Dr Solomon's Virus Encyclopedia Index

Dr Solomon's Anti-Virus detects well over 10,000 viruses.  Below you'll find a list of some of the most commonly found viruses, with detailed information about what they do.

Please note: This is NOT the complete list of viruses that Dr Solomon's Anti-Virus detects.  Further descriptions can be found on our website (http://www.drsolomon.com), or contact our technical support department.

Copyright © 1989-1997 Dr Solomon's Software Limited.  All Rights Reserved.

#

100 years

1099

1575

15 years

2KB

3APA3A

3 Tunes

69

A

Ahav

Aija

Alfons

Angelina

AntiCMOS

AntiDMV

AntiEXE

Arara

Armee

Athens

Atom

Avispa.2048

Azusa.d

B

B1

Baclab

Bandung

Barrotes

Bath

Batman

Beijing

BFD-451

BigMouse

Black Avenger

Bloomington

Boot-437

Boot-c

BootEXE.451

Brain

Brasil

Breasts

BuptBoot

Bupt 9146

Burglar

Butterflies

Butthead

Bye

ByeBye

Byway

C

Campana

Cansu

Cavaco

Cawber

Casino

Century

Chance.B

Chill.554

Chinese Fish

Claws

Clock

Coffeeshop

Colors

Columbus Day

Concept

Concept.j

Corgi

CPW

Crazy Boot

Cruel

D

D3

Da'Boys

Dallas Cowboys

Dark Avenger 1800

Datacrime

Datalock

Deeyenda

Delwin

Desperado

DH2

Diablo

Diana

Die Hard

DieLamer

Dir II

Dir.Byway

Disk Filler

Doom II Death

E

Eddie 1

Ekaterin

Ekaterinburg

EMF

Empire.Monkey

Enemy

Espejo

Essex

Esto te pasa

Exebug

Explosion II

Extra

F

FAT Avenger

Feint

Fichv

Fifty boot

Filler

Findme

Finnish.357

Finnish Sprayer

Fish 6

Fish Boot

Fist

Flip

Floss

Form

Freddy

FreeLove

French boot

Frodo

G

Galicia

Gdynia.680

Ginger

Goblin

Goddam Butterflies

Goldbug

Good Times

Grandma's Grave

GranGrave.1150

Green Caterpillar

Green Cat

H

Hahagif

Harakiri

Hare

Hari

Havoc

HDEuthanasia

Helloween

Hidenowt

HLLO.Harakiri

HLLO.Messanger

HLLO.Novademo

HndV

Hot

I

IHC

Infector

Int_7F

IR&MJ

Irina

Istanbul

J

J&M

Jack the Ripper

Jackal

Jakarta

Jerusalem

Jerus3

Jimi

Jimmy

Joshi

Jumper

JuneTunes

Junkie

K

Kaczor.mp.4444

Kamikaze

Kampana

Kaos4

Keeper.Lemming

Keypress

Krsna

L

Laroux

Lehigh

Lemming

Lenart

Lennon

Liberty

Lixi

Lyceum

M

MacGyver

Major

Maltese Amoeba

Mange-Tout

Manzon

Marijuana

Markt

Matteo

MCGV

Mediamarkt

Michelangelo

Mierda

Mirea

Misis

Mongol

Mongolian

Monkey

Musicbug

N

N8Fall

Nado

Natas

Necros

Neurobasher.N8Fall

Neurohavoc

Neuroquila

Neuville

Newboot_1

NewBug

New York Boot

New Zealand

Nightfall

No_Frills

No_Frills.Dudley.1153

NoInt

Nov17

November_17th

Npad

Nuclear

NYB

O

Odious

Omicron

One_Half

Orsam

P

Parity.b

Parity.Boot.Enc

Pasta

Pathogen

PC Byte Bandit

Peter2

Ph33r

Pichincha

Pinworm

PHX

PUX

Pindonga

Pirates Hat

PKZ300

PKZip 3.00 trojan

Prank Macro

Predator

Pretentious.680

Q

Qrry

Quandary

Queeg

Query

Quickie

Quicksilver

Quicky

Quox

R

Red Spider

Reverse

Ripper

RPS

Russian Flag

Russian Hook

S

Sampo

Sanded

Sarampo

SatanBug

Satria

Sayha.4000

Sayawat

Screamer

Screaming Fist II

SheHas

Shoo

Sibylle.858

Sigalit

Sillybop

Sleep_Walker

Slovak Bomber

Slydell

SMEG.Pathogen

SMEG.Queeg

Square

Starship

Stat

Stoned

Stoned.Angelina

Stoned.Satria

Swiss

Swiss Army

Swiss Boot

T

Taipan.438

Taipan.666

Tchechen

Telefonica

Tentacle

Tequila

Three Tunes

Titz

Tornado

Tracker

Track Swap

Trakia

Trekrar

Tremor

Trkswap

Trojector

Turbo

U

Ugur

Unashamed

Urkel

Uruguay

V

V-sign

Vacsina

VLamix

V.1376

V2P6

VCL.Markt

VCL.Werbe

VCL-3.DI

Vinchucha

Virogen.Pinworm

Viva

W

W-Boot

Walker

Watpu

WBMV

Wedding

WelcomB

Werewolf

Wewo

WinWord.AntiDMV

WinWord.Atom

WinWord.Bandung

WinWord.Colors

WinWord.Concept

WinWord.Concept.j

WinWord.Extra

WinWord.Hot

WinWord.Npad

WinWord.Nuclear

WinWord.Wazzu

Wllop

WordMacro.AntiDMV

WordMacro.Atom

WordMacro.Bandung

WordMacro.Colors

WordMacro.Concept

WordMacro.Concept.j

WordMacro.Extra

WordMacro.Hot

WordMacro.Npad

WordMacro.Nuclear

WordMacro.Wazzu

WM.AntiDMV

WM.Atom

WM.Bandung

WM.Colors

WM.Concept

WM.Concept.j

WM.Extra

WM.Hot

WM.Npad

WM.Nuclear

WM.Wazzu

WXYC

X

X-Boot

XM.Laroux

XPEH

Y

Yale

Yankee Doodle

YD

Z

Zaraza


3APA3A

Alias: Zaraza (the pronunciation in Russion of 3APA3A). 'Zaraza' means 'infection' in Russian.

A new and unique boot sector virus has appeared in Russia. The virus was named "3APA3A" (in Russian slang, it means "INFECTION"). The virus was found in the wild in Moscow, between 12th and 14th of October 1994.

The virus uses a complex infection method that seems also to be a completely new one. Like other boot sector viruses, 3APA3A infects the boot sectors of diskettes. However, on hard disks the virus infects the DOS core file IO.SYS. The diskette boot sector infection mechanism is like that of many other boot-sector viruses, but the hard disk infection method is unique. Because of this, the virus is deemed to belong to a new virus class, known as "kernel infectors". The size of the virus size is 1024 bytes (i.e., 2 sectors). On a diskette, the first half of the virus code is stored in the boot sector. The original diskette boot sector and the second half of the virus code are stored at the very end of the diskette's root directory. This means that when the virus infects a diskette, it also overwrites the last two sectors in the root directory.

When a computer is booted from an infected diskette, the virus tries to infect the first file in the root directory of the active DOS partition (this file being usually IO.SYS). The virus begins by making a copy of the IO.SYS file, after which it infects the original file. After the infection, the root directory contains two IO.SYS entries. The first is not shown in a directory listing, however, because the virus sets its volume-label bit. The directory entries point to the two IO.SYS files. The first, infected IO.SYS is located in its customary place at the beginning of the root directory. It contains the virus code, 1024 bytes, in its beginning, but is not otherwise changed. The second IO.SYS directory entry points to the copy of the original IO.SYS file, which is located at the end of the partition. The copy is not infected.

When DOS is started during the computer's next boot-up, the infected IO.SYS is executed and the virus loads itself into memory like any other boot sector virus. It will then infect all non-write protected diskettes that are used in the computer.

Infected hard disks carry the label "IO SYS". The label can be seen with the DIR and LABEL commands. This label cannot be changed even with the LABEL command.

