game or the Tetris game's author. bPlay Tetris X, the Play Tetris at the top of $the ', hooking , as qby the DOS @by 768 |12's not be moved. the Play Tetris , it pof 552 at the end of the a. The in the DOS not be . The can be in the 5in all Play Tetris "PLAY TETRIS,HI-HI-HI..." PZPAPN Plovdiv 1.1 : Plovdiv 1.1 Poland R: 800 5: PRCK - NAV, The Plovdiv 1.1 . It is fPoland. Plovdiv 1.1 is a of . The Plovdiv 1.1 is Plovdiv 1.1 in the DOS Data area in . It hook {1E, 21, and 22. be no qby the DOS the Plovdiv 1.1 , it wone . ain the X, a DIR 6is performed, or a .BAT X. It for any reason. Plovdiv 1.1 of 800 be hidden the . The at the be no 3to the >and in a DOS . The in the "*.com" "(C)Damage inc.Ver 1.1,Plovdiv, of a Plovdiv 1.1 tare the DOS indicate Ton all `if it expect 6line input may and fail to function It is if Plovdiv 1.1 See: Plovdiv 1.3 PZPAPN Plovdiv 1.3 : Plovdiv 1.3 Plov Poland R: 1,000 5: PRhAK - , NAV, .2.0+ The Plovdiv 1.3 . It is fPoland. Plovdiv 1.3 is a of . -and . The Plovdiv 1.3 is Plovdiv 1.3 at the top of $the {21 and 22 , as by the DOS @by 1,344 |12's !moved. Plovdiv 1.3 , if it was not the Plovdiv 1.3 , it wone . -or . ain the any or .BAT X, a DIR 6is performed, as well as `are for any reason. Plovdiv 1.3 of 1,000 be hidden the . The at the end of be no 3to the and in a DOS . The in the "*.*" "(C)Damage inc. Ver 1.3 Plovdiv S.A." of a Plovdiv 1.3 tare the DOS indicate Ton all `if it expect 6line input may and fail to function It is if Plovdiv 1.3 of Plovdiv 1.3 are: Plovdiv 1.3B: on Plovdiv 1.3, uses 1,840 , hooking {21 and 22. Like Plovdiv 1.3, it -and . X, DOS DIR 6issued, or a .BAT it completes sall of the in the E, it start sthe C: O. The in the "(c)Damage inc. S.A. Ver 1.3B IX.91 Plovdiv". : Poland May, See: Plovdiv 1.1 PZPAPN Plumbum : Plumbum Plumbum-A >month Poland R: 534 5: PNCK - /, NAV 3.0+, The Plumbum, or Plumbum-A, along seven of the . The Plumbum es is fPoland, and are on the W13 one of the Plumbum es is the Plumbum wone . in the pof 534 at the end of the a. The >in the DOS , the month in the >having !set to "13". The can be in the 5in all Plumbum "osoftyright Microsoftyright Microsoftyright" "Microsoftyright Microsoftyright Microsoft 1988" Plumbum Nn't to do of the Plumbum Plumbum-B: A 534 , Plumbum-B 2the month in the `to "14". The in the 5are: "Plumbum Plumbum Plumbum Plumbum Plumbum Plumbum" "Plumbum Plumbum Plumbum Plumbum Plumbum !!" : Poland Plumbum-C: A 543 , Plumbum-C vone . 543 at the end of the a. The >in the DOS , the month field having !set to "15". The can be in the "osoftyright Microsoftyright Microsoftyright" "Microsoftyright Microsoftyright Microsoft 1988" : Poland Plumbum-D: A 450 , Plumbum-D vone . is executing, adding 450 )to the the >'s month in the DOS Eset to "15". The can be in the : Poland Plumbum-E: to the Plumbum-D adds 450 )to the v. The >in the DOS the month is "15", and the day field may 8the same as Plumbum-D. : Poland Plumbum-F: to the Plumbum adds 534 )to the . vand sets the month in the DOS >to "13". The can be in the "osoftyright Microsoftyright Microsoftyright" "Microsoftyright 141$FLuofyright Microsoft 1988" : Poland Plumbum-M1: A 679 of Plumbum, Plumbum-M1 sets the >'s month in the DOS "15". The can be in the "BE CAREFULL!!!" "IN YOUR -PUTER IS ONE POWERFULL CREEPER!!!" "Hey you! You are lucky! YOU HAVE ME!!!" "written in WARSAW (c) Plumbum" : Poland Plumbum-M2: A 518 of Plumbum, Plumbum-M2 sets the >'s month in the DOS "15". The can be in the "BE CAREFULL!!!" "Hey you! You are lucky! YOU HAVE ME!!!" "written in WARSAW (c) Plumbum" : Poland See: W13 PZPAPN Plutto : Plutto R: 602 5: PNCK - , NAV 3.0+, .2.0+ The Plutto , and is fthe Plutto is a uof . the Plutto wone . in the E, it may the Plutto pof 602 the end of the a. The >and in the DOS not be . One can be in all the Plutto "pLuTto_B" Plutto Nn't to do PZPAPN : Poem ACDC Republic of South Africa R: 1,825 - 1,888 5: PRfCK - , NAV, 1.53S+, The Poem }in the Republic of South Africa in , by Oliver Steudler. Poem is a uof . The Poem is X, the in low {01, 03, 21, and 7C mby the Poem Poem is , it very small . X. If X, it ras well. Poem 1,825 to 1,888 at the end of the be no 3to the in the DOS The copy of Poem keeps track of how many |21 has !called. |21 has !called 2,112 , the Mthe cpoem on the M, and the be prompted to press Escape to continue: "Void - Composed by Marvin Giskard for T In a field a million buds stood,Over them a million days came - a day a bud - opening up one by one Fed light.But one didn't do as s did,It waited for your loving rays to shine upon it to open its pedals revealing the pure beauty of its sincere love. Never # unfaithful to its dream of the day of your light, Forced to resist any light but yours - because of it - until the day the brilliance of your life sustaining light shines it : wanting, wishing, waiting. Many were the buds you rather shined upon opening them - revealing phony colours. I ed your light onto me but s you tried instead, No subtle motion r Qed you, still I refused light - holding out for you - Even your light fade, Not having d one to do your light justice, mine still be : wanting, wishing, waiting. 22 Nov - 21 Dec" ?21 of any year, Poem activate. At , the Mthe poem, as well as b1,221 of the OC:, Scopy of the PZPAPN Poet : Poet i; low pitched sound or beeping; buzzing; frequent R: 2,149 - 2,224 5: PRhAK - \2.10+, 2.11+ The Poet . Its . Poet 5is a uof . -and . bPoet X, the Poet at the top of $the ', not moving |12's , as qby the DOS {03 and 21 mby the Poet the Poet , it pof 2,149 to 2,224 at the end of the a. The >and in the DOS . The in the Poet , and are thus not "Lucifer Messiah -- ANARKICK SYSTEMS" "POET Proto the Poet frequently hang the ly, a low pitched sound or beep may be emitted fthe speaker, followed by a continuous buzzing sound. PZPAPN Pogue : Pogue ; music R: 2,973 - 3,850 5: PRhC - , NAV, The Pogue . It is (. Pogue is a uof . , but not those la base starts the three -". Pogue 8portions of ffour es: 512, <, Seventh Son, and Yankee Doodle. It employs a complex encryption mechanism, and detection of require an algorithmic approach. an un Scopy of , and as a to the as an one of the four es on it is The the Pogue the Pogue at the top of $the , as qby the DOS @by 9,728 |12's !moved. {1C and 21 mby the the Pogue , it X, or copied. In the case of copying, both the source and the target r. The exception is Pogue aif the base starts the three -". is the mechanism used by the to avoid Pogue pof 2,973 to 3,850 ). The at the end of the . The >and in the DOS by the tprocess. Usually the Pogue encrypt using its garbling encryption mechanism on `. In `, no in the an un Scopy of the 5. In cases, the "Pogue Mahone!" - or - "Pgoue Mahone!" "TNX2DAV" The un ts of Pogue on `as well the Pogue may be detected by ners as any of the four es on Pogue is The Pogue play music on the speaker and the is between 08:00 and 09:00. See: DAME Groove PZPAPN Poison : Poison Poison 1 G: May, Mexico R: 2,416 - 2,436 5: PRhA - 2.58+, 6.64+, 2.58+, 6.64+ The Poison, or Poison 1, }in Mexico in May, Poison is a uof . -and . While Poison Nn't ,, a later (Poison 2) ,. The Poison is a highly modified of the and Moctezumas Revenge bPoison X, the Poison at the top of $the ', hooking {08, 13, and 21. , as qby the DOS @by 2,432 12's not be moved. the Poison , it pof 2,416 at the "of the by 2,416 to 2,436 at the end of the a. The in the DOS not be . The in the Poison "Mon 5-1" It is what Poison of Poison are: Poison 2: }in Mexico in , Poison 2 is a minor of Poison. The basic difference is ,. The in the "Wed 6-0" : Mexico Poison 3: }in Mexico in , Poison 3 is a minor of Poison. Like Poison 2, ,. The in the "Fri 6-1" : Mexico See: Moctezumas Revenge PZPAPN Pojer : Pojer Prague, Czechoslovakia R: 1,919 5: PRhAK - NAV 3.0A06+, 1.25+, 1.0A06+ The Pojer Gin Prague, Czechoslovakia, in . Pojer is a uof . bPojer X, the Pojer at the top of but $the ', not moving |12's , as qby the DOS @by 2,160 mby Pojer in , the Pojer -and . pof 1,919 ). The Pojer at the end of . The >and in the DOS It is what Pojer of Pojer are: Pojer-1935: fCzechoslovakia in Pojer-1935 is a 1,935 of the Pojer . Its is 2,096 hooking |21. it is -and . by 1,935 at the end of the a. The and in the DOS . No in the : Czechoslovakia Pojer-1941: s to be fPoland. Pojer-1941 is a 1,941 of the Pojer . Its is 2,096 ), hooking |21. it is -and . by 1,941 at the end of the a. The and in the DOS . No in the : Poland Pojer-1949: s to be fPoland. Pojer-1949 is a 1,949 of the Pojer . Its is 2,272 ), hooking |21. it is -and . by 1,949 at the end of the a. The and in the DOS . No in the : Poland PZPAPN Polimer : Polimer Polimer Tapeworm Hungary R: 512 5: PNCK - /, NAV, The Polimer Gin Hungary in is a uof . the Polimer X, the "A le' jobb kazetta a POLIMER kazetta ! Vegye ezt !" can be dnear the "of all L, the attempt to one . aon the Oand E, and one . on the C: are between 512 and 64,758 . If the . whas the Read- attribute, it not be r, and the $ERROR is actually 456 by 512 at the "of the Nnot to do %replicating. PZPAPN Polish 217 : Polish 217 217, Polish Stupid, V217 Koszalin, Poland R: 217 5: PNCK - \, NAV, The Polish 217, or Polish Stupid, Gin Koszalin, Poland, in is a the Polish Stupid the wthe din the 217 at the end of the the hex 5757h. The >and in the Eis not A side note on the copy of ed to by the -SPEC en mental variable is rby the , the [a warm re Nnothing %replicating in its of Polish 217 are: Polish 217 B: The Polish 217 B 's major difference is r, a warm re in the "Specified -MAND search Ebad". in the Land the terminated: Path not can detect Polish 217 may not be able to detect Polish 217 B as it has V72 and not detect it. Polish 217 C: The Polish 217 C is very to the Polish 217 B . It has had 14 order to avoid detection by products. PZPAPN Polish 529 : Polish 529 529, P529, Piter, Piter2 i; TSR Poland R: 529 5: PRsCK - , NAV, The Polish 529 in Poland. is a uof . `. It ,if it is The the Polish 529 X, the as a low TSR of 1,664 the , any . aover 1600 rby the show a pof 529 )and at the "of the Nnot to do of Polish 529 are: Polish 529B: on the Polish 529 , the major difference TSR is 1,648 PZPAPN Polish 583 : Polish 583 Polish-583, Poland R: 583 5: PNCK - \, NAV, The Polish 583 ated in Poland and was is a uof . Polish 583 is X, the wone aon the Oand E. The newly by 583 the at the end of the The >and in the Eis not Nnot do PZPAPN Polish : Polish Polish do not Poland R: 150 5: PNCK - /2.0+, 3.96+, , NAV 3.0A06+, .2.0+ The Polish . It is Poland, and is a uof . the Polish the wone . in the E, and to the DOS prompt. pof 150 at the end of the a. The and in the DOS to the >and . One in the "*.com" Nnot do not function of Polish Polish -158: to the Polish adds 158 the . : Poland Polish -176: to the Polish adds 176 the . v. It 8one : "*.com" : Poland Polish -226: to the Polish adds 226 the . : Poland PZPAPN Polish-45 : Polish-45 P-45 Poland R: 45 5: ONCK - , NAV, The Polish-45 corrupts the Polish-45 is X, the wall . in the Eby over- writing the )of the a copy of the Since the )are , the permanently damaged and no function be a pif the . awas smaller ). In case, the lhad >and in the DOS to the >and Polish-45 should be Bd and replaced clean copies. It is not possible to dis as the )of the !lost. PZPAPN Polish-376 : Polish-376 V376 Poland R: 376 5: PNCK - n, NAV, The Polish-376 ated in Poland and was is a uof . Polish-376 is X, the wall . in the E. If ,resides in E, it well. Polish-376 376 at the end of the The >and in the DOS to the >and Polish-376 Nnot to do PZPAPN Poor Man : Poor Man Beggar R: 1,168 5: PNCK - 2.11+, 2.58+, 6.64+, n1.05+, 2.58+, .2.0+, 6.64+, The Poor Man, or Beggar, . Its . Poor Man is a the Poor Man wone . in the C: Oroot Eof the C: ODOS sub pof 1,168 at the end of the a. The >and in the DOS not be . The in the 5in all Poor Man "c:\ 6.com c:\dos\ 6.com" "Good morning, Sir! How nice it is! Please giv" "money," "Good morning, sir! How nice it is!" "Please give me money, I,m a poor man." "Do good things, sir!" PZPAPN Porridge : Porridge R: 1,384 5: PNCK - 3.96+, 30.00+, The Porridge . Its . Porridge is a ,. It hides the . Porridge is X, the wone . in the pof 1,384 ), unless were smaller 1,384 ). In the case of were smaller 1,384 2,768 t. The at the "of the a. The >and in the DOS to the >and sets the Hidden attribute on v, so Porridge fthe DOS The can be in the 5in all Porridge "*.com" PZPAPN Possessed : Possessed Possessed-2443, Possessed 1.03A, Possessed 1.03B, Possessed 1.07, Possessed 1.07B, Possessed 1.08 i; TSR; ; write fault Australia R: 2,446 - 2,460 5: PRsAK - , NAV, 1.53S+, The Possessed , in Australia. Possessed is a uof . -and . bPossessed X, Possessed as a low TSR of 3,008 {08, 21, and 24 mby the , if it was not Possessed is , it -and . X. Possessed at the end of all the exception by 2,446 ). . by 2,446 to 2,460 ). In the case of be no it is r. All >and in the Possessed 9the "POSSESSED! Bwa! ha! ha! ha! ha! Author: JonJon Gumba of AdU" Possessed has 15 to 20 minutes, it occasionally erase a Yit. to copy in the receiving a "Write fault writing device -1", the source and target of the operation was a of Possessed are: Possessed 1.03A: Possessed 1.03A is a of the Possessed 's TSR 2,912 , hooking {08, 21, and 24. It becoming , and -and . X. . by 2,367 ). . by 2,367 to 2,381 not . In all cases, the at the end of the the for the , the in the Possessed 1.03B: to Possessed 1.03A, Possessed 1.03B's major characteristic its TSR is now 2,928 Possessed 1.07: to the Possessessed adds 2,446 )to . ,, and 2,446 to 2,460 )to . . Its in TSR is 2,992 ), hooking {08, 21, and 24. %the din the the , two d: "*. -" and "*. Possessed 1.07B: to Possessed-2443 and Possessed 1.07, TSR is 3,008 by 2,443 by 2,443 to 2,457 Nnot has 17 differ fPossessed-2443. May, Possessed 1.08: to Possessed 1.07, 's major difference is 8one : "Fucker". Possessed-2443: Three )smaller the Possessed Possessed-2443 was . Its TSR is 2,992 {08, 21, and 24 2,443 by 2,443 to 2,457 Nnot r. Possessed-2443 8the din the Possessed PZPAPN Possum : Possum /corrupted; R: 202 5: ONCK - 3.96+, NAV 3.0+, n1.05+, .2.0+ The Possum . Its . Possum is a the Possum wthe in encounters in the 202 )of the host . Since the 202 )of the host are , the permanently corrupted and no longer function Possum p, unless was less ), in the 202 . The in the DOS not be The can be din all the Possum "IN HASTINGS addr UD9EB, 02" - WOLVERINE v1.01" "by Nick(ie) Haflinger" the Possum rall of the . the Zof an in a "I AM ' x' IN HASTINGS addr UD9EB,02" The ' 9a group of garbled Possum Nn't do See: Hastings PZPAPN Praying : Praying R: 579 5: PRhCK - \2.09+, The Praying . Its . Praying is a bPraying at the top of the ', not moving |12's , as qby the DOS @by 2,640 {1C and 21 mby Praying in the Praying , it pof 579 at the end of the a. The >and in the DOS not be . The can be in the 5in all Praying "Keep On Praying,Jesus!" It is what Praying PZPAPN Predator : Predator Predator-1072 i; slowly corrupts >has 100 years R: 1,072 5: PRtCK - 6.64+, 6.64+, 1.25+ The Predator, or Predator-1072, Its . Predator is a ,. It Nnot wvery small . bPredator at the top of $the ', moving |12's , as qby the DOS @by 2,160 {13 and 21 mby Predator in the Predator , it for any reason. of 1,072 be hidden Predator is . The >and in the DOS to be un years has to the >. The at the end of `. The in the "Predator (c) Mar. 93 Priest" the Predator #detected by the DOS on all . The 5to slowly corrupt `by randomly altering in read of Predator are: Predator-1148: A 1,148 of the Predator 2,304 ). It adds 1,148 )to the . v. It 8the same as the Predator-1154: A 1,154 of the Predator 2,320 ). It adds 1,154 )to the . v. It 8the same as the Predator-1195: A 1,195 of the Predator 2,400 ). It adds 1,195 )to the . v. It 8the same as the PZPAPN Pregnant : Pregnant d to "PREGNANT" R: 1,199 5: PRhCK - \, NAV, The Pregnant Gand Pregnant is a uof . The Pregnant is X, Pregnant at the top of $the qby the DOS 2,048 mby the , Pregnant are hides the it is , so the not see a is performed. The actually by 1,199 at the "of the had a of 12:00a in the la blank Pregnant future >or event, at 3the s in Fories to "PREGNANT". The triggering factor has not yet !determined. PZPAPN Press : Press R: 1,024 5: PNE - 3.96+, NAV 3.0+, 8/93+, The Press . It is fthe . Press is a a Press X, the Press wone . in the pof 1,024 at the end of the a. The in the DOS not be . The in the 5in all Press "Press any key" "\ IRUS S" The Press Mthe "Press any key" PZPAPN Prime : Prime Prime Evil i; unexpected Sweden R: 580 5: PNCK - , NAV 3.0+, 8/93+, .2.0+ The Prime, or Prime Evil, . It is fStockholm, Sweden. Prime is a uof . the Prime X, the Prime locate and wone in the pof 580 at the "of the a. The in the DOS not be The in the Prime 5, and as such cannot be seen in "*.C*" "Prime Evil! (C) Spellbound, Line Noise 5d in Stockholm, Sweden." "Please spell my right!" the Prime rall of the . in the Zof an in a warm re ring. PZPAPN Print : Print EB 21, 8290, PRTSC , 1989 BSC; Kaccess slowdown Bombay, India R: N/A 5: BR - \, NAV, : CleanUp, M- K, NAV, or DOS SYS The Print }in Bombay, India in 1989 by Neville Bulsara. It is the in India. are two s of Print , the later having had bugs fixed. fa Print O, the in the top of . The adjusts the amount of thinks is zed. show is 2K less zed. On floppy Ks, the of the be copied to becoming , the wany or floppy is accessed by the notice Kaccesses done for any reason be much slower expected. In cases, the root show apparently garbage entries in it. entries are actually part of the The of the Print is buggy, and as such Nn't actually accomplish having to do printing s to on the Ping Pong , and identify it as such. of Print Print -2: Print -2 is the later, bug fixed the Print attempt to perform a print or dump to the printer every 255 KI/Os PZPAPN PrintMonster : PrintMonster H: R: 853 5: PRtCK - 3.96+, 1.25+ The PrintMonster . Its . PrintMonster is a uof . bPrintMonster at the top of $the ', moving |12's , as qby the DOS @by 1,024 mby PrintMonster in The PrintMonster vall . in the pof 853 at the end of the a. The in the DOS not be . The can be in the 5in all PrintMonster "PrintMonster30" the PrintMonster PZPAPN Problem : Problem Problem-856 H: R: 856 5: PRhAK - 3.96+, NAV 3.0+, .2.0+ The Problem . It is . Problem is a uof . -and . bProblem X, the Problem at the top of $the , as qby the DOS @by 1,008 by the rif it was not rby the , the Problem -and . X, copied, or for any reason. pof 856 at the end of the a. The >and in the DOS not be . The can be in the 5in all Problem "THIS IS YOUR PROBLEM !" hang the Problem of Problem are: Problem-734: An earlier of the Problem is 896 hooking |21. It adds 734 )to the . v, and Nnot 9any Unlike the Problem , it Nnot The at the end of the a, and the >and in the DOS not be Problem-863: A 863 of the Problem is 1,024 hooking |21. It adds 863 )to the . v, and 8the same . The executing the do not PZPAPN Protecto : Protecto Protect, Protecto-1157 H: fail to R: 1,157 5: PRtAK - , NAV 3.0+, The Protecto, or Protecto-1157, It is reported to be fthe . Protecto is a uof . -and . bProtecto X, Protecto at the top of but $the ', moving |12's , as qby the DOS @by 2,064 1C and 21 mby Protecto in the Protecto , it and . pof 1,157 at the end of the a. The >and in the DOS not be . The can be din all Protecto aprotection" anot "masm.exe" Protecto may larger 64K are of Protecto are: Protecto-1196: to the Protecto . The major differences are {1C, 21, and 24 are mby the and 1,196 ). The can be din all Protecto-1196 "sl.exe" aprotection" anot Protecto-1323: to the Protecto . The major differences are {1C, 21, and 24 are mby the and 1,323 ). The can be din all Protecto-1323 "c.exe" aprotection" anot Protecto-1355: to the Protecto . The major differences are {1C, 21, and 24 are mby the and 1,355 ). The can be din all Protecto-1355 "c.exe" aprotection" anot See: CPSU-2535 PZPAPN Protipus : Protipus H: `of 5,472 ); Hidden . R: 5,472 5: SNE - Spawning or Companion . n1.04+, 2.58+, 2.58+, 1.25+ The Protipus . Protipus is uof . uses a technique to spawning or companion the Protipus wone . in the b, the s the the last character of the base is now a "V". The hidden attribute set so in a DOS . The creates a 5,472 5,472 8the Protipus 5and lthe >and . The can be in the 5,472 *Protipus . "Sei stato contagiato dal Protipus virex "Conficius said: 'Arrangietes'" ".exe" tof the Protipus is fairly straight-forward. The should match the hidden s to the 5,472 `. The 5,472 `should Bd, and the d to the correct . Lastly, the hidden attribute should be reset so s in the DOS PZPAPN Proud : Proud V1302, P1 Related H: FAT entry R: 1,302 5: PRtCK - \, NAV, The Proud, or V1302, (by Vesselin Bontchev. Proud is a of . The Proud is X, the checks to determine if |13 is in use by an and if it is, the hang the . If |13 is not in use by an , Proud at the top of , but $the Aby 8,192 be replaced by the , it certain candi ranges for any reason. The candi ranges are: 2,048 - 14,335 16,384 - 30,719 32,768 - 47,103 49,152 - 63,487 Proud is an , and is unusual in it "splits" the rinto two parts, placing the between the two sections. Proud is unable to distinguish ahas r, so . `can rmultiple the exception of add 1,302 )to the `generally don't on the tas the part of the 00h area of Proud can be a damaging a probability of 1 out of 256, it may swap entries in the PZPAPN see es listed H: Varies depending on present R: Varies depending on present 5: PONAK - 30.00+, , NAV 3.0A06+, 1.25+ is a 5generation developed by Phalcon/Skism during the summer of . It s to be response to the VCL generator fNowhere Man of Nuke. The es listed $are were generated, at least in part, the generator. The 644 and Walkabout din the wild in the and Canada. were created 7% Solution: is a 599 uof . -and . ,. It at the top of $the the X, hooking 21. , as by the DOS @by 2,048 , it -and . pof 599 at the end of the a. The in the "The 7% Solution" The 7% Solution may corrupt CMOS. 7% Solution 2.0: ^, 1994, is a 672 uof . -and . ,. It at the top of $the the X, hooking 21. , as the DOS @by 2,048 , it -and . are pof 672 at the end of the a. The in the "The 7% Solution 2.0" may corrupt CMOS, ing in all devices and the zed, disabled, or reset to a default value. : Sweden ^, 1994. 7% Solution 3.0: is a 918 uof . -and . ,. It at the top of $the the X, hooking 01 and 03. qby the DOS 1,024 , it -and . pof 918 at the end of the be hidden The in the "The root Eof the Ohas" !destroyed by the 7% Solution 3.0 203: The 203 . Its . The 203 is a uof . the 203 wone . in the pof 203 at the end of the a. The and in the DOS not be One in the "*.com" The 203 Nn't do 644: The 644 . It is uof . -and . `, but not Zof an in all . -and . in the Ebecoming the 644 644 at the end of the The >and in the DOS not be . The the 5: "*.exe *.com" 696: The 696 . It is uof . -and . Zof an in three . Wor . in the Ebecoming preference to . the 696 pof 696 at the end of the a. The >and in the DOS not be . The in the "c:\autoexec.com" "*.exe *.com" Abraxas: , Abraxas is a 546 uof . -and . ,. It vone in the a preference for . pof 546 the at the end of the a. Abraxas not always recognize a and re wthe s, it adds an ). The >and in the DOS not be . The "*.exe *.com" "[Z10] Abraxas" not function the to the DOS prompt &failures ,has Abraxas-1520: , Abraxas-1520 is a 1,520 uof . but not ,. It vup to four . in the pof 1,520 at the end of the a. The >and in the DOS not be . The "Ich bin ein Geschenk von dem Teufel" ".. *.com \" the Abraxas-1520 Alien-1: , Alien-1 is a 571 uof . -and . ,. It at the top of $the the X, hooking 21. , as by the DOS @by 1,216 , it -and . pof 571 at the end of the a. The in the "ALiEN 1 Levia Alien-3: , Alien-3 is a 625 uof . -and . ,. It at the top of $the the X, hooking 21. , as by the DOS @by 1,328 , it -and . pof 625 at the end of the a. The in the "ALiEN 3 - Demon Spawn Levia Anathema: , Anathema is a 588 uof . -and . ,. It at the top of $the the X, moving 12's qby the DOS 2,048 mby Anathema in , it -and . pof 588 at the end of the a. The in the "[ANATHEMA] THE STRANGER" cross-linking of and data &failures © of Armana-564: , Armana-564 is a 564 uof . -and . . It vtwo . `in the all of the . `in the r, it wtwo . `in the pof 564 at the end of the a. The >and in the DOS not be . The in the Armana-564 "[MPC]" "rx3" "*.exe *.com" all of the . `, and four non- rin the E, a hang Bamestra 1: , Bamestra 1 is a 530 uof . . It vtwo . `in the pof 530 at the end of the a. The and in the DOS not be . The the Bamestra "[MPC] [Bamestra] Frans Veldman" "*.exe" Bamestra 2: , Bamestra 2 is a 535 minor of Bamestra 1. Bamestra 3: , Bamestra 3 is a 531 minor of Bamestra 1. Bamestra 4: , Bamestra 4 is a 536 minor of Bamestra 1. Bamestra 5: , Bamestra 5 is a very minor of Bamestra 2. Bamestra 6: , Bamestra 6 is a very minor of Bamestra 1, adding 530 )to the Bamestra 7: , Bamestra 7 is a 529 minor of Bamestra 1. Bamestra 8: , Bamestra 8 is a 534 minor of Bamestra 1. Bamestra 9: , Bamestra 9 is a very minor of Bamestra 1, adding 530 )to the Bamestra 10: , Bamestra 10 is a minor of Bamestra 1, adding 530 )to the Birthday: , Birthday is a 1,104 uof . . It vone . aon the C: and B: pof 1,104 at the end of the a. The and in the DOS not be . The the 5in all Birthday is the birthday of the great one." be no computer usage today." is the second release of the weak virii, It is weak virii % *. If the B: Nnot J, a Cheesy: , Cheesy is a 381 uof . . It vone . ain the pof 381 at the end of the a. The and in the DOS not be . The in the 5in all Cheesy "[MPC] Dark Angel of PHALCON/SKISM" "[Demo W] for 40Hex" "*.exe" Chuang Tzu: , Chuang Tzu is a 970 uof . -and . , but not ,. It vtwo . Wor . in the pof 970 at the end of the a. The >and in the DOS not be . The in the Chuang Tzu "No one has lived longer a dead child, and Methusula died young." "Heaven and Earth are as old as I, and ten thousand things are one." "-- Chuang Tzu, 300 B.C." "[MPC] Cinco de Mayo: , Cinco de Mayo is an 885 uof . , but not ,. It vthree . in the pof 885 at the end of the a. The >and in the DOS not be . The in the Cinco de Mayo "** Cinco de Mayo **" "No trabajas hoy." "[MPC] [VCL] [Cinco de Mayo]" "Danzig Tanks to Dark Angel and Nowhere Man for excellent creation ! more to follow" "*.exe *.com .. US" Cinco to the Cinco de Mayo is a vthree . X. Its , location, and >effect are the same as the The in the "**Cinco de Mayo**" "No trabajas hoy." "Bebe mas cerveza!!" "[MPC] [VCL] [Cinco de Mayo]" "Danzig ks to Dark Angel and Nowhere Man for excellent creation ! more to follow" "*.exe *.com .. US" Clint: , Clint is a 1,076 uof . -and . ,. It at the top of $the the X, moving 12's qby the DOS 3,072 mby Clint in , it -and . pof 1,076 at the end of the a. The in the "[CLINT] (c) Copyright THE STRANGER" "THIS VIRUS PROUDLY MADE IN THE USA!" Crumble: , Crumble is a 778 uof . -and . ,. It vtwo in the pof 778 the end of the a. The >and in the DOS not be . The "*.exe *.com" "[MPC]" "[CrumblKouch] Kouch" DataDeath: , DataDeath is a 1,060 uof . -and . ,. It vfour or five in the preference for . pof 1,060 at the end of the The >and in the DOS not be . The "Hello I am Absolute of DataDeath" "I am in your computer now... I lmagic" "powers..." "DataDeath - Taking The World By Storm!!!" "Now your pay for your stupidity!" "Hi to: Aristotle, Apocalypse, Vengeance, and YOU!" "Love You Joslyn" "HACKERS, VIRUSES, AND ANARCHY FOREVER..." "-Absolute (DataDeath)" "Your Ohas now felt my magic lightning" produced ( modifications of course!)" "*.exe *.com" Death 2: , Death 2 is a 671 uof . -and . , but not ,. It vone in the preference to . pof 671 the at the end of the a. The >and in the DOS not be . The "*.exe *.com" "[MPC] The Of Death 2" "The Happy Hacker" Eclypse: , Eclypse is a 641 uof . -and . ,. It vone in the preference to . pof 641 the at the end of the a. The >and in the DOS not be . The "[MPC] [Eclypse] Abraxas" "*.exe *.com" Grease: , Grease is an 856 uof . -and . ,. It vfive . in the pof 856 at the end of the a. The in the DOS not be The in the Grease "You !hit the Grease Man "Listen to him on 92.3 or 94.1 FM in the NYC listening area f6-10PM" "Monday-Friday. Give him a call at 1-800-544-9294 and