The 3APA3A virus is mildly polymorphic - the boot sectors of infected diskettes vary slightly. Only the string 'MSDOS 5.0' is visible at the beginning and, obviously, the 55AA marker is present at the very end of the boot sector.

The virus contains the message  "B BOOT CEKTOPE 3APA3A!" (which means "IN BOOT SECTOR - INFECTION!") The message string is encrypted, and cannot be seen even in memory. In August, the virus displays its message during every computer boot-up.

The 3APA3A virus does not contain destructive routines.

Because of a bug, the virus frequently hangs 386/486 computers. 3APA3A can only infect hard disks whose active DOS partition is bigger than 10.6 MB.


Ahav

Description:

This virus was originally distributed in an Internet newsgroup in an infected copy of the archiving tool, PKARC.

Ahav is a primitive (although encrypted - primitively) non-resident COM infector, 377 bytes long.  Every time an infected program is run, it infects another .COM in the current directory.  The virus contains (beneath the encryption) the text:

[AHaV] Gothmog/DHA

*.COM

DHA stands for the Digital Hackers' Alliance.


Alfons

Variants:  1344, 1536

Description:

Alfons is a non-encrypted, memory-resident COM and EXE file infector. It uses a prepending method of infection for COM files, and appending method for EXE files.

The Alfons.1344 variant (which is actually an improved variant of Alfons.1536) uses 32-bit instructions.

No strings are visible in the virus.


Angelina

Alias: Stoned.Angelina

Type:  Memory-resident boot and partition sector virus.

Affects:  Floppy and hard disks.

File growth:  N/A

Description:

This stealth boot and partition sector virus infects hard disk when booted from an infected floppy. Diskettes are infected on read and write access (e.g. DIR command)

Functionally the virus is similar to Stoned virus.

The virus contains following encrypted text, which is never displayed:

 Greetings for ANGELINA !!!/by Garfield/Zielona Gora

Variants: There are two slightly different variants of the virus.


AntiCMOS

Alias: Lenart, Lixi

Type:  Memory-resident boot and partition sector virus.

Affects:  Floppy and hard disks.

Description:

This boot and partition sector virus infects hard disk when booted from an infected floppy. Diskettes are infected on read or write access (e.g. DIR or COPY command)

The virus does not preserve original boot and/or partition sector - it overwrites it with itself.

On a floppy disk access, the virus can trigger with a probability of approximately 1/256.  Then the virus attempts to patch CMOS data.  Fortunately this fails because the author of this virus failed to test it properly.

AntiCMOS.A contains the message  "I am Li Xibin!".

AntiCMOS.B has no specific strings contained internally.


AntiDMV

Aliases:  WM.AntiDMV, WordMacro.AntiDMV, WinWord.AntiDMV

Description:

WM.AntiDMV is a WordMacro virus; it is has been reported in the wild in Italy, Malta and Spain and probably in some other Mediterranean countries.

This virus was designed to spread until 1 June 1996; and should, therefore, have stopped spreading at this time.  However, it is possible that many infected documents and templates may exist 'in the wild'.

WM.AntiDMV contains only one macro, AutoOpen.  If an infected document is opened under Microsoft Word for Windows, the current year is before 1997 and the current month is before June 6th, the virus infects NORMAL.DOT.  The virus also removes the macro AutoClose from documents and templates, if it exists.

It is the time-limited feature, plus the removal of the AutoClose macro, which prompted the name of the virus; it effectively removes the DMV macro virus.


AntiEXE

Aliases: NewBug, D3

Type:  Memory-resident boot and partition sector virus.

Affects:  Write-enabled hard and floppy disks if the computer is booted from an infected (not necessarily bootable) floppy.  Some EXE files.

File growth:  N/A

Description:

This boot and partition sector virus infects the hard disk when booted from an infected floppy.  Diskettes are infected on read access (eg. DIR command).

When a certain (unknown as yet) EXE file is being executed or read from a disk (eg. using the COPY command) the virus patches the first byte of the in-memory file image, thus causing unpredictable errors.  In most cases the computer hangs.


ARARA

Type:  File virus.

Affects:  A COM file in the current subdirectory on execution of an infected file.

File growth:  Variable: 1052-1067 bytes.

Description:

This non-resident virus is variably encrypted and polymorphic.

Since the virus uses 80286+ specific instructions, it would not operate properly on pre-80286 computers (most of XTs).  The virus has no payload. It contains two encrypted strings

[ARARA]

*.OCM

and the following text:

ILASA MICALAZODA OLAPIRETA IALPEREJI BELIORE: DAS ODO BUSADIRE OIAD OUOARESA CAOSAGO: CASAREMEJI LAIADA ERANU BERINUTASA CAFAFAME DAS IVEMEDA AQOSO ADOHO MOZ, OD MAOFASA. BOLAPE COMO BELIORETA PAMEBETA. ZODACARE OD ZODAMERANU! ODO CICALE QAA. ZODOREJE, LAPE ZODIREDO NOCO MADA, HOATHAHE SAITAN!


Atom

Alias:  WordMacro.Atom

Type:  Word Macro virus.

Description:

ATOM consists of 4 macros - AutoOpen, FileOpen, FIleSaveAs, and ATOM - all of which are execute-only.

When an infected document is opened, ATOM infects the global template. If the auto macros are disabled, the virus is rendered ineffective. ATOM does not turn off the prompting when saving the global template, so if prompting is turned on you will be prompted to save changes to the global template at the end of the session.

After the global template is infected, ATOM calls its first destructive payload. If the current date is December 13, the virus deletes all files in the current directory.

Once the virus is active (i.e., it has infected the global template), it infects all documents which are saved via the FileSaveAs command or which are opened via the FileOpen command. If the seconds field of the current time is 13 at the time of infection, the virus encrypts the document being saved with the password "ATOM#1".


Avispa.2048

Type: Memory resident file virus.

Affects: EXE files.

Description:

This is a polymorphic virus.

The virus intercepts INT_13 and INT_21.  It checks for itself in memory by issuing a call, AX=4BFF/Int_21h; tyhe correct response is AX=4BFE.

The virus avoids infecting files *AN.*, *LD.*, *OT.* and files where CS:IP=0:0 (apparently to avoid some AV programs like SCAN and simple 'sacrificial goat' files).

Avispa.2048.d (the most common variant) contains the following strings:

__ Virus Avispa - Buenos Aires - Noviembre 1993 __

$$ Virus AVISPA $$ Republica Argentina$$ Elijah Baley

$$ Noviembre 10 de 1993

$$ This program is not an old virus variant, and it was

written in Argentina by Elijah Baley. It uses polymorphic

technics to avoid conventional scanning.

$$ MENEM: Libertador de torturadores y asesinos de inocentes, que Dios se apiade de tu pobre alma. $$

Variants: a-f


Barrotes

Type: Memory resident file virus.

Affects: COM and EXE files (except variant 849, which infects COM files only).

File Growth: See variants.

Description:

The virus is not encrypted (except Barrotes.1303).  Barrotes always tries to infect COMMAND.COM (all variants contain the string COMMAND.COM).  When infecting EXE files, the virus does not modify the current SS:SP, which means that some infected files will be corrupted.

To detect itself in memory, the virus issues the call AH=EE/INT_21; the correct response is AL=FE (Barrotes.1127 uses AX=AAAA/INT_21 -> AX=BBBB; Barrotes.1463 uses AX=EEFF/INT_21 -> AX=FFEE; Barrotes.1874 uses AH=EC/INT_21 -> AL=EF).

On the 5th of January, Barrotes.849 overwrites the partition sector and prints:

Virus BARROTES por OSoft

This message appears on a background of vertical colored lines.

Variants: 849, 1127, 1194, 1303, 1310, 1463, 1874

The following strings and payloads are present in other virus variants:

1127 uses SO (53 4F) as a marker at the end of the file for self-recognition.  It has no payload.

1194 has a bug in the payload which prevents it from overwriting the hard drive on the 1st of each month, as intended.

1303  displays sta Tecla (MAD1) and changes the codes of keys being pressed on 23 September.

1310 displays Virus MIKELON por MSoft.  It overwrites the partition sector on 5 January (one minor sub-variant does not have this destructive payload).

1463 overwrites the partition sector on 22nd of any month.


Batman

Description:

Infection of a hard disk begins with the introduction of a batch file; for example, INF.BAT.  This would look something like this:

 @echo off

 rem <machine code instructions interpreted as ASCII>

 copy INF.BAT INF.COM > nul

 INF

 del INF.COM

In other words, when the batch file runs, it is renamed to a COM file. The virus instructions are then executed (and the virus does whatever the author chooses to include), after which the COM file is deleted.


Beijing

Alias:  WelcomB, BuptBoot, Bupt 9146

Description:

Beijing infects the boot sector of floppy disks and the partition sector of hard disks.

If the PC is booted from an infected floppy disk, the virus goes memory resident and infects the partition sector of the hard disk. The virus infects any floppy disk which is accessed.

The virus does NOT store a copy of the original, clean partition sector elsewhere on the disk.  It stores additional virus code on Cylinder 0, Head 0, Sector 4 on the hard disk and in one of the root directory sectors on floppy disks;  the text

 Welcome to BUPT 9146, Beijing!

can be found in this sector.


Boot-437

Aliases: Bath, Square

Type: Boot sector virus.

Affects: The boot sector of floppy disks; and the boot sector of hard disks when the PC is booted from an infected floppy disk.

Description: This is a very simple boot sector virus.  It infects both 720Kb and 1.44Mb floppy disks.  It uses 1Kb of RAM.

It intercepts the read and write functions of INT_13.  To check if a sector is already infected, the virus compares 6 bytes at offset 100h (they must be 05 0e 1f e8 08 00).


BootEXE.451

Alias:  BFD-451

Description:

BootEXE.451 is a fast-infecting memory-resident multipartite virus. It infects the boot sectors of floppy disks, the boot sector of the hard disk drive and EXE files.

For EXE files (starting with 'MZ' signature) shorter than 64k the virus infects the EXE header if there is enough free space after the relocation table. The virus converts EXE file into COM.

When the virus is memory-resident all suitable EXE files accessed in any way (read, write, execute) get infected.  The virus has no strings inside, and has no payload.


Brain

Aliases:  Pakistani; Pakistani Brain; Lahore; Ashar; UIUC

Type: Memory-resident boot sector virus.

Affects:  360Kb 5.25-inch floppy disks (even if not bootable).  Hard disks are not infected.

File Growth: N/A

Description:

The volume label of the infected floppy is changed to  (c) Brain and infected disks have 3Kb of bad sectors.  The following text can be found in the boot sector:

Welcome to the Dungeon (c) 1986 Brain & Amjads (pvt) Ltd VIRUS_SHOE RECORD V9.0 Dedicated to the dynamic memories of millions of viruses who are no longer with us today - Thanks GOODNESS!! BEWARE OF THE er..VIRUS : this program is catching program follows after these messages....$#@%$@!!

There are a number of major and minor variations in the actual wording, but the substance of the message remains the same.  There is also a completely different message giving three telephone numbers.

Brain replaces the boot sector of a diskette with its own code and moves the original boot sector further up the disk.  Whilst the virus is in memory the boot sector looks normal, as the virus redirects any attempt

 to look at it and displays the original boot sector instead.  The virus has no ill effects other than slowing down the floppy disk drive and making 7kb of memory unavailable to DOS.

Variants:

Ashar:  An early version of Brain.  There are six variants where the Brain message is different.


Brasil

Description:

This stealthing boot sector virus, infecting boot sectors of floppies and the partition sector (MBR) of hard disks. The virus takes up two sectors. The first sector is an infection routine, the second is the resident interrupt handler and payload. The first sector of the virus is not stored in memory and is only read from the hard disk when the virus infects a floppy.

The virus infects floppies in the A: drive only.

The virus resides in the partition sector (sector 1 on track 0) and in the next sector (sector 2) of the hard disk. The original partition sector (MBR) is stored in sector 3.

No strings are visible in the virus. An encrypted string  "Brasil virus!" is stored in the virus.

On floppies the virus stores itself in the boot record. The second part of the virus and original floppy boot sector are stored in the last two sectors of the floppy's root directory (sectors 14-15, side 1, cylinder 0 for 1.44MB floppy).

The virus has a payload - it prints the message  "Brasil virus!" and erases the sectors on track 0 of the DD. The trigger depends on many factors (frequency of disk access, timer counter contents and internal virus counter).


Butterflies

Alias:  Goddam Butterflies

Type:  File virus

Infects:  COM files

File growth:  302 bytes

Description:

There are three variants of this virus, the only difference being the text inside them (which is not displayed). The three texts are "Goddamn Butterflies",  "Hurray The Crusades" and an offensive message about a person. The main interest in this virus is that it was spread via a couple of infected files that were widely copied around, especially via BBSes and Internet.

This virus is not very infectious, and is likely to die out unless it gets a similar boost.


Butthead

Butthead is a file virus which appears to be a variant of Cruncher.

It contains the following text:

 BUTTHEAD v 1.0 Automatic Compression Utility

 Written by The Cocanium Twilight Hell (c) 1994

 Greetings to Eastwave BBS II, hoping he'll get killed!!!!


ByeBye

Alias:  Bye

Description:

ByeBye infects the partition sector (MBR) of hard disks and the boot sector of floppy disks.  It contains the following encrypted string: "Bye by C&CL".

The hard disk is infected by booting (or attempting to boot) off an infected floppy.  Any subsequent floppy disk which is accessed will become infected by the virus.


Coffeeshop

Type: Memory resident file virus.

Affects: EXE files.

Description:

There are two variants of this virus.  Coffeeshop.MtE is a polymorphic virus using the MtE polymorphic generator (Mutating Engine).  Coffeeshop.1568 is almost the same virus, but this variant is not even encrypted (and apparently it has no built-in MtE generator). Both viruses infect EXE files when they are executed or copied; and neither variant works on DOS versions below 3.10.

Coffeeshop intercepts INT_21 functions 4B00 (Execute), 6C00 (Extended Open).  To detect itself in memory, the virus issues a call, AX=33DA/INT_21; the correct response is AL=A5.  It contains a filename recognition string (to avoid infecting anti-virus programs, the first two letters of the name are used; for example, SCAN, CLEAN, VSAFE, etc.):

SCCLVSNEHTTBVIRAFEMTBR

Coffeeshop contains a message, which is displayed on Friday if, when an infected program is run, the seconds counter is zero and the virus is not yet memory resident.  The first string is encrypted, but the next two are visible, in memory:

LEGALIZE CANNABIS

Amsterdam = COFFEESHOP!

MK1992

Variants: MtE, 1568


Dir.Byway

Aliases:  Byway, HndV

Description:

Unlike most file viruses, Dir.Byway does not add its code directly to infected files; it spreads by manipulating the way files are accessed under DOS.  When an infected file is run, the virus goes memory resident and creates a file called  CHKLIST  .MS  (with spaces after the T and  S, using the `space' character [ALT-255] from the extended ASCII character set) in the root directory, with hidden, system and read-only attributes.  It is this file which contains the virus code; and infected files are cross-linked to this file.  The virus infects files in a directory when the directory is accessed (this includes directories accessed via the search path).  The cross-linking is detectable if a clean copy of CHKDSK is run after a clean boot from a DOS system disk.  If CHKDSK is run with the virus in memory, however, the virus uses stealth to conceal the cross-linking.

If the current DOS date is set to the year 1996 or above, and the day of the month is equal to the month's number times 2 and plus 2 (for  example, 04-01-96, 06-02-96, ...26-12-96), the virus can trigger.  When

 triggered, every 3 hours, on hours that are a multiple of three (for example, 09:00, 12:00, 15:00), the virus displays a running text string:

  TRABAJEMOS TODOS POR VENEZUELA !!!

Literally translated, this means "We are all fighting for Venezuela"; it is accompanied by a tune, possibly Venezuela's state anthem


Casino

Type:  Memory-resident file virus

Affects:  COM files on execution.  COMMAND.COM and files larger than 62905 bytes and those with the system attribute set are avoided.

File growth: The file size is rounded up to the next multiple of 16 bytes and 2330 bytes are added.