tell him the good news!" "Ohhh Schweet ahhh!" jfrequently Groovy: , Groovy is a 466 *non- uof . . It vtwo . `in the pof 466 at the end of the a. The and in the DOS not be . The in the 5in all Groovy "GRooVYGRooVYGRooVYGRooVYGRooVYGRooVY stupid biquts *.exe" Helmet 1.0: , Helmet 1.0 is a 412 uof . , but not ,. It vone in the pof 412 at the end of the The >and in the DOS not be . The "[MPC] [HELMET 1.0] Basher IV" "*.com US" Hiccup: in March, , Hiccup is a 533 uof . at the top of $the X, hooking |21. , as qby the DOS @by 2,048 pof 533 the at the end of the a. The in the "[N.I.T is a waste of money!]" "[Created at the National Institute of Technology]" "[Hiccup]" ""May the world fear the hiccup! Created Feb. March, Iron Hoof 1: , Iron Hoof 1 is a 459 uof . . It vthree . in the ;or higher level pof 459 at the end of the The >and in the DOS not be . The in the "[Iron Hoof] less One -- ANARKICK SYSTEMS" "*.exe .." Iron Hoof 2: , Iron Hoof 2 is a 462 uof . . It vthree . in the ;or higher level pof 462 at the end of the The >and in the DOS not be . The in the "[Iron Hoof v2] less One -- ANARKICK SYSTEMS" "*.exe .." Kersplat: , Kersplat is a 670 uof . -and . ,. It at the top of $the the , as qby the DOS @by 2,048 mby Kersplat in -and . pof 670 at the end of the The in the "[KERSPLAT] THE STRANGER" Love Bink: , 1994, Love Bink is a 557 uof . ,. It at the top of $the , as qby the DOS @by 1,184 by the , it pof 557 at the end of the a. The in the "Today The Love Of Binky Started... Your Computer Shall Celebrate!" "[MPC] Binky Love Z-Boy" Love Bink s the of any year. , 1994. Math Test: , Math Test is a 1,136 uof . -and . ,. It at the top of $the the X, hooking 21. , as the DOS @by 2,384 , it -and . are pof 1,163 at the end of the a. Math Test between 9:00 and 10:00 in the morning, at it may Mthe requiring the to respond "It's for a math test courtesy of YAM! And the question is... What is 00 + 00 =" If the s "00", run. If else is the L, and the to the DOS prompt: "WRONG ! TRY AGAIN!" The fthe in the 5, as is the "Admiral Bailey [MATH TEST VIRUS]" McWhale: , McWhale is a 1,125 uof . -and . , but not ,. It vtwo . Wor . preference for of 1,125 at the end of the a. The >and in the DOS not be of the X, the Lin the middle of the M, scrolling fright to left on one line: "Beware!!! Anti- .John .McAfee .wrote WHALE HONEST!!! , the follow "- (c) Abraxas Warez The in the as is the " ABRAXAS -" "[MPC] [McAfee' Whale] [pAgE]" "*.exe *.com .. US" Unexpected jmay McWhale-1022: in March, , McWhale-1022 is a 1,022 uof . -and . , but not ,. It vtwo . Wor . preference for of 1,022 at the end of the a. The >and in the DOS not be of the X, the Min a scrolling, diagonal formation on the "by McWhale - (c) McAfee Warez." "McAfee, wrote the WHALE "...and Solient Green is people" , the reports The in the as is the "*.exe *.com .. US" March, Mimic-Den Zuk: , Mimic-Den Zuk is a 4,893 vtwo . pof 4,893 the at the end of the a. The >and in the DOS not be . Several in the 5, and are not "DENZ-SIM requires DOS 2.0 or later" "DOS 2.x -" is the wrong "check for On Fridays, Mimic-Den Zuk . At Zof an of the . in the by a trojan. trojan "Den Zuk" logo on the it is and to the DOS prompt. The s the b4,243 )of trojanized . Mimic- , Mimic- is a 2,832 uof . -and . , but not ,. It weither all . Wor all in the pof 2,832 at the end of the a. . may be r, adding an 2,832 be no 3to the >and in the DOS . Mimic- is an Several in the trojanized . "JERU-SIM. -V1.02" "Written by URN KOUCH" "Copyright (c) URN KOUCH requires DOS 2.0 or later" "DOS 2.x -" Mimic- on Fridays. Upon Zof an the . in the #trojanized. The "of the . a small mimics the behaviour of the Napolean Complex: , Napolean Complex is a 729 uof . ,. It vthree in the preference for . pof 729 the at the end of the a. The >and in the DOS not be . The "LMluvsSI" "Dynamite cums in small packages!" "[NAPOLEAN -PLEX v1.0] less One -- ANARKICK SYSTEMS" "*.exe *.com .." are X, as well as the s write a portion of its 5to the Nirvana: , Nirvana is an 835 uof . . It vall of the . `in the the C: Oroot pof 835 at the end of the a. The >and in the DOS not be . The "YOU ARE DEAD. YOUR -PUTER IS NOW EXPERIENCING NIRVANA" "IT IS DELETING ALL WCUTABLE FILES FROM YOUR HARD DRIVE" &% of Nirvana released in No God: ^, 1994, No God is an 728 uof . - and . . It vfive . Wor . `in the pof 728 the at the end of the a. The >and in the DOS not be . The in the "[NOGOD]" "*.exe *.com .." "God is fake, He wouldn't let happen." ^, 1994. No Wednesday: , No Wednesday is a 520 uof . , but not ,. It vone in the pof 520 the end of the a. The >and in the DOS not be . The "*.com" "[MPC] [No Wednesday]" "* by Goethe *" "for [AKL/4269]" anot No Wednesday on any Wednesday, at Zof an in the fake anot d." and the to the DOS prompt. The run normally on any day of the week. Page: , Page is a 570 uof . -and . X, it wall of the . in the E. If the . were instead wall of the . in the pof 570 the end of the a. The >and in the DOS not be . The in the "C:\AUTO "*.exe *.com \ [pAgE]" Page-B: in May, , Page-B is a 780 uof . X, it wthe in the regardless of whether it was tof Page-B on the the . The at the end of the a. The >and in the DOS not be . The in the "by-->>pAgE<<--(C) TuRN-THE-pAgE" "Ancient Sages" "Is one of pAgEs" The Page-B Mthe in a diagonal scroll using multi-colored letters: "Ancient Sages Is one of pAgEs" May, PSMPC-331: , PSMPC-331 is a 331 uof . . It vmultiple . `in the pof 331 at the end of the a. The and in the DOS not be . The the PSMPC-331 "[MPC]" "*.com" PSMPC-338: , PSMPC-338 is a 338 uof . . It vone . ain the pof 338 at the end of the a. The and in the DOS not be . The the PSMPC-338 "[MPC]" "*.com" wthe bfour . `in a PSMPC-339: , PSMPC-339 is a 339 uof . . It vone . ain the pof 339 at the end of the a. The and in the DOS not be . The the PSMPC-339 "[MPC]" "*.com" jmay PSMPC-344: , PSMPC-344 is a 344 uof . . It vone . ain the pof 344 at the end of the a. The and in the DOS not be . The the PSMPC-344 "[MPC]" "*.com" jmay PSMPC-347: , PSMPC-347 is a 347 uof . . It vone . ain the pof 347 at the end of the a. The and in the DOS not be . The the PSMPC-347 "[MPC]" "*.com" jmay PSMPC-351: , PSMPC-351 is a 351 uof . . It vone . ain the pof 351 at the end of the a. The and in the DOS not be . The the PSMPC-351 "[MPC]" "*.com" jmay PSMPC-352: , PSMPC-352 is a 352 uof . . It vone . ain the pof 352 at the end of the a. The and in the DOS not be . The the PSMPC-352 "[MPC]" "*.com" jmay PSMPC-353: , PSMPC-353 is a 353 uof . . It vone . ain the pof 353 at the end of the a. The and in the DOS not be . The the PSMPC-353 "[MPC]" "*.com" jmay PSMPC-478: , PSMPC-478 is a 478 uof . Wand . . It vtwo . Wor . `in the pof 478 the at the end of the a. The >and in the DOS not be . The in the PSMPC-478 "[MPC]" "*.exe *.com" jmay PSMPC-573: , PSMPC-573 is a 573 uof . Wand . . It vtwo . Wor . `in the pof 573 the at the end of the a. The >and in the DOS not be . The in the PSMPC-573 "[MPC]" "*.exe *.com" 30 seconds to 1 minute X, the attempt to write to device "PRN" (the printer). If the device isn't hang may PSMPC-598: , PSMPC-598 is a 598 uof . Wand . . It vall of the . Wor . `in the pof 598 at the end of the The >and in the DOS not be . The are in the PSMPC-598 "[MPC]" "*.exe *.com" PSMPC-603: , PSMPC-603 is a 603 uof . Wand . . It vall of the . Wor . `in the pof 603 at the end of the The >and in the DOS not be . The are in the PSMPC-603 "[MPC]" "*.exe *.com" jaccompanied by loud buzzing on the speaker may PSMPC-611: , PSMPC-611 is a 611 uof . Wand . . It vall of the . Wor . `in the pof 611 at the end of the The >and in the DOS not be . The are in the PSMPC-611 "[MPC]" "*.exe *.com" Pussy: , Pussy is a 493 companion creating a corresponding . a. It at the top of $the DOS , as qby the DOS @by 4,096 mby Pussy in , it creating a . the same base be 493 >and . It the Pussy 5. The Pussy may corrupt the (FAT) Quadratic-986: , Quadratic-986 is a 986 X, it the copy of qby the -SPEC en mental variable. The )of the hex 00 area s it pthe by 986 at the end of the a. The >and in the DOS lthe seconds field set to "62". The in the "Quadratic Equation" "SD93" j, and thus &failures, frequently Scarey: , Scarey is a 739 uof . -and . ,. It at the top of $the , as qby the DOS @by 1,552 mby Scarey in -and . pof 739 at the end of the Scarey 5to emit a buzzing noise on the speaker while performing a read of the Schrunch: , Schrunch is a 458 uof . ,. It vone in the pof 458 at the end of the The >and in the DOS not be . The are "[ZEB (C) ] [SCHRUNCH[ Abraxas 2]" "*.com" On VGA , executing an in the #placed in 50 line mode, and beeping may . On non-VGA , garbled may on the Silent Killer: , 1994, Silent Killer is a 397 uof . ,. It at the top of $the X, hooking |21. , as qby the DOS @by 448 , it pof 397 at the end of the The in the all Silent Killer "[ZRK] Silent Killer Z-Rock" , 1994. Skeleton: , Skeleton is a 556 uof . -and . ,. It vthree in the preference to . pof 556 the at the end of the a. The >and in the DOS not be . The "[MPC] [Skeleton] Deke" "*.exe *.com" jmay has run out of non- : Germany Sucker: , Sucker is a 572 uof . -and . ,. It at the top of $the , as qby the DOS @by 2,048 by Sucker in , it pof 572 at the end of the a. The in the "[MPC] Sucker (C) Sunday Death: , Sunday Death is a 644 uof . ,. It vall . and . in the pof 644 the end of the a. The >and in the DOS not be . The "[BCA]" "Sunday Death -- (c)BCA" "Raven" "*.exe *.com" On Sundays, Zof an in a hang ring. T-Rex: , T-Rex is a 410 uof . at the top of $the qby the DOS .5K. mby T-Rex , it pof 410 at the end of the a. The the 5in all T-Rex "[MPC] T-REX subcon" frequently hang the are X, and &failures copy of simply to the DOS prompt. Test 441: , Test 441 is a 441 uof . . It vthree . all of the . in the r, it move upward in the Estructure. pof 441 at the end of the a. The >and in the DOS not be . The can be in the in all as the is not "[MPC] [Test] Sam Hain" "*.exe .." Tim 3: , Tim 3 is a 301 uof . . It ain the pof 301 at the end of the a. The >and the DOS not be . The in the "[MPC] [TIM] Abraxas" "*.com" Tim 4: , Tim 4 is a 515 uof . . It vone . Wor . ain the pof 515 at the end of the a. The >and in the DOS not be . The in the "[MPC] [TIM] Abraxas" "*.exe *.com" Tim 5: , Tim 5 is a 401 uof . . It ain the pof 401 at the end of the a. The >and the DOS not be . The in the "[MPC] [TIM] Abraxas" "*.com" Tongue: , Tongue is a 597 uof . -and . ,. It vthree in the preference to . pof 597 the at the end of the a. The >and in the DOS not be . The in the 5in all "*.exe *.com" Toys: , Toys is a 773 uof . -and . ,. It vtwo . -or . in the preference given to . pof 773 at the end of the a. The >and in the DOS not be . The "All my toys are broken" "And so am I inside." "The carnival has closed" "Years ago..." "[VCL/MPC]" "*.exe *.com" Walkabout: , Walkabout is a 573 uof . -and . ,. It at the top of $the the , as qby the DOS @by 2,048 mby Walkabout in -and . pof 573 at the end of the The in the "[WALKABOUT TSR VER 1.0] THE STRANGER" War Dork: , War Dork is a 553 uof . vthree in the pof 553 at the end of the a. The >and in the DOS . The "[MPC] War Dork A rombus" "*.exe .." Warez D00d: , Warez D00d is a 1,803 uof . and .OVR ,. It candi in the pof 1,803 at the end of the a. The >and in the DOS not be . The "HEY!!! Blow ME, WaReZ FAGGOT" "You got sorta lucky!!!" "I am afraid I am going to lto smash your WaReZ, d00d!!!" "Go ahead! Call the police and tell them" "[NuKe]" "paid you a visit!" "*.exe *.ovr *.com" Mthe graphics, and corrupt in the "DONT'T YOU KNOW THAT PIRACY IS ILLEGAL I am afraid I am going to lto smash your Warez, d00d!!! Go ahead! Call the police and tell them [NuKe] paid you a visit!" Who Cares: , Who Cares is an 181 uof . ,. It vall of the . in the pof 181 ), unless were smaller ), in case ). The at the "of the a. The >and in the DOS to the and . The can be in the 5in all "*.com" Z10: , Z10 is a 704 uof . -and . , but not ,. It vtwo in the preference given to . pof 704 at the end of the a. The >and in the DOS not be . The "*.exe *.com" "[PF] [Z_10] Paul Ferguson" Zeppelin: , Zeppelin is a 1,508 uof . -and . ,. It vfive in the preference given to . pof 1,508 at the end of the a. . may be re rby the , adding an 1,508 t. The >and in the DOS not be . The "*.exe *.com" "Ripped fucker off" "SHIT!!! Wont work "[pAgE] [SwanSong] Gandolph" The Zeppelin activate sfive . , the be cleared and a color graphic of a zeppelin , accompanied by tones #emitted on the speaker. On mono , the graphic may series of s of various `, a hang usually follows. See: ARCV-n G2 Joshua Shock Therapy Warez-1341 PZPAPN Psychogenius : Psychogenius Cover Girl, Psycho H: & data `corrupted; &failure R: 723 5: ONAK - & Data , NAV, 8/93+ The Psychogenius, or Cover Girl, source. Psychogenius is a vany execu or non- execu a. It permanently corrupts any Psychogenius is X, it all exist in the E. It Nnot care if the `are execu , or if are data sort. lhad the b723 by the 5, and >and to the be no if the was 723 )or larger. were smaller now be 723 The can be din the 5in all "Oh, oh, oh, She's my cover girl, Oh, oh, oh, oh, oh, oh, Cover Girl by The New Kids On The Block Hangin' Tough (c) 1988 CBS Records" "Written by" "(Psychogenius) 12/28/91" "NKOTB JORDON" It is not possible to dis `as the `should be Bd and restored fa clean backup copy. of Psychogenius are: Psychogenius-B: gequivalent to the has one differs fthe May, PZPAPN Psychosis : Psychosis H: ^, 1994 Sweden R: 1,202 5: PNC - 6.64+, 1.22+, 6.64+ The Psychosis ^, 1994, and fSweden. It is a , but not the Psychosis X, the Psychosis wthree . not in the E. Typically, the rby the in a $the Ein the Estructure. Psychosis pof 1,202 at the end of the a. The >and in the DOS not be The in the Psychosis "\ *.com *.* .." "\\ Merry Xmas and a happy new year // Sweden - Snowing Again" year passed by" tear the ows cry" "to 3the world we ever try" "to make a difference before we die" "[PSYCHOSIS]" "Greets, Phalcon/Skism." "(c) 93/94 The Unforgiven / Immortal Riot" 6th of any year. even s, the a 704 *TSR, hooking |08. the TSR is the Mthe 4 - 9. The s every few minutes at the top of the a dozen or so to the PZPAPN Puke-393 : Puke-393 Puke H: Australia R: 393 5: PRAK - 30.00+, NAV 3.0+, n1.04+, 6.60+, 6.64+, 1.25+ The Puke-393 fAustralia in Puke-393 is a uof . -and . The the Puke-393 X, the Puke-393 a "hole" in low , hooking |21. and , as qby the DOS not be , the Puke-393 -and . pof 393 at the end of the a. The in the DOS not be . One in the "[PuKE]" It is if Puke-393 PZPAPN PV-81 : PV-81 H: March, R: 81 5: PNCK - 3.96+, The PV-81 in March, . Its ~. PV-81 is a primitive, uof . the PV-81 X, the PV-81 wone or several of the . the pof 81 at the of the a. Unfortunately, PV-81 cannot determine if it has a, so it wthem, adding an at both the "and the end of the a. The >and in the DOS to the and the last . One in the jmay wise, the Nn't do PZPAPN : QMU QQ-1513 H: 2; TSR or R: 1,513 5: PRsCKX - NAV 3.0+, 8/93+ The QMU . QMU is a uof the ) as well as . ,. Its bQMU Xon a , QMU as a low TSR of 2,080 ). The TSR {13 and 21. At , QMU wthe , moving the to the second side 0, cylinder 0, 2, and writing a full copy of the starting in If the is later fthe K, the at the top of the qby the DOS @by 5,120 {13 and 21 |12's !moved. QMU is , it pof 1,513 ). The at the end `. The >and in the DOS to the >and `include the normally din the , along "Bad It is what QMU PZPAPN : QP3 1028, <1028 H: slowdown R: 1,028 - 1,042 5: PRhAK - n, NAV, The QP3 . Its . QP3 is a -and . ,. It is on the The QP3 is X, QP3 at the top of , but $the as measured by the DOS Aby 1,104 {1C and 21 mby the , QP3 -and . X. If X, it r. Unlike <, it Nnot by 1,028 by 1,031 to 1,042 ). In both cases, be no 3to the =in the The at the end of the The QP3 8one can be viewed in : "QP3". It is what QP3 See: PZPAPN Quake : Quake H: May, i; shaking or "quaking" of The R: 518 - 532 5: PRfE - 3.96+, NAV 3.0+, .2.0+ The Quake }in The in May, . It is a uof . a very noticeable effect. The the Quake the Quake in the DOS buffers. be no the Quake , it pof 518 to 532 at the end of the a. The >and in the DOS not be are no in the the Quake [shaking or "quaking" of all but the bottom line of the effect s every few minutes. PZPAPN Queens : Queens Micro Cop, Queensland H: Kinaccessible; Queensland, Australia R: N/A 5: BRX - , NAV 3.0+, : DOS SYS on The Queens, or Queensland, }in Queensland, Australia in . Queens is a and the fthe bQueens the Queens at the top of $the ', moving |12's , as the DOS @by 2,048 , the wthe the Queens , it wthe of any non-write protected is accessed on the . The Queens is too large to fit entirely in the , so a portion of the elsewhere on the J, along On double density 5.25 inch I, the in the location, along its continuation 10. The On high density 5.25 inch I, the the location, along its continuation in 27. The Since the s the last two of the root Eentries in inaccessible. On the K, Queens wthe . The s, but the inaccessible as a the Queens notice blank the M, reversing the video, and Mthe at the bottom of the "unauthorized software used --Micro Cops" s, the be hung. See: Generic PZPAPN Quiet : Quiet H: i; TSR Kansas, R: 2,048 - 2,063 5: PRsC - , NAV 3.0+, The Quiet Gin the State of Kansas in the . Quiet is a of . , but not ,. It's was in a computer repair facility, so it is believed to be in the public domain. bQuiet X, the Quiet as a low TSR of 2,304 ). The {16, 21, and 64. the Quiet , it X. Quiet pof 2,048 to 2,063 at the end of the . The >and in the DOS . The can be din the last 2K of Quiet "DNAMMOC" "t=1024 /write=off /win /quiet" It is what the Quiet PZPAPN Quick : Quick Brasil BSC; Jroot R: N/A 5: BRtX - \, NAV 3.0+, : CleanUp, M- K, or DOS SYS on The Quick . Quick is a and the ). Quick is a employing techniques to re to read the secotr and The fa Quick the Quick at the top of $the ', moving |12's , as qby the DOS @by 1,024 , the wthe if it was not the Quick , it wthe of any non-write protected Iaccessed on the On 360K 5.25" I, the write one 10, and copy the The s the On 1.2M 5.25" I, the write one 27, and copy the The s the On the K, the lwritten one 5to Side 0, Cylinder 0, 2, and copied the to Side 0, Cylinder 0, 3. The s the at Side 0, Cylinder 0, The Nnot 9any in the and has d to due to its ability to quickly spread to #detected. Since the s the last two of the root entries were be lost. PZPAPN Quirk : Quirk H: `created R: 9,977 5: SNE - Spawning or Companion The Quirk . Its . Quirk is a spawning or companion the Quirk X, the Quirk wtwo or more . in the E. The . themselves are not rather the creates a 9,977 ain the same the same base . The newly created . `are not hidden, and lthe >and in the DOS set to the >and It is if Quirk PZPAPN : R-10 DataRape-10, Rape-10 H: Canada R: 500 5: PRhCK - /, NAV, The R-10, DataRape-10, or Rape-10 , and ated in Canada. R-10 is a of . ,. It is one of the the RABID group claims responsibility for writing. The R-10 is X, R-10 at the top of the {21 and 69 mby R-10 , as the DOS @by 528 R-10 is , it by 500 ), the at the end of the be no 3in the in the DOS R-10 on a random basis, at the X. The of the Kstarts at the C: writing to the Kthe completes writing to the K, it continue formatting the O, writing full of x'FF' 4until the powers off the R-10 is probably an earlier of the R-11 See: R-11 PZPAPN : R-11 DataRape-11, Rape-11 H: Canada R: 747 5: PRhCK - /, NAV, The R-11 fsources in both the V. At least in the case of the United States submission, the din the public domain. R-11 is a uof . The R-11 is X, R-11 at the top of $the remain 1, but Aby 848 {21 and 69 mby the , R-11 X. If X, it R-11 by 747 at the end of the R-11 hides the . If the DOS R-11 , it indicate a a. The DOS may get an "Invalid Ospecification" R-11 R-11, on a random basis, may on the K. It s to be a later of the R-10 See: R-10 PZPAPN Radyum : Radyum H: R: 448 5: PNCK - 3.96+, 30.00+, NAV 3.0+, 1.25+ The Radyum . It is . Radyum is a the Radyum wone in the pof 448 at the end of the a. The >and in the DOS not be . The fourth and fifth be "II". The the Radyum "radyum, the attitude adjuster, brought to you by ViRuLeNT GRaFFiTi" "\*. Radyum Nn't do of Radyum are: Radyum 2-707: A 707 of the Radyum vone . in the X. If an Nnot exist in the E, it move upward in the structure until it locates a Qes the root E, if it Nn't locate an w, it create a hidden a, HELLO.RAD, of 156 " radyum, 2, by the attitude adjuster" " brought to you by ViRuLeNT GRaFFiTi" " 07/31/92 Greets to Gary Watson!" " look for us again in the future." Radyum 2-707 adds 707 )to the . at the end of the a. The >and in the DOS not be . The in the Radyum 2-707 5, as is the "Hello.Rad .. *. may be identifed by the "QQ" starting in the fourth *of all March Radyum-B: A 698 of the Radyum vone . in the X. If an Nnot exist in the E, it move upward in the structure until it locates a Qes the root E, if it Nn't locate an w, it create a hidden a, HELLO.RAD, of 147 " radyum-b, by the attitude adjuster," " brought to you by ViRuLeNT GRaFFiTi" " 07/31/92 Greets to Gary Watson!" " look for us again in the future." Radyum-B adds 698 )to the . at the end of the a. The >and in the DOS not be . The the Radyum-B 5, as is the "Hello.Rad .. *. may be identifed by the "QQ" starting in the fourth *of all Radyum-C: A 860 of the Radyum vone . in the X. If an Nnot exist in the E, it move upward in the structure until it locates a Qes the root E, if it Nn't locate an w, it create a hidden a, HELLO.RAD, of 221 " radyum-c, by the attitude adjuster," " brought to you by ViRuLeNT GRaFFiTi" " 08/18/92 " 6 out of 16 keep the same" " position and value, not too bad in my" " book! greets to patti hoffman, i love you!" Radyum-C adds 860 )to the . at the end of the a. The >and in the DOS not be . The the Radyum-C 5, as is the "Hello.Rad .. *. may be identifed by the "QQ" starting in the fourth *of all PZPAPN : Rael H: , 1994 Bd upon unexpected access to C: O; TSR Argentina R: 3,211 - 3,226 5: PRsC - \2.13+, 2.58+, 6.64+, 1.25+, 6.64+, 2.58+ The Rael fArgentina in , 1994. is a uof particular in the C:\DOS bRael as a low TSR of 3,268 ), hooking |21. The access the C: the express purpose of "c:\dos\sys.com" "c:\dos\dosshell.com" "c:\dos\format.com" "c:\dos\keyb.com" were not r, the Rael wthem. The pof 3,211 to 3,226 the end of the a. The >and in the DOS not be Next, the Mthe on the "RAEL IMPERIAL AEROSOL KID" !performed, the any The , as well as the s, are in the 5, as well as the "01/NOV/93 por RAEL" "com -MAND "RAEL IMPERIAL AEROSOL KID VIRUS III" "-Buenos Aires-Argentina...Rael, Imperial Aerosol Kid-" "Exists in the daylight, spraygun head...-SaTaN" "C BRaIn B.B.S. 383-7480 Las 24 Horas" PZPAPN : Rage H: Canada R: 575 5: PNCK - , NAV, The Rage . Rage is Canada, and one of the RABID s to lwritten. is a uof . Rage is X, the check the Oand Efor an w. If one is very small . `, the Rage wit. by 575 at the end of the be no 3in the =in the DOS . The can be "Patricia Boon" Rage Mthe "Pray for death - RABID '91" cannot be `as it is in the It is if Rage PZPAPN : RAM H: May, i; black box; Bd on Fri 13th; TSR; slowdown R: 3,517 -) & 1,808 - 1,822 5: PRsAK - , NAV 3.0+, The RAM Vin May, . The RAM on the . Like the es, it is uof . W, and overlay `. It The the RAM the as a low TSR of 4,008 {08 and 21 , the RAM are X. The is the same as for the , 1,808 to 1,822 at the end of the The RAM walready , adding 1,808 )to the How the RAM is the major difference between es. The RAM , places a copy of the "of the . and an copy at the end. The pon . be 3,517 the end of the , and a pof 1,704 9two "sUMsDOS" the RAM for 30 minutes, a "black box" on the lower left hand side of the The slow the down by percent. The RAM on Friday the 13ths. If the on Friday the 13ths, it the Ythem. See: PZPAPN Random : Random H: Australia R: 615 5: PRhCK - , NAV 3.0+, n1.04+, 6.60+, 1.25+, 6.64+ The Random in March, Hin Melbourne, Australia in . Random is a uof . The the Random the Random at the top of $the ', hooking , as qby the DOS Aby 624 |12's not be moved. the Random , it X. If X, it the Random pof 615 at the end of the a. The >and in the DOS not be . The in the 5in all Random Kevin Mitnick" Lenny DiCcoco" Hans Hubner" 414's" Legion of Doom" Phiber Optik" Dr Popp" Robert Morris" Shooting Shark" Chesire Catalyst" Captain Crunch" Ron Austin" Kevin Poulsen" "are all to be congratulated" PZPAPN Rattle : Rattle Death Rattle H: seconds = 62 R: 615 5: PRaCK - NAV 3.0+, 1.53S+, The Rattle, or Death Rattle, . Its the submission was Van source. Rattle is on the uof . The the Rattle the Rattle , as by the DOS mby Rattle in the Rattle , it X. If X, it the Rattle pof 615 at the end of the a. The >and in the DOS to be the seconds field !set to 62. the Rattle [frequent jdue to a See: PZPAPN RaubKopie : RaubKopie Raubkopi H: March, Germany R: 2,219 5: PNAK - , NAV, The RaubKopie in March, by Jan Terpstra of the . It is fGermany. Raubkopie is a uof . -and . `. It RaubKopie is X, the wup to five . in the E. If less five existed in the E, it `until the number of it has s five. Raubkopie 2,219 at the "of the a. The >and in the not be Raubkopie 2,475 to 2,491 at the end of the a. The larger `is due to a different mechanism #used to wthe `, the badd up to 16 )to the candi is now di by 16. adding the ), it adds 256 )of hex 00's and appends the Raubkopie 5to the end of the . The >and in the not be The RaubKopie occasionally and require a response is invoked. The Lcannot be seen S. The A C H T U N G Die Benutzung einer RAUBKOPIE ist strafbar! Nur wer Jn, Handbucher, oder PD-Lizenzen besitzt, darf Kopien verwenden. mierung is muhevolle Detailarbeit: Wer Raubkopien verwendet, betrugt mierer un den Lohn ihrer Arbeit. A pause , and the cquestion "Bist Du sauber ? (J/N) " Entering "J" for yes in the Land the proceed to "Ich glauben, was Du sagst Entering "N" for no in the , the second of is garbled, and the be terminated: "CPU-ID wird gespeichert... * LO The last garbled samples of * Losche dieses in the RaubKopie to format the of the Kif the >is greater the 12th of the month, or the hour is 17:00 (5:00 PM). 5, however, Nnot function due to a bug in the RaubKopie %the of the Fories 9ing RaubKopie sorted so at the "of the of RaubKopie are: Raubkopie-FRD: , Raubkopie-FRD is of the 1,888 at the "of the pof 2,150 to 2,160 at the end of the The in the "\ OSSI EN ST" "C:\ * NETWARE LMS MAUS MDB DOS BASE L" "*.exe *.com" "C:\ C:\CONFIG.SYS DEVICE = COUNTRY.SYS" "hgt42" "V1 FRD" of RaubKopie alter the C:\CONFIG.SYS 9the "DEVICE = COUNTRY.SYS" statement PZPAPN Reaper : Reaper Reaper Man H: England R: 1,072 5: PRhA - 3.96+, NAV 3.0+, 8/93+, .2.0+ The Reaper, or Reaper Man, It is fEngland. Reaper is a uof . -and . , but not ,, and not on the A: bReaper X, the Reaper at the top of $the ', hooking , as qby the DOS @by 3,008 |12's not be moved. the Reaper , it are copied or reason location is on the A: the Reaper 1,072 at the end of the Reaper is not able to determine r, so it , adding an 1,072 ). The >and in the DOS be corrupted to an unusual value is not a normal, valid >and . The >and s in the DOS are not rby the The can be in the all Reaper "Reaper Man" "(c) 92, Apache Warrior, ARCV Pres." "[ReaperMan] Apache Warrior" PZPAPN : Re H: i; unexpected Eastern R: 715 5: PNCK - , NAV 3.0+, .2.0+ The Re . It is fEastern V. Re &is a uof . the Re wone . in the E, it may the Re pof 715 at the end of the a. One "891221" the Re [unexpected ring PZPAPN Red Diavolyata : Red Diavolyata 830, MLTI H: R: 830 5: PRhCK - \, NAV, The Red Diavolyata is an 830 ,. It was , and ated in the The Red Diavolyata is the at the top of $the '. The not moved. The DOS indicate @by 960 mby the Red Diavolyata is , any . rby the . If X, it pd by 830 ), and >and in the to the >and . The at the end of the The can be dat the end of "Eddie die where in m was written in the city of Prostokwashino" "(C) RED DIAVOLYATA" "Hello! MLTI!" ly, the "MLTI! -MAND" can be It is if Red Diavolyata of Red Diavolyata are: Red Diavolyata B: Very to Red Diavolyata B, the major difference fthe are two the differ fthe PZPAPN RefRef : RefRef H: R: 1,204 5: PRhE - , NAV 3.0+, 3.96+, 8/93+, The RefRef . Its . RefRef is a of . bRefRef X, the RefRef at the top of $the , as qby the DOS by 2,496 {21 and 22 mby RefRef in the RefRef , it very small ones, pof 1,204 at the end of the a. The >and in the DOS not be The in the RefRef "ReFReF" "TFReF" "4tsonpm" It is what RefRef PZPAPN Reklama : Reklama H: i; TSR Poland R: 2,723 5: PRsCK - , NAV 3.0+, 3.96+, The Reklama . It is fPoland. Reklama is a uof . bReklama X, the Reklama as a low TSR of 2,736 ). It hooks the Reklama , it pof 2,723 ). The at the end of the a. The and in the DOS not be The can be in the all Reklama "Przekaze tylko pewna informacje i juz mnie nie ma." "Wszystko jest OK." "A oto ta oczekiwana informacja:" "Ognisko Muzyczne F R A Z A we Wroclawiu uczy gry na :" "- pianinie," "- akordeonie," "- syntezatorach," "- gitarze," "- skrzypcach," "- uczy rowniez spiewu solowego." "Ognisko Muzyczne F R A Z A organizuje rowniez kursy" "CHWYTOW GITAROWYCH." "Juz po czterech miesiacach poznasz tajniki" "gry na gitarze badz syntezatorze." "I TY mozesz umiec grac na roznych instrumentach muzycznych." "Kontakt : Wroclaw, tel. 25-90-97" "Nacisnij dowolny klawisz abys mogl pracowac" "Jesli chcesz umiescic relame w ie samokopiujacym," "pisz do:" "Agencji Wydawniczej: skr. poczt. 