Description:

When an infected program is run it infects the first COM file in the  subdirectory and creates a hidden file called COMMAND_.COM where '_'  is the invisible character 0FFh.  This file is used by the virus to go

 memory-resident, and then deleted.

The increase in file size is masked if the virus is in memory.  This is not always precise as the virus subtracts 2330 bytes from the file size  if the file is a multiple of 16 bytes (unless the file is smaller than 2330 bytes), so some uninfected files appear smaller than they really are.

On the 15th of January, April and August the payload triggers.  The first 80 sectors of the current drive are read into memory; this includes the  whole copy of the FAR and normally part or all of the second copy.

 Garbage is written to the same 80 sectors.  The following message is then  displayed:

DISK DESTROYER A SOUVENIR OF MALTA

I have just DESTROYED the FAT on your Disk!! However, I have a copy in RAM, and I'm giving you a last chance to restore your precious data

WARNING: IF YOU RESET NOW, ALL YOUR DATA WILL BE LOST - FOREVER!!

Your DATA depends on a game of JACKPOT CASINO DE MALTE

When you play, there are three possible results:

1.	"HA HA !! You asshole, you've lost: say Bye to your Balls ..." and the machine hangs

2.	"No Fuckin' Chance; and I'm punishing you for trying to trace me down!" followed by the first message and a machine hang.

3.	"BASTARD! You're lucky this time - but for your own sake, now SWITCH OFF YOU COMPUTER AND DON'T TURN IT ON TILL TOMORROW !!!" and the FAT is copied back on to the disk.


Cawber.2138

Aliases: Baclab, NTU.T4, T4

Description:

Cawber is a memory-resident virus which only infects EXE files. The virus is full-stealth and encrypted.  All infected files have the seconds field of their file time stamp set to 30 seconds. Files shorter than 2000 bytes are not infected.

The virus has a couple of short strings inside:

" T4 " (at the very beginning of virus body, unencrypted)

"Griffe" (encrypted)

and a long text message inside (encrypted):

"T4 virion   by NTU BACTERIOPHAGE LAB

There Once Was A King, Who Called For The Spring

For His World Was Still Covered In Snow

But The Spring Had Not Been, For He Was Wicked And Mean ...

Here I'm Sitting And It's Getting Cold

The Morning Rains Against My Window Pane

While The World Looks So Cold And Grey

In My Mind I Dream Away

Then I'm On My Way To Tropic Islands

You'd Always Say I Was A Dreamer

You Were Right

What Do I Say When It's All Over ?

And SORRY Seems To Be The Hardest Word ..."

When the payload triggers (this should happen after 13th of January) the virus writes the text above at the beginning of some EXE files, causing them to hang when executed.


Chance.B

Alias: Lennon

Description:

Chance.B is a memory-resident boot sector virus which infects the boot sector of floppy disks and the DOS boot sector of the harddisk.

The hard disk's original boot sector is saved in sector 2 of track 0, just after the partition sector (MBR).  On the 8th of December the virus plays the Lennon/McCartney tune  "Give Peace A Chance" and prints:

 "All we are saying is give peace a chance (J.Lennon)"

This message is encrypted in the virus body and is not visible.  John Lennon was killed on the 8th of December, 1980.


Chill.554

Type: Memory resident file virus.

Affects: COM files.

File Growth: 554 bytes.

Description:

This infects COM files only, by appending itself to the end of the host file.  The virus is encrypted.  It is a fast infector, intercepting EXEC, open and rename/move DOS functions.

The virus has a payload, which is supposed to format the hard disk drive using AH=5/INT_13 function.  This command is not recognised by IDE and SCSI drives (it can only affect some old MFM drives), so virus doesn't do any damage.

It contains the following string inside:

[CHiLL TOUCH].You cannot touch these phantoms


Chinese Fish

Alias: Fish Boot

Type:  Memory-resident boot and partition sector virus.

Affects:  Floppy and hard disks.

File growth: N/A

Description:

This boot and partition sector virus infects hard disk when booted from an infected floppy. Then it infects diskettes on read or write access (e.g. DIR command).  When active in memory, the virus stealths both infected partition sector and infected boot sectors on floppies.

If a disk infected with Chinese Fish is then infected with Stoned virus, Chinese Fish removes Stoned from the disk, leaving it infected with just itself.

Starting from 1992, on 1st, 11th, 21st and 31st of every month when a PC is booted from an infected disk, Chinese Fish displays the following message:

 Hello! I am FISH, please don't kill me.

 Congratulate 80th year of the Republic Of

 China Building,Fish will help to kill stone

 Written by Fish in NTIT. TAIWAIN  80.10.18


Colors

Alias: WordMacro.Colors

Type:  Word macro virus.

Description:

Colors is a Word macro virus which most likely comes from Portugal.

When an infected document is opened under Microsoft Word (Word for Win95,  Word for NT, Word for Windows 3.x, MacWord, ...), the virus infects the  global template (usually NORMAL.DOT). Then every document being created  via File/New or saved via Save or File/SaveAs is infected by the virus.   The virus contains the following ten macros:

AutoOpen, AutoClose, AutoExec, FileNew, FileExit, FileSave, FileSaveAs, ToolsMacro and other macros.

If macros with such names existed prior to infection, they are overwritten by the virus.

Surprisingly enough, AutoExec macro in the virus is an empty one - it does nothing. The possible aim of it could be overwriting existing AutoExec macro which could contain anti-virus routines (e.g. supplied by Microsoft).

The virus can propagate even with AutoMacros being disabled (e.g. by invoking Word as  WINWORD.EXE /mDisableAutoMacros or by using one of Microsoft's recent antivirus template tools). As soon as a user chooses File/New, File/Save, File/SaveAs, File/Exit or Tools/Macro, the virus gets control and infects NORMAL.DOT.  Moreover, unlike other known Word viruses (such as Concept, Nuclear, DMV), Colors virus cannot be spotted by using Tools/Macro to list active macros. The virus intercepts Tools/Macro and effectively disables it, while still using it for infection. This way Colors can be called the first macro virus with some stealth capabilities. Nevertheless, one can use File/Templates/Organizer/Macros to view the names of virus' macros and even to delete them.

As in the case of Nuclear (the first encrypted macro virus), all macros in Colors are Execute-Only and thus cannot be viewed/edited by means of Microsoft Word.

The virus also enables AutoMacros (just in case the user had disabled it) and disables Word's prompt to save changes to NORMAL.DOT.

The virus maintains a counter named 'countersu' in [windows] section of WIN.INI file. Every time a virus macro is called (with the exception of AutoExec) the counter is incremented by one. That is, every time a user opens, creates, saves, closes a document, attempts to use Tools/Macro or exits Word, the counter is incremented. When the counter reaches 299 and each 300th time thereafter (i.e. 299, 599, 899 and so on) the virus triggers. It then changes Windows colours settings (text, background, buttons, borders, etc.) to randomly selected colours. So that the next time Windows are started the user is puzzled by the most unusual and weird colour palette.


Concept

Aliases:  WinWord.Concept, WW6Macro, WW6Infector, WBMV (Word Basic Macro Virus), Prank Macro

Type:  Word macro virus.

Description:

This is the first virus to infect data files.  Concept infects Microsoft Word 6 documents (*.DOC) and the NORMAL.DOT template.  The virus makes use of the well-developed Microsoft Word macro language, Word Basic, in an attempt to exploit the fact that computer users exchange documents far more often than programs.

When an infected document is opened under Microsoft Word for the first time, the virus gets control as an AutoOpen macro and infects the NORMAL.DOT template (or any other template, if it has been selected as a global default template).  A message box, with the text '1', appears on the screen.  After this, every document saved using the File|SaveAs command is infected with the virus.  This normally happens when a newly-created document is saved to the disk.

If Microsoft Word is run, then Tools|Macros is selected and the list of macros checked, the presence of the macros named AAAZFS, AAAZAO, AutoOpen, PayLoad and FileSaveAs indicates that the Microsoft Word system is infected.

This virus works under Microsoft Word for Windows 3.x, Word for Windows 95, Word for Windows NT, and Word for Macintosh.  This made it the first ever multi-platform virus.  Other macro viruses have been written in the wake of Concept, including Nuclear, DMV, Colors, and Hot.  Some macro trojans have also been written, including FormatC and Wierderoffnen.