1009, WROCLAW 3" "Wirusek reklamowy 1" It is what Reklama PZPAPN Relzfu : Relzfu 233, Fake VIRx H: i; "Specified -MAND search Ebad" Finland R: 233 5: PNCK - , NAV, The Relzfu, or 233, Gin Finland in . Relzfu is a uof . Relzfu is X, the search the Efor an , the wit, was attempted to Relzfu 233 at the end of the be no 3in the >and in the DOS E. Two can be "ufzleR" "*.com" The !used for the reversed. It is if Relzfu PZPAPN Repent : Repent H: fail to function &failures R: 350 5: ONCK - 30.00+, NAV 3.0+, n1.04+, 6.64+, 8/93+, 6.64+, 1.25+ The Repent . Its . Repent is a the Repent X, the Repent wthe bfour . the E. If it may r. The Repent 5to move up one Ein the Estructure, not function in higher level Fories are not rby the the Repent lthe )of the host by the Repent be no 3to the unless it was smaller , in case it 350 . The >and in the DOS not be . One in the Repent the Repent not function and are permanently corrupted. &failures © of rby the PZPAPN Reset : Reset Omega, Friday-13th-440 H: i; Very long Kaccesses R: 440 5: PNCK - , NAV, The Reset . Its is a non- uof . the Reset X, the search the Estructure looking for . aencountered rby the has completed sthe O, it search the C: Oin the same manner. Since the searches the entire O, a long period of Kaccess any the Reset pd in by 440 ). The at the end of the a. One can be in the : "*. Reset Nnot to do PZPAPN H: R: 512 5: PRfE - , NAV 3.0+, .2.0+ The Gin the s is a uof . and in on the video card if it is |21 is mby the in the |area. s is , it pof 512 at the end of the a. The >and in the DOS not be . No in the It is what PZPAPN Revenge Attacker : Revenge Attacker 777, Revenge H: i; DIR 6problems; hang; Kformat Philipines R: 1,127 5: PRsCK - , NAV, The Revenge Attacker, or 777, ated in the Philipines. Revenge Attacker is a generic uof . It is a very destructive The Revenge Attacker is the as a low TSR of 1,392 mby the rby the Revenge Attacker is , it wone . by 1,127 at the end of the >and in the the >and be marked by the "777" din the fourth through sixth are two "*** 777 - Revenge Attacker V1.01 ***" Revenge Attacker's low TSR is not used for t, but interfer operation internal 6s are issued. For example, issuing a DIR Revenge Attacker is in a Eentry repeated in place of actual Eentry. a DIR 6, the hang. all . in the Eare Revenge Attacker activate. At , followed by repeated 7's across the . While it is Ming the and writing the 7's to the , it Kstarting Side 0, Cylinder 1, 0. Fat :, and aloss may even if the turns off the computer immediately PZPAPN Revelation : Revelation H: R: 4,096 5: PRhCK - The Revelation . Its . Revelation is a It employs an encryption mechanism used by the "Fish" bRevelation at the top of but $the ', not moving |12's , as qby the DOS @by 32,768 21 and 22 mby Revelation in , Revelation over 4,096 a DOS DIR X. The not always wthe . `it encounters, s it just add 10 )to the end of the the 4096 pof 4,096 4,086 be hidden by the it is . The at the end of the a, and the >and in the DOS not be . The in the Revelation "Genesis" "Revelation Alpha" "Exodus" "Copyright (c) by Transvisionary" the Revelation DOS indicating Ton all See: Fish PZPAPN Riihi : Riihi H: , 1994 R: 132 5: PRaCK - \2.13+, V116+, n1.05+, 2.58+, 6.64+, 1.25+, 6.64+, V116+, 2.58+ The Riihi , 1994. Its . Riihi is a uof . bRiihi in al , hooking |21. and/or , as by the DOS not be , the Riihi pof 132 at the end of the a. The >and in the DOS to the >and . No in the PZPAPN RIP-699 : RIP-699 RIP, Patsy H: i; TSR; Australia R: 699 5: PRsCK - NAV 3.0+, .2.0+ The RIP-699, RIP, or Patsy, Gin Australia in . It is a uof . ,. It on March 6th and it may bRIP-699 X, the RIP-699 as a low TSR of 1,792 ). It hooks interupts 10 and 21. It may as part of 6Data in under mapping utilities. , RIP-699 pof 699 at the end of the a. The >and in the DOS not be . The in the RIP-699 "RIP Patsy Cline 8th 1932 - 6th March 1963" RIP-699 on March 6th and 8th of any year. On those >s, if the Ys a to set the video mode to mode 80 by 25 the PZPAPN : RNA H: March, i; zero `created; R: 7,296 5: PNA - , NAV, 1.25+ The RNA in March, . Its . RNA is a uof . and . . It Nnot RNA is X, the RNA wup to four . -and . in the of 7,296 at the the a. The >and in the DOS not be The can be din RNA "Run "uc253.rqz" the RNA [intermittent X. The notice zero- `may be created in the Oand Kaccesses to Omay , but the Nn't actually on the of RNA are: RNA-7408: RNA-7408, or RNA2, was It is in behavior to the are given preference for tover pof 7,408 at the "of the a. The can be in the "Run "Portions Copyright (c) 1983,90 Borland" PZPAPN Rocko : Rocko H: Canada R: 666 5: PRhAK - , NAV, 1.53S+, The Rocko fCanada. Rocko is a -and . ,. It employs techniques to avoid detection. bRocko X, Rocko at the top of $the , as qby the DOS @by 704 mby Rocko the Rocko , it -and . to not lany pas the hides the it is . The DOS the Rocko pof 666 at the end of the a. The in the DOS may dis . The seconds in the stamp !set to 60. One can be in the "RocK STeaDY!" The Rocko on the 13th of any month, at the on the K. It 8two mechanisms to perform damage. of Rocko are: Mutating Rocko: on the Rocko , at the of its submission, is not detected by aware of the Rocko to an complex encryption mechanism. Its is 1,280 ), hooking {09 and 21. It adds 609 )to the . Z, the at the end of the Mutating Rocko is , the be hidden. One can be seen in all "(c) Rock Steady/NuKE]" Mutating Rocko on the 24th of any month, hits CTRL-ALT-DEL, the K. On the 24th of the month, a cold : Montreal, Canada Rocko-B: to the Rocko . It has 11 differ. The at the end of the : Montreal, Canada PZPAPN Roguey : Roguey Badcmdx H: i; TSR; host Lost clusters on fail to function; &failure R: 967 5: PRsCK - V111+, /2.1+, 2.58+, n1.05+, V111+, 2.58+, .2.0+, 6.64+ The Roguey, or Badcmdx, . Its . Roguey is a uof . bRoguey as a low TSR of 1,584 mby the Roguey is , it may are 967 be hidden . Roguey encrypts the entire host in addition to its 5, so the position of the in the host aisn't particularly applicable. The may be Lby the "Bad , and thus is not In addition to Ming the s of may note an pin the rance of lost clusters on Ks, as well as the failing to copy of PZPAPN Rosen : Rosen H: R: 131 5: PNCK - /, NAV, The Rosen . Its . Rosen is a uof . the Rosen wall . in the E. If E, it the Rosen pof 131 at the of the a. The >and in the DOS to the . The can be in the 5in all Rosen "R*. The Rosen is unable to recognize rby the , so it later re wthem, adding an Nnot do PZPAPN : RPVS 453, TUQ Endangered H: West Germany R: 453 5: PNCK - /, NAV, 6.64+ The RPVS, or 453, Gin West Germany in early is a uof . The RPVS is d for an unusual s in a adump of the - "TUQ.RPVS" - in not really a , but a series of PUSH instructions. The RPVS is a rather unsophisticated ever a . the RPVS or 453 X, the look for an ain the The determines if the . ahas by checking to see if the last two )of the aare 9090h. If the last two )are not 9090h, the appending 453 5to the end of the a. One . not normally be Nnot 9any logic to activate and cause damage in its ;state. It 9many NOP instructions and odd jumps leave plenty of space for later additions. of RPVS are: RPVS-B: The RPVS the end of an s, the act differently. It not be able to determine it has already a, so it wthe ait finds in the Eover and over again. PZPAPN RSP-1876 : RSP-1876 1876 H: i; beeping; random 4written to R: 1,876 5: PRsAK - , NAV, The RSP-1876 . Its . RSP-1876 is a uof . -and . bRSP-1876 in low to a TSR. The area as a TSR, however, most mapping utilities. {21 and 22 mby the RSP-1876 is , it -and . X. If X, it 1,876 at the end of the The >and in a DOS . The can be the "RSP" Zof RSP-1876 in beeping emitted fthe speaker, as well as randome #written to the may PZPAPN : RTL4 H: The R: 503 5: PNCK - n1.03+, NAV 3.0+, 8/93+, 1.25+ The RTL4 , and is . RTL4 is a the RTL4 X, the RTL4 wone . in the along Ming the "RTL4" "Joop van den Ende Produkties BV Marco Daas (Casting Assistent) Postbus 397 1430 AJ AALSMEER van Cleeffkade 15 1413 BA AALSMEER The Wedden dat... je een hebt?" hang . The `, so it is not the RTL4 pof 503 at the end of the a. The >and in the DOS not be . In addition to the , the The individual and the addresses by the , but should not be construed to indicate individual wrote the PZPAPN Ryazan : Ryazan H: R: 512 5: PRaE - 3.96+, The Ryazan and is fthe . Ryazan is a uof . bRyazan X, the Ryazan in a "hole" in al at 0010. It |21. , as qby the DOS not be the Ryazan , it very small ones, pof 512 the at the end of the a. The and in the DOS not be . The in the Ryazan "!!Ryazan" It is if Ryazan PZPAPN Rybka : Rybka H: i; TSR; Zfailures; &failures R: 123 Plus 5: PRAK - , NAV, The Rybka . Its . Rybka is a uof . -and . The Rybka is X, the Rybka as a low TSR of 1.3K ), hooking |21. Since the Rybka cannot later recognize it has already its TSR, it zit again X. As a continue to Ain 1.3K increments as the tprogresses. Rybka is , it -and . over 132 X. If X, it ras well. Rybka by at least 132 many cases the pmay be over 13,000 ). In any event, the at the end of the a. The >and in a DOS . The can be "VACSINA" %the increasing loss of while the , Rybka failing to ing the to the DOS prompt. If r, the PZPAPN Sabbath : Sabbath H: R: 1,684 5: PNC - The Sabbath . Its . Sabbath is a uof . , but not the Sabbath wone . in the pof 1,684 at the end of the a. The >and in the DOS not be The in the Sabbath "[Sabbath By Havoc The Chaos of Trinity" "Sucks To Be You Pal!" "Your Computer The Sabbath - Trinity!" "Dedicated To Heaven In Black (He's Excited By jfrequently PZPAPN : Sad H: &failures; R: 301 5: PNCK - , NAV 3.0+, 8/93S+, 8/93+, .2.0+ The Sad . Its . Sad is a uof . bSad X, the Sad wthe bfour . `in the were not pof 301 at the "of the a. The and in the DOS not be The can be in the all Sad "Sad - 24/8/91" "*?.com" the Sad [frequent j, as well as &failures © of in the month of in the "Sad - 24/8/91" of Sad are: Sad-307: A 307 of the Sad adds 307 )to the . v. Like the , Sad-307's at the end of the a, and the >and in the DOS not be The din the . The major distinction regards is the ' behavior in Upon Zof an during the month of , the Mits the O, effectively trashing the See: Bljec PZPAPN Saddam : Saddam Sadam, Profesor H: &failures; I/O "Insufficient to run .BAT `; DIR France (reported Israel R: 919 5: PRsCK - \, NAV, The Saddam breported in France in , the bsample of was actually , its was Israel. Saddam is a uof . ,. It is on the Do-Nothing The the Saddam X, the in low not as a TSR. {21 and 22 mby the it has not Saddam is , it pof 919 ), the at the end >and upon are several may be [d on the Saddam . The most obvious symptom is the occasionally be "HEY SADAM LEAVE QUEIT BEFORE I cannot be seen in `, it is Y.BAT in an insufficient a Saddam fail, the hang. in an I/O Uand the aborting Z. The DOS 6may not function . Lastly, may [frequent jrequiring the to re the of Saddam are: Profesor: on the Saddam , Profesor adds 919 )to the . v. Its usage and to Saddam, differs in s allocate very large amounts of fail to Y. Professor vup to two . the Zof an in a line of meaningless L. Professor 8the "??? "The Profesor is in town again !!!" See: Do-Nothing PZPAPN Sadist : Sadist H: i; unexpected warm re &s of R: 1,436 - 1,450 5: PNE - , NAV, The Sadist . Its . Sadist is a uof . the Sadist X, the Sadist search the Eand wup to three r, a warm re &may , or the host the Sadist pof 1,436 to 1,450 the end of the . The >and in the DOS . The can be in the 5in all Sadist "CopyRight by Vadim V.N.1989" PZPAPN Sandwich : Sandwich H: Manchester, England R: 1,172 5: PRhC - /, NAV 3.0+, 3.96+, 30.00+, .2.0+, 1.25+ The Sandwich fManchester, England. Sandwich is a uof . requiring a response in a manner to the Ear . It Nnot The the Sandwich X, the Sandwich at the top of $the , as qby the DOS @by 3,008 mby the Sandwich , the Sandwich for any reason. by 1,172 the initial not be if the . The at the end of the The >and in the DOS not be one out of every six in the Sandwich Ming a requiring a response. The ARCV Member Likes a Sandwich? Is it A. Apache Warrior B. ICE-9 C. Slartibartfast Select a Letter: " The "" be one of the "Cheese, Beef Spread, Cucumber and Crisp" "Corned Beef and Salad Cream" "Jaffa Cake and Hamster on Rye" If the answers the question correctly, the the , and the "Well you know you`re ARCV Members." If the answers the question incorrectly, the the , and a hang may "Bad Luck.. Better Luck Next All of the in the 5, and thus not . The answers for the questions, on the sandwich s in the order , are A, B, and the Sandwich notice #detected on all Sandwich PZPAPN Saturday The 14TH : Saturday The 14TH Durban, Saturday 14th G: March, TSR;. W, .OV? i; corrupts , FAT & on Saturday 14th Republic of South Africa R: 669 5: PRA - , NAV, The breports of the Saturday The 14TH came fSouth Africa in March . The Saturday The 14TH, or Durban , is a generic W, and overlay `, but not by between 669 and 684 The Saturday The 14TH on any Saturday falls on the 14TH of any month, at 100 logical of the C: O, B: O, and A: O. In effect, on OC:, the destroys the , and (FAT). PZPAPN Sayha Watpu : Sayha Watpu i; TSR R: 4,000 5: PRsAK - \2.13+, NAV 3.0A06+, 1.0A06+ The Sayha Watpu, or SW UV2f, . Its . Sayha Watpu is uof . -and . ,. It is a fast u, quickly spreading on bSayha Watpu as a low TSR of 9,824 {16 and 21 mby the the Sayha Watpu , it and . for any reason. pof 4,000 at the end of the a. The >and in the DOS not be . The in all Sayha Watpu "SW U V2f Sayha Watpu" It is what Sayha Watpu may do PZPAPN Schrunch-420 : Schrunch-420 Mof garbled may "schrunch" the R: 420 5: PNCK - n, NAV 3.0+, .2.0+, 1.25+ The Schrunch-420 . Its . Schrunch-420 is a uof . the Schrunch-420 wup to six . in the 420 at the end of the a. The >and in the DOS . The can be in the 5in all Schrunch-420 "*.com" "- S C H R U N C H U P T I M E -" The Schrunch Mgarbled the Mand hang the . It "schrunch" or compress the work on the it was tested on. It write protect fwrite protected PZPAPN Scott's Valley : Scott's Valley 2131, Scott's, Slow-2131 TSR; . -and . Scott's Valley, California, R: 2,131 5: PRsA - \, NAV, The Scott's Valley Scott's Valley, California. is a generic uof . -and . `, and Nnot The the Scott's Valley X, the as a low TSR of 2,384 |21 is mby the , any . -or . by 2,131 ). . between 2,131 and 2,140 9the chex in the 5: 5E8BDE909081C63200B912082E. It is is malicious. PZPAPN Scream : Scream Fist, Screaming Fist , Except Scream 2-696, 7in USA & Canada Canada R: 711 - 1,191 5: PRtAK - NAV, The Scream, or Screaming Fist, }in Canada in . Scream is a uof . The the Scream at the top of $the ', moving |12's , as the DOS @by 2,048 {21 and 24 mby Scream in , the check to see if C:\ ,has rby the . If it is not r, the promptly wit. The copy of on the Omay the Scream , it for any reason. pof 711 pof 711 to 1,191 ). In both cases, the at the end of the . The >and in the DOS Two can be din the Scream 5in all "Screaming Fist" "C:\ It is if Scream of Scream are: Scream 1B: The Scream 1B gequivalent to the Scream . It has four differ fthe : Canada Scream 2: The Scream 2 on the Scream . It adds 838 )to the . v, and 838 to 1,318 )to . . Like Scream, the at the end of the S, and no its : Canada Scream 2B: The Scream 2B is a 692 of the Scream it is and , as measured by the DOS @by 2,048 {21 and 24 mby Scream 2B. Scream 2B is , it -and . , or copied. . by 692 ). . pof 898 to 1,172 ). In both cases, the at the end of the : Canada Scream 2C: The Scream 2C gidentical to Scream 2B. It is a minor : Canada Scream 2-696: The Scream 2-696 Gin the in May, it is , as measured by the DOS @by 2,048 ), and it is , it -and . , or copied. . pof 696 ). . pd in by 902 to 1,176 ). In both cases, the at the end of the a. Scream 2-696 is polymorphic, employing a complex encryption mechanism. As of May, , it was confirmed by several large ts to be in the public domain, and is considered a in the as a : Canada May, Scream 2-732: The Scream 2-732 }in the in May, . It is in many respects to the Scream 2-696 however, by 732 ). . pof 1,128 to 1,212 In both cases the at the end of the a. Like Scream 2-696, is polymorphic. May, Scream-650: The Scream-650 is a 650 of the Scream vthe C: Oroot Ecopy of X. It Nnot until the fthe Kand the rcopy of as measured by the DOS by 2,048 mby Scream-650. it is , it are , or copied. pof 650 at the end of the a. The and in the DOS not be . The the "Screaming Fist (c)12/91" "C:\ : Canada See: Emf Enemy PZPAPN Scroll : Scroll seconds set to "62"; U; .BAT England R: 795 - 1,306 5: PRhCK - NAV 3.0+, 1.53S+, 1.25+ The Scroll fManchester, England in . Scroll is a uof . ,. It employs techniques to avoid the noticing the The rby the Scroll the Scroll at the top of $the , as qby the DOS @by 3,008 Scroll in , the Scroll for any reason. 795 to 1,306 hide it is . The Scroll at the end of . The seconds field in the >and in the DOS !set to "62", the tmarker for the . The in the "[SCROLL] ICE-9 ARcV" the Scroll may notice the DOS detect the Scroll . It .BAT `, permanently corrupting them. PZPAPN Scythe : Scythe England R: 1,208 5: PRCK - 3.96+, 30.00+, NAV 3.0+, 1.25+ The Scythe fManchester, England in . Scythe is a uof . ,. It employs techniques to avoid the noticing the ts, and is a fast The rby the Scythe the Scythe at the top of $the , as qby the DOS @by 3,008 Scythe in , the Scythe for any reason. 1,208 usually hide it is (note: it Nn't always do ). The Scythe at the end of . The in the DOS . The be different, and the be set to 10:56.18. The in the is the Scythe for Reaper Man." "Beware I`m Sharp!" "Made in England by Apache Warrior, ARCV Pres." "Scythe Ver. 1.01 (c) Apache Warrior 92." "Reaper Man Swung The SCYTHE and the PC Died!" "[SCYTHE] Apache Warrior, ARCV Pres." the Scythe may notice the DOS detect the Scythe PZPAPN SeaCat : SeaCat Read- Attribute set on R: 160 5: PNCK - 3.96+, NAV 3.0+, The SeaCat . Its . SeaCat is a uof . the SeaCat X, the SeaCat wone . in the 160 at the "of the a. The >and in the DOS to the >and . The Read- attribute be set on in the DOS for the a. The can be in the 5in all SeaCat "SeaCat*.com" SeaCat corrupt . smaller are rby the PZPAPN Search-1000 : Search-1000 G: March, R: 1,000 5: PNCK - 8/93S+, 3.96+, , NAV 3.0A06+, .2.0+ The Search-1000 in March, . Its . Search-1000 is a uof . the Search-1000 wone . in the pof 1,000 at the end of the a. The >and in the DOS to the >and The can be in the 5in all Search-1000 ly, the "CPX" dat the very "of all of Search-1000 are: Search-377: A 377 of the Search-1000 vall of the . in the pof 377 at the end of the a. The >and in the DOS to the >and . The in the 5in all Search-377 "*.com" : Israel PZPAPN : Self Polish-457, Polish-550, Self-457, Self-550 Poland R: 457 or 550 5: PNCK - , NAV, The Self is actually two were ated in Poland. Both are us of . one of the Self es is the search the Eto find all . All the Self . The either 457 or 550 ), depending on of the two es is present, at the "of the a. In either case, the >and the DOS to the and of Self are: Self-457: The 457 of the Self pd in by 457 ). The can be "MS *. -" and "RZRZ". Polish-457. Self-550: The 550 of the Self pd in by 550 ). The can be "CMS*. -", "*. W", and "QYQY". as Polish-550. PZPAPN Semtex : Semtex Czechoslovakia R: 1,000 5: PRhCK - n, NAV, The Semtex . It is fCzechoslovakia. Semtex is a uof . bSemtex Xon a Semtex at the top of $the , as qby the DOS by 4,080 |12's not be moved. Semtex hook {8 and 21. , Semtex Semtex is , it for any reason. In the case of copying fone Eto an , both the source and target copy of the . Semtex by 1,000 The at the end of be no 3to the >and in the DOS . The can be the "S E M T E X by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)213-23" is not Lby the Semtex has for 60 minutes, it produce a Qcursor position on the 9a colored background and an ASCII character. The effect is a multi-color flashing of very small rectangles. The to normal by pressing a key on the of Semtex are: Semtex-B: A 1,000 of the Semtex is 4,080 ), hooking |21. It for any reason. pof 1,000 at the end of the a. The pis not hidden . The >and in the DOS not be . The in the 5in all Semtex-B "S E M T E X by Dusan Toman, CZECHOSLOVAKIA *** la nice day ***" jmay : Czechoslovakia Semtex-C: A 619 of the Semtex is 4,080 ), hooking {08 and 21. It for any reason. pof 619 at the end of the a. The is not hidden . The >and in the DOS not be . The in the 5in all Semtex-C "S E M T E X by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)213-23" jmay : Czechoslovakia Semtex-D: A 1,000 of the Semtex is 4,080 ), hooking {08 and 21. It are for any reason. pof 1,000 at the end of the a. The pis not hidden . The >and in the DOS not be . The in the 5in all Semtex-D "S E M T E X by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)213-23" jmay : Czechoslovakia PZPAPN Seneca-B : Seneca-B & data &failure; R: 493 5: ONAK - 3.96+, NAV 3.0+, 8/93+, The Seneca-B . Seneca-B is and data `. It corrupts the the Seneca-B X, the Seneca-B wall of the in the b493 )of the host a. The Nnot differentiate between and data `, so :, data and data the Seneca-B as the smaller . The >and in the DOS to the >and . The in the Seneca-B "*.* .." PZPAPN Sentinel : Sentinel Sentinel-3, Sentinel-5, BC stuck key failure" R: 4,625 5: PRHAK - , NAV, .2.0+ The Sentinel , and is is a uof . `, and ,. Unlike most Turbo Pascal source 5. It may be purely a research Sentinel is X, the at the top of , but $the |12's not moved by the mby the ,, if not rby Sentinel at as well. Sentinel is , it -and . larger 1K as pof 4,625 ), the at the end of the makes no attempt to hide the >and the Eis not by the The can be dat the very end of Sentinel: "You won't hear me, but you'll feel me (c) by Sentinel. ks to Borland." Sentinel Nnot to do of Sentinel are: Sentinel-3: Sentinel-3 is a 5,173 of the Sentinel . Unlike Sentinel, , it hide the if it is . Sentinel-3's is 5,328 are no recognizable visable in Sentinel-3 notice executing the DOS Tdo not Sentinel since it didn't attempt to hide the ( May Sentinel-5: Sentinel-5 is a 5,402 of Sentinel-3. Sentinel-5 is , it hide the . Like Sentinel-3, executing the DOS uncover . Sentinel-5 smaller 2K in in the stuck key failure", always if the to view aeditor Sentinel-5 is . Sentinel-5's is 5,568 are no readable in the 5in Sentinel-5 ( May PZPAPN Serena : Serena i; TSR Italy R: 792 5: PRsCK - , NAV 3.0+, n1.04+, 6.64+, 6.64+, 1.25+ The Serena . It is fItaly. Serena is a uof . bSerena X, the Serena as a low TSR of 1,104 ). It hooks the Serena , it pof 792 at the end of the a. The in the DOS not be . No in the It is what Serena PZPAPN Seventh Son : Seventh Son 7th Son, Seventh Son-284, Seventh Son-350 The Eastern R: 284 or 350 ), depending on 5: PNCK - NAV 3.0+, 8/93+ The Seventh Son is actually two behavior were }in the are believed to lactually ated in Eastern The Seventh Son es are us of . a Seventh Son X, the Seventh Son search the Oand encountered by either 284 or 350 ), depending of the Seventh Son es has rthe be no 3in the >and in the DOS E. The can be "Seventh son of a seventh son" Seventh Son Nnot to do of Seventh Son are: Seventh Son-284: Seventh Son-284 is a 284 Seventh Son-332: Seventh Son-332 is a 332 the Seventh Son . It vall . in the pof 332 at the end of the a. The >and in the DOS not be . The din the Seventh Son es are : The Seventh Son-350: Seventh Son-350 is a 350 Seventh Son.426: Seventh Son.426 is a 426 the Seventh Son . It vall . in the pof 426 at the end of the a. The >and in the DOS not be . The in the 5in all "ARBEIT MACHT FREI!" "The Unforgiven / Immortal Riot Sweden 01/10/93" : Sweden , 1994. Seventh Son-473: Seventh Son-473 is a 473 the Seventh Son . It vall . in the pof 473 at the end of the a. The >and in the DOS not be . The in the 5in all "Fight Fire Fire..." "Soon to fill our lungs the hot winds of death" "The gods are laughing, so take your last breath" "Immortal Riot..Death Greets me warm.." Seventh Son-Kernel: Seventh Son-Kernel, or Kernel, is a 610 on the Seventh Son at the top of $the X, decreasing by 8,448 ). It hooks |21. pof 610 to 624 at the end of the be no 3to the >and in the DOS . One in the 5in all "KERNEL" PZPAPN Shadow : Shadow Shadow, Shadow-2 G: May, R: 713 5: PNCK - n, NAV, The Shadow *, or Shadow, }in May, . Its . Shadow *is a generic , it Shadow X, it one in the E. If ,is in the E, it may 713 rby Shadow by 723 )if it r. In both cases, the at the end of the be no 3to the >and in the Shadow 9two "!seviL etybwodahS" The comes fthe reversed says "Shadow *Lives!". It is if Shadow of Shadow *are: Shadow-2: A smaller of the Shadow , Shadow-2 adds 635 `. The can be "!sevil etybwodahS*. "AWK" PZPAPN Shake : Shake Shake Dropper G: May, R: 476 5: PRCK - \, NAV, The Shake (in May, Daniel Kalchev. It is a generic . u, and The X, the Shake , altering the image of The Shake sthem as accessed. by 476 pcannot be seen using a DIR (list if the While the is not destructive, it occasionally the : "Shake well before use !" attempted to be run. L, the terminates rather Ys. A second attempt to run the same in it running successfully. of Shake are: Shake Dropper: A small . drops the Shake (, May, PZPAPN Shaker : Shaker Prague Joker i; "shaky" effect may be produced; Prague, Czechoslovakia R: 512 5: PRhCK - , NAV, The Shaker reported to ated in Prague, Czechoslovakia. Shaker is a uof . It is on the Back , and identify it as such. The the Shaker Shaker at the top of $the , as qby the DOS @by 528 {08 and 21 by Shaker in |12's moved. Shaker is , the wany . it is X. If X, it r. Shaker pof 512 ). The at the end of the be no 3to the >and in the DOS . One can be viewed in the "Shaker" Shaker may [a "shaky" effect effect, however, on all See: Back Blinker PZPAPN Shaman : Shaman G: March, R: 251 5: PNCK - 3.96+, 1.25+ The Shaman in March, . Its . Shaman is a uof . the Shaman wall of the . in the 251 at the "of the The >and in the DOS to the >and . The can be in the 5in all Shaman "*.com" "Demo v1.0 Copyright (c) 20.8. by Shaman" Shaman Nn't to do PZPAPN Shanghai : Shanghai G: May, =seconds = "62" China R: 848 5: PRhCK - , NAV 3.0+, 30.00+, n1.04+, .2.0+, 6.64+, 1.25+ The Shanghai in May, , and is fChina. Shanghai is a uof . bShanghai X, the Shanghai at the top of $the ', not moving |12's , as qby the DOS @by 2,048 mby Shanghai in , the Shanghai wthree . in the a DOS DIR issued. Shanghai Nnot the Shanghai pof 848 at the end of the a. The >and in the DOS to be un , but the seconds field !set to "62". The can be in the 5in all Shanghai "ShangHai Railway Institute" It is what Shanghai may do PZPAPN : Shhs R: 585 5: ONAK - n, NAV 3.0+, 8/93S+, 1.53S+, The Shhs . Shhs is a uof . and . ,. It corrupts the Shhs is X, the Shhs search the Efor three w. If were d, it wthem. If were d, the search the Efor three and wthem if were d. If all the . -and . in the Ewere r, the activate (see $). If the Nn't activate, the L, and the ed to the DOS prompt: too big to fit in in the , and is a fake the Shhs lthe b585 of the host the Shhs 5. Unless the was smaller be no 3to the in the DOS were smaller 585 rby Shhs. be no to the >and in the DOS all of the . -and . in the the Shhs , the activate the next X. At , the of the starting at 0. The "I'm sorry, Dave... but I'm afraid I can't do Dedicated to the dudes at SHHS The BOOT SECTOR u..." to access on the fDOS. Examination of the on the Norton Utilities in maintenance mode reveal the in the "Killed by: The " 9the of the activated f. For example, if the the activated, the thirteen periods be replaced by -...". The Shhs S, so the cannot be seen `. Since Shhs s the "of the cannot be dis r, but must Bd and replaced fnon- rcopies. has activated, the Kshould be reformatted. of Shhs are: Secret Service: on the Shhs , the Secret Service s the b600 the . v. It vthree . in the all of the . in the r, the next Zof the in the trashing the O. The in the too big to fit in "I'm sorry John McAfee (NOT!)..." "Secret Service has arrived..." "Dedicated to all makers!" "By: Agent #13/Nuke Member" "Killed by:" : Canada PZPAPN Shield : Shield G: March, i; hidden . `created; 3; TSR; R: 5,152 )(companion `), 127 5: PSRsA - Spawning , NAV, 8/93+, The Shield in March, . Its is a spawning or companion by creating corresponding . `. It adds 127 )to . `do not carry an active The Shield is X, the Shield as a low TSR of 5,456 the Shield , it create a hidden companion . aof 5,152 )for . It add 127 . The 127 to the end of . , and the >and in the DOS The Shield is creates an active in the companion, hidden . jmay PZPAPN Shifter : Shifter R: 6,672 5: PRtEX - /, NAV 3.0+, n1.05+, \2.13+, 1.53S+, `& Replace The Shifter . Its . Shifter is a of the ) and bShifter X, the Shifter wthe , the 9ing the x. The Nnot , and not start The next fthe K, the Shifter at the top of $the ', moving |12's , as qby the DOS @by 7,168 the Shifter , it pof 6,672 at the end of the a. The >and in the DOS not be . No in the Shifter It is what Shifter PZPAPN Shiny Happy : Shiny Happy =seconds = "48"; :-) 1to :-( North America R: 921 5: PRtAK - 30.00+, n1.04+, 6.64+, 1.25+ The Shiny Happy , and fNorth America. Shiny Happy is a of . -and . ,. It employs techniques to avoid detection. bShiny Happy X, the Shiny Happy at the top of $the ', moving |12's , as qby the DOS @by 1,024 03, and 09 mby Shiny Happy in the Shiny Happy , it and . pof 921 be hidden Shiny Happy is . The at the end of all `. The >and in the DOS , but the seconds field 1to "48". The can be in the 5in all Shiny Happy "Shiny Happy by Hellraiser and Dark Angel of Phalcon/Skism" the Shiny Happy , it character sequence ":-)" to ":-(" it is d on the PZPAPN Shirley : Shirley i; TSR Germany R: 4,099 - 4,112 5: PRsE - can, NAV 3.0+, 8/93+, The Shirley . It was }in Germany in . Shirley is a of . bShirley X, the Shirley as a low TSR of 4,160 mby Shirley in the Shirley , it pof 4,099 to 4,112 at the end of the a. The >and the DOS not be . The in the 5in all Shirley "IWANTSHIRLEY" "Marty McFly lives where in (Doc Brown)" "Fuck for Eddie!!" one place to spend nice holidays... "CASAL BORSETTI" "in Italy... "Fuck for John McAfee and all the Vrs-Killers..." "We la right to live "Greetings to the 1704... you were the "Greetings to -B...You were the Second!" "But now its my turn." "Hope You lfun the Shirley- The the "IWANTSHIRLEY" included in the 5in German. PZPAPN Shock Therapy : Shock Therapy R: 620 5: PRtAK - 3.96+, 30.00+, NAV 3.0+, The Shock Therapy . Its . Shock Therapy is a uof . -and . bShock Therapy X, the Shock Therapy at the top $the ', moving 12's , as by the DOS @by 2,048 mby Shock Therapy in the Shock Therapy , it and . pof 620 the at the end of the a. The and in the DOS not be . The in the Shock Therapy thus not "Your HD is TOAST! x to Shock Therapy!" "SHOCK THERAPY" "TIaMaT" It is what Shock Therapy See: PZPAPN Sicilian Mob : Sicilian Mob warm re Canada R: 1,024 5: PNCK - /, NAV, The Sicilian Mob . It is fCanada. is a uof . ,. It is on the the Sicilian Mob the look for an The Eis searched b, and path. If no path has !set, the search the Estructure. ahas , the the Sicilian Mob pof 1,024 ). The at the end of the a. The >and in the DOS Starting in , the Mthe "Sicilian Mob Ia - [NUKE]'91 - Rock MP" in all `, as are the "Copyright (C) by [NUKE] InterNat'nl Software Development" "Completed , Montreal, Canada" "--> [NUKE] H/A/P/V/T at its Best <--" the Sicilian Mob is a one in seven chance of the performing a warm See: Parasite VHP PZPAPN Signs : Signs Signs of Life i; TSR R: 720 5: PRsCK - 3.96+, NAV 3.0+, .2.0+ The Signs, or Signs of Life, Its . Signs is a uof . bSigns X, the Signs as a low TSR of 720 ). It hook |21. mapping utilities may show the TSR as pin the of the "config" area in the Signs , it pof 720 the end of the a. The >and in the DOS not be . The can be in the 5in all Signs "Signs Of Life." It is what Signs may do PZPAPN Silence : Silence R: 555 5: PRhCK - , NAV 3.0+, 1.53S+, .2.0+, The Silence . Silence is a uof . ,. Its The the Silence the Silence at the top $the '. It Nnot move |12's qby the DOS @by 1,568 mby Silence in the Silence , it X. If X, it rby the the Silence pof 555 at the "of the a. The >and in the DOS not be . The in the "The Silence Of The Lambs!" Silence Nn't to do See: Youth PZPAPN Silly : Silly 200, V200 G: May, R: 200 5: PNCK - , NAV, The Silly Vin May, . It is a uof . Silly is X, the search the OC:, and wall . pof 200 the at the "of the a. The >and in the not be The Silly Nnot do See: Amstrad Hell Pixel Silly-365 PZPAPN Silly : Silly formatted R: 2,268 - 2,313 5: PNAK - 30.00+, 2.11+, \2.13+, The Silly . Its . Silly y is a uof . ,. It trojanizes . the Silly X, it wor trojanize up to two on the C: O. The blook for the in the C: Oroot E, and move downward as necessarily in the structure. of 2,268 to 2,313 at the "of the a. Trojanized . p. The >and in the DOS not be Ys an . !trojanized by the Silly , the be cleared, and an animated face in the upper left hand corner of the , accompanied by the "Hello, I'm Silly Now I'm formating Your HARDDISK! 's fine! - Isn't it (har,har)..." The C: be accessed, Kis not formatted by the a short period of , the cleared and the "ERROR: No SYSTEM Insert SYSTEM OA: and push any key!" The attempt to format the A: PZPAPN Silly-365 : Silly-365 Pixel, Pixel 877 G: May, i; slow to very slow loads; R: 877+ 5: PNCK - , NAV, 8/93S+, The Silly-365 Vin May, . It is a very buggy of the Silly . Like Silly, it is a non- uof . ,. It is #listed separately as its behavior and tare considerably different. Silly-365 is X, the search the E, and wall . d. If the . in the Ewere rby Silly-365, be re Silly-365 >and in the to the >and tand re The bugs in Silly-365 lto do the re ts of tof a by Silly-365, the by 877 ). On the t, the by an 877 ). The second re in a pof 1,754 ). The third re tadds 3,508 The pattern is starting the second re t, the pis equal to two s the previous Needless to say, even starting a very small 42 , by the eighth t, the is too large to be The problem Silly-365 is it is very noticeable. As the tproceeds, the takes longer and longer to Yany . . By the seventh re ton the one of my test , the was literally working on re two . for 20 minutes. The Silly-365 was intended to Mthe an 8th generation U fucking defoult Please by me a new , in actual 8th generation ts, is not as the 8th generation ais too large to be as a . Silly-365 fits base is 365 . The Silly Nnot do of Silly-365 are: Silly-740: to Silly-365, is actually 370 . Like Silly-365, it re multiple s, so multiple of 370 or 740 See: Amstrad Hell Pixel Silly PZPAPN Silver Dollar : Silver Dollar ; long Kaccesses; do not R: 2,071 5: ONAK - , NAV 3.0+, The Silver Dollar . Its a mention is made in the of Boulder, Colorado in the . Silver Dollar is a vboth . -and . the Silver Dollar search the Efor up to four w. If the (s) are d, the wthem, b2,071 )of the host . The >and in the DOS not be . The can be in all Silver Dollar "Copyright(C) by CU, Boulder Colorado." too big to fit in "Person/People/Things we >>hate<<:" "Person/People we admire:" "Person/People/Things we think are cool: Irving Berlin's Music." rby the Silver Dollar may notice too big to fit in . Long Kaccesses of Silver Dollar are: Silver Dollar-2A: , Silver Dollar-2A is a 1,644 of the Silver Dollar . It vfour . Wor . in the b1,644 )of the host . The >and in the DOS not be . The in the 5in all "Allocating . Please wait accessing , please turn off all RAM" and press >>Enter<< to continue too big to fit in "Copyright(C) by Fairview High School, Boulder Colorado, 80303. Macintrashes Suck!" "Victoria McMath. XX" "Linda" "Darnell." ".. *. The bfour Las a Xand all of the . in the lalready rby the Silver Dollar-2B: , Silver Dollar-2B is a 1,874 of the Silver Dollar . It vfour . Wor . in the b1,874 )of the host . The >and in the DOS not be . The in the 5in all "Allocating . Please wait accessing , please turn off all RAM" and press >>Enter<< to continue too big to fit in "Copyright(C) by Fairview High School, Boulder Colorado, 80303. Macintrashes Suck!" "Person/People/Things we >>hate<<: Paul Harvey's sucks MacinTrashes Suck ! BASIC Suck "Windows sort of suck. Person/People we admire:" "Victoria McMath(Ginger Rogers)," "Linda Darnell. Person/People/Things we think are cool:" "The author of Star Trek, Poker Faces, C++, LISP. XX" ".. *. The bfour Las a Xand all of the . in the lalready rby the Silver Dollar-2D: , Silver Dollar-2D is a 2,218 of the Silver Dollar . It vfour . Wor . in the b2,218 )of the host . The >and in the DOS not be . The in the 5in all "Allocating . Please wait accessing , please turn off all RAM" and press >>Enter<< to continue too big to fit in "Copyright(C) by Fairview High School, Boulder Colorado, 80303. Macintrashes Suck!" "Person/People/Things we >>hate<<: Paul Harvey's sucks MacinTrashes Suck ! Graham (Not Alexander but ass kids whjo calls himself graham) sucks!" "Person/People we admire:Lynn Bari, Jean Arthur, Jane Russell" "Person/People/Things we think are cool: Cybernetics, C++, 39 Steps, The Mafia, maybe "Monty Python"" ".. *. The bfour Las a Xand all of the . in the lalready rby the Silver Dollar-2F: , Silver Dollar-2F is a 736 of the Silver Dollar . It vfour . Wor . in the b736 )of the host . The >and in the DOS not be . The in the 5in all ".. *. The too big to fit in s be Silver Dollar-8101: fa United States source, Silver Dollar-8101 is a 8,101 of the Silver Dollar . It one . -or . in the the b8,101 )of the host . The >and in the DOS . The the 5in all "Copyright(C) by CU, Boulder Colorado." "Person/People/Things we >>hate<<:" "Person/People we admire:A Midgit, or maybe two :-)." "The Luna - moon. Ivy, Irene, Iris" "Person/People/Things we think are cool or find phus:" "Strip Poker," "Gambling." "PLO" "The Silver Dollar Strikes Again" is dedicated to a nice person AMY" "Everyone say Hi Amy!" Silver Dollar-SHJH: , Silver Dollar-SHJH is a 1,547 of the Silver Dollar . It vfour . Wor . in the b1,547 )of the host . The >and in the DOS not be . The in the 5in all "Allocating . Please wait accessing , please turn off all RAM" and press >>Enter<< to continue too big to fit in "Copyright(C) by Souther Hills Jr. High, 1500 Knox Dr., Boulder Colorado, 80303. Macintrashes Suck!" "Victoria McMath. XX" "Linda" "Darnell." The bfour Las a Xand all of the . in the lalready rby the the fourth Las a See: Leprosy PZPAPN Simple : Simple R: 424 5: PNCK - 3.96+, NAV 3.0+, 1.25+ The Simple , and is fthe . Simple is a uof . the Simple X, the Simple wall of the . in the E, as well as the copy of in the Oroot pof 424 at the of the a. The >and in the DOS to the >and . The can be in the Simple 5in all "SIMPLE "C:\V.0 *. "C:\ Simple Nn't to do PZPAPN Simple Minds : Simple Minds do not R: 207 5: ONCK - NAV 3.0+, The Simple Minds . Simple Minds is a the Simple Minds the Simple Minds wall of the . in the it has completed sall of the . `, it Mthe the to the DOS prompt: "A vir 4 da simple minded people of the earth Since ya didn't notice dis vir.. YAR LAME the Simple Minds lthe 207 )of the host by the Simple Minds 5. Since the b207 )of the host are not saved by the , host are permanently corrupted. The punless the smaller ), in case 207 . The >and in the DOS to the and %the , the in the 5in Simple Minds Simple Minds fail to copy of PZPAPN Simulati : Simulati hang; R: 1,257 - 1,313 5: PNC - , NAV, The Simulati . Its . Simulati is a . It Nnot Simulati is X, the search the Efor an . If one is d, the wit. by 1,257 to 1,313 at the end of the a. The in the to the >and On a random basis, the Simulati hang the . The be one of the three: "ALIVE... Your rby the SIMULATION la nice day!" "FRODO LIVES!" "HA HA HA YOU HAVE A VIRUS" L, are centered vertically and horizontally on the PZPAPN Sinep : Sinep G: March, R: 644 5: PRhCK - 3.96+, V112+ V113+, 1.25+ The Sinep in March, . Its . Sinep is a uof . bSinep X, the Sinep at the top of $the ', hooking |22. |12's not be moved. qby the DOS @by 672 the Sinep , it pof 644 the end of the a. The >and in the DOS to the and . No the 5in Sinep jmay PZPAPN Siskin : Siskin Sistkin-948 R: 948 - 956 5: PRhAK - , NAV 3.0+, The Siskin, or Siskin-948, along of the es are fthe Siskin is a uof . -and . ,. On XT class machines, the es in destroy or corrupt the The the Siskin the Siskin at the top of $the '. It Nnot move |12's qby the DOS @by 960 {1C and 21 mby Siskin in the Siskin , it usually pof 948 by up to 956 ). The at the end of the a. The >and in the DOS not be Frequent jmay be [d on especially © of of Siskin are: Siskin-1017: An earlier of the Siskin is 1,024 It adds 1,017 to 1,025 )to the . -and . >and to the >and Siskin-Goodbye: An member of group of es, Siskin- Goodbye's is 848 ). It adds 839 to 847 )to the . -and . >s the >and are PZPAPN Sistor : Sistor Sistor-2225, Plaice j; bouncing small diamond Sweden R: 2,225 5: PRtAK - , NAV, 1.53S+, .2.0+ The Sistor, or Sistor-2225, location. It is believed to ated in Sweden. is a uof . -and . The the Sistor at the top of $the |12's be moved. , as by the DOS @by 4,096 {1C and 21 mby the Sistor At the of becoming , the Sistor check to see if the copy of ,the r. If it is not r, the Sistor the Sistor , it pof 2,225 at the end of the be no 3to the >and in the DOS . The can be dnear the end of all "Sistor" the Sistor or .BAT , the be left spinning. The notice a "bouncing ball" on the s to actually be a very small diamond character. of Sistor are: Sistor-1129: A 1,129 of the Sistor is an earlier of the Sistor-J4J listed $. It pof 1,129 the end of the a. The in the DOS not be , and the pis not hidden. The 8one is the tmarker at the very end of "J4J" : Sweden May, Sistor-2380: A 2,380 of the Sistor the exception p, and jdo not typically Sistor-2630: A 2,630 of the Sistor the exception p, and jdo not typically by 2,630 t. Sistor-2630 cannot distinguish r, so it , adding an 2,630 are no in the Sistor-J4J: A 1,273 of the Sistor by 1,273 be hidden if Sistor-J4J is . The at the end of . The in the DOS not be Sistor-J4J notice the DOS , and to be smaller actually are qas having T). The can be in the 5in Sistor-J4J "Elo , Elo , lam sabakt "Charlie says: Support ()DEMORALIZED YOUTH()" "J4J" : Sweden Sistor-J4J Alpha: , Sistor-J4J Alpha s to be an earlier of the Sistor-J4J . Its is 4,096 ), hooking |21. It were ron open usually not function Sistor-J4J Alpha pof 833 at the end of the a. The >and in the DOS to the >and . The can be in the 5in all Sistor-J4J Alpha "Jump 4 Joy, alpha-release. Not to be distributed!" "J4J" : Sweden See: PCBB PZPAPN Skater : Skater Skater-1021, Tonya i; TSR; Australia R: 1,021 5: PRsCK - 30.00+, NAV 3.0+, 1.25+ The Skater, Skater-1021, or Tonya, Australia in . Skater is a of . bSkater X, the Skater as a low TSR of 2,416 ). It hook {10 and 21. mapping utilities may indicate the as an pin the of the in copy of the 6inter- pretor, showing a pof up to 2,500 , the Skater pof 1,021 at the end of the a. The in the DOS not be . The in the Skater "I love Tonya king. The best womens Figure Skater in history." "Now Tonya, Do triple axle and kick Kristi Yamaguchi's arse" "- Australian Parasite -" The btwo may be Lby the ever a to set the video mode mode, 80 by 25. of Skater are: Skater-977: A smaller of the at the top of $the ', hooking {10 and 21. , as qby the DOS @by 2,016 , Skater-977 pof 977 at the end of the a. Skater-977 in the same manner as the , and the same : Australia PZPAPN Skew-469 : Skew-469 Skew R: 469 - 485 5: PRxE - 3.96+, NAV 3.0+, 1.25+ The Skew-469, or Skew, , and fthe . Skew-469 is a of . . It is a fast u, quickly spreading on bSkew-469 in a "hole" in al low , hooking {1C and 21. , as qby the DOS not be the Skew-469 , it for any reason. pof 469 to 485 the at the end of the a. The and in the DOS the >and . No in the It is if Skew-469 PZPAPN Skism : Skism R: 1,992 5: ONE - P, NAV 3.0+, The Skism }in the is a Skism look for an win the second fthe O's root E. If an is not d, the continue reading down through the Estructure looking for , Skism wit, b1,992 )of the host be no 3to the unless it was smaller 1,992 ), in case it 1,992 . The >and not be Skism has completed a, it the to the DOS prompt. The not function. Skism 8the in the "The man who brought you" "622, Skism One, Captain" "Trips, and Sub-Zero now" "shanks you again, "his latest..." "Skism "Get a late pass!" "* *. It is if Skism corrupting the of Skism Angel Dust 1.0: on the Skism one . ain the if more two sub Fories are present on the lthe b700 . The 8the not "* *. W*.* \" "ANGEL DUST V1.0" jmay Skism gequivalent to the 's encryption has !slightly modified. Skism-808: on the Skism one . ain the if more two sub Fories are present on the lthe b808 . The 8the not "Skism Rythem Stack -808." "Smart Kids Into Sick Methods" "Dont alter 5into your own strain, faggit." "HR/SSS NYCity, is the fifth of many, many more "You sissys "* *. W*.*" On the last Friday of any month, the attempt to destroy all `in the May, PZPAPN Skull : Skull Necro :; graphic R: 666 5: PNCK - The Skull, or Necro, , and is fthe State of Pennsylvania in the . Skull is a uof . ,. It "drop" a second , the Skull $under . Since the Skull s, it is listed as a rather as part of the base Skull the Skull X, the Skull wone . in the If it cannot find a . w, it instead "drop" the Skull an . the Skull pof 666 at the end of the a. The >and in the DOS not be . The in the Skull "PATH=" The Skull Nn't do and drop the Skull $. The Skull it is of Skull are: Skull W: Skull Wis the is dropped by the Skull rby the Skull X, the Skull wone . in the b466 the host . The Skull Ma graphic "skull" on the "You cant Its already dead!" in the 5. The is un in the Skull : Pennsylvania, USA PZPAPN Skynet : Skynet , 1994 output slowed; China R: 1,448 - 1,462 5: PRhE - \2.13+, V116+, V116+ The Skynet fChina in , 1994. It is a uof . disrupts operation. bSkynet X, the Skynet at the top of $the ', not moving |12's , as qby the DOS @by 1,664 mby the the Skynet , it pof 1,448 to 1,462 at the end of the a. The >and in the DOS not be . The $can be in the 5in all the Skynet , the d" out to the "Terminator Don't be afraid. I am a very kind You ldo many works today. let your computer slow down. la nice day, Goodbye. Press a key to continue. . ." a key is pressed, it Mthe at the top of the , followed by the output Lin single lines: "*** Terminator I *** Created by Sky Net in Chung-Li." Lat the end of the output, as well as at the end of all output X. In cases, it in the loss of of the output data fthe %the Skynet noticeably slow output, and unexpected jmay PZPAPN Slayer : Slayer Brain Slayer, Slayer, Yankee Doodle Dropper, VBasic 2 G: March, i; long Kaccesses; Kaccesses to unexpected R: 5,120 5: PNA - \, NAV, The Slayer es was Gin March, group of ;ly consists of five were fdifferent locations at the same . All of the of . -and . do not $is a generic description of the es in Specifics for are listed under " " at the end of entry. In cases, the difference between the is a few a Slayer X, it wall . -and . in the the ly, depending on the , it may Os as well. a Slayer between 5,120 and 5,135 at the end of the a. The >and in the not be of Slayer es include long Kaccesses , and possibly accesses to unexpected Os. The order of the bin the At least one member of ], Slayer-E or Yankee Doodle Dropper, carries the Yankee Doodle later release on Yankee Doodle is the TP45VIR Members of the Slayer ]are: Slayer-A: Slayer-A wup to nine in a the root E, on the addition to on the Slayer-B: to Slayer-A, in the C: Oroot Ein addition to those on the Oand Slayer-C: to Slayer-A and Slayer-B, Slayer-C all on the Oand all on the C: O. The can be din samples of Slayer-C: "KEYB*. -KEYB*. WBASRUN BRUN COBRUN NET$OS *. "IBMBIO. "IBMDOS. ,*.* .. \ .. *. "Access denied." Slayer-D: Slayer-D is to Slayer-C, the major difference while it accesses the C: X, it on the C: Ounless the fC:. The Slayer-C Slayer-E: Slayer-E is as the Yankee Doodle Dropper. X, it the on the Oand E, and wa few on the C: period has elapsed since the release the Yankee Doodle onto the ing in an active Yankee Doodle If the successfully removes Yankee Doodle, but Nn't remove the Slayer-E t, Yankee Doodle promptly re wthe fthe Slayer-E remain. be in the public domain. PZPAPN Sleepwalker : Sleepwalker 1to 10:47a Australia R: 1,268 - 1,282 5: PRhCK - 30.00+, 1.25+ The Sleepwalker , and is Australia. Sleepwalker is a bSleepwalker at the top of $the ', hooking {1C and 21. , as qby the DOS @by 1,552 |12's !moved. the Sleepwalker , it pof 1,268 to 1,282 at the end of the a. The >in the DOS not be but the to "10:47a". The in the Slime "STAC" "Sleepwalker. (c) OPTUS It is what Sleepwalker PZPAPN Slime : Slime ARCV-773 G: March, ; DOS England R: 773 5: PRhCK - 3.96+, The Slime, or ARCV-773, in March, , and is fEngland. Slime is a semi- bSlime X, the Slime at the top of $the ', hooking |21. and , as qby the DOS @by 2,048 |12's !moved. the Slime , it for any reason. of 773 be hidden the is in . The Slime at the end . The >and in the DOS not be . The are in the Slime "[Slime] By Apache Warrior, ARCV Pres." "Sliming around your PC, I go make a sticky MESS over your ly, the can be at the end of all "4Qu2u" the Slime , the DOS detect Ton all PZPAPN Slovak : Slovak Slovak 2.00, Slovakia G: May, Czechoslovakia R: 1,673 - 1,771 5: PNE - 30.00+, NAV 3.0+, 1.25+ The Slovak, Slovak 2.00 or Slovakia, Czechoslovakia in May, . During May, of four different es were }in the Slovak ]. Slovak 2.00 entry, initial listed $under . All of the es in group are polymorphic the Slovak 2.00 X, the may wone . in the Nnot always `. The always wan . Ewhere the Xis not the E, and is on the path. At , the wone . in the the Slovak 2.00 pof 1,673 to 1,771 at the end of the a. As all of the Slovak es, the Slovak 2.00 S, and no in the . The >and in the DOS not be a Slovak 2.00 X, the requiring the in the word "SLOVAK": "SLOVAKIA 2.00 (c) by ??. All Rights Reserved. Greetings fBratislava, SLOVAKIA. the word SLOVAKIA:" If the starts to a word SLOVAKIA, the Mthe cleared the presses escape as requested: the word SLOVAKIA, not CZECH, YUGOSLAVIA, or SLOVENIA!! Press Esc." s the word SLOVAKIA, the One in the "PATH=*. Slovak 2.00 Nn't to do Mits requiring a response. of Slovak are: Slovak 1.00: An earlier of Slovak, `instead of . , adding 1,352 to 1,603 )to the end of the v. The Lis much simplier, still requiring the word SLOVAKIA: "Greeting fBratislava, SLOVAKIA. the word SLOVAKIA:" : Czechoslovakia May, Slovak 2.02: A later of Slovak 2.00, , adding 1,969 to 2,091 )to the v. The Lby the to Slovak 2.00, the exception the number be 2.02. : Czechoslovakia May, Slovak 3.00: A later of Slovak 2.02, pof 2,051 to 2,177 at the end of the a. The to Slovak 2.02, the exception number is now 3.00. : Czechoslovakia May, Slovak-4: An earlier of Slovak, is very to the Slovak 1.00 Nnot Many pof 1,363 to 1,587 at the end of the a. It is slighly polymorphic. : Czechoslovakia Slovak-4B: A later of the Slovak-4 , Slovak-4B vone . of 2,586 to 2,810 at the end of the a. The >and in the DOS not be . The s be L, requiring the the word "Slovakia": "SLOVAKIA 4.00 (c) by ??" "ALL Rights Reserved." "Greetings fBratislava, SLOVAKIA." the word SLOVAKIA: Typing the word Slovakia in the ed to the DOS prompt. : Czechoslovakia May, PZPAPN : Slow Slowdown, Zero G: May, Australia R: 1,701 5: PRsA - , NAV 3.0+, : CleanUp, NAV, or The Slow Gin Australia in May . It is a generic W, and overlay ,is not The Xon a , the as a low TSR, taking up 1,984 mby the Later, as rby the Slow . While the Slow 5is actually 1,701 pby more amount. by 1,721 at the "of the by 1,716 to 1,728 at the end of the In the process of `, the may hang the , causing the lto re The Slow on the It is what else the Slow of Slow are: Slow II: A minor of the Slow adds 1,721 )to the . v, and 1,716 to 1,730 )to . . The at the "of . the end of . usually not function ing in frequent Slow III: on the Slow II , Slow III is very no longer hang the March, Slow IV: on the Slow III , Slow IV is very : Australia March, See: PZPAPN Sluknov : Sluknov R: 867 - 875 5: PRhCK - 2.11+, \2.13+ The Sluknov . Its . Sluknov is a of . bSluknov X, the Sluknov at the top of $the ', not moving |12's , as qby the DOS @by 1,728 mby the , the Sluknov pof 867 to 875 at the end of the a. The >and in the DOS not be . No in the It is what Sluknov PZPAPN Small ARCV : Small ARCV England R: 236 5: PNCK - \, NAV 3.0+, .2.0+ The Small ARCV fEngland in Small ARCV is a uof . ,. It Nn't to do the Small ARCV wone . in the pof 236 the at the end of the a. The and not be . The can be in the 5in all Small ARCV "[SmallARCV] Apache Warrior. *.com" PZPAPN Small : Small England R: 349 5: PNE - NAV 3.0+, 8/93+, .2.0+, 1.25+ The Small fEngland in Small Wis a uof . Nn't to do the Small wone . in the pof 349 the at the end of the a. The and not be . The can be in the 5in all Small "*.exe [Small W] Apache Warrior." PZPAPN Small-38 : Small-38 and data fail to Canada R: 38 5: ONAK - & Data The Small-38 fWallace Hale of Canada. Source fMr. Hale was , and indicates he wrote it in response to the Mini-45 in May, is not believed to be in the public domain, and is considered a research . It is a and data Small-38 is X, the wall in the E. The not care if the ais an execu or a data a. It wany ait encounters. the punless the less ), in case the ). The >and in the DOS to the >and Small-38 has finished sall the `in the E, the be hung in a search loop on the E. The need to be re &ed to get out of the loop. and data Small-38 are permanently damaged, having had the should be replaced a clean backup copy. PZPAPN Small-115 : Small-115 Zfailure R: 115 5: PNCK - n1.04+, 3.96+, NAV 3.0+, y1.53S+, .2.0+ The Small-115 , its . Small-115 is a uof . the Small-115 wall of the . in the E. The ed to the DOS prompt. the Small-115 pof 115 at the end of the a. The >and in the DOS to the >and . One in the in all Small-115 "*.com" Small-115 Nn't do PZPAPN Small-145 : Small-145 R: 145 5: PRxCK - , NAV 3.0+, 1.53S+, The Small-145 , its . Small-145 is a uof . bSmall-145 in a "hole" in low al , hooking |21. , as qby the DOS not be the Small-145 , it pof 145 at the "of the a. The >and in the DOS to the >and in the 5in Small-145 Small-145 Nn't do PZPAPN Small-178 : Small-178 R: 178 5: PRxCK - 3.96+, NAV 3.0+, The Small-178 , and is . Small-178 is a uof . bSmall-178 in a "hole" in low al , hooking |21. , as qby the DOS not be the Small-178 , it pof 178 at the end of the a. The in the DOS to the >and . No in the 5in Small-178 Small-178 Nn't do PZPAPN Smaug : Smaug R: 349 5: PNC - n1.04+, 6.64+, NAV 3.0A06+, .2.0+, 1.25+, 6.64+, 1.0A06+ The Smaug . Its . Smaug is a uof . , but not the Smaug wone . in the pof 349 the at the end of the a. The and in the DOS not be . The in the 5in all Smaug -MAND.*. "I$ W PZPAPN Smiley : Smiley Smiley face ASCII character bouncing around R: 1,987 - 1,994 5: PRfCK - , NAV 3.0+, n1.05+, 8/93+, The Smiley . Its . Smiley is a , but its tmechanism is u. The portion is used for the effect. the Smiley X, the Smiley wone . ain the Nnot X. For example, if it encounters a very small . ain the Eas it searchs for an a, it typically not the Smiley pof 1,987 to 1,994 ). The the end of the a. The >and the DOS The can be in the Smiley "\*. W*.