The Concept virus is very common in the wild.  This is largely due to Microsoft accidentally shipping it on a CD ROM called Microsoft Windows 95 Software Compatability Test to hundreds of OEM companies in August 1995. Another company distributed more Concept-infected documents on 5500 copies of  a CD ROM called Snap-on Tools for Windows NT shortly afterwards.


Cruel

Description:

Cruel appears to be of Hungarian origin.  It is a boot sector virus infecting the boot sectors of floppy disks and the boot sectors of hard disks (NB. That's rather unusual, most boot sector viruses infect the partition sector (MBR) of a hard disk.  Exceptions include Form and DaBoys.)

Cruel can be removed from diskettes and hard disks with the DOS SYS command after a cold-boot from a clean (virus-free), write-protected diskette.


CPW

Aliases: Viva, Mierda

Description:

CPW-1527 virus was first examined in February 1993.

CPW-1527 is a memory resident file virus infecting both COM and EXE files.  Infection takes place if a file is run or opened, or if any of its attributes are changed. It will not infect a file smaller than about 10K. It seeks out and infects COMMAND.COM by name when it first goes resident. If it cannot infect a file because a disk is write protected, it hangs the computer.  When the system clock reads May 27, September 11, or December 28, it deletes the first file in the current directory every time a program is run.

Most of the virus is encrypted, including several messages. The messages are not displayed. When decrypted, the following text can be seen:

 CPW fue hecho en Chile en 1992, -VIVA CHILE MIERDA!

Then the filespec used to seek out COMMAND.COM:

C:\COMMAND.COM

Next, some filenames of common anti-virus software programs are listed. These are probably used to avoid infecting anti-virus programs.

 GUARD guard CPAV SCAN CHKVIRUS CLEAN TOOLKIT VSAFE CHKLIST.CPS

Variant:

There is another variant called CPW-1459. It seems quite different from CPW 1527, lacking both encryption and the targeting of anti-virus software.


Crazy Boot

Description:

Crazy Boot is a boot sector virus infecting boot sectors of write-enabled floppies and the partition sector (MBR) of hard disks.

This stealthing virus uses a total of 3 sectors.  On the hard disk it installs itself in the partition sector and track 0 sectors 4 and 5.  On a floppy disk it can be found in the boot sector as well as head 1, track 0, sectors 4 and 5.  This virus may overwrite some data and corrupt files when infecting floppies.

Crazy Boot virus can display a message depending on the status of an internal counter inside the virus:

Don't PLAY with the PC!

Otherwise you will get in 'DEEP,DEEP' trouble!...

Crazy Boot Ver. 1.0


DaBoys

Aliases:  Da'Boys, Dallas Cowboys

Description:

Da'Boys is a boot sector virus.  Unlike most boot sector viruses it infects the boot sector of the hard disk rather than the partition sector (MBR).  It does not keep a copy of the original, clean boot sector when it infects.

It will infect the boot sector of write-enabled floppy disks in drive A: or B: on access.

Any software using interrupts 87-C6 is likely to hang the PC.


Dark Avenger 1800

Aliases: Eddie-1, Black Avenger, Diana

Type: Memory-resident file virus.

Affects: COM and EXE files (see below). Only works on MS-DOS v3.0 and higher. Only files larger than 1,800 bytes are affected.

File Growth: 1,800 bytes, subject to a rounding-up to the nearest 16 bytes.

Description:

A number of different actions on a file can trigger an infection:

     If copied, both the source and target are infected;

     If it is read;

     If the attributes are changed;

     If it is loaded and executed.

Read-only files are made read-write, and the attribute reset after infection. The boot sector is used to store data. The virus writes a sector that starts "Eddie lives...somewhere in time!" at intervals to a random sector on the hard disk. This sector might not land on anything critical.

The virus includes two other messages which are not used:

This program was written in the city of Sofia (C) 1988-89 Dark Avenger

Diana P.


Datacrime

Alias:  Columbus Day

Type:  File virus.

Affects:  A COM file on execution of an infected file; files with D as the seventh letter (including COMMAND.COM) will not be infected.

File Growth: 1,168 bytes.

Description:

When an infected file is run, the virus scans through the directory tree for an uninfected file; it also searches DOS devices in the order C:, D:, A:, B:.  It recognizes infected files by setting the last byte of the seconds field in the directory entry, which is not displayed by the DIR command.

Every year from October 13th to December 31st, when it runs it displays the message  DATACRIME VIRUS RELEASE 1 MARCH 1989 and does a low-level format of the hard disk of cylinder 0 and all heads up to 8. If it tries to infect a write-protected disk, the DOS write-protect message is suppressed.  The virus handles this incorrectly, and the next critical error encountered by DOS can crash the machine.

Variants:

Datacrime 1b:  Files grow by 1,280 bytes.

Datacrime 2, 2b:  Both COM and EXE files are infected.  COM files grow by 1,480 bytes and EXE files by 1,500 to 2,000.  When the virus triggers is displays  DATACRIME II VIRUS.


Datalock

Type:  Memory-resident file virus.

Affects:  COM and EXE files on opening or execution.

File Growth:  920 to 1,043 bytes.

Description:

The virus contains the text  DataLock version 1.00.

When any file called *.?BF is opened on any date after August 1990 the machine hangs (although it was intended to do something else).

Variants:  Datalock.a, Datalock.b, Datalock.c, Datalock.d, Datalock.e and Datalock.f.  The f version is 1,043 bytes long; all the others are 920 bytes long.


Deeyenda

Deeyenda is not a virus, it's a hoax (like Good Times and Irina)

A warning about a virus called Deeyenda has being distributed around the Internet. However, the virus does not exist and this is yet another example of a growing trend: hoax virus alerts being mistakenly sent all around the Internet.

If you receive the warning about Deeyenda be sure to tell the person who sent the warning to you that it is in fact a hoax, and they should take care not to pass the hoax warning on to anyone else.


Delwin

Alias:  Goblin

Variants:  Delwin.1199, Delwin.1759

Description:

Delwin is a stealth, polymorphic and multipartite virus, infecting the partition sector (MBR) of hard disks and EXE files.  The virus occupies 6 sectors on track 0 of the hard disk drive (immediately after the MBR). The virus is a fast infector - infecting not only on execution, but when files are opened as well.

The virus does not infect EXE files shorter than 3k.  The string "DELWIN" can be found inside the virus body.

The virus has an unusual payload.  Several months after the virus first infects the partition sector the screen begins to shake.  WIN.COM no longer starts when the virus is resident.


Desperado.1403

Description:

Desperado.1403 is a memory-resident polymorphic fast infecting virus, affecting both COM and EXE files when they are being executed or opened.

The virus does not infect files if their size divided by 16 leaves 3 as a remainder (i.e.,if Filesize mod 16 = 3). This is a way to recognise already infected files.  The virus also does not infect COM files shorter than 4096 and longer than 60000 bytes.

When going memory-resident the virus can place itself in the UMB.  The virus deletes the CHKLIST.MS files produced by Microsoft Anti-Virus.

The following text is found inside the virus (variant "b" has F02D instead of F02E and "c" has F02C):

Dr W-2

Dr White - Sweden 1993

Desperado Virus - Written in Malmo... F02E

SCANCLEAVSHITOOLMSAVCPAVVSAFF-PRVIRSTBAVTBSCTBCLTBUT-V  UTSCUT CHKLIST.MS

The Last string represents the 4 first letters various antivirus programs.  The virus uses this to avoid infecting them.

Variants:  Desperado.1403.a, Desperado.1403.b, Desperado.1403.c


Diablo

Type:  Memory resident boot sector and partition sector virus.

Description:

This boot sector virus, infects boot sectors of floppies and the partition sector (MBR) of hard disks.  The virus infects high capacity floppies in A: drive only.  It does not infect media less than 1.2MB (eg. 360k andf 720k floppies).

The virus uses the string 'DIABLO' as an infection marker. By checking whether this string is present at offset 1AAh it  can tell whether the disk is infected.

Diablo moves the original partition sector (MBR) to sector 2 on track 0.