* \*. "yANKEE Doodle#and VACsin." "The red planet("InvasiOn" ,in the Oroot the Smiley za portion of the next &s the , the Smiley |1C. a short period of has elasped, the Smiley produce effect of an ASCII smiley face character bounces around the It is if Smiley carries any damage potential. PZPAPN Socha : Socha R: 753 5: PRhCK - , NAV, The Socha . Its , or ~, are . Socha is a ,. It should be noted Socha >has the year is 1981. The Socha is X, the Socha at the top of $the , as qby the DOS @by 3,008 mby the if the year of the >is 1981. Socha is , it are if the >'s year is 1981. In years, the in its ;form Socha 753 >and in the DOS to the >and . The Socha at the end of . The can be dnear the end of Socha "Socha" "C:\m_edit\me$.ovl com Socha Nnot to do PZPAPN Solano 2000 : Solano 2000 Dyslexia 2.01, Solano G: March, i; TSR; unusual California, R: 2,000 5: PRsC - , NAV, The Solano 2000 }in Solano County, California in mid-March by Edward Winters. The by the Dyslexia V2.01, can be produced by negating null terminated in the 5. Using the same technique, what s to be the creation >of the , 08FEB90, can be produced. The xregarding the xproduced by negation of )was determined by Jay Parangalan of Solano County. The Solano 2000 is a generic u. The Xon the , the proceeds to wevery . can be manually identified by using a editor to view the )1168 through 1952 consist of '(' or 28h , such as DISKCOPY. is included on all DOS not run instead an "invalid Ospecification" is not in the 5, but is due to an Ucondition #induced due to the 's presence. The -induced ring KCopy was how the bspotted and eventually Solano is , it take up 3K of RAM The Solano 2000 Nno apparent damage, however it Ncheck the video buffer occasionally, and may transpose numbers din certain locations. effect, however, was not [d on the author's in researching !reports instead of transposing numeric 4, the Solano 3color attributes on the it is active in of Solano 2000 are: Dyslexia 2.00: same as Solano 2000, except the 28h are now binary zeros. The attempted transposing of numeric 4in video slowed down. The creation s to be 22JAN90 instead of 08FEB90. Solano 2000-B: same as Solano 2000, except the 28h 1to DAh 4, and are )1168 through 1912 in Solano D: to the Solano, has had its encryption slightly in order to avoid detection. The 28h to 00h Subliminal 1.10: A very early of the Solano 2000 vany . 1,496 , the monitor to flicker. What is ring is to flash the "LOVE, REMEMBER?" in the lower left portion of the Mfor a subliminal duration. The actual amount of Ms on the varies due to CPU speed differences. PZPAPN thing thing thing-658 i; SOME. acreated; R: 658 5: PRhCK - , NAV, The thing Its , and ~, are thing is a uof . The thing X, the thing at the top of $the , as qby the DOS @by 672 |12's !moved. mby the thing . At be created in the d SOME. (the extension be blank). of zero thing , it pof 658 at the "of the a. The in the thing v1.1" It is if the thing PZPAPN Sonik Youth : Sonik Youth R: 854 - 866 5: PNE - 30.00+, 2.58+, \2.13+, 2.58+ The Sonik Youth . Its . Sonik Youth is a uof . the Sonik Youth wone . in the pof 854 to 866 ). 160 to the "of the the remainder of the #at the end of the a. The >and in the DOS , but not to the >and . The in the 5in all Sonik Youth "My m used to say" "You're the boy can enjoy invisibility" "The pleasure is everlasting" "Sonik Youth released 29 The in the W\* \" lhad the Sonik Youth present for may [the deleting . fthe PZPAPN Sorlec : Sorlec Sorlec 3 R: 597 5: PRhAK - , NAV 3.0+, 1.25+ The Sorlec, or Sorlec 3, . Its . Sorlec is a uof . -and . the Sorlec X, the Sorlec at the top of $the mby the the Sorlec , it pof 597 the at the end of the a. The and in the DOS not be . The can be in the 5in all Sorlec "CLtV" "Sorlec 3 - Detonaton!" jfrequently the Sorlec of Sorlec are: Sorlec 4: , Sorlec 4 is a later of the Sorlec is 10,240 ), hooking |21. It X, adding 553 )to the . The >and in the DOS not be . The in the "MSDOS.SYS" "Sorlec 4" Sorlec 5: , Sorlec 5 is a non- of the Sorlec . It vall of the . `in the pof 535 at the end of the a. The >and the DOS not be . The in the "Sorlec 5 *. Sorlec 6: , Sorlec 6 is a of the Sorlec . It vall of the . and . `in the pof 565 at the end of the a. The >and the DOS not be . The in the "..1... ... 1 *. usually not function ing in a hang. PZPAPN Sorry : Sorry V1.3, Perfume-2 R: 731 5: PRhCK - \, NAV, : NAV, or The Sorry . Its comes German phrase in the : "Tut mir Leid !". on the Perfume fWest Germany, and identify it as Perfume or 4711. The the Sorry the in high both Aby 1,024 mby the immediately rby the , thus insuring on later immediately. , it wany . X, increasing the by 731 ). The at the end of The Sorry 8the "G-VIRUS V1.3" "Bitte gebe den G- 5ein" "Tut mir Leid !" It is what the Sorry See: Perfume PZPAPN Soupy 00a Q 0PTa : Soupy i; TSR; R: 1,072 5: PRC - 3.96+, NAV 3.0+, n1.04+, 6.64+, 1.25+ The Soupy , and is . Soupy is a of . , but not ,. In the case of advanced ts, it may za portion of order to facilitate the mechanism in the the Soupy X, the Soupy wone . in the E, as well as up >a counter in the the Soupy pof 1,072 at the end of the a. The >and in the DOS not be The Soupy the counter in the has r Qed 11, indicating the 11th generation of the Qed. At , the za portion of of 736 ), hooking |08. portion of the zed, it Mthe one at a every three minutes: "Unsuspecting , 12 o'clock!" "Get ready... 'cause... THERE'S A VIRUS IN YOUR SOUP!" fthe guys brought you Lythyum, Radyum, and VioLite comes:" "The Soupy , (k) VG Enterprises, 216/513/602/904/703" "By The Attitude Adjuster & AccuPunk!" "Hurry! Hire an Anti- Professional! pWallet Space!" "...hmmm, ya' know, I think I''ll halt now..." the last L, the halted or hung. The in the Soupy 5, as are the "[Soupy] The Attitude Adjuster & AccuPunk, VG 08/23/92 to 12/02/92" "Bad of Soupy are: Soupy-Death: on the Soupy adds 1,001 )to the . Like Soupy, it zs a 720 *portion of its an 11th generation thas X. In the case of Soupy-Death, the hooks |9. , Soupy-Death waits for the to press CTRL-ALT-DEL, and clear the in color. The in the Soupy-Death "Your PC has lapsed into a higher state of #..." "D E A T H!!" "Please, feel eto cold "as nothing has !damaged," "it was a near death" "Your PC should meditate more often," "cuz all the evil "flowing around neurospace" "we wouldn't want "to a real" "D E A T H" "[Death] The Attitude Adjuster, VG, 12/02/92" "Bad PZPAPN : Sov Leningrad, Sov-545, Sov-602 R: See 5: PNCK - \, NAV, The Sov is actually two . Both es are us of . ,. Since characteristics are Cjointly as Sov, differences noted under a Sov X, the Sov one . in the E. If E, it may r. Sov depends on of the es is present (see $). The at the end of the be no 3to the >and in the DOS It is if the Sov es do es are: Sov-545: One of the two Sov adds 545 to 599 )to the v. The din the "PATH=" could be a crash, crash, crash" Sov-602: One of the two Sov adds 602 to 616 )to the v. The din the "PATH=" See: Leningrad II PZPAPN Spanish : Spanish i; TSR; slow loads; cascading letters graphic effect Spain R: 2,930 5: PRsAK - , NAV, The Spanish Gin Spain in . Spanish is a generic is very to the Traceback II The Spanish is X, Spanish as a low TSR of 7,632 {1C, 20, 21, and 27 mby the X, the wthe Y, along in the E. Spanish by 2,930 ). The at the end of the be no in the >and in the DOS A symptom of a Spanish loads longer . The slowdown is due to the searching the Efor a candi Spanish is for one hour, it cascading effect to the Traceback II . The 4on the fall to the bottom of the , until encounter an character. Unlike Traceback II, the is not restored by the , and the end up #hung. See: Traceback II PZPAPN Spanish Fools : Spanish Fools ?28th i; TSR; j; copy, B, and 6s may fail Spain R: 1,417 5: PRsE - \, NAV, n1.04+, 8/93+, 1.25+ The Spanish Fools, or ?28th, , in the Zaragoza area of Spain. It is reported to be widespread in area. Spanish Fools is a uof . bSpanish Fools X, the as a low TSR of 1,808 {21 and 28 mby the Spanish Fools has for several minutes, it start by 1,417 to 1,431 ). The at the end of be no 3in the in the Spanish Fools if it the ?28th of any year. Upon sporatically interfer DOS internal 6s, such as COPY, RENAME, and DELETE. 6s may not function involve . , either not executing the 6, or hanging the PZPAPN Spanz : Spanz =may dis R: 639 5: PNCK - NAV 3.0+, 8/93+, The Spanz . It ated in V. Spanz is a uof . Spanz is X, Spanz search the Eto locate the , it by 639 ), the at the end of the a. If the in the Ewas 12:00a, it now blank a DIR 6is issued. can be identified by the s near the end of all "INFECTED! * SPANZ *" Spanz Nnot do PZPAPN Sparse : Sparse Sparse-B TSR; . i; gradual R: 3,840 5: PRsCK - , NAV, The Sparse . Sparse is a uof . The Sparse is X, the as a low TSR of 3,872 {21, D1 and D3 the Sparse is , it by 3,840 at the "of the a. The >and in the to the >and Sparse lthe ASCII 4"UK" as the second and third )of the execu 9the SHELLC, and 9the of the ed in the becoming . (If the "sparse.com", "sparse.com" din all later as long as the Sparse slowly lless and less . The loss of Zof an in an 64K block of . If the Ys 10 , in effect be no of Sparse are: Sparse-B: gequivalent to the Sparse differ. PZPAPN Spring : Spring Spring-640 R: 640 - 655 5: PRhAK - 30.00+, 1.25+ The Spring, or Spring-640, . Its . Spring is a uof . -and . bSpring-640 at the top of ', not moving |12's and , as qby the DOS @by 768 Spring in the Spring , it pof 640 to 655 at the end of the a. The >and in the DOS not be . The in the in all Spring "699F" It is what Spring of Spring are: Spring-768: , Spring-768 s to be a later of the Spring . Its , and usage, is the same as for the . Spring-768 -and . for any reason. by 768 - 783 the end of the a. The >and in the DOS not be . The in the in all Spring-768 "Spring" PZPAPN Spyer : Spyer Faust, Spyer-B, Spyer-C TSR; . Taiwan R: 1,181 5: PRsA - , NAV, The Spyer in Taiwan. is a uof . -and . `. It Nnot The the Spyer the Spyer as a 1,760 low TSR. {21 and 22 mby the , the attempt to the next X. If the is already the Spyer , the hung. If the was not already r, Spyer wit and hang the always by 1,181 Spyer between 1,181 and 1,195 ). In both cases, the at the end of the always lthe chex character sequence at the end of a: "CBDFD9DE848484". The Spyer , in its present form, is not expected to ever be a serious problem. Since it always jthe the next becoming , it is simply too obvious thing is wrong. of Spyer are: Spyer-B: to the Spyer, fthe NCSA collection . Its source is . Spyer-B is to Spyer, the exception hooks |21. hang the X, but usually not. the same hex character sequence at the end of the detect Spyer miss Spyer-C: Very to the Spyer, noteable differences. It was the NCSA collection and its or source is PZPAPN Squawk : Squawk G: March, R: 852 5: PRtAK - n, NAV 3.0+, The Squawk in March, . Its . Squawk is a uof . -and . bSquawk X, the Squawk at the top of $the ', moving |12's , as measured by the DOS @by 4,096 mby the Squawk is , it -and . pof 852 at the end of the a. The >and in the DOS not be One can be din all Squawk "Nguyen Van Cuong - Siagon IBM comppany." It is what Squawk PZPAPN Squeaker : Squeaker .Exe Bd if R: 1,091 5: PRhAK - , NAV, The Squeaker Squeaker is a uof . -and . The Squeaker is X, the at the top of $the , as qby the DOS @by 1,136 |12's moved. {1C and 21 mby the Squeaker is , it -and . X. If X, it Squeaker pof 1,091 at the end of the a. The in the DOS to the >and A symptom of a Squeaker , if the .Exe, Bd. The ed to the DOS prompt. It is if Squeaker 8any damage potential. PZPAPN Squisher : Squisher Hunter R: 340 5: ORfCK - , NAV 3.0+, The Squisher or Hunter . It fthe . Squisher is a Unlike many Squisher function uses techniques to avoid detection, to the ZeroHunt bSquisher X, the Squisher in a hole in low , hooking |21. , as qby the DOS not be the Squisher , it at least 340 )of hex '00' are lthe inserted where the hex '00' 4were . In the case of a more )of hex '00' it may rmultiple p, and the >and in the DOS not be . No are in the Squisher Nn't to do PZPAPN : Staf Staff may fail to R: 2,083 5: PNCK - , NAV, The Staf . Its but breports of it were out of u. It the Staf X, the Mthe Demo Ver.: 1.1 - Handle care! By STAF (Tel.: (819) 595-0787) Generation #n Press any key to The "n" cthe pound sign be replaced generation number of the . The " the of the . in the has just r. If no aexisted in the X, the s:" portion of the be replaced rall your `in the la nice day!" Staf may fail to "VIRUS ERROR #nn - Aborting process." Staf pof 2,083 at the "of the a. The Nnot alter the >and in the Eat the Staf Nnot do PZPAPN Stahl : Stahl Stahlplatte Germany R: 750 5: PNCK - , NAV, 1.53S+, The Stahl, or Stahlplatte, . It fGermany. Stahl is a of . Stahl is X, the wone . in the E. If the encounters a very small . it is searching for a w, it stop the Stahl pof 750 ). The at the of the . The >and in the DOS not be . Two din all Stahl "STAHLPLA.TTE Ich bin da!" "*.com" It is what Stahl PZPAPN Stanco : Stanco i; unusual Eastern R: 7,529 5: PNCK - NAV 3.0+, The Stanco . It is fEastern V. Stanco is a uof . the Stanco wone . in the pof 7,529 at the "of the . The >and in the DOS not be . The 9ed in the 5, but are not as the s in a PKLited form: "Insufficient DOS ... must be 3.2x or greater!" "Write Protect KFull ..." "Abort" the Stanco may receive unusual such as the Write Protect PZPAPN StarDot 600 : StarDot 600 :; spurious I/O ports R: 604 5: PNE - /, NAV, The StarDot 600 . Its is a uof . StarDot 600 is X, StarDot 600 wone . in the StarDot 600 by 604 to 616 at the end of the newly a. The >and in the not be StarDot 600 write random data to the default s, as well as send random data to the ports (37F to 3DF). See: StarDot 789 StarDot 801 PZPAPN StarDot 789 : StarDot 789 R: 789 - 805 5: PNAK - , NAV, The StarDot 789 . Its . StarDot 789 is a of . -and . StarDot 789 is search the Efor an w. If one is d, it r. If an ais not d, the search the Efor an w, and it if StarDot 789 pof 789 to 805 at the end of the be no 3in the in the DOS StarDot 789 may It is what StarDot 789 See: StarDot 600 StarDot 801 PZPAPN StarDot 801 : StarDot 801 Italian R: 801 5: PNAK - , NAV, The StarDot 801 . Its it is very to the Italian 803 , so it may fItaly. StarDot 801 is a uof . -and . . It StarDot 801 is X, the look for an in the w. If an Nnot exist in the E, it look for an is selected, the wit, adding the 5to the end of the StarDot 801 by 804 to 817 >and in the not be StarDot 801 ^13th is 1PM or later. At , it write random data to all Os on the in reverse order (it starts at OZ:). jmay See: StarDot 600 StarDot 789 PZPAPN Stasi : Stasi Stasi-1728 G: March, =seconds = 42; R: 1,728 - 1,742 5: PNE - 30.00+, The Stasi, or Stasi-1728, in March, . Its . Stasi is a uof . . It ities to the Wit the Stasi X, the Stasi wone . in the pof 1,728 to 1,742 at the end of the The >and in the DOS not to be the seconds !set to 42. in the 5in Stasi The Stasi Mthe "Stasi is watching you" destructive See: Wit PZPAPN Sterculius : Sterculius Sterculius.280, Sterculius I ^, 1994 R: 280 5: PRaCK - \2.10g+, 2.11a+, V114+, 6.64+, V113+, 6.64+, 1.25+ The Sterculius ^, 1994. Its . Sterculius is a uof . ,. A later bSterculius in low al hooking |21. qby the DOS not be the Sterculius , it pof 280 at the end of the a. The >and in the DOS not be . One in the 5in all "STERCULIUS" of Sterculius are: Sterculius.440: as Sterculius II, pof 440 at the end of the a. The in the DOS to the >and . The can be the 5in all "STERCULIUS ][" ^, 1994. PZPAPN Sticky : Sticky Multi-2, Nu Way G: May, R: 927 - 1,407 5: PRtAKX - W, Overlay, and n, NAV 3.0+, 1.53S+, The Sticky, or Multi-2, Gat several sites in the and Canada in May, . Sticky is a multi-partite vthe ) and all execu bSticky X, the Sticky wthe writes a copy of its 5to Side 0, Cylinder 0, 2 and 3, and alters the 5. The Sticky Nnot , and not Later, fthe Sticky K, the Sticky top of $the 12's be moved. qby the DOS 3,072 mby Sticky in the Sticky , it execu pof 927 ). . by 1,133 to 1,407 ). In both cases, the at the end of the a. The >and in the DOS . Sticky is an , and no in the It is what Sticky PZPAPN StinkFoot : StinkFoot Stink crashes on 8086/8088 machines Republic of South Africa R: 1,254 5: PNC - , NAV, The StinkFoot Gin the Republic of South Africa in . It is a `, and Nnot StinkFoot is X, the search the Oand Efor an wwhose is at least 1,000 ). If such d, the wit. StinkFoot pof 1,254 ). 259 of the at the "of the the remaining 995 #at the end of the be no 3in the >and in a DOS StinkFoot Nnot do . It function on XT (8088- ) machines. of StinkFoot are: StinkFoot-1273: s referred to as Stink 2, StinkFoot-1273 is an . It adds 1,273 )to the . v, splitting the 5between the "and the end of the : Republic of South Africa StinkFoot-2B: A minor of the StinkFoot adds 1,254 )to the t. It , adding an 1,273 )to the March, PZPAPN Stone`90 : Stone`90 Polish 961, Stone-90 Poland R: 961 5: PNCK - , NAV, The Stone`90 , or Polish 961, is a uof . ,. It was , and is fPoland. the Stone`90 X, the look for one . on the Oand in the w. If one is d, the rit. The newly by 961 ), and lthe at the end of the The can be "Sorry, I`m INFECTED!" "I`m already NOT "(C) Stone`90" Stone`90 Nnot to do PZPAPN &, Donald Duck, Hawaii, Marijuana, New Zealand, Rostov, San Diego, Sex Revolution, Smithsonian, Deunis, -16, -AT Love, -Collor, -Mexican, Mutation ^, 1988 BSC; TSR; ; RLL controller New Zealand R: N/A 5: BRtX - , NAV, : CleanUp, M \, NAV The breported in Wellington, New Zealand in early 1988. The r360KB 5-1/4" I, doing no overt damage. The uis extinct, however, and all are capable of sthe ) as well as may damage Eor FAT x. Most minor modifications, usually in what the a computer at the top of . The be moved, and ChkDsk indicate the computer as 2K less zed. If the &was J, the attempt to wthe , if it was not During the &process, the The Lmore or less on a random basis. The most for the "Your computer is now "Your PC is now , it are accessed on the J, it moves the 0) to 11. The copies into 0. Since 11 is normally part of the Jroot Eon 360K 5.25" I, any Eentries be lost. s of DOS 11 as part of the in the K's FAT #corrupted. K, it copies the to side 0, cyl 0, 7. A copy of the placed at side 0, cyl 0, 1, the location of the . If the Kwas formatted software starts the , or Eon side 0, cyl 0 right the , the Kmay be corrupted as well. In order to dis , the must be powered off and , write- protected J. If is not done, the Ias soon as are dis are many can dis Iand Ks. To successfully use one of , follow the instructions To remove manually, the DOS SYS 6can be used on 5.25" 360K I. On the K, the must be copied back to side 0, cyl 0, can be performed Norton Utilities, or editors. Deunis : on the , Deunis is a fSpain in . The in the is now: s abras tu Cpu!" "(c) IMAN4" on the , PS- is a has to avoid detection. Unlike most members of the ], PS- Nnot , and Nnot Many wthe of both normal and high-density I, as well as the . In the case of the , the is moved to cylinder 0, side 0, 17. On low density I, the is moved to 11, while on high density Iit can be fNew Brunswick, Canada }at a university. As of May, , no products detect can be just about in Rostov: Nnot . It 8the : "Non- K" and "Replace and strike". Sex Revolution V1.1: -B. the "EXPORT OF SEX REVOLUTION ver. 1.1" Sex Revolution V2.0: to Sex Revolution V1.1, the has "EXPORT OF SEX REVOLUTION ver. 2.0" -16: The Nnot as the in the replaced binary zeros. On 5.25 inch 360K the not be saved by the . On 5.25 inch 1.2M I, the is saved at 17, part of the root E. The Side 0, Cyl 0, May, in May, differs in vthe of the DOS of the . It to the , moving the on 360K 5.25" 11. It Nnot 9typical , but 9the " near the "of the May, -A: Same as , but Nnot wthe is the and is now extinct. The din the is: "Your computer is now . Legalize Marijuana". The "Legalize Marijuana" portion of the is not -AT Love: to the PS- moves the on 5.25 inch 360K 11, the last of the root E. On 1.2M 5.25 inch I, the be moved to 17, in the middle of the root E. The on the !moved to Side 0, Cyl 0, 8the may be Your PC is now St NED in L May, -B: Same as controllers may [frequent typically is: "Your computer is now . Legalise Marijuana". The "Legalise Marijuana" may be in capital letters, or may be partially . It is not -C: same as , except removed. -Collor: to the fBrazil's main distinction is in the "Collor, um tiro basta!" "Call John" : Brazil -D: same as the exception can whigh density 3.5" and 5.25" now emits a "beep" through the speaker L: "Your PC is now !" The "LEGALISE MARIJUANA!" can din the emits a "beep" through the speaker L. The is: "Twoj PC jest teraz be!" The "LEGALISE MARIJUANA?" can the !modified to avoid detection by utilities. Since its , most utilities can now detect in the "Your PC is now 2" Or: "Donald Duck is a lie." The " 2" portion of the may be corrupted as well. -LM: on the Fly accessed read and write intent, usually ing in a hang. The location of the and the to the : Canada -Mexican: Gin Mexico in May, 8the "NO VOTES FOR EL PRI". : Mexico, May Mutation: Mutation is a minor of the . Its major destinction Nnot Iunless the is accessed write-intent. It the same as the -NSD: in the Eastern United States, -NSD is a minor of the . Its major difference is to: "Non SYStEM dISc" and "LEGALISE MARIJUANA", the second usually be corrupted to "LEGALISE4". second is corrupted, all later the corrupted -NSD can whigh density, 1.2M 5.25" I, moving the -NZ: fNew Zealand in has one slight difference. It not always save the vthe K. The din the is: "YOUR PC IS NOW STONED!". See: Evil Empire Horse & Swedish Disaster NoInt WXYC PZPAPN Storm-1163 : Storm-1163 Storm =seconds = 62; TSR R: 1,163 5: PRsCK - 3.96+, 30.00+, NAV 3.0+, .2.0+ The Storm-1163 . Its . Storm-1163 is a uof . bStorm-1163 as a low TSR of 1,424 ), hooking the Storm-1163 , it pof 1,163 at the end of the a. The in the DOS to be un however, the non- Lseconds field !set to 62. One in the Storm-1163 It is what Storm-1163 PZPAPN Storyteller : Storyteller TSR; may run out of R: 3,184 - 3,196 5: PRsE - V112+, \2.13+, V113+ The Storyteller . Its . Storyteller is a uof . Nnot wvery small bStoryteller X, the Storyteller as a low TSR of 3,568 {08, 16, 21, and FB mby the . The copy of so in the case of advanced ts, the eventually run out of the Storyteller , it pof 3,184 to 3,196 at the end of the a. The >and in the DOS to the >and . The in the 5in all Storyteller "STORYTELLER" , the Storyteller Mthe in a box on the monitor: "Sitting on a grassy,beneath one of the window of the church,was a little girl. her head bent back she was gazing up at the sky and singing,while one of her little hands was to the a cloud hovered like a golden feather her head.So co- mpletely absorbed was she in watching the cloud to song or incantation seemed addressed, did not observe me I rose and went toward her.As I slowly approached the child,I could see by her forehead, the sunshine seemed like a globe of pearl,and especially by her complexion she was un 7ly lovely.Her eyes at one moment seemed blue_gray, at an violet,were shaded by long black lashes,curving backword in a most peculiar way,and matched in hue her eyebrows, and the trees tossed about her tender throat and were quivering in the sunlight.Gradully the features,especially the sensitive full-lipped mouth,grew upon me as I st- ood silently gazing. Here seemed to me a more perfect beauty had ever co- me to me in my loveliest dreams of bea- uty.Yet it was not her beauty so much as the look she gave me facinsted me , melted me in the 5, as are the "By : Theodore Watts-Dunton" "Sir . Press any key" PZPAPN Striker #1 : Striker #1 Striker, QD335 G: March, R: 461 5: PNC - , NAV, : CleanUp, or The Striker #1 }in the Eastern March, is a of . Striker #1 is X, the wone . bthirteen , and the body of the appended to the end of the show a pof 461 )in the and s are not can be easily identified as the "Striker #1" in the fourth through thirteenth all s near the end of Striker #1 Nnot to do PZPAPN Student-776 : Student-776 =seconds = "62"; R: 776 5: PRhAK - n1.04+, V112+, 2.58+, 6.64+, 1.22+, V113+, 6.64+ The Student-776 . Its . Student-776 is a uof . -and . bStudent-776 at the top of but $the ', not moving |12's , as qby the DOS @by 1,024 mby the , the Student-776 wthe the the Student-776 , it pof 776 at the end of the a. The >and in the DOS to be , but the seconds field !set to "62". The in the Student-776 "(C) Student It is what Student-776 PZPAPN Stupid-1355 : Stupid-1355 &failures R: 1,355 5: PNCK - NAV, 1.53S+, The Stupid-1355 . Its . Stupid-1355 is a of . Stupid-1355 is X, the wone . in the E, and hang . If ,is in the E, it may r, the fail to the Stupid-1355 pof 1,355 the end of the be no 3to the >and in the DOS . One can be in the "*.BNL" PZPAPN Suicidal : Suicidal G: March, R: 305 5: PNCK - 3.96+, The Suicidal in March, . Its . Suicidal is a ,. It Nn't wpast the fifth . ain a the Suicidal X, the Suicidal wone . in the 305 at the end of the The >and in the DOS not be The in the 5in all Suicidal "Suicidal! -/\-=> [Stingray/VIPER] < Suicidal Nn't to do PZPAPN Sunday 00/ L PT/ : Sunday , 1989 TSR; execu ; FAT Washington (state), R: 1,636 5: PRsAT - W. & .OV? , NAV, : CleanUp, , NAV, or The Sunday Gby many s in the Seattle, Washington area in , 1989. on any Sunday, Ming the "Today is Sunday! Why do you work so All work and no play make you a dull boy! Come on! Let's go out and fun!" The Sunday s to !derived fthe , the in many respects. Damage to the or FAT has !reported number of of Sunday are: Sunday-B: to the Sunday activate on any day of the week due to an Uin the day of the week checking routine. The in the is never L, and no damage is done to the Sunday-C: to Sunday-B, never It has, however, !modified so it differs both the Sunday and Sunday-B es. g, it is the same as Sunday-B. Sunday.Satan: to the Sunday 's low TSR is 1,936 , hooking {08 and 21. It -and . X. . by 1,636 at the "of the a. . by 1,636 to 1,650 at the end of the a. The in the DOS not be The in the in all "-Satan-" "* Satan *Carzy !! An piece of Satan "Written by Mad Satan in TAIWAN .\ 2.04 /" "= Mad Satan =" : Taiwan 1994. Sunday-UNAM: to the Sunday 's low TSR is 1,872 , hooking {08 and 21. It -and . X. . by 1,636 at the "of the a. . by 1,636 to 1,650 at the end of the a. The in the DOS not be On Sundays, it Mthe accompanied a strange sound on the speaker: "El talento no impide tener manias, pero las hace mas no Saludos porros de la UNAM" and sound are repeated every 12 seconds. The in the , as is the : Mexico City, Mexico See: Carfield Sunday-2 PZPAPN Sunday-2 : Sunday-2 Datarape 2.2 Canada R: 2,877 5: PRhAK - , NAV, .2.0+ The Sunday-2 }in Canada in . Sunday-2 is a generic u. It W, and overlay on the and Sunday The Sunday-2 is X, Sunday-2 at the top of , but the qby the DOS Aby 5,888 {21, 22, and 27 mby Sunday-2. At Sunday-2 Sunday-2 is , it W, and overlay for any reason. Sunday-2 at the end of `. . pof 2,877 ). . pof 2,877 to 2,891 not see the `in the DOS Sunday-2 is as the adjusts the it is Sunday-2 on Sundays X. The L, and the be hung: "It's Sunday. Why are you working? Take the day off compliments of RABID" cannot be seen in `as the The Sunday-2 5to perform a format on Sunday, however 5has several bugs and is not functional. Sunday-2 notice #detected by the DOS Sunday-2 is as the Eand to match checked by the DOS of Sunday-2 are: Sunday-2B: gequivalent to the is a minor See: Basilisk Sunday PZPAPN Sundevil : Sundevil i; beeping and Canada R: 691 5: PRfCK - 1.25+ The Sundevil . Its . Sundevil is a uof . bSundevil X, the Sundevil at 9000: hooking |21. qby the DOS not be the Sundevil , it for any reason. pof 691 at the end of the a. The in the DOS not be . The in the Sundevil in all is no America." is no Democracy." IBM, ITT, and AT&T." is dedicated to all !busted" "for computer hacking activities." "The SunDevil by Crypt Keeper" "[Sundevil]" The Lby the on the M, accompanied by beeping. jmay PZPAPN Suriv 1.01 : Suriv 1.01 1st, Israeli, Suriv01, Suriv A Extinct , 1987 TSR; . lock on Israel R: 897 5: PRsC - , NAV, \, or The Suriv 1.01 is a u. It activate on rby running an aand X. On , it Mthe "APRIL 1ST HA HA HA YOU HAVE A VIRUS". The lock up, requiring it to be powered off and back on. The "sURIV 1.01" can be din the See: Suriv 4.02 PZPAPN Suriv 2.01 : Suriv 2.01 1st-B, Israeli, Suriv02, Suriv A Extinct G: 1987 TSR; . lock on Israel R: 1,488 5: PRsE - , NAV, \, or The Suriv 2.01 is a u. It activate on rby running an Ming the same as Suriv 1.01 and locking up the . The cause a lockup, , 1 hour on any day on default >of 01-01-80 is used. The wthe of Suriv 2.01 are: Suriv 2.01B: fFrance in , 1994, on the Suriv 2.01 X, it za 1,808 *TSR, hooking |21. pof 1,488 at the "of the . The >and in the DOS not be . The can be in the 5in all "sURIV 2.01M" "TMP$$TMP. may be the not be consistent in all : France , 1994. PZPAPN Suriv 3.00 : Suriv 3.00 Israeli, Suriv03, Suriv B Extinct G: 1988 TSR; . W, & .SYS i; black window; slowdown Israel R: 1,813 ( `) & 1,808 ( 5: PRsA - , NAV, : CleanUp, \, or May be a of the . The "sUMsDos" has 1to "sURIV 3.00". The Suriv 3.00 Friday the 13th is run or if it is already present in , however `are not Bd due to a bug in the on Friday the 13th, for 30 seconds, an area of the is turned into a "black window" and a wasting loop is overlay, . SYS, and execu Wand . Nnot See: PZPAPN Suriv 4.02 : Suriv 4.02 i; TSR; to DOS prompt; &failures; Ireland R: 897 5: PRsC - , NAV, The Suriv 4.02 fIreland in Suriv 4.02 is a uof . `, but not ,. It The Suriv 4.02 is X, the as a low TSR. Suriv 4.02 is , it X. If X, it by 897 at the "of the The can be din all "Suriv 4.02" -MAND "$$TMP. -APRIL 1ST" The , "Suriv 4.02", is the tmarker the uses to determine if the ais already r. It in the fourth through thirteenth Suriv 4.02 . If the Ythem, or Ya non , the to the DOS prompt. in a &failure. Suriv 4.02 1st, at the "APRIL 1ST" followed by blanks the next goes . A , requiring the to re &the See: Suriv 1.01 PZPAPN Surrender : Surrender R: 513 5: PRaAK - , NAV, The Surrender , and has an . Surrender is a uof . and . . It ,if it is The the Surrender in the DOS buffers and graphics card be no qby the DOS Fly by the Surrender is , it -and . pof 513 at the end of the be no 3to the >and in the DOS The in the Surrender all "Jet" "Jews NEVER surrender!" Surrender Nn't to do PZPAPN Susan : Susan Zfailure; Bd; TSR; =set to "62" Mexico R: 571 5: ORsE - 2.11+, 8/93S+, NAV 3.0+, 1.0A06+ The Susan fMexico in . Susan is a uof . on Sundays, and in a very limited manner. bSusan X, the Susan as a low TSR of 832 mby Susan in Susan is , and the issues a DOS DIR 6line arguments (ie. simply "DIR" at the DOS prompt) on any Sunday, the wthe in the E. . not be re r, and the Nnot spread past the in any Susan lthe b571 by the Susan 5. The >and in the DOS to be un , but the seconds field !set to "62". The in the 5in all Susan "Susan" "*.* *. "DIR" "Bad fifteen ts of the Susan activate. At , the start deleting all of the `in the PZPAPN SVC 3.1 : SVC 3.1 SVC V3.1 G: May, R: 1,064 5: PRhAK - \, NAV, The SVC 3.1 Vin May, . It is fthe . SVC 3.1 is a of . -and . The SVC 3.1 is X, it at the top of but $the , as measured by the DOS 1,088 |12's not be moved. mby the SVC 3.1 is , it -and . X. If X, it 1,064 at the end of the a. The >and in the DOS not be SVC 3.1 9the "(c) by SVC,Vers. 3.1" SVC 3.1 is an earlier of the 1689 . Unlike 1689, it Nnot hang the the next becoming . It Nnot hide the of SVC 3.1 are: SVC 3.1-CHR: , SVC 3.1-CHR is a modified of the SVC 3.1 Like the adds 1,064 to the . -and . are X. The at the end of `. The can be in the 5in SVC 3.1-CHR "(C) by CHR,Sverdlovsk" is not detected by all can detect the SVC 3.1 See: SVC 4.0 SVC 5.0 SVC 6.0 SVC-2936 SVC.3241 PZPAPN SVC 4.0 : SVC 4.0 1689, Off , SVC V4.0, SVC 4.0-1740 R: 1,689 5: PRA - \, NAV, The SVC 4.0 . It is is not a very viable both . -and . SVC 4.0 is in the in- interpreter. , the wthe next -or . hang by 1,689 `larger 1,689 ), the hide the pif the is already in smaller 1,689 indicate a pin the DOS . In all cases, the at the end of hang , it is not a very viable , and should not be considered a threat in its ;state. of SVC 4.0 are: SVC 4.0-1740: A 1,740 of SVC 4.0, the bug fixed in the j. It Nnot wvery small . `. The DOS Ton all . The "(c) by SVC,Vers. 4.0" See: SVC 3.1 SVC 5.0 SVC 6.0 SVC-2936 SVC.3241 PZPAPN SVC 5.0 : SVC 5.0 3103, SVC V5.0 Israel R: 3,103 5: PRhAK - , NAV, 1.53S+, The SVC 5.0, or 3103, }in Israel in . It is believed to ated in the 3103 is a uof . , as well as overlay `. It is a The SVC 5.0 is X, the at the top of $the , as qby the DOS Aby 3,120 {01, 03, 08, and 21 mby the , SVC 5.0 -and . X. SVC 5.0 is a , and , the of 3,103 not be . Likewise, to view SVC 5.0 in a "clean" copy of the #made . In reality, the by 3,103 at the end of the a. The can be in the "(c) by SVC, Vers. 5.0" SVC 5.0 checks see if the is "AIDSTEST.C". If the has add a copyright the reads: "-* -91 by SVC, Vers 6.0 *- SVC 5.0 may cause multiple open at the same of SVC 5.0 are: SVC 5.0B: gequivalent to the SVC 5.0, minor SVC 5.0C: gequivalent to the SVC 5.0, minor 2. It "(c) by SVC,Vers. 5.0" SVC 5.0D: on the SVC 5.0 are two major differences b, the hooks {13 and 21, instead of 01, 03, 08, and 21. Second, it Nn't 9the typical copyright notice din the SVC 5.0 See: SVC 3.1 SVC 4.0 SVC 6.0 SVC-2936 SVC.3241 PZPAPN SVC 6.0 : SVC 6.0 R: 4,644 5: PRhAX - n, NAV, The SVC 6.0 Gin the . It is fthe . SVC 6.0 is a -and . . It Nnot The SVC 6.0 is X, the at the top of $the , as measured by the DOS by 4,672 {08 and 21 mby the and |12's !moved. The SVC 6.0 has actually al 68K of uses the 4,672 If the bSVC 6.0 fthe K, the rthe by altering three ). The written to the Kstarting at side 0, cylinder 0, 2. The three )cause the to be fthe SVC 6.0 is , it -and . pof 4,644 be hidden by the it is SVC 6.0 at the end of be no 3in the >and in the DOS SVC 6.0 is a true are read into , it "dis v" them, so a clean copy be in As such, if SVC 6.0 is utilities may not be able to detect the in the Three be able to be if the is not "(c) -91 by SVC, Vers. 6.0" "AIDSTEST.C" "SVC 6.0" It is what SVC 6.0 of SVC 6.0 are: SVC 6.0-4677: A later of SVC 6.0, is 4,704 ). Like the SVC 6.0, it hooks {08 and 21. , SVC 6.0-4677 -and . for any reason. pof 4,677 at the end of the a. The pis not SVC 6.0-4677 is . The >and in the DOS not be . The in the SVC 6.0-4677 "/* (c) -91 by Moscow SVC, Vers. 6.0 */" "AIDSTEST.C" "SVC 6.0" Like SVC 6.0, SVC 6.0-4677 is a full SVC 6.01: A later of SVC 6.0, is 4,688 ). Like the SVC 6.0, it hooks {08 and 21. , SVC 6.01 -and . for any reason. pof 4,661 at the end of the a. The pis not SVC 6.01 is The >and in the DOS not be . The in the SVC 6.01 "/* (c) -91 by Moscow SVC, Vers. 6.0 */" "AIDSTEST. "Moscow SVC 6.01" Like SVC 6.0, SVC 6.01 is a full SVC 6.01-B: to the SVC 6.01 is a minor . The "/* (c) -91 by Moscow SVC, Vers. 6.0 */" "AIDSTEST. "Moscow SVC 6.01" See: SVC 3.1 SVC 4.0 SVC 5.0 SVC-2936 SVC.3241 PZPAPN SVC-2936 : SVC-2936 R: 2,936 5: PRhA - 30.00+, 8/93s+, NAV 3.0+, .2.0+ The SVC-2936 . Its . SVC-2936 is a uof . -and . , but not The SVC-2936 is X, it at the top of but $the , as measured by the DOS 2,960 |12's not be moved. 01, 03, 08, 13, and 21 mby the SVC-2936 is , it -and . by 2,936 at the end of the a. The p, however, not be SVC-2936 is as the , or Eand FAT entries, are read into The >and in the DOS not be SVC-2936 9the at the very end of all it can be seen in is not "5Fr" It is what SVC-2936 See: SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 SVC.3241 PZPAPN SVC.3241 : SVC.3241 ^, 1994 =seconds set to "58"; R: 3,241 5: PRhA - \2.10g+, 6.60+, 2.11a+, V114+, 1.22+, V113+ The SVC.3241 ^, 1994. Its . SVC.3241 is a uof . -and . , but not ,. It is a , hiding the well as dis are read into The SVC.3241 is X, it at the top of but $the , as measured by the DOS 3,264 |12's not be moved. 01, 03, 08, 13, and 21 mby the SVC.3241 is , it -and . by 3,241 at the end of the a. The p, however, not be SVC.3241 is as the , or Eand FAT entries, are read into The >and in the DOS to be un , but the seconds field set to "58". It is what SVC.3241 See: SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 SVC-2936 PZPAPN Sverdlov : Sverdlov Hymn-2 R: 1,962 5: PRhAK - \, NAV, The Sverdlov believed to ated in the . Sverdlov is a uof . -and . `, and The the Sverdlov X, the at the top $the DOS '. 4,080 !reserved, and the is not by the . The DOS indicate is 4,080 )less expected. if it was not already Sverdlov is , any . -or . aover 2K in rif it is for any reason. pof 1,962 1,962 to 1,977 . In both cases, the at the end of It is if Sverdlov of Sverdlov are: Sverdlov-B: Very to the Sverdlov has one basic 3in behavior. It -and . `over 3K in before wise, the 5is very to avoid detection, and may identify it as Hymn-2. PZPAPN : SVir Endangered Poland R: 512 5: PNE - , NAV, /2.0+, .2.0+ The SVir }in Poland early in The }had a fatal flaw in its prevented it fexecuting. In , a sample was obtained fFridrik Skulason second sample, identified as SVir-B, is a `. A third the SVir-B X, the wone . between 516 and 526 5appended to the end of the a. If the could not find an . w, it leave the O"spinning" as it be in an endless loop looking for a Interestingly enough, the A: =in the 1to the >and SVir, at least in the three Nnot do malicious, it simply of SVir are: SVir-0: A is very to SVir-B. the weither 1 or 2 `in the in a hang. SVir-A: The fPoland in early not SVir-B: A has the bug in SVir-A fixed so PZPAPN : Swap Falling Letters &, Israeli , 1989 Graphic M; BSC (floppy ); TSR; bad cluster Israel R: N/A 5: RsF - Floppy K, CleanUp, \, or DOS SYS The Swap , or Israeli , was breported in 1989. is a vfloppies. The floppy's it is accessed. One bad cluster be written on track 39, 6 and 7 the head unspecified. If track 39, 6 and 7, are not empty, the , it uses 2K or RAM. The actual of the 5is 740 The Swap for 10 minutes. A cascading effect of letters and 4on the monitor is seen, to the cascading effect of the Cascade and Traceback The d the Swap because the }case had the cphrase )00B7-00E4 on track 39, "The Swapping- . (C) , 1989 by the CIA" However, phrase is not freshly rby the Swap the Swap can be easily identified by looking at the editor, such as Norton Utilities. The normally at the end of the not be , instead the start of the 5is present. The remainder of the track 39, 6 and 7. PZPAPN Swedish Boys : Swedish Boys Data Molester, Headache, Swedish, Why Windows Sweden R: 457, 459, or 538 )(depending on present) 5: PNCK - , NAV, 8/93S+, 8/93+, .2.0+ Swedish Boys is a group of initially three Sweden in es are all us of . ,. Depending on the present, may be destructive. The Swedish Boys es are: Data Molester: The Data Molester is a uof . wall . in the pof 538 the at the end of the a. The >and in the DOS . The in the , and are not ":+:+ The Data Molester V1.00 +:+:" "The Vile One / The BetaBoys Development Corporation." Data Molester the C: root Eand : Sweden Headache: The Headache is a uof . ,. It wone . in the pof 459 at the end of the a. The and to the . The can be in the 5in all "-+( Severe Head-Ache V2.oo )+-" "Created by The Vile One & MaZ" "Copyright (c) The BetaBoys Development Corp" "-Sweden 04/19/92" : Sweden Why Windows: The Why Windows is a uof . wone . in the 459 at the end of the . The >and in the DOS to the and . The can be din the 5in all Why Windows "*.com" "C:\ 6.Com C:\Autoexec.Bat C:\Config.Sys" "\windows\win.com" "Why Windows (c) MaZ / BetaBoys B.B" Why Windows is a destructive . It attempt to Bthe a\windows\win.com. ly, on ^23rd of any year it attempt to C:\Autoexec.Bat. On ^24th of any year, it attempt to BC:\Config.Sys. Lastly, on ^25th of any year it attempt to the C: Oroot Eand : Sweden PZPAPN Swedish Disaster : Swedish Disaster BSC; Sweden R: N/A 5: BRhX - \, NAV, The Swedish Disaster was s to be fSweden. It is a floppy and the Jwhose the Swedish Disaster , the moved to side 0, cylinder 0, 6. The at the top of but $the by 2,048 be 6,944 )less what is expected by the |12's moved by the Swedish Disaster is , the all non-write protected are accessed on the . On 360K 5.25" I, the !moved to is normally a part of the root means if the entries in be lost. The can be dat the end of the I, as well as in the "The Swedish Disaster" the Swedish Disaster can be dis powering off the and re &ing fa write-protected, J. The DOS SYS 6can be used to replace the I. For Ks, the remove remain in the See: PZPAPN Swiss 143 : Swiss 143 Switzerland R: 143 5: PNCK - NAV, The Swiss 143 , by Dany Schoch of Hagendern, Switzerland. is a non- uof . Swiss 143 is X, the wall . `in the by 143 ), the the end of the . The >and to the >and were Nnot do PZPAPN Swiss Phoenix : Swiss Phoenix Switzerland R: 927 5: PRhAK - 3.96+, 8/93S+, NAV 3.0+, 1.53S+, .2.0+ The Swiss Phoenix }in Switzerland in is a uof . -and . ,. It exhibits techniques. The Swiss Phoenix fa low-level sub , it reside at the top of but $the , as qby the DOS by 976 mby Swiss Phoenix in the Swiss Phoenix , it -and . , or copied, usually in sub Fories. the Swiss Phoenix pof 927 at the end of the a. The >and in the DOS not be . The the , and is not the Swiss Phoenix the DOS . Not all be flagged, but those were prior to the becoming It is what Swiss Phoenix may do PZPAPN Sylvia : Sylvia Holland Girl ?, 1989 i; TSR R: 1,332 5: PRsC - , NAV, \, or The Sylvia, or Holland Girl, breported by Jan Terpstra of the `, increasing by 1,332 ). The apparently damage, and Nnot The is due to the fact and phone number of a girl d Sylvia in Holland, along her address, requesting post cards be sent to her. The is believed to !written by her ex-boyfriend. of Sylvia are: Sylvia 2: The Sylvia 2, or Holland Girl 2, is a modified of the Sylvia uof . Zof an in up to four becoming may be in the C: Oroot E, or the pof 1,332 at the "of the a. The can be in the 5, along Sylvia's last and full address is not #repeated here: rby a HARMLESS V2.1" "Send a FUNNY postcard to : Sylvia" "You might get an ANTIVIRUS : New Brunswick, Canada PZPAPN SysLock 00U G PTU : SysLock 3551, 3555 Endangered , 1988 i; data R: 3,551 5: PNA - Encrypting , NAV, \, or The SysLock is a encrypting both . -and . `, as well as damaging data Nnot , but instead searches through the . -and . Fories on the K, picking one execu random to w. The lits 3,551 it may vary slightly depending on The SysLock damage `by searching for the word "Microsoft" in any combination of upper and lower case and dreplace the word "MACROSOFT". If the SysLock finds an en ment variable "SYSLOCK" exists in the and has !set to "@" (hex 40), the wany or perform replacements, but instead pass control to its host immediately. of SysLock are: Advent: Reported to be a SysLock , the sample of by the author Nnot . All samples of researchers do not . Fridrik Skulason of Iceland has it is on an a, and t to be extinct. Advent-B: fthe NCSA is , Advent-B is a bug fixed of the Advent . Advent-B may wone . -or . in the , however, wthe bfew `in the 2,768 to 2,783 at the end of the . The >and in the not be . Like Advent, Advent-B activate in ?, at randomly activate, Ming four candles and playing "On Tannenbaum" on the speaker. Cookie: on the SysLock , Cookie is a considerably shorter in . It is a uof . -and . ,. It vone . -or . the of 2,232 to 2,251 at the end of the a. The >and in the DOS Cookie may X. In cases, the functioning a number of Zs. !reported to Mthe "I want a COOKIE!", the sample Nn't exhibit behavior. Macho-A: same as the SysLock , except "Microsoft" is replaced "MACHOSOFT". PZPAPN T-1000 : T-1000 &failure; R: 128 5: ONCK - 8/93+, .2.0+, 1.25+ The T-1000 . T-1000 is a ,. It corrupts the the T-1000 X, the T-1000 wall of the . in the E, and Mthe "T-1000" hang the T-1000 lthe )of the host by the T-1000 unless were smaller ), in case 128 . The >and in the DOS to the >and . The , along , is in the "*.Com" PZPAPN Tabulero : Tabulero 7- South America i; TSR Venezuela Argentina R: 2,048 - 2,062 5: PRsE - .2.0+ The Tabulero . It is Venezuela, it was }in Argentina. Tabulero is a uof . . It is on the bTabulero X, the Tabulero as a low TSR of 2,048 ). It hooks {09 and 21. the Tabulero , it X. Tabulero cannot recognize previous ts on `, so it the Tabulero pof 2,048 to 2,062 of the a, and 2,048 t. The at the end of the a. The >and the DOS not be . The can be din all Tabulero "pTpApBpUpLpEpRpOp pI.U.P.L.C.M Wilmer C G" "exe" Tabulero may Mthe "TABULERO" on the it has period of of Tabulero are: Tabulero-B: A later of the Tabulero , it Nnot re . The "pTpApBpUpLpEpRpOp p" "ISRAEL" "ODALUBAT atse CP us, otreum ah LEMRAC" "--IUP LUIS CABALLERO MEJIAS--" Tabulero 2: An of the Tabulero Nnot re `. The in the 5are: "ODALUBAT atse CP us, otreum ah LEMRAC" "--IUP LUIS CABALLERO MEJIAS--" "Wilmer 86-Phonix (R) Rescue anti "Copyright (C) Phonix Corp 1987- All right reserved." "Immunizing" "No path especifed or no "Example RESCUE A:" "pTpApBpUpLpEpRpOp p" "ISRAEL" PZPAPN : Tack G: May, R: 449 - 464 5: PNCK - , NAV 3.0+, The Tack, or 4-A, in May, . Its . Tack is a the Tack X, the Tack wone . in the and Mthe - Hello, I am pof 449 to 464 at the end of the a. The >and in the DOS to the >and %the , the can be in the 5in Tack "TACK" the Tack Lon the monitor, and of Tack are: Tack-411: , Tack-411 is a 411 of the Tack Ms the It adds 411 to 426 )to the . In addition to the in its "*.com" Tack-477: , Tack-477 is a 477 of the Tack Ms the same as the , and adds 477 to 492 )to the . r. In addition to the in its "*.com" PZPAPN Taiwan : Taiwan Taiwan 2, Taiwan-B, Doom I, Doom I-B Endangered i; 8th day of any month corrupts &, FAT, Taiwan R: 743 5: PNCK - , NAV, \, NAV, or The Taiwan in Taiwan, R.O.C. ,, and Nnot into the Taiwan X, the attempt to wup to three . `. The default Eis not r, instead the start its search for candi `in the C: Oroot , the vthe aby copying the 5to the b743 of the a, the b743 )of the ais re to the end of the . a. A bug exists in , if the ais less , the always be 1,486 effect is due to the not checking to see if it read less )of the abefore The Taiwan is destructive. On the 8th day of any month, is run the perform an absolute write for 160 starting at logical 0 on the C: and D: Os. In effect, logical write in the FATs and root of Taiwan are: Doom I: The of Taiwan is between Taiwan-B and Taiwan, Doom I adds 752 3in the >and in the DOS E. Doom I wfour . `on the C: X. It reset the Oand `, so if the was not ;ly using the C: as the may notice the 3. Due to a bug in the Doom I smaller ), the 1,488 Doom I-B: Doom I-B is a later of the Taiwan , and ps the `by 677 ). It wthree . on the C: X. The and reset to the Ethe tprocess is complete. Unlike Taiwan, smaller Taiwan-B: Apparently an earlier of the Taiwan hang the X, but it has ausing the selection mechanism qfor the Taiwan PZPAPN Taiwan 3 : Taiwan 3 Anticad 2 Taiwan R: 2,900 5: PRA - \, NAV, : CleanUp, or The Taiwan 3 in Taiwan, R.O.C. It was dubbed the Taiwan 3 by John McAfee because it is the third fTaiwan, the two are Taiwan and KKiller. is not related to either of The the Taiwan 3 Xon a , the in low 3,152 ). The hooks becoming , Taiwan 3 wany X. . by 2,900 pby between 2,900 and 2,908 Overlay `may ras well. It is what the criteria is for what it %spreading. See: Fu Manchu PZPAPN Taiwan 4 : Taiwan 4 2576, Anticad 5 TSR; . slowdown and Thailand Taiwan R: 2,576 5: PRsA - n, NAV, 1.53S+, : CleanUp, or The Taiwan 4, or 2576, . While one copy of by a of Excalibur! who it had fa download of AutoCad BBS, a second copy was to John McAfee Thailand on the same s to ated in Taiwan, and is on the Taiwan 3 . It is a uof . -and . `, but the Taiwan 4 X, the check to see if it is already . If the isn't already in , the as a low TSR of 2,832 and 21 mby the , the start to slow down the gradually. 30 minutes, it slowed the down by 30 percent. Any . -or . Taiwan 4 active in pd by 2,576 )for . `, and 2,576 - 2,590 for . `. The at the "of . `, and the end of . `. The din all "To Whom see : Shit! As you can see document, you may know what is. But I must tell you: DO NOT TRY to WRITE ANY ANTI-PROGRAM to THIS VIRUS. is a test- , the real dangerous implement on . I use MASM to generate varius easily and you must use DEBUG against my kly, is foolish. Save your until next month. OK? Your Sincerely, ABT Group., Oct 13th, 1989 at FCU." can be din all "ACAD. PZPAPN Talentless : Talentless R: 1,077 5: PNAK - , NAV, The Talentless . Its . Talentless is a -and . u. It the Talentless the Talentless wone . -or . on the C: O. The start looking for a win the C: Oroot E, and move down through the Estructure. the Talentless pof 1,077 ). The at the end of the a. The >and in the DOS not be . The in all Talentless "Bad It is if Talentless PZPAPN TalkingHeads : TalkingHeads fail to function; README. acreated R: 519 5: ONCK - /, NAV 3.0+, 30.00+, n1.04+, 6.64+, 1.25+ The TalkingHeads . Its . TalkingHeads is a uof . ,. It permanently corrupts the . the TalkingHeads wtwo . in the , the create a 519 README. -in the E, as create a 519 ain the C:\DOS Eif the Nn't already exist. the TalkingHeads lthe 519 )of the host by the be no unless the awas smaller , in case it . The >and in the DOS not be . The can be in the 5in all "C:\DOS\ "README. The TalkingHeads Mthe Xon Fridays between 11:00 and 11:59: ain't no disco..." The Nn't always behaviour. The in the PZPAPN Tamanna : Tamanna ^, 1994. i; Read Attribute set on R: 1,857 - 1,872 5: PRhAK - \2.10g+, 6.60+, 2.11a+, V114+, V113+, 6.64+, 1.25+ The Tamanna ^, 1994. Its . Tamanna is a -and . bTamanna X, the Tamanna at the top of $the ', hooking {1C and 21. |12's not be moved. , as qby the DOS @by 1,888 the Tamanna , it pof 1,857 to 1,872 at the end of the a. The >and in the DOS not be , but the read attribute be set. The in the Tamanna 5in all "Tamanna" "Wish.." "Facts need no recognition" "A silent friend" "DHAKA" "Press T to reconcile my Wish" "OK carry on >>" ahas !modified" "Rebuilding..." "Standby while re &ing" It is what Tamanna may do PZPAPN Tankard : Tankard Tankard V2.0 G: March, R: 493 5: PRhCK - 3.96+, NAV 3.0+, 1.25+ The Tankard, or Tankard V2.0, in March, Its . Tankard is a , fast uof . bTankard X, the Tankard at the top of $the ', hooking |12's not be moved. , as qby the DOS @by 1,024 the Tankard , it for any reason. pof 493 at the end of the a. The in the DOS not be . The in the Tankard in all "IBMBIO. -IBMDOS. "Tankard vers.2.0" It is what Tankard may do of Tankard are: Tankard V3.01: A 556 of the Tankard 1,024 ), hooking |21. It adds 556 )to the . Zand open. The can be in the Tankard V3.0 "IBMBIO. -IBMDOS. "Tankard vers. 3.01" March, PZPAPN Tao Cheng : Tao Cheng j; video mode &failure; garbage 4written to unexpected R: 1,295 5: PRtAK - 3.96+, n1.03+, 30.00+, NAV 3.0+, The Tao Cheng . Its . Tao Cheng is a uof . -and . bTao Cheng X, the Tao Cheng at the top of $the ', moving |12's , as qby the DOS @by 3,072 mby the Tao Cheng the Tao Cheng , it and . pof 1,295 at the end of the a. The >and the DOS not be . The in the Tao Cheng "TheDraw Save" "Unsupported Video Mode" "[Tao Cheng] Tommy Chong" The author of the "TheDraw" had nothing to do creation of . The btwo are in the due to use of TheDraw to create part of the the Tao Cheng [a number . Frequent jmay be accompanied colored squares 9ing random 4on the monitor. The video mode may be switched. Unexpected may , as well as &failures © of Tmay accompanied by a -MAND cannot be loaded, and the !halted. PZPAPN Tatou : Tatou i; TSR; seconds set to "62" Poland R: 1,153 5: PRsCK - n, NAV 3.0+, 8/93+, The Tatou fPoland in . Tatou is a uof . bTatou X, the Tatou as a low TSR of 1,424 ). It hooks interrup 21. the Tatou , it pof 1,153 at the end of the a. The >and in the DOS to not be 's seconds field !set to "62". The in all Tatou It is what Tatou PZPAPN : TB1 R: 124 - 448 5: PNE - The TB1 . Its . TB1 is a uof . the TB1 X, the TB1 wup to three . in the 124 to 448 at the end of the a. The >and in the DOS not be . No in the TB1 Nn't to do PZPAPN TBug-634 : TBug-634 Andr-634 R: 634 5: PRhAK - n1.04+, 6.64+, V109+, 1.25+, 6.64+ The TBug-634 . Its . TBug-634 is a of . -and . bTBug-634 at the top of the ', not moving |12's , as qby the DOS @by 640 mby TBug-634 in the TBug-634 , it pof 634 the end of the a. The >and in the DOS to the and . The can be dnear the end of all "TbUg" TBug-634 uses a mechanism employed by the Vacsina . As a employing ning technologies may detect of the Vacsina PZPAPN Tchantches : Tchantches i; graphic hang; Liege, Belgium R: 3,303 - 3,318 5: PRsAK - 30.00+, NAV 3.0+, 1.25+ The Tchantches . It is fLiege, Belgium, and is on the Gotcha Tchantches is a uof . -and . bTchantches at the top of but $the ', not moving |12's , as qby the DOS @by 3,648 mby Tchantches in , the Tchantches the Tchantches , it and . for any reason. Tchantches 3,303 to 3,318 at the end of the a. The >and in the DOS not be . The the Tchantches 5, thus not "TCHANTCHES d mineur v1,10" "Portez secours votre disque dur" "Entr e=Drapeau, Espace=Explorer" "(C)Copyright Setaicossa EefaCm '92" The Tchantches 1st of any year. At , the draw a box centered on the M. The btwo lines be at the top of the box, and the last two lines at the bottom. The be hung. See: Gotcha PZPAPN TechnoRat : TechnoRat Rat-615 G: March, =seconds set to "62" R: 615 5: PNCK - NAV 3.0+, n1.05+, The TechnoRat, or Rat-615, in March, . It s to be fthe . TechnoRat is a uof . the TechnoRat wall of the . in the E, and the pof 615 the at the end of the a. The and in the DOS to be , however the seconds field !set to "62". The in the TechnoRat in all "Techno-Rat I. Copyright by Lord Blaise, Odessa "*.* *. -..\*. It is what TechnoRat may do PZPAPN Telecom : Telecom Telefonica, Telecom a, Spanish Telecom-2 Kformatted Spain R: 3,700 5: PRhC - , NAV, The Telecom, Telefonica, or Telecom breported , in Spain. several samples of Telecom were in early , the breplicable sample arrived sample is fSpain. Telecom is a uof . . It carries a of the Anti-Tel zon the ). Telecom was written by the same individual as the Anti-Tel and Holocaust es. All of es are Telecom is X, Telecom at the top of $the |12's not be moved. , as measured by the DOS @by 3,984 mby the Telecom Telecom is , it larger 1K in by 3,700 the pcannot be seen in the as the hides it. The alters the in the Eby adding 100 to the year, readily apparent. The >alteration is how Telecom determines if the ais already Telecom , it wthe of the Anti-Tel accesses a on the K. See the description for Anti-Tel for xon the The Nnot 9a complete copy of the Telecom , so it by cannot The uportion of Telecom Nnot mechanism per say, the mechanism is in the K, the See: Anti-Tel Holocaust PZPAPN : Ten 1554, 9800: , V-Alert, 1559 H: i, TSR, linkage R: 1,554 5: PRfAK - \, NAV, \, or The Ten ), or 1554, was accidentally sent out over the VALERT-L network on ^13, subscribers. , the . It proceed to `over 1000 and . `over 1024 ,, increasing tby 1,554 to 1,569 The Ten ?of any year. Upon , any are written be missing the bten ). At the end of `, ten )of miscellaneous . In effect, both and data be corrupted. If the Ten Xon a less , the hang the of Ten )are: 1415: The 1415 on the Ten . It elow hooking {21 and 49. The 1415 by 1,415 to 1,462 at the end of the be no 3in the >and in the DOS )-1514: The Ten )-1514 on the Ten . It , it and . by 1,518 to 1,569 at the end of the may notice `written to Kmay be missing the were in the a, thus corrupting the )-1514B: gequivalent to the Ten )-1514, differs in a few PZPAPN Tequila : Tequila modified; Switzerland R: 2,468 5: PRtEX - , NAV, 1.25+ : CleanUp, \, or replace The Tequila . It is fSwitzerland, and at the of its ~was V. Tequila is a ) and . uses a complex encryption method and garbling to avoid disassembly and detection by using a or search The Tequila is Xon a , the check to see if it has already . If the has not r, Tequila write an un Scopy of to the last six of the K, as well as modify the wious. Tequila , and it Later, is re fthe Tequila . It at the top $the |12's be moved, preventing the {13 and 21 mby the , as qby the DOS be 3,072 )less expected. Tequila is , it 2,468 ), but not be able to be seen in the DOS Eif the . The at the end of . The >and in the not be The be able to be don the last few of the "Welcome to T.TEQUILA's latest production. Contact T.TEQUILA/P.o.Box 543/6312 St'hausen Switzerland. Loving t to L.I.N.D.A. BEER and TEQUILA forever !" Tequila notice #detected the DOS . If the /F option, :may perform CRC checking may not be able to detect Tequila on `, regardless of whether the Tequila four months the initial of the K. At , and every month on the anniversary >, the Ma graphic and the Y: mov ax, FE03 / int 21. Key to go on!" If the Ys a 9ing sequence of instructions, the don the last the PZPAPN Terminator : Terminator 2; TSR; write protect R: 526 5: PRsCK - , NAV, The Terminator . Its . Terminator is a uof . The the Terminator X, the Terminator as a low TSR of 1,104 {21, 22, and the Terminator , it the Terminator of 526 at the end of the The >and in the DOS to the >and the Terminator may notice the fa write-protected J, a write-protect PZPAPN Terminator-2294 : Terminator-2294 R: 2,294 5: PRhAK - \, NAV 3.0+, 8/93+, 1.25+ The Terminator-2294 . Its . Terminator-2294 is a uof . -and . ,. It employs techniques to avoid detection, and Nnot until the ring ?31, ?31, , and a Terminator-2294 X, the Terminator-2294 at the top of $the ', hooking {13, 21 and 24. , as the DOS @by 2,448 , the Terminator-2294 ,if it was not the Terminator-2294 , it -and . pof 2,294 at the end of the a. The not be . The >and in the DOS not be . The in the Terminator-2294 "TERMINATOR" ".csc.eziarchomanxep" the Terminator-2294 notice Ton all . It is what effects the Terminator-2294 may PZPAPN Terminator-3549 : Terminator-3549 `corrupted; fail to function ; "Divide overflow" The R: 3,549 5: ONE - The Terminator-3549 . It is fThe . Terminator-3549 is a . It permanently damages the the Terminator-3549 the Terminator-3549 wone . the C: O. The starting in the O's root E, and slowly work down the structure. the Terminator-3549 b3,549 )of the host by the 5. Unless the . awas smaller 3,549 be no smaller 3,549 before 3,549 t. The >and in the DOS to the and . The in the 5in Terminator-3549 "*.exe" "$456789:;=>?u" in the Lon the monitor: "Divide overflow" PZPAPN Tester : Tester TestVir, Test B V1.4 R: 1,000 5: PNCK - \, NAV, The Tester, or TestVir, . Its is a uof . `. It Tester is X, the Mthe , requiring a response by the is TESTVIRUS B V1.4 ! 