The virus has no payload.  It tries to avoid being detected by heuristic boot sector analysers by reducing memory variable in word at [0:413] by means of complex operations with word at [0:412] and byte at [0:414].


Die Hard

Alias:  DH2

Description:

Die Hard is a memory-resident file infecting virus. The 3000 bytes variant only infects COM files.  The 4000 bytes variant infects both COM and EXE files and is a fast infector.

Infected files grow by exactly 3000 or 4000 bytes.  The virus does use stealth, but a "DIR" command reports the size of infected files correctly. This is because functions 11h/12h are not used by the virus stealth routine.

The virus detects whether a file is in EXE format by looking for the 'MZ' signature at the beginning of the file.  This means that it will corrupt any EXE file starting 'ZM', as it will be treated by the virus as a COM file.

Variants of 4000 bytes long have a string inside - "SW DIE HARD 2".

The 4000 bytes variant overwrites .ASM files with a short assembler text. When compiled the corresponding code hangs the machine.

Variants:  Die Hard.3000, Die Hard.4000.a, Die Hard.4000.b, Die Hard.4000.c


DieLamer.1098

Alias:  Vlamix

Description:

DieLamer is a memory-resident, fast infecting, encrypted virus.  It only infects EXE files being executed or closed.

Sometimes the virus fails to infect files properly producing a file which fails to decrypt.

The following strings can be found inside the virus:

smart*.cps chklist.* -=*@DIE_LAMER@*=- CHKLIST ???

CHKLIST.CPS

VLamiX-1

The virus deletes CHKLIST.MS and CHKLIST.CPS files (and also SMARTC*.CPS files) produced by Microsoft Anti-Virus and Central Point Anti-Virus.

DieLamer has a payload, which activates if the string "-=*@DIE_LAMER@*=-" is being printed via Int_10h. If this is the case erases a series of sectors on the floppy in drive B:.


Dir II

Description:

When an infected application is run the virus goes memory resident and copies its code to the last cluster on the partition.  This is then marked as bad in the FAT. Thereafter the virus infects by patching the directory entries of uninfected files.  With the virus in memory, any file/directory activity will result in an infection. E.g. 'dir' on a directory will 'infect' all the files in that directory.

The directory patching is as follows: the start cluster of the file is copied (and encrypted) to bytes immediately preceding the date and time in the reserved area, of the directory entry, between the file attribute and date and time  The original start cluster in the directory entry is patched to the cluster where DIR II code is contained.  When an infected program is run, DOS executes DIR II first, which then decrypts the start cluster of the original file and passes that to DOS to allow the original file to execute.

Further infections occur when the virus is in memory and any uninfected program is run, the virus patches the directory entry, as above.

Both .COM and .EXE files are infected.  DIR II uses advanced stealth methods (the tunnel) to conceal infections.

Recognition:

If the computer is booted from a clean DOS disk and CHKDSK is run, a large number of files are cross-linked via one cluster.  If the computer is booted from the hard disk, CHKDSK reports no errors.

Effects:

None apart from the crosslinking.  Data files are not affected.


Disk Filler

Alias:  Filler

Description:

Disk Filler is a stealth boot sector virus which infects the partition sector (MBR) of hard disks and the boot sector of floppies.  On floppies the virus creates an extra track and writes the body of the virus there. On the hard disk drive the body is stored in seven sectors on track 0.

The virus does not change the partition sector code, but does change the partition table (this is a method of infection known as 'self-partitioning' and was first encountered in the multipartite Starship virus).

There is a message in Hungarian stored inside the virus.  It is displayed when the virus triggers.

Haha, vrus van a gpben!!

Ez egy eddig mg nem kszimert virus. De hamarosan az lesz.

A neve egyszeren tltget

Ezt a nevt onnan kapta, hogy feltltgeti a FAT-tblt klnbz

alakzatokkal.

Ez mr meg is trtnt !!!

The translation reads like this:

Ha Ha, the machine has a virus!!

It is not yet known virus, but soon it will be.

Its name is "The Filler".

It received the name, because it fills up the FAT with various characters.

This has already happened!!!

At this point the file allocation table (FAT) is filled with a pattern of ASCII symbol 01 forming two laughing faces:

     *****  *****

    *     **     *

   * *  * ** *  * *

   *      **      *

   * **** ** **** *

    *    *  *    *

     ****    ****

Obviously, after this the harddisk does not boot and data recovery is not a trivial task because of the damage done to the file allocation table.

Variants:  a-b


Espejo

Aliases:  15 years, Esto te pasa

Type:  Memory-resident boot and partition sector virus.

Affects:   Floppy and hard disks.

File growth:  N/A

Description:

When the virus is memory-resident it infects hard disks and diskettes being read (e.g. DIR command).

On 7th of April, or any other date if the virus infected 10 disks since the last bootstrap, Espejo triggers and switches to its destructive mode. Any disk being accessed after that is overwritten with the following text

(in Spanish):

Esto te pasa por programas que a nosotros nos cuesta tanto trabajo hacer. Que te quede de Experiencia, Mexico,1994

The virus also intercepts INT 16 (BIOS Keyboard Services) interrupt. Then it occasionally simulates typos by adding 5 to the character code being entered from the keyboard. E.g. 'A' changes to 'F', 'B' to 'G' etc.

The virus contains another text string:

This Virus is from MEXICO, I have 15 years old


Exebug

Description:

Exebug infects the boot sector of floppy disks and the partition sector  (MBR) of hard disks. The partition sector becomes infected when the PC is  booted from an infected floppy disk (even if the floppy disk is not

 bootable).  The virus then goes memory memory resident, infecting floppy  disks which are accessed (even if floppy disks are just being read).  The  original partition sector is re-located to cylinder 0, head 0, sector 17.

On floppy disks, the virus formats an extra track and re-locates the  original boot sector to one of the sectors on this track.  In certain  circumstances, an EXE file being written to disk (for example, with the  COPY command) may be trojanised (EXE files written to disk may be  trojanised so that they become an Exebug dropper:  on execution, the  program deletes all files in the current sub-directory, infects the hard  disk and terminates.  EXE files being written to drives other than drive  A may be turned into instant trojans, trashing all data on the hard disk).

Exebug uses stealth to conceal itself when memory resident.  This virus  survives a standard, power-off boot from a DOS system disk.  When the  virus infects the PC, it patches CMOS to disable drive A.  When the PC is  booted subsequently (including a boot from a DOS system disk), the infected  partition sector is loaded, the virus goes memory resident and, after drive A has been re-installed  by the virus, the PC boots normally from the  floppy drive.  Before attempting a clean boot, therefore, it is essential  to ensure that drive A is enabled in CMOS.


FAT Avenger

Description:

FAT Avenger is a boot sector virus which infects the MBR of hard disks and the boot sector of floppies.

The virus is slightly unusual in that it occupies three sectors (usually boot sector viruses use 1 or 2 sectors).  The virus contains the following string:

THIS PROGRAM WAS WRITTEN IN INDIA.(c)1993 FAT AVENGER

PS. this program is not meant to be destructive

The virus appears to have been written in a high-level language - parameters for subroutines are passed through the stack, which is not common in virus writing.


Feint

Alias:  INT_7F

Description:

This is a simple boot sector virus, infecting the boot sectors of floppies and the partition sector (MBR) of the harddisk.

The virus does not work on machines with less than 640k RAM, and does not infect floppy disks less than 1.2MB (360k and 720k).  The virus has no strings inside and has no payload.


Fichv

Type:  File virus.

Affects:  All COM files in the current subdirectory more than 1,500 bytes long when an infected file is executed.

File Growth:  896 to 903 bytes.

Description:

The text  FICHV 2.1 vous a Eu can be found in the virus.

During March it will trash the disk by writing the above message to the first six sectors of each track.  The virus is encrypted and attempts to resist disassembly by using interrupts 1 and 3.

Variants:  Version 1.0 infects EXE files, adding 897 bytes; version 2.0 infects COM files, adding 896 bytes.


Findme

Type: Boot sector virus.

Affects: The boot sector of floppy disks; and the partition sector of hard disks when the PC is booted from an infected floppy disk.

Description:

Findme occupies just one sector.  It uses 1Kb of RAM and goes resident at the top of memory (below 640Kb).