1 = E+ run orig. prog. 5 = run orig. 9 = abort" If a "1" is entered by the , the all of the . in the E, and the Tester , it Mone of the ctwo lines, indicating it is ;ly processing. The bline is the if it was r, the second line it is sthe "Already "INFECTED: Entering a "5" in no r, and the X. Finally, entering a "9" in the terminating and the ed to a DOS prompt. Tester by 1,000 the at the "of the The >and in the DOS to the >and PZPAPN Thimble : Thimble i; TSR; R: 1,024 - 2,046 5: PRsCK - , NAV, The Thimble . Its ~, is . Thimble is a uof . bThimble X, the Thimble as a low TSR of 4,416 {21 and CC the the Thimble , it X. If the Thimble normally by 1,024 ). The exception is smaller 1,024 2,048 . The at the "of the . The >and in the DOS to the >and The can be din all Thimble "Greetings to Cracker Jack..." "Loving ts to Shirley" "Marty McFly lives where in "Kill Eddie. Kill Diana. Kill Fredo." It is if Thimble PZPAPN Thirty Three : Thirty Three R: 525 5: PRtCK - n1.04+, \2.10+, V112+, 6.60+, 2.58+, 2.58+, V113+, 6.64+ The Thirty Three . Its . Thirty Three is a uof . bThirty Three at the top of $the ', moving |12's , as qby the DOS @by 1,024 mby the , the Thirty Three pof 525 at the end of the a. The >and in the DOS to the >and . One in the "33" It is very near the end of all PZPAPN mark 1 H: Poland R: 1,062 - 1,076 5: PRhE - 3.96+, NAV 3.0+, 8/93+, The mark . It is fPoland. mark is a uof . mark X, the mark at the top of the qby the DOS @by 1,072 {1C and 21 mby the mark mark , it very small ones) pof 1,062 to 1,076 #at the end of the a. The >and in the DOS . No in the mark It is what mark mark are: mark 2: Probably an earlier of the mark is 1,088 ), hooking {1C and 21. It adds 1,083 to 1,097 to the . v. Unlike mark, mark 2 adding an 1,083 to 1,097 ). The >and in the DOS not be : Poland PZPAPN Timid : Timid H: Zfailure Oregon, R: 306 5: PNCK - , NAV, The Timid Gin the state of Oregon in the . Timid is a uof . ,. Timid s to be an escaped research , and has din the public domain. It was by Wallace Hale of Canada. Timid is X, the Timid look for an in the w. The encountered rby the . If no exist in the E, a hang Timid pof 306 ). The at the end of the The >and in the DOS to the >and . Two can be din the "VI" The , "VI", in the fourth and fifth `. Together a jump (E9h) instruction at the "of the a, it forms the marker used by the to determine if the awas rby Timid. &the in a hang. yield unexpected s, such as beeping, or a of Timid are: Hehheh: , Hehheh is a 320 of the Timid . It vone ain the `may be of any odata `, as the uses a search argument of *.*. pof 320 at the end of the a. The and in the DOS to the >and all of the `in the Zof the next in the #repeatedly Lon the monitor, accompanied by beeping: "*.* HEH!HEH!HEH!HEH!" can be in the 5in all Hehheh Timid-290: , Timid-290 is a 290 of the Timid Zof an in the searching the Efor an w. Unlike the , it Nnot Mthe newly pof 290 at the end of the a. The >and in the DOS to the >and . The 4"VI" can be dstarting in the fourth all . The the 5is "*. : North America Timid-297: , Timid-297 is a 297 of the Timid-371 Zof an in the searching the Efor an w. If the cannot find an w, it hang the pof 297 at the end of the a. The >and in the DOS to the >and . The 4"GR" can be dstarting in the fourth all . The the 5is "*. : North America Timid-305: , Timid-305 is one *smaller Timid Zof an in the searching the Efor an w. If the , it Mthe newly . No beeping Timid-371: , Timid-371 is a 371 of the Timid-290 Zof an in the searching the Efor an w. If the cannot find an w, it of the Kstarting at Side 0, Cylinder 0, any to access the in an "Invalid Ospecification" U. Norton KDoctor can be used to fix the pof 371 the end of the a. The >and in the DOS to the >and . The 4"VI" can be dstarting in the fourth all . The the 5is "*. : North America Timid-382: , Timid-382 is on the Timid Zof an in the searching the Efor an w. If the , it Mthe newly . No beeping pof 382 at the end of the a. The >and in the DOS to the >and . The "VI" can be dstarting in the fourth *of all may corrupt the &record ( Timid-431: , Timid-431 is on the Timid Zof an in the searching the Efor an W, or .SYS pof 431 at the end of the a. The >and not be in the DOS . The "GR" can be dstarting in the fourth of all s of &failures and failing to function Timid-526: , Timid-526 is on the Timid Zof an in the searching the Efor an wboth and data the exception in the root wthe hidden `, both and data, pof 526 at the end of the a. The and not be in the DOS . The "GR" can be dstarting in the fourth *of all s of &failures, failing to function , and data non-execu r. If the Nnot encounter w, it may slowly alter the Muntil it is left blank. A hang Timid-557: , Timid-557 is on the Timid Zof an in the searching the Efor an wboth and data the exception in the root wthe hidden `, both and data, pof 557 at the end of the a. The and not be in the DOS . The "GR" can be dstarting in the fourth *of all s of &failures, failing to function , and data non-execu r. If the Nnot encounter w, it slowly drop down the Mif it is in mode, and later move them back into place. Timid-LM: , Timid-LM is a 305 of the Timid . It is fCanada, written by Lucifer Messiah. Timid-LM vone . ain the by 305 at the end of the a. The and in the DOS to the >and 9the "LM" starting in the fourth *of the a. The din the 5is "*. : Canada Timid-Orig: The Timid whose source published in "The Little Black Book of Computer by Mark Ludwig. the Timid- Orig X, the search the Efor an w, and wit. it has , it Mthe of the has just Timid-Orig pof 306 at the end of the . The >and in the DOS to the >and . The Timid-Orig Nnot cause beeping on the speaker. : Arizona, PZPAPN Timor : Timor H: i; TSR; R: 1,562 - 1,576 5: PRsA - /, NAV 3.0+, 8/93+, .2.0+ The Timor . Its . Timor is a uof . -and . , and is on the bTimor X, the Timor as a low TSR of 2,816 ). It hook {21 and F8. Timor is , it -and . X. . pof 1,562 at the "of the a. . pof 1,562 - 1,576 at the end of the a. Unlike , Timor lany >and in the DOS The can be din all Timor "Timor" Cruz, Dili" "LxTimor" "sso, edom for East Timor !" Nov 12, Lusit ia Expres" Timor 12th of any year, at may Mthe : "St Cruz, Dili". See: PZPAPN Di-94, Di-101, Di-108, Di-110, Di-94, Di-101, Di-108, Di-110 H: &failure; R: 94 - 110 )(see 5: PNCK - n, NAV, 3.96+, The Di, or Di, ]of four es was . Its . The es in ]are non- us of . ,. Since four es exhibit behavior, in general, differences $under X, the wall . in the E. If E, it well. one of the the at the "of the a. The p, and whether the later be re depends on is present. In any case, the lhad >and in the DOS to the >and One can be in the "*.com" The es do not intentionally do may fail to are r. The fail to &if the copy of members of the ]are: Di-94: adds 94 )to the . v. It is unable to distinquish has r, so it add 94 Di-101: A 101 *member of the vall . `in the not always in a manner. In cases, the b101 out saving the b101 fore, the initial tof a , the be either zero or 101 Like Di-94, it cannot recognize `, and later re wthem, adding an zero or 101 Di-108: Di-101, is 108 in a manner, and s by b108 Unlike Di-101, it can recognize `, and Nnot re wthem. Di-110: Di-108, is 110 PZPAPN 009 H PT9 see $under " members" H: R: 133 - 198 )(see 5: PRC - \, NAV, The es was by the author in fVesselin Bontchev of (. All the es in grouping share the same characteristics, difference is the effective of the five (5) es included in the " ]" as of -158, -159, -160, -167, and -198. In , five (5) es in ]were Vesselin Bontchev: -134, -138, -143, -154, and -156. In , an eleventh member was -133. In March , the twelveth member was -143B. The one of the Xon a , the segment 60h. area of is normally used by DOS &ed, it is never used or referenced. mby the , the wany . pof between 134 - 198 ), depending on is present on the . The >and in the to the >and The Nnot do The es in ]" are not related to the documented members of the ]are: -133: -134, 's effective 133 ). The bugs in -134 !fixed, is an excellent replicator. it cannot be detected by utilities were aware of members of -134: 's effective is 134 is the member of is not a very viable , it usually hang the -138: Same as , effective is 138 -143: Same as , effective is 143 -143B: -143B was in March, , and is -143. It has to avoid detection by familiar -143. March, -154: Same as , effective is 154 -156: Same as , effective is 156 -158: Same as , effective is 158 -159: Same as , effective is 159 -160: Same as , effective is 160 -167: Same as , effective is 167 -198: Same as , effective is 198 See: Dutch Micro 128 Mini-97 PZPAPN 163 , Danish H: Denmark R: 163 5: PNCK - \, NAV, \, or The 163 , or , was }by Fridrik Skulason of Iceland in is a generic . u, and it The the 163 the attempt to wthe ain the E. On &able normally be attempt to be `are greater by 163 ), and =stamps in the 1to the always end hex : '2A2E434F4D00'. Nnothing but , and is the smallest MS-DOS as of its The may or may not be related to the documented elsewhere in of the 191: A 191 of the , the 191 wone . ain the pof 191 at the end of the a. The >and in the DOS not be . One s in the The 191 Nnot wvery small `, and it usually not wmore four `in the E. It Nnothing Brenda: A 256 of the , Brenda one . ain the of 256 at the end of the a. The >and in the DOS to the Brenda has bthree . `in the E, it the instead of "(C) '92, Stingray/VIPER Luv, Brenda" is not `as it is S. One in the Brenda 5: "*. May, Brenda-B: to Brenda, has one Kennedy: The Kennedy is a 333 of the . It vone . X, adding 333 )to the end of the has three 6 (Robert Kennedy's assassination in 1968), 18 (death of Joseph Kennedy in 1969), and 22 (John F. Kennedy's assassination in 1963) of any year. On , the "Kennedy is deal - long live 'The Dead Kennedys'" Two can be in the 6.com" "The Dead Kennedys" [cross-linking of `, lost clusters, and : Denmark Stigmata: Stigmata is a 1,000 of the vone . in the if it encounters a very small . the Stigmata pof 1,000 the end of the a. The >and in the DOS not be . No in the -177: A 177 of the , the wone . ain the pof 177 at the end of the a. The >and the DOS 1to the >and . One in the -180: A 180 of the , the wone . ain the pof 180 at the end of the a. The >and the DOS not be . One s in the The -180 Nnot wvery small `, and it usually not wmore four `in the E. It Nnothing See: PZPAPN : Tiso H: Italy R: 846 5: PRhCK - 30.00+, 2.11+, NAV 3.0A06+, The Tiso , and is Italy. Tiso is a uof . bTiso X, the Tiso wthe copy of in the C: Oroot E. It Nnot until later fthe Kand the Tiso is , it at the top of $the ', moving |12's qby the DOS @by 1,024 {08 and 24 mby Tiso in the Tiso , it pof 846 at the end of the a. The >and in the DOS not be . No in the 5in Tiso It is what Tiso of Tiso are: Tiso.1279: in May, 1994, Tiso.1279 is a 1,279 of the Tiso . Unlike the is multi-partite, the ), in addition to . -and . X, the the . The not , however, until the fthe K. The is 2,048 )at the top of , but $the |12's be moved, and the -and . pof 1,279 at the end of the a. The >and in the DOS . No in the 5. It is what : Italy May, 1994. PZPAPN : TMTM Two Minutes To Midnight H: England R: 441 5: PNCK - 3.96+, NAV 3.0+, 8/93+, .2.0+ The TMTM, or Two Minutes To Midnight, Manchester, England in . TMTM is a uof . the TMTM wone . in the hang may pof 441 at the end of the a. The in the DOS to 11:58p, or two minutes to midnight. One in the jfrequently PZPAPN Tobacco : Tobacco H: i; TSR R: 2,900 - 2,914 5: PRsAK - , NAV, 1.53S+, The Tobacco . Its . Tobacco is a uof . -and . on the Plastique bTobacco X, the Tobacco as a low TSR of 3,152 ). It hook the Tobacco , it and . the exception of pof 2,900 at the "of the a. . rby Tobacco by 2,900 to 2,914 at the end of the lany rby Tobacco. The can be din all Tobacco "Tobacco v2" "AntiDacha. 21193We don't want" "gypsies in our" "world. We don't" "want DACHAs." 2nd Tabacalera gana siempre. Tobacco Ver. 2.0" It is what Tobacco of Tobacco are: Tobacco-B: to the Tobacco Nnot ,. The the "Tobacco v2" "We don't want" "gypsies in our" "world. DHC 1997" "ENIGMA MCMXCV I@TTF" 2nd Tabacalera gana siempre. Tobacco Ver. 2.0" See: Plastique PZPAPN Today : Today H: Zfailure; &failure; R: 177 5: ONCK - 2.58+, n1.05+, 6.64+, NAV 3.0A06+, 2.58+, 1.25+, 6.64+ The Today . Its . Today is a ,. It permanently corrupts the the Today X, the Today wone . in the The Today s the b177 )of the host a, so unless the smaller ), the not be were smaller 177 rby Today. The >and in the DOS to the >and . The in the 5in all Today -Today is Good Thursday, nothing can go wrong!" PZPAPN Todor : Todor H: R: 1,993 5: PNEK - n, NAV 3.0+, 30.00+, The Todor . It is Todor is a uof . `and the Todor wup to four . in the ly, it ,if it was not the Todor pof 1,993 at the end of the a. The in the DOS not be The in the Todor "*.exe *.com" -SPEC=(C)Todor" It is what Todor of Todor are: Todor-B: gequivalent to the 8minor alterations. }: The PZPAPN Tokyo : Tokyo H: may not function Japan R: 1,258 - 1,273 5: PNE - 30.00+, NAV 3.0A06+, The Tokyo Gin Japan in . Tokyo is uof . Tokyo is X, the one . ain the by 1,258 to 1,273 at the end of the Tokyo may [frequent are made to hang Nnot , often the las the is expecting, pauses ring in output operations, such as to the It is if Tokyo PZPAPN Tolbuhin : Tolbuhin Sk1, Tolbuhin-1147 H: R: 1,147 5: PRhC - , NAV 3.0+, 1.53S+, The Tolbuhin, or Sk1, . Its . Tolbuhin is a uof . , but not bTolbuhin X, the Tolbuhin at the top of $the , as qby the DOS @by 2,048 {20 and 21 Tolbuhin. The wone . in the Tolbuhin is , it pof 1,147 the end of the a. The >and in the DOS to the >and . The can be din all the Tolbuhin "Created 21.I. - PMG\OTME - Tolbuhin" "*.com" -MAND" jfrequently . It destructive of Tolbuhin are: Tolbuhin-626: on the Tolbuhin 2,048 ). It hooks 13, and 21. pof 626 at the end of the a. The and in the DOS to the >and . The can be in the "*.com" "SK9" The "SK" dstarting in the fourth *of all Tolbuhin-992: on the Tolbuhin 2,048 ). It hooks 13, 20, and 21. pof 992 at the end of the a. The and in the DOS to the >and . The can be in the "Created 21.I. - PMG\OTME - Tolbuhin" "*.com" -MAND" Tolbuhin-1004: on the Tolbuhin 2,048 ). It hooks 13, 20, and 21. pof 1,004 at the end of the a. The and in the DOS to the >and . The can be in the "*.com" -MAND" PZPAPN Tomato : Tomato H: j; unusual R: 2,156 - 2,171 5: PRhAK - 2.58+, 6.64+, 2.58+, 1.25+, 6.64+ The Tomato . Its . Tomato is a uof . -and . The the Tomato X, the Tomato at the top of $the , as qby the DOS @by 2,736 {09, 13, and 28 mby Tomato in the Tomato , it -and . X. If X, it may the Tomato of 2,156 to 2,171 at the end of the a. The >and in the DOS not be The in the Tomato "TOMATO!!!" "Praise the tomato! God save the tomato" "Big tomato is watching you Big Tomato says:" "Fighting for peace" "is like fucking for virginity TOMATO says:" "the pope suffers fAIDS Big Tomato says:" "NO MERCY lyou ever danced the devil" "under the red light of a big tomato ?" "pray for your Ks . . . Call McAfee (408) 988-3832" "if you [problems fTomato "\VIRUS \DOS *. ,tomato.tmp" the Tomato jor unusual For example, the DOS get the "Cannot +a Network it is Xeven it is not on a networked PZPAPN : Tony H: R: 200 5: PNCK - , NAV, The Tony . It comes to us (. Tony is a uof . the Tony X, the check the day of the >. Depending on the day of the month, the determine `in the w. The algorithm is if the day = "1", `starting "B" are r. On the 2nd, `starting "C" are algorithm continues for the rest of the days of the month. Tony vall . `in the meet the selection criteria. Tony pof 200 ). The at the "of the be no 3in the >and DOS . The can be in the 5in Tony "Tony+*. Tony Nnot do of Tony are: Tony-203: to the Tony adds 203 )to the . v. The din the s in PZPAPN Tony : Tony R: N/A 5: BR - n, NAV, 1.53S+, 1.25+ Kor DOS SYS The Tony . It is (. Tony &is a The fa Tony J, Tony copy the to the last of the O, and wthe . The not be The next fthe K, the Tony it is , it wany non-write protected exposed to the . The in the Ks and "Tony" It is if Tony of Tony &are: Tony &Dropper: Tony &Dropper is a small places a copy of the Tony into a . The Dropper not PZPAPN Tormentor : Tormentor H: i; .PAS Sweden R: 1,024 5: PRhE - , NAV, The Tormentor fMikael Larssen of the Help Center, Sweden, in . Tormentor is a uof . The Tormentor is X, the Tormentor at the top of $the , as qby the DOS @by 1,056 mby the |12's !moved. Tormentor is , it over 3K in pof 1,024 at the end of the a. The >and in the DOS . The ctwo can be din Tormentor "*.PAS" "TORMENTOR!" The Tormentor B.PAS the a Tormentor jmay of Tormentor are: Tormentor-1040: , Tormentor-1040 is a 1,040 of the Tormentor . Its is 1,072 ), and like the it hooks |21. Tormentor-1040 pof 1,040 at the end of the a. No are in the : Sweden Tormentor-1072: on the Tormentor Tormentor-1072 is a 1,072 -and . , but not Its is 1,104 ), and it hooks |21. it is , it -and . larger by 1,072 at the end of the a. The >and in the DOS reflect the >and . The can be din all "NUKE!" "TORMENTOR,soldier of -=DY=-" ks DAv!] DEMORALIZED YOUTH!" Unlike Tormentor, Nnot .PAS jmay : Sweden Tormentor-1072B: gequivalent to the Tormentor-1072 , the are: "NUKE!" "THOMASC. KILLER !!! -=SY=-" ks DAv!] DEMORALIZED YOUTH!" Tormentor-1072C: gequivalent to the Tormentor-1072 has a few differ. Tormentor-1072D: gequivalent to the Tormentor-1072, minor Nuke: on the Tormentor-1072 , Nuke adds 1,072 )to the . v. The Nuke `, not . members of the Tormentor group do. The in the Nuke "NUKE!" ks DAv!] DEMORALIZED YOUTH!" Nuke on the second day of any month. At Kon the fC: through Z:. Nuke Dropper: A small . the Nuke . The is not a natural and serves no purpose except to release or drop the Nuke Lixo Nuke: to the Nuke reformat the Kon the 31st of any month. becoming , it are copied. Both the source and target pof 1,072 at the end of the a. The can be din the Lixo Nuke "NUKE!" "TORMENTOR,soldier of -=DY=-" ks DAv!]" "DEMORALIZED YOUTH!" : Sweden Lixo Nuke Dropper: A small . the Lixo Nuke . The is not a natural t, and serves no purpose except to release or drop the Lixo Nuke : Sweden See: Murphy PZPAPN Tormentor-205 : Tormentor-205 Lession, Lession-1 H: 3; unexpected executing Sweden R: 205 5: PNCK - NAV 3.0+, 8/93S+, 8/93+, .2.0+ The Tormentor-205 fSweden in is a uof . ,. It is by the same author as The Tormentor and Tormentor-1072 the Tormentor-205 wall the . in the pof 205 at the end of the a. The >and in the DOS to the . The in the 5in all Tormentor-205 "(c) Tormentor ,Swedish Laboratory" "/ Demoralized Youth /" Tormentor-205 may receive unexpected include "Exec failure" and "Too many `open". usually not run of Tormentor-205 are: Tormentor-263: Tormentor-263 is a 263 of the Tormentor-205 . It in the pof 263 at the end of the The >and in the DOS to the >and . The can be din all "Modifications provided by ME, Inc." "I hope works!" "(c) Tormentor ,Swedish Laboratory" "/ Demoralized Youth /" : Sweden Tormentor-358: Tormentor-358 or Lession-2B is a 358 of the Tormentor-205 vall . in the pof 358 at the end of the . The >and in the DOS to the >and . The can be din all "(c) Tormentor / Demoralized Youth" "Rather bin hell, second in heaven." : Sweden Tormentor-358 Dropper: is a small . is a dropper for the Tormentor-358 : Sweden Tormentor-360: Tormentor-360 or Lession-2 is a 360 of the Tormentor-205 . It vall . in the pof 360 at the end of the . The >and in the DOS to the >and . It the same as Tormentor-358. : Sweden Tormentor-360 Dropper: is a small . is a dropper for the Tormentor-360 : Sweden See: Tormentor PZPAPN Totoro : Totoro H: March, 2; TSR Taiwan R: 1,540 - 1,554 5: PRsA - 8/93S+, 30.00+, NAV 3.0+, n1.05+, 8/93+, .2.0+, 1.25+, 1.0A06+ The Totoro in March, , and is fTaiwan. Totoro is a uof . , but not ,. It is on the bTotoro X, the Totoro as a low TSR of 1,856 ), hooking the Totoro , it pof 1,540 at the "of the pof 1,540 to 1,554 at the end of the a. In both cases, the >and in the DOS to the >and . The in the Totoro 5in all "Totoro Dragon" "Hello! I am TOTORO CAT" "Written by Y.T.J.C.T." "Don't Worry,be Happy" "YTIT" It is what Totoro PZPAPN Toxic : Toxic H: March, fail to function England R: 171 5: ONCK - 3.96+, 1.25+ The Toxic in March, , and is fEngland. Toxic is a are permanently corrupted, and not function the Toxic X, the Toxic wone . in the lthe b171 )of the host the Toxic 5. The in the DOS not be . The can be in the 5in all Toxic -[Toxic] By Toxic Crusader -=ARCV=-" PZPAPN : TPE Girafe H: ; graphic & The R: Generally Over 3,000 5: PRhA - 6.64+ The TPE, or Trident Polymorphic Engine, was . It is fThe . TPE is not actually a , but rather a polymorphic encryption engine is used as part of the entry. The encryption produced by the encryption engine is extremely complex and in respects to the DAME encryption engine. engine can be identified by the presence of the encryption engine . At the of its submission, one Girafe, exists uses TPE for its encryption. Girafe uses 1.1 of the Trident Polymorphic Engine. An 1.2, has , but not encorporated it. The entry $is for the Girafe , and future using encryption engine be listed and researched. The the Girafe the Girafe at the top of but blow the ', hooking , as qby the DOS @by 8,960 |12's !moved. the Girafe , it pof 3,039 - 3,117 at the end of the a. The >and in the DOS . The in the 5in Girafe "COSCCLVSNEHTTBVIFIGIRAFEMTBRIM" "[ MK / Trident ]3 RV" "Amsterdam = COFFEESHOP!" The Girafe on Thursdays, at Ma graphic cannabis (marijuana) leaf and the "legalize cannabis". (es) use the TPE engine are: Beethoven: The Beethoven in March, 1994. It is a uof . -and . . Its at the top of $the 'is 2,048 ), hooking {1C and 21. , it -and . are Xor openned, as well as 1,718 - 1,745 the at the end of the a. The >and in the DOS not be . The in the Beethoven 5in all "Beethoven is here . And now, enjoy the music..." The in the all "EMS Page Frame Mappable Pages" Beethoven may play music on the speaker. March, 1994. Bosnia: The Bosnia . It is uof . -and . . Its at the top of $the 'is 9,216 ), hooking |21. , it -and . , but not 3,146 - 3,245 at the end of the The >and in the DOS not be . The in the Bosnia 5in all "HELP BOSNIA, BEFORE IT'S TOO LATE!" "[ MK / TridenT ]" "[TPE 1.4]" Bosnia Nn't to do Civil War IV v1.1: A later of the Civil War Civil War IV v1.1 is a of . ,. It in the pof 2,018 - 2,127 at the end of the a. The in the DOS not be The in the Civil War IV v1.1 5in all "Civil War IV v1.1, (c) Jan '93 *.com" "For all i've seen has 1my mind But still the wars go on as the years go by no love of God or human rights Cause all dreams are swept aside By bloody hands of the hypnotized Who carry the cross of homicide And history bears the scars of our Civil Wars." "[ DH / TridenT ] [ MK / TridenT ]" "[TPE 1.3]" : The March, Civil War V v1.0: A later of the Civil War IV v1.1 , Civil War V v1.0 is a of . at the top of , but X, hooking |21. , as qby the DOS @by 8,192 , it pof 2,068 - 2,161 at the end of the a. The >and in the DOS not be . The in the Civil War V v1.0 5in all "Civil War IV v1.0, (c) Jan '92" "DH[ DH / TridenT ][ MK / TridenT ]" "[TPE 1.3" : The March, Coffeeshop 4: , Coffeeshop 4 is a uof . uses the TPE engine for its encryption. It is on the Coffeeshop were and were created. The the "Find me!" The TPWorm Nnot always . It Bthe companion . , the companion `created by 12,969 are not hidden, and are in the . The can be in the TPWorm companion ".com .exe" "PATH ; ; ; \ *.exe .com rb wb . "Find me!" "Packed ais corrupt" TPWorm Nn't to do Mits and PZPAPN Traceback 00_ F PT_ : Traceback 3066, TB Extinct , 1988 i; TSR; graphic M1 hour R: 3,066 5: PRsA - , NAV, , NAV, CleanUp, or The Traceback vboth . -and . `, adding 3,066 )to the of the X, it ly, if the ?5, 1988, it attempt to wone -or . ain the E. If an Nn't exist in the E, it search the entire K, starting at the root E, looking for a candi search process terminates if it encounters an before finding a candi >non- derives its ftwo characteristics. 9the Epath of the acausing the in the 5, thus is it possible to "trace back" the tthrough a number of `. Second, succeeds in a, the attempt to access the on- Kcopy of the the copy of the was loaded it can up >a counter in the . The takes over Uhandling while trying to >the , so if it can't wit, the be unaware The primary symptom of the Traceback having if the ?28, 1988, the produce a cascading effect to the Cascade (1701/1704) . The cascading s one hour If a keystroke is entered fthe during lockup one minute, the restore ing to positions. cascade and restore Mare repeated by the at one hour intervals. of Traceback are: Traceback-B: to the Traceback , the major differences are Traceback-B ,and is no cascading Meffect for one hour. 9the of the became , but instead the of the a. A "MICRODIC MSG" can be Traceback-B. If the whose copy of Yany in a Uand the #halted. : Spain, March Traceback-B2: to Traceback-B2, has the cascading Meffect for one (1) hour. The " XPO DAD " replaces the "MICRODIS MSG" in Traceback-B. : Spain, May See: Spanish Traceback 3029 Traceback II PZPAPN Traceback 3029 : Traceback 3029 Traceback-4 i; TSR; graphic M1 hour R: 3,029 5: PRsAK - , NAV, The Traceback 3029, or Traceback-4, . Its . Traceback 3029 is a uof . and . ,. It hour becoming bTraceback 3029 X, the Traceback 3029 wone . in the E. If the Xhappens to be a . , the a low TSR of 7,696 ). It {1C, 20, 21, and 27. If the not a . , the until the Ys an Traceback 3029 , it and . X. In addition to the , the wone -or . . Traceback 3029 pof 3,029 ). The at the end of the a. The >and DOS . The can be in the "BASE" "SPC FIL" Traceback 3029 it has for one hour. At , all the 4on the "cascade" into a pile at the bottom of the minute has elasped, the be restored to its "pre-cascade" See: Spanish Traceback Traceback II PZPAPN Traceback II : Traceback II 2930 Extinct , 1988 i; TSR; graphic M1 hour R: 2,930 5: PRA - , NAV, , NAV, or The Traceback II is a of the Traceback (3066) It is believed Traceback II pre >s the Traceback however the Traceback }and reported b. As the Traceback , the Traceback II and vboth . The comments qfor the Traceback generally apply to the Traceback II the exception pis 2,930 )instead of 3,066 of Traceback II are: Traceback II-B: to Traceback II, the cascading effect s, the not be restored, instead the be hung requiring it to be powered off and See: Spanish Traceback Traceback 3029 PZPAPN Traveller 00- R !PT- : Traveller Bupt R: 1,220 - 1,237 5: PRhAK - 6.60+, NAV 3.0A06+, 6.64+, 1.0A06+ The Traveller . It is reported ated in the . Traveller is a generic uof . -and . The Traveller is X, the Traveller at the top of $the , as measured by the DOS @by 1,840 the in high , as well as |24 in low |12's !moved. Traveller is , it -and . X. It wone X, or a DOS DIR 6is issued. Traveller of 1,220 to 1,237 at the end of the be no 3to the and in a DOS Traveller 9the "Traveller (C) BUPT "Don't panic I'm harmless <<--- "*.* It is if Traveller of Traveller are: Traveller-B: as BUPT-B, is 1,840 ), hooking |21. It -and . or one a DOS DIR 6is performed. of 1,220 ). . 1,223 to 1,238 ). In both cases, the at the end of the a. The in the DOS not be . The can be all Traveller-B "*.* !--->> Traveller (C) BUPT .4 Don't p Traveller-C: is 2,032 ), hooking |21. It -and . or one a DOS DIR 6is performed. of 1,261 ). . 1,261 to 1,278 ). In both cases, the at the end of the a. The in the DOS not be . The can be all Traveller-C "*.* !--->> Traveller (C) BUPT IE .4 Don't panic,I'm harmless !<<---" Traveller-C2: is a very minor of Traveller-C, and is Traveller-C3: is a very minor of Traveller-C, and is PZPAPN Tremor : Tremor 7(particularly in Germany) G: March, ; minor shaking of Germany R: 4,000 5: PRhEK - , NAV 3.0+, 3.96+, 30.00+, 6.64+ The Tremor in March, , and is fGermany. Tremor is a ,and . It is an "anti anti- 9ing checks to avoid detection by software. bTremor X, the Tremor at the top of $the ', hooking {15 and 21. If, however, upper or extended , the zmost of its instead, a hook to it in qby the DOS @by 4,288 , the wthe copy of ed to by the -SPEC variable. , the Tremor X, adding 4,000 )to the The be hidden Tremor is The at the end of the a. The >and in the DOS , but actually lhad 100 to the years field in the is the tmarker for the Tremor is an , and no the the Tremor [a sluggish response to 6s and be detected by the , but not Tremor is not in Tremor has !present on the for over three months, a slight shaking effect of the contents of the Mmay accompanied by a hang. The clear the Mand Mthe on the monitor: "-=> T.R.E.M.O.R was done by NEUROBASHER / May- '92, Germany <=- -MOMENT-OF-TERROR-IS-THE-BEGINNING-OF-LIFE-" a few seconds, the to "normal". The Tremor is a full , dis are read into . As a are Xto check achecksums/CRCs, or for the presence of the bverifying it isn't in not find the `. It checks for the presence of monitoring ly, Tremor is polymorphic, and an algorithmic approach must be used for detection. PZPAPN Trident 005 O PT5 : Trident See -and/or . possible The R: Depends on Present 5: PNRAK- n1.04+, 2.58+, 6.64+ The Trident entry represents a group of were written by members of the Trident writing group in The es are . -and/or . us, and may or may not be . At least one of the es in group, Trident 90210, is a The are members of the Trident ]are: Trident 90210: , Trident 90210 is as the 90210 BH . It is a uof . ,. Trident 90210 at the top of $the ', hooking and 21. , as by the DOS @by 896 , it 647 be hidden the . The at the end of the a. The >and in the DOS not be . The in the "[90210 BH]" "John Tardy / TridenT" The DOS indicate all : The Trident-444: , and as the Servant , Trident-444 is a uof . ,. It vone . in the X. It Nnot on the A: Trident-444 pof 444 the at the end of the a. The >and in the DOS not be . The in the "CAVAGUCO4DVSTB" "*.CoM" "John Tardy / TridenT" not function : The Trident-611: , Trident-611 is as the Bugfix 1.1 . It is a uof . ,. Trident-611 at the top of but $the ', hooking {1C and 21. , as qby the DOS @by 624 , it pof 611 at the end of the a. The >and in the DOS not be . The in the "[TridenT]" "{V1.1 Bugfix}" "OROiOgOhOaOrOdO OZOwOiOeOnOeOnObOeOrOgO OmOaOdOeO OtOhOeO ODOUOTOCOHO-O5O5O5O OVOiOrOuOsO!O!O!O" It is what Trident-611 : The See: Darkray Flue PZPAPN Trigger : Trigger i; possible beeping speaker; R: 2,520 - 2,696 5: PRtAK - 2.58+, 6.64+, 2.58+, 6.64+ The Trigger , and is Phalcon/Skism writting group in the . Trigger is a uof . -and . ,. It is more or less a proto uses the Dark Angel Multiple Encryptor engine for its encryption, thus making it a polymorphic . It is the to use engine. bTrigger X, the Trigger at the top of $the ', moving |12's , as qby the DOS @by 6,144 mby the , as well as 21. The hooking of |21 is accomplished using a tunnelling technique, so mapping utilities not map it to the the Trigger , it accompanied by beeping on the speaker. pof 2,520 to 2,696 at the end of the . The >and in the DOS not be . The in the Trigger "Trigger by Dark Angel of Phalcon/Skism" "Utilising Dark Angel's Multiple Encryptor (DAME)" Trigger Nn't to do PZPAPN : Troi G: March, ; output not be written to input 4may not Michigan, R: 322 5: PRaCK - , NAV 3.0+, .2.0+ The Troi }in the state of Michigan in the United States in March, is a of . The the Troi , hooking Fly in the be no qby the DOS the Troi , it X. If the Troi pof 322 at the end of the a. The >and the DOS not to the >. The s in the Troi "The Troi the Troi may notice d on the may not on the M, or output should be written to not actually be written to the of Troi are: Troi-2: Simultaneously }in Finland and Australia in May, of Troi May 19, . It are X, adding 512 )to the end of the a. The >and not be the DOS . One the ">>>-Troi Two -->" The remap the it is May, Troi-2B: gequivalent to Troi-2, Troi-2B is a very minor Troi-2C: gequivalent to Troi-2, Troi-2C is a very minor PZPAPN TSoft : TSoft TSoft-547, TurboSoft, TurboSoft-547 seconds set to "62"; Poland R: 547 5: PNCK - , NAV 3.0+, The TSoft, or TurboSoft, . It fPoland. TSoft is a uof . ,. It is the the TSoft X, the TSoft wone . in the pof 547 at the end of the a. The >and in the DOS not be the seconds field in the !set to "62". The can be the 5in all TSoft "TurboSoftware" TSoft a portion of the of TSoft are: TSoft-598: A 598 of the TSoft vone . in the pof 598 ). The seconds field in the in the DOS be set to "62". The can be in the 5in all TSoft-598 "\dos" "T.Software -Death 1.0" TSoft-598 a portion of the : Poland See: PZPAPN Tu-482 : Tu-482 R: 482 5: PRhCK - 3.96+, NAV 3.0+, 6.64+, 1.25+ The Tu-482 , and is fthe . Tu-482 is a uof . larger bTu-482 X, the Tu-482 at the top of $the ', hooking |21. , as qby the DOS @by 512 |12's !moved. the Tu-482 , it larger 8K in pof 482 the at the end of the a. The and in the DOS not be . No in the 5in Tu-482 It is if Tu-482 PZPAPN : Tula Tula-419 R: 419 5: PRtCK - , NAV 3.0+, .2.0+ The Tula, or Tula-419, . It is fthe . Tula is a ,. It Nnot all The the Tula Tula at the top of but $the |12's moved. , as qby the DOS @by 1,024 21 and 22 mby Tula in the Tula , it larger pof 419 at the "of the . The >and in the DOS to the >and One in the Tula "Tula .Sat" of Tula are: Tula-417: as the F-Word or F-You is an earlier of the Tula Its is 1,024 ), hooking 08 and 21. , Tula-417 by 417 the at the end of the a. The >and in the DOS to the . The can be din all "Fuck You!" Tula-417 may [difficulties executing . , such as EDLIN. require 6line input. Tula-593: The Tule-593 is a 593 of the Tula . Its is 1,024 hooking {08 and 21. , Tula-593 -and . by 593 at the end of the a. The >and in the DOS not be . One can be at the end of Tula-593: "TR" Tula-593 may [difficulties executing . , such as EDLIN. require 6line input. Tula-635: The Tule-635 is a 635 of the Tula . Its is 1,024 hooking {08 and 21. , Tula-635 -and . by 635 at the end of the a. The >and in the DOS not be . No in the Tula-635 may [difficulties executing , such as EDLIN. require 6line input. Tula-1480: The Tule-1480 is a 1,480 of the Tula . Its is 2,048 hooking {03 and 21. , Tula-1480 -and . for any reason. by 1,480 by 1,480 to 1,494 In either case, the at the end of the a. The >and in the DOS not be . No in the PZPAPN Tumen : Tumen Tumen V.5 G: May, ; music and graphics; R: 1,663 5: PRhCK - , NAV, .2.0+ The Tumen, or Tumen V.5, Vin May, ated in the . It is a uof . bTumen X, the at the top of but $the , as measured by the DOS by 4,096 {09 and 21 mby the Tumen is , it X. If X, it of 1,663 at the end of the a. The >and in the to the >and The in the Tumen "Full moon tonight... The of Wolfbacks... U...U...U... demonstration , but you hear howl." "(C) Copyright MMA Company All rights reserved. Tumen -v0.5 was created in Tumen by group of three Wolfbacks at General `affecting effects by Max Main consultant -- Tall Lazy Micle General Music_&_Video harmless effects by Alex BACKWOLFS OF THE WORLD, UNITE!!" The bset of s near the "of the the remaining at the end of the Tumen should produce graphic and musical effects upon event ring. of Tumen are: Tumen V1.2: , Tumen V1.2 is a later of the Tumen pof 1,255 at the end of the a. The >and in the DOS to the >and Tumen V1.3: , Tumen V1.3 is a later of the Tumen pof 1,242 at the end of the a. The >and in the DOS to the >and The can be in the 5in all Tumen V1.3 "Tumen.,v1.3" Tumen V2.0: in May, , Tumen V2.0 is a later of both Tumen and Tumen V1.2. In addition to the behavior of the modify the C: is present. It adds 1,092 )to the . The can be din all "Be carefull... Hackers tonight... present was created in Tumen in v 2.0. (c) Max Soft corporation Hackers of the work, Unite!" Tumen V2.0 may May, PZPAPN Turbo : Turbo Turbo 448, @ , Turbo @, Polish-2, Nagytud anot utilities Hungary R: 448 5: PRCK - , NAV, The Turbo, or Turbo 448, Gin Hungary in is a The the Turbo X, the at the end of the 6Interpreter in mby the The Turbo is unusual in Nnot X. Instead, it are reason Z. For example, if the -is copied to B. both rby the by 448 at the end of the a. The in the to the >and awas r. The can be dat the end of all "Udv minden nagytudasunak! Turbo @" interesting behavior of products are unaware of the Turbo 448's presence in not function the third ais read, the may fail due to a " to open the fourth of Turbo are: Turbo Kukac: Gin Hungary in is a uof . ,. It cthe 6interpreter and any loaded TSRs, decreasing by 1,040 and 21 are mby the . Turbo Kukac for a reason by 512 at the end of the a. The in the DOS . The can be in all "Turbo Kukac 9.9" : Hungary PZPAPN Tver-308 : Tver-308 R: 308 5: PRaCK - 3.96+, 1.25+ The Tver-308 . Its . Tver-308 is a uof . bTver-308 X, the Tver-308 in a "hole" in al , hooking |21. , as qby the DOS not be the Tver-308 , it pof 308 end of the a. The >and in the DOS to the and . The in the 5in all Tver-308 "G.J.V. Tver PZPAPN Twin Peaks : Twin Peaks &failures; Australia R: 1,310 5: ONCK - 6.64+, Bhidden The Twin Peaks fAustralia in Twin Peaks is a the Twin Peaks wone . on the C: O. The Mthe , and to the DOS prompt: "Welcome to Twin Peaks.. Your PC now has the Twin Peaks the Twin Peaks lthe 1,310 be no 3to the >and in the DOS . The `, as are the "*.com*" ?com\" ?exe ?com" See: VirDem PZPAPN Twin-351 : Twin-351 -351, Twin `created & hidden attributes; TSR R: 351 5: SRsA - Spawning , NAV, Bhidden The Twin-351 . Twin-351 is a spawning . It creating a corresponding . Yin place of the . The Twin-351 is X, Twin-351 as a low TSR of 656 mby the , Twin-351 X. Instead of altering the . a, Twin-351 creates a 351 corresponds to the of the . a. For example, if the YABC. W, Twin-351 create ABC. 5. The 351 `created by the the hidden and attributes set so `are not in the As a of the hidden . a, the Twin-351 . If Twin-351 is already , it corresponding . a. If Twin-351 wasn't already Twin-351 hide the hidden `if the Twin-351 in PZPAPN Typo : Typo Mistake , 1989 BSC; -TOM; garbled printout Israel R: N/A 5: BRt - , NAV, \, NAV, CleanUp, or DOS SYS The Typo }in Israel by Y. Radai in , 1989. is a taking up 2K at the upper end of it has The major symptom be noticed on Typo certain 4in printouts are always replaced phonetically 4. Since the substitutes Hebrew letters for Hebrew letters, the was most likely written by one in Israel. Digits in numbers may be transposed or replaced numbers. The substitutions impact printouts , the Mand data in `are not affected. The Typo structurally to the Ping Pong and may be a of Ping Pong. It can be removed by using M K, CleanUp, DOS SYS 6, or just about any Ping Pong dis PZPAPN Typo : Typo Fumble, 867, , 712, Typo-712 Extinct , 1989 -TOM; garbled printout (see England R: 867 5: PRtC - , NAV, \, or The Typo to the Typo garble data is sent to the parallel port it has activated. Unlike the , the . vgeneric breported by Joe Hirst of Brighton, UK, in , 1989. The Typo `on even-numbered days. of Typo -are: Typo-712: Typo-712 is a 712 of the Typo vall . `in the X, adding its 5to the end of the a. Its portion is 224 and hooks |16. It may intermittently interfer input. Typo-867B: Typo-867B is a minor of the Typo . It vall . `in the X. It a 480 *TSR hooks |16. pof 867 at the end of the May, PZPAPN : Tyst `truncated to 3,424 >set to 4-04-92; R: 3,424 5: ONAK - V112+, The Tyst . Its . Tyst is a W, and .SYS the Tyst X, the Tyst copy the s of the the C:\DOS Eto the E. The the 9the but instead of pure copy of the Tyst of 3,424 ). The >in the DOS Eof 4-04-92. The be set to the zero -SPEC, may be created in the The Tyst Ms the ever an "Tyst f r fan.. Jag spr nger!" %the , the can be the 5in all Tyst "C:\DOS\*.*" -SPEC" "/C copy" "NUL" "RoTh" PZPAPN UFA-1201 : UFA-1201 R: 1,201 5: PNCK - NAV 3.0+, The UFA-1201 , and is fthe . UFA-1201 is a the UFA-1201 X, the UFA-1201 wtwo . in the 1,201 at the end of the The >and in the DOS not be . The in the UFA-1201 "*.com" It is what UFA-1201 may do PZPAPN : Ugur Mumcu Turkey R: 1,297 - 1,313 5: PRhAK - 30.00+, n1.04+, 6.64+, 1.25+ The Ugur }in Turkey in . Ugur is a uof . -and . ,. It "commemorates" turkish journalist Ugur Mumcu whom passed away in early bUgur X, the Ugur at the top of $the ', hooking |21. and , as qby the DOS not be |12's not be moved. the Ugur , it for any reason. . the Ugur pof 1,297 ). . by 1,301 to 1,313 ). In both cases, the at the end of the a. The >and in the DOS not be . The in the 5in all Ugur "UGUR MUMCU LMEDi.." turkish phrase translates roughly to: "Ugur Mumcu has not died" PZPAPN Ultimation : Ultimation G: March, 2; hidden starting "_" created; R: 23,802 5: ONE - n1.04+, V112+, V113+, 6.64+, 1.25+ The Ultimation in March, . Ultimation is `. Unlike most one saves a copy of the the Ultimation X, the Ultimation wone . in the E. The bmakes a copy of the bcharacter of the base 1to "_", and sets the hidden attribute. The s the 23,802 )of the host 5. . larger 23,802 p, while those smaller 23,802 23,802 . The >and in the DOS value. The can be in the 5in Ultimation "PATH *. "I'm bored." "Screw you." "Life is a drag." "kufc fof." "Ouch! Don't hit me so "Floppy OA: is flooded. Please insert J cloth." "Murderer." "You rby ULTIMATION corp." "Go Fly to jail. Do not pass go. Do not collect $200." "Ah ha! Caught you." "Copy protection U23. Please re- , one of the may be Las a , possibly accompanied by hang, To dis tof the Ultimation , and remove the hidden attribute the . acopies start the "_" character. The need to be re d so bcharacter of the is restored to its value. PZPAPN Under 7 : Under 7 Paradise R: 320 5: PRaCK - 30.00+, n1.04+, 6.64+, 1.25+ The Under 7 . Under 7 is a uof . bUnder 7 in low , hooking |21. It access the and a hang may the Under 7 , it pof 320 at the end of the a. The >and in the DOS to the >and . One can be dat the end of the 5in all Under 7 PZPAPN UnExe : UnExe R: 425 5: PNCK - NAV 3.0+, 30.00+, n1.04+, 6.64+ The UnExe . UnExe is a non- uof . ,. It the UnExe X, the UnExe wone . in the E. If E, it may of 425 at the end of the The >and in the DOS to the >and . The in the UnExe 5in all UnExe "Viru" "1 /M" The UnExe Bone . in the PZPAPN : Unk G: March, =s corrupted R: 1,015 5: PRhAK - , NAV, The Unk . Its ~are . Unk is a -and . bUnk X, the Unk at the top of but $the , as qby the DOS @by 3,008 the Unk , it for any reason. The hides the `, so it is not noticeable to the the Unk pof 1,015 at the end of the , adding an 1,015 The >and in the DOS Emay to be corrupted. One can be in the 5in Unk "(c) Szegedi & Farmosi Kiss." It is what Unk PZPAPN Urfydus : Urfydus G: May, i; TSR Italy R: 2,638 - 2,653 5: PRsAK - , NAV 3.0+, The Urfydus }in Italy in May, is a uof . -and . ,, but not very small . -and . . Its is italian, and translates to "Nasty" in english. The Urfydus is as a low TSR of 3,152 ), hooking {21, CC, and F8. Urfydus is , it -and . X. If the fa write protected J, the attempt wthe ing in the hanging while it to write to the write protected Urfydus of 2,638 to 2,653 ). The at the end of the a. The >and in the DOS . The can be in the 5in all "C:\SYSTEM\ ,MMAND. It is what Urfydus PZPAPN Uruguay : Uruguay Uruguay 3 j; music; Uruguay R: 2,552 - 2,637 5: PRhA - The Uruguay, or Uruguay 3, and is fUruguay. Uruguay 3 is a -and . , but not ,. Uruguay 3 and the later s of are polymorphic, using a complex encryption mechanism to complicate ability to be detected by products employing ning technology. An algorithmic approach is required to detect the Uruguay 3 X, the Uruguay 3 at the top of $the , as qby the DOS @by 5,120 |mapping indicate many use both |13 and 21 via a tunnelling technique. the Uruguay 3 , it and . pof 2,552 - 2,637 at the end of the a. The >and in the DOS not be . The in the Uruguay 3 notice slow response to 6. The s be accompanied by tones on the speaker. "'Uruguay-#3' med in Montevideo (URUGUAY) by F3161. 06/92 is a research - DO NOT DISTRIBUTE" is not `as it is of Uruguay are: Uruguay 4: on the Uruguay 3 Uruguay 4's is 5,456 ). It adds 2,718 to 2,859 )to the . -and . Zand aopen for read- . The Lby the accompanied by a tune on the speaker is: "'Uruguay-#4' med in Montevideo (URUGUAY) by F3161. 07/92 is a research - DO NOT DISTRIBUTE" : Uruguay Uruguay 5: on the Uruguay 4 , Uruguay 5's is 8,352 of Uruguay at all, but stays the presses CTL-ALT-DEL: "'Uruguay-#5' med in Montevideo (URUGUAY) by F3161. 08/92 is a research - DO NOT DISTRIBUTE" As Uruguay 5 Nnot , it is included here for xal purposes, and is not used for product testing. : Uruguay Uruguay 6: on the Uruguay 5 Uruguay 6's is 9,504 ). It adds 4,879 )to the . -and . Zand aopen for read- . The pis hidden Uruguay 6 is . The DOS detect all Uruguay 6 is in . The Lby the accompanied by a tune on the speaker is: "'Uruguay-#6' med in Montevideo (URUGUAY) by F3161. 11/92 is a research - DO NOT DISTRIBUTE" : Uruguay PZPAPN Uruk-hai : Uruk-hai R: 394 5: PRxCK - 3.96+, .2.0+, 1.25+ The Uruk-hai , and is . Uruk-hai is a uof . -progams, bUruk-hai in a "hole" in low al , hooking |21. , as qby the DOS not be the Uruk-hai , it X. If X, it the Uruk-hai pof 394 at the end of the a. The >and in the DOS to the >and . The can be in the 5in all Uruk-hai "V 1.0 Igor, The Uruk-hai are upon you!" of Uruk-hai are: Uruk-hai 300: A 300 of the Uruk-hai resides in a "hole" in al , hooking |21. It X, adding 300 . The the end of the a. The >and the DOS to the >and . The can be in the 5in all Uruk-hai 300 "Igor v.2.0 The Uruk-hai and winged Nazgul strikes again!" Uruk-hai 361: A 361 of the Uruk-hai at the top of $the ', moving |12's and , as qby the DOS @by 1,024 mby the . It X, adding 361 . The the end of the a. The >and the DOS to the >and . The can be in the 5in all Uruk-hai 361 "Igor v.3.0 It was last assault of the Uruk-hai... We shall meet in Valhalla!" PZPAPN damage; j; long load R: 576 5: PNE - , NAV 3.0+, The in the . It is generic uof . X, it search the Efor the a. If it finds one, it attempt to wit. a, it hang the leaving the Olight on, however most of the successful. by 576 to 586 at the end of the may go to its to find !removed, and the ) has damaged, thus rendering the Kinaccessible. damage can be repaired using Norton KDoctor, or M the /P option. [longer normal load X. The longer normal load is due to the searching for a w, and sthe candi aif one was PZPAPN V-311, -311, Com2Con d to -MAND.CON R: 311 5: PNCK - /, NAV, The 311, or V-311, . It ated in the is a 311 is X, the check the to see if the seconds value is equal to one of 16 values. If it was equal to one of those 16 values, be re d to -MAND.CON. Whether or not the , the in the by 311 ), the at the end of the a. The in the be modified to be 11:19:32, the tmarker for . The >in the Eis not alter the aattributes for the ain the E. In particular, bits 8 through 15 be reset, may produce unexpected s in en ments make use of bits. PZPAPN -492, RC492, 492 R: 495 - 508 5: PRfCK - \, NAV, The and is is a u, it 492 is X, the in high but $the is not reserved by the mby the . At the of going , the check to determine if ,on the C: r, if it isn't, 492 is , it wany . ,on the A: Ois the way to ,on A:. 495 to 508 ). The at the end of >and the 1to the >and Nnot to do PZPAPN Leapfrog, V516, 516 R: 516 5: PRCK - \, NAV, The . It is is a uof . ,. It The X, the in a "hole " between MSDOS and the DOS Stacks. area labeled DOS Data. mby the be no , it had an greater pd by 516 ), the at the end of the Nnot to do . The sample was not a natural , so may be a research PZPAPN -600, V600, 600 R: 600 5: PRhCK - \, NAV, The , and is is a uof . 600 is X, the at the top of $the '. The DOS indicate are 2,048 )less expected. Nnot move the 600 uses {21 and 24. 600 is , it of at least 600 by 600 ), and the at the "of the It is PZPAPN -707, V707 R: 707 5: PRtCK - , NAV, The . It is is a uof . at the top $the '. It move the cannot be 707 makes use of |21, map to the in high be 720 )less expected. 707 is , any . rby the pof 707 ), the at the end of the a. If X, it It is PZPAPN -711, 699, V711-2 R: 704 - 719 5: PRhC - \, NAV, The , and comes the is a uof . Nnot 711 is X, the at the top of $the is reserved. The hooks {08, 13, and 21. The DOS indicate is 704 )less what the expects. The is not 711 is , any . had an of at least 1600 rby the by 704 to 719 ), and the at the end of the 711 may notice occasional It is occasionally hang the PZPAPN -948, V948, 948 R: 948 5: PRhA - \, NAV, The , and in the is a uof . `, and 948 is at the top of $the '. The not be in use by the reserved. {1C and 21 mby the 948 is , and . -or . for any reason rby the the exception of by between 950 to 963 ). In the case of ,, the a portion of the stack space in the a, so the 3. In all cases, the >and s in the Eare not lthe at the end of the It is PZPAPN 1014 R: 1,014 - 1,028 5: PRhA - 3.96+, n1.05+, .2.0+, 2.58+ The 1014, or 1014, . It is fthe 1014 is a of . -and . ,. It smaller The 1014 at the top $the , as qby the DOS @by 1,040 {10, 21, and 60 1014. , the 1014 -and . pof 1,014 to 1,028 at the end of the a. The >and in the DOS not be . No in the The 1014 alter . smaller , adding 2 to 30 )to the `are not r, and continue to function PZPAPN RCE-1049, 1049 and R: 1,049 5: PRhA - , NAV, The 1049 . It in the is a uof . `, and Nnot 1049 is X, the at the top of $the be 1,056 and is reserved. The is not moved. mby the 1049 is , the X. The , however, wvery small . by 1,051 to 1,064 ), the at the end of the 1049 is unusual in 5to support a 5via a special |21 call the 5may !used by the author developing the to stop it 1049 occasionally actually be 1049 Nnot do See: Alfa PZPAPN V2144, 2144, 2144-B R: 2,144 5: PRhAK - \, NAV, The 2144 , and is the is a uof . 2144 X, the at the top $the '. The DOS indicate values show 4,608 )less expected. Nnot move the . The Fly alters the |page in Ythe 2144 is , and greater in reason rby the by 2,144 ). . by 2,144 to 2,159 ). In both cases, the at the end of >and in the and Nnot hide the It is 2144 2144 are: 2144-B: in March, gequivalent to the . The ' encryption has !slightly modified. PZPAPN : V-1n V-10, V-11 G: May, R: 113 or 624 5: ONCK - The V-1n group of es was in May, group's . The es in entry are earlier s of the Cin the V-3n entry. Unlike the Cin the V-3n entry, the Chere are es. The earliest of the es, V-10, entry, member of the group $. Both of the es in entry the V-10 wthe third . in the b624 )of the . The ed to the DOS prompt. %having the b624 )of the host 5of the V-10 >and in the DOS to the >and . If the host smaller ), it 628 larger p. The can be in V-10 "V - V-10 Nn't do , destroying the host Member(s) of the V-1n group of es are: V-11: A later of the V-10 s the b113 )of the . v. The in the "V - 1.1". May, See: V-3n PZPAPN : V-3n V-30, V-31, V-32 i; seconds in set to 00 R: 268 5: PNCK - .2.0+ The V-3n es was . The earliest of the es, V-30, entry, ]members $under . All of the es in ]are us of . V-30 is X, the V-30 wone in the E. If ,resides in E, it may V-30 268 ). The at the end of the The seconds in the in the DOS be set to "00", is the marker the uses to determine if the ais already r. The din all V-30 "*.com V - V-30 Nn't do Members of the V-3n es are: V-31: to the V-30 adds 266 to the . v. The is now: "*.com V - 3.1". V-32: to the V-30 adds 274 to the . v. The is now: "*.com V - 3.2". See: V-1n PZPAPN V270x : V270x 268-Plus G: May, R: 268 - 272 5: PNC - NAV, The V270x Vin May, . V270x is uof . `. It V270x is X, the wup to five . in the E. The by 268 ). The second pby 269 ). The third through fifth by 270, 271, and 272 ), respectively. In all cases, the at the . The and in the not be V270x s to not do PZPAPN : V351 V-351 fail to function R: 351 5: PRhCK - The V351, or V-351, . Its . V351 is a uof . bV351 X, the V351 at the top of $the ', hooking |21 at address 7D00. |12's !moved. the V351 , it pof 351 at the end of the a. The >and in the DOS not be . One in the 5in V351 the V351 fail to function PZPAPN : V388 V-388 R: 388 - 403 5: PRhCK - 3.96+, NAV 3.0+, 1.25+ The V388, or V-388, , and is fthe . V388 is a uof . ,. It is not likely to a serious threat in its present form. bV388 X, the V388 at the top of $the ', hooking |21. , as qby the DOS @by 102,400 |12's !moved. the V388 , it pof 394 to 403 at the end of the a. The >and in the DOS not be . No in the 5in V388 the V388 [frequent PZPAPN : V483 R: 483 5: PRAK - The V483 . Its . V483 is a uof . -and . V483 is becoming wthe next . -or . X, it r. At , the hung has completed sthe V483 483 ). The at the end of the . The >and in the DOS to the >and . V483 hex "FF" 4, thus permanently corrupting them. usually not PZPAPN : V651 Eddie 3, Sofia, R: 651 5: PRtA - , NAV, : CleanUp, or The V651, or Eddie 3, }in Sofia, by Vesselin Bontchev. V651 is believed to written by the same author as <, V1024, and V2000. is a generic ufor . -and . The V651 is X, the . Using the DOS , as well as @by 688 Later, as of 651 )or greater are rby the by 651 not be seen by performing a present in . The Kspace adjusted by the Kspace due to the 's activities cannot be seen. Powering off the &ing clean J, followed by issuing a in the correct Las well as the actual space on the `can be easily identified as the "Eddie Lives." s near the end of the be 651 )longer expected is not present in A side effect of the V651 lost clusters may if the 6is used. While not for all `, the number of Treported by be much higher statistically V651 is present. Unlike for Whether the rdepends on the of the . it is attempted to be X. In no event is a . asmaller 1024 r, but not all . `over 1024 )are reither. The V800 increasing by 800 t. It Nnot, however, `more eight of V800 are: V800M: Very to V800, the major difference is V800M `on both aopen and putting into the " category. the 8,192 not lthe "Live Death" in it. PZPAPN : V801 V791, V-801, 805 G: March, R: 791 5: PNAK - , NAV, : CleanUp, or The V801 in March, fthe is a uof . . It V801 is X, the search the Efor an . If one is d, it wthe . If an is not d, the search for an in the E, and V801 by 791 to 808 ). . lthe ". . lthe at the end of the a. The >and in the not be may cause a hang attempted to be V801 Nn't to do PZPAPN : V82 aalternation; R: 2,000 5: PRhAK - \2.13+, The V82 . The submitter awas (. V82 is a uof . -and . , and internally , but not actually 9a replicating copy of the The V82 is X, the V82 at the top of $the , as qby the DOS @by 8,192 |12's moved. mby the . It za 48 *portion in low , V82 either wor alter . -and . In the case of . over 2,000 at the end of the rmany s as the Nnot recognize the already it is later Xby the by 2,000 tof the on the a. V82 wor alter . `smaller 2,000 rby the fairly large, and usually not lany the part of the host . In most . `, however, the not actually wthe abut a portion of the 9ing 00h 4, thus altering it. 5may actually be a trojan if it is by the host It is what V82 See: Phoenix Phoenix 2000 PZPAPN V1024 : V1024