The original partition sector is re-located to cylinder 0, head 0, sector 16. The virus uses steatlh to conceal both the infected partition sector, and the re-located original sector (0, 0, 16 looks blank when examined with the virus memory resident).  The infected partition sector does not contain a valid partition table.  As a result, if the PC is booted from a DOS system disk, the hard disk will be inaccessible.

It infects 720Kb and 1.44Mb floppy disks.  On 1.44Mb floppies original boot sector is re-located to cylinder 0, head 1, sector 15; this copy is not stealthed.

On May 23 and December 26 the virus attempts to overwrite the CMOS memory.  There is a bug which will allow the virus to corrupt a maximum of only one CMOS byte.

Infected sectors contain the string FIND_ME! in the OEM field (at offset 3 in the sector), which gives the virus its name.

For self-recognition, the virus uses bytes 01, 46 at offset 2 in the sector (46 is F, the first letter of FIND_ME!).


Finnish.357

Description:

Finnish is a memory-resident appending COM-file infector, which only intercepts only Exec (4bh) function of Dos Int_21.

Infected files all start with byte 93h (instruction XCHG BX,AX) and virus uses this byte to check to see whether it has already infected a file.

There are also variants of the same virus of length: 378 (starts with 90h), 709a-b (both use F0).


Finnish Sprayer

Alias: Aija

Type: Boot sector virus.

Affects: The boot sector of floppy disks; and the partition sector of the hard disk when the PC is booted from an infected floppy disk.

Description:

Finnish Sprayer uses 1Kb of RAM and uses stealth to conceal itself when memory resident.  It occupies 2 sectors on the disk.  On the hard disk, the original partition sector is re-located to the end of the active partition.

The virus uses Ai at offset 45h in the boot sector for self-recognition.

The payload is to overwrite the hard disk with the contents of the interrupt vector table, on the 25 March.  It displays the following string and then hangs the machine:

FINNISH_SPRAYER.1. Send your Painting +358-0-4322019 (FAX), [Aija]

The following string in the virus is never displayed:

Tks to B.B., Z-VirX .....

Variants


Fish6

Description:

Fish6 infects COM and EXE files when any disk access involving these files is made.  When the virus first goes memory resident, it seeks out, and infects, COMMAND.COM.

3584 bytes are added to infected files. Fish6 adds 100 years to the file date as a self-recognition (DOS displays only the last two digits, so this change is not noticeable; and any program requesting the date is given the original date).  the virus also preserves the original file attributes.  The virus determines which files to infect by taking the last three letters of the file specification (assuming them to be the three-letter extension) and adding up the ASCII values of the letters: the result is that the virus may attempt to infect data files, if the last three letters of the filename have the same ASCII values as COM or EXE.

If the virus is memory resident, it uses stealth to conceal the increase in file size of infected files.  It also slows down access any access to DOS, because of the many things it does whenever interrupt 21H is called. For example, Fish6 attempts to avoid detection in memory by encrypting itself between DOS calls, using a different key each time (the decryption routine, however, remains unencrypted).

If the DOS date is 1991 or later, and an infected COM program is run, Fish6 displays the message

 FISH VIRUS #6 - EACH DIFF - BONN 2/90

and then hangs the PC with a HALT instruction (NOTE: this will be the second infected program run, as Fish6 must be resident when the COM program is run; the first infected program run will load Fish6 into memory).


Flip

Alias:  Omicron

Type:  Memory-resident file and partition sector virus.

Affects:  COM and EXE files on execution.  COM files must be smaller than 62,857 bytes.

File Growth:  2,343 bytes.  EXE files vary slightly.  If COMMAND.COM has been infected the increases are hidden.

Description:

The virus contains the encrypted text  OMICRON by PsychoBlast.  The encryption and the encryptor/loader are variable.

At 10am on the second day of the month, if the computer has been booted from an infected partition, there is a monitor reversal on EGA and VGA screens.  The date is obtained from CMOS memory so this only works on AT and PS/2 machines.

Variants:  Flip.2343.a, Flip.2343.b, Flip.2153


Form

Description:

When you boot from an infected diskette, the virus goes memory-resident; this is true whether the diskette is a boot disk or not.  So the usual thing is for someone to have an infected data diskette, which they leave in drive A when they shut down.  Next day when they start up the computer, it attempts to boot form that diskette; if it isn't a system disk, you see the message

'Not a system disk.  Please insert a system disk and retry.'

or a similar message.  If that diskette was infected, the virus is now in memory, and when you continue the boot, it remains there.  It is also written immediately to the hard disk, if one is present.

While the virus is in memory, any disk that you access is liable to be infected. If you access the diskette (whether read or write) and the diskette is write-enabled then Form will infect it.

On the 18th of each month, each key beeps when you type it.  This doesn't work if your keyboard interrupt has been intercepted by, for example, KEYB.  Infected floppy disks have 1kb in bad sectors.

There is a message in the virus that never gets displayed.  It says:

The FORM-Virus sends greetings to everyone who's reading this text.  FORM doesn't destroy data! Don't panic!  Fuckings go to Corrine.


Freddy

Description:

There are two different versions of this virus - Freddy.1870 and Freddy.1878.  The virus is memory-resident and infects COM and EXE files.  To recognize  whether it is present it uses INT_21 with AH=FF.  A reply of AH=FE tells  the virus that it is already resident.

Freddy has a special routine to infect COMMAND.COM which increases its  size by only 77 bytes. When activated, the virus rewrites the boot sector  using INT_25 with the string "FREDDY KRG 0" and hangs.   The computer will not boot after this.


Frodo

Aliases: 4096, Century, 100 years

Description:

Frodo goes memory resident when an infected program is run.  It then infects COM and EXE files on almost any operation.  4096 bytes are added to infected files.  Frodo adds 100 years to the file date as a self-recognition (DOS displays only the last two digits, so this change is not noticeable; and any program requesting the date is given the original date).  The virus also preserves the original file attributes.

If the virus is memory resident, it uses stealth to conceal the increase in file size of infected files.

NOTE:  There is code in the virus which is intended to install a routine on the partition sector of the hard disk and the boot sector of any disk in drive A.  When the PC is booted, it is designed to display  'FRODO LIVES' in large block graphics, with a surrounding flashing neon border.  This is designed to happen between September 22nd and December 31st.  However, the routine designed to do this is corrupted and the PC hangs when the routine is called.


Galicia

Aliases:  Spanish-Telecom-3, Kampana.mp.d

Description:

Galicia is a boot sector virus, infecting the boot sector of floppy disks and the partition sector (MBR) of hard disks.   It is encrypted, but with a constant key (XOR with FFFF which is equivalent to NOT operation, when all bits are reversed).

If a disk read is made on 22nd of May at 12:00am the virus prints the message:

"Galicia contra telefonica!"

Then it tries to format first 255 sectors of the HDD.

Fortunately the formatting command it uses is not recognised by IDE and SCSI drives (it can only affect some old MFM HDDs), so it fails to do any damage.


Ginger

Description:

When an infected COM file is run, Ginger infects the partition sector.   When the PC is next booted, the virus goes memory resident and will  infect any COM file which is run.

The virus uses the five sectors immediately after the partition sector  (sectors 2, 3, 4, 5 and 6) to store its own code.  The following text  can be seen in sector 2:

 You can't catch the Gingerbread man. . .

 Bad Seed . . . made in OZ

Ginger modifies the partition table so that, instead of passing control  to Cylinder 0, Head 1, Sector 1 (the DOS boot sector), it points to  0, 0, 2 (virus code), which then passes control to 0, 1, 1.

If the virus is memory resident, it uses stealth to conceal itself.  If the partition sector is examined in a `dirty' machine, the virus displays the original, clean partition sector.

[NOTE: Orsam (a variant of Ginger).  As for Ginger, but with one important difference.  The virus alters the partition sector so that, instead of  pointing to 0, 0, 2 (the virus), which then points to 0, 1, 1 (the boot  sector), it executes the code in 0, 0, 1 (the partition sector), points  back to that code, AND ONLY THEN points to 0, 0, 2 and 0, 1, 1.

If you attempt to boot the PC from a DOS system disk, versions 4.x, 5.x or 6.x, DOS is unable to handle the fact that the partition sector code points back to itself. The result is that the PC will fail to boot. A PC infected with this virus should be booted from DOS 3.3 or Novell DOS 7.]


Goldbug

Type: Multipartite virus.

Affects: EXE files, the partition sector of the hard disk and the boot sector of 1.2Mb floppy disks.

Description:

GoldBug is a polymorphic virus and uses stealth to conceal itself when memory resident.  It infects EXE files using the companion technique.  The virus intercepts interrupts 13h and 21h.

The infected partition sector always starts with CHKLIST???? which appears to be a legal sequence of processor commands (INC, DEC, PUSH and AAS).  On floppy disks, the body of the virus is written to two unused sectors (the virus checks to see if these sectors are really free).

The virus does not work on XT machines, because it hides the body of the virus in HMA memory (created by the HIMEM.SYS driver).  During the boot process, the virus hides itself temporarily in video memory (it does this because HIMEM.SYS is not yet loaded and, as a result, HMA memory is not present).

Goldbug attacks anti-virus software named *AN.* and *AV.*.  It also deletes CHKLIST.* files.

The virus has a payload.  It instructs the modem (if present) to answer incoming calls on the 7th ring and continue work with the line (this is done with the command ATMLS0=7O1).

When Microsoft Windows is loaded on an infected machine, the virus 'disinfects' the partition sector; and re-infects it again when the Windows session is finished.

Goldbug contains the following strings:

1O7=0SLMTA

CHKLIST????

Variants: a-f


Good Times

Description:

Good Times is not a virus, it's a hoax.

If you receive the warning about Good Times be sure to tell the person who sent the warning to you that it is in fact a hoax, and they should take care not to pass the hoax warning on to anyone else.


Grandma's Grave

Aliases:  GranGrave.1150, Burglar

Description:

Grandma's Grave is a stealth file virus.  Every time the virus infects a file it checks whether the minute field of the current time is set to 14.  If it is it displays a flashing message in the top left corner of the screen:  "Burglar/H"

The virus contains an unencrypted text string which never gets displayed: "AT THE GRAVE OF GRANDMA"


Green Caterpillar

Alias:  1575

Type:  Memory-resident file virus.

Affects:  COM and EXE files when a directory is examined.  The next uninfected executable file in that directory is infected.  This virus only works on an AT or PS/2 with a CMOS clock.

File Growth:  COM:  1,583 to 1,591 bytes.  EXE:  as COM, but may vary slightly.

Description:

At any time after two months from the date of infection, provided the screen isn't mono MDA, the caterpillar is triggered.  The caterpillar has a green body, a yellow head and a red mouth; it starts at the top left of the screen and works its way across, line by line from top to bottom.  It eats characters and drops them out of its rear end, displaced by 10 characters to the left and converted to yellow on black.

Variants:  a, b, c.


Hahagif

Description:

This is a companion virus.  When a COM or EXE program is run, the virus renames the original (clean) file from (for example) PROG.COM to PROV.VOM; it also sets the attribute for this file to 'hidden'. It creates a new (infected) file with the original name (but 681 bytes longer).

If you boot 'dirty', you see normal file names and the virus stealths to prevent the additional 681 bytes being seen.

If you boot 'clean' (in other words without the virus memory-resident), you see the true length of the infected file, but (because of the 'hidden' attribute) you do NOT see the original renamed file.


Hare

Aliases:   Krsna, Hari, HDEuthanasia

Description:

Hare.7610 is a multipartite, stealth, slow polymorphic virus.  It is memory resident and infects COM and EXE files on execution.  The virus also infects the partition sector [Master Boot Record, MBR] of the hard disk and the boot sector of floppy disks.  Infected files grow in size by between 7630 bytes [approximately] to 7800 bytes [approximately].

The virus overwrites the partition table in the MBR.  When the PC is booted from a clean system disk, the hard disk is inaccessible at a DOS level.  Access is normal when the PC is booted from the hard disk.

The virus triggers on 22 August and 22 September, displaying the message

"HDEuthanasia" by Demon Emperor: Hare Krsna, hare, hare...

and overwriting all hard disks in the system, destroying all data on them.


Harakiri

Alias:  HLLO.Harakiri

Description:

Harakiri is an old (1992) and absolutely uremarkable high level language overwriting virus. The virus was written in Pascal and simply overwrites victim files with itself. There are two slightly different variants of the virus.


Helloween

Description:

Helloween is a memory-resident virus which infects COM and EXE files.

There are two variants of this virus, one with an infective length  of 1182 bytes; the other with an infective length of 1376 bytes (in  memory, the first occupies 1696 bytes, the second occupies 1904 bytes).

Normal stealth is used, so that, for example, the date and time of infected files is preserved.

The virus looks for files containing the following and, if it finds them, does not infect them:

 SCAN, SHIE, TRAP, VIRU, VCOP, ASTA, ALIK, AZOR, REX. MAND,

 VEXE, VCOM, VIRI, CLEA, TSAF, NAV.INI, BOOT.

In doing this, it aims to avoid infecting some anti-virus programs, which perform an integrity self-check.

The following message is displayed, on ATs only, with either color or monochrome monitors (on color monitors the message is in white on a red background):

 Nesedte porad upocitace a zkuste jednou delat neco rozumenhol!

                       ******************

 !!Poslouchejte HELLOWEEN - nejlepsi metalovou skupinu!!

The 1376 variant displays this message on November 1st.  The 1182 variant, which is the more common of the two, captures interrupt 21h (DOS functions), interrupt 8 (the timer tick) and interrupt 13 (hard and floppy disk access).  When the timer tick reaches 0, it causes an occasional time-out so that floppy disk accesses fail to work.


Hidenowt.1741

Description:

Hidenowt is a memory-resident virus which infects COM and EXE files. It is partially encrypted and uses anti-tracing tricks.

Hidenowt always tries to infect COMMAND.COM.

The virus avoids infecting some programs (if a checksum of the filename  matches one of five 16-bit values).


HLLO.Novademo

Aliases:  HLL.ow.12288, HLLO.Messanger

Variants:  a-c

Description:

HLLO.Novademo is a high level language overwriting virus apparently written in Pascal. Variants "a" and "c" are compressed with PkLite 1.15.

Variant "a" has visible text in the EXE header which gave the name to the whole virus family:

"Finish demogroup NOVA 1994!".

Other messages are not visible except for variant "b" (which is not compressed).

Messages in variant "a":

"This is Dangerous Messanger, and here is my message to the world"

"Bad command or file name"

"Computer protected, no action."

"Dangerous Messanger was here!"

"Can't initalize hardware... Try on another computer..."

"*.exe*.*"

Messages in variant "b":

"This is Dangerous Messanger, and here is my message to the world     v1.1"

"Bad command or file name"

"Computer protected, no action."

"Dangerous Messanger was here!"

"Sound init fails."

"*.exe*.*"

Messages in variant "c":

"This is Dangerous Messanger, and here is my message to the world     v1.2"

"Bad command or file name"

"Computer protected, no action."

"Disk error"

"Dangerous Messanger was here!"

"EMS page fault. Check EMS driver."

"*.exe*.*"

"DOS ATTRIB function"


Hot

Aliases:  Wordmacro.Hot, WM.Hot

Type:  Word macro virus.

Description:

WordMacro.Hot creates an entry in the  WINWORD6.INI configuration file which contains a "hot date" 14 days in the future when its payload will trigger.

The virus can then activate randomly within a few days of the "hot date":  when you try to open a document its contents are erase instead.

The payload is disabled if the file C:\DOS\EGA5.CPI is found to exist.  A comment in the virus source code suggests that this is a "feature" designed to protect the virus author and his friends.


IR&MJ

Description:

IR&MJ is a boot sector virus infecting 1.44MB and 720k floppies. The virus body is stored on track 0, sector 7 of the hard disk drive. On a 1.44MB floppy it is stored on head 1, sector F.  On 720k disks it is stored at head 1, sector E.

On the 30th of December the virus displays: "December 30th (C) by IR&MJ CompuServe 1993" and does not load into memory.

The virus does not stealth changes to the partition sector.


Irina

Irina is not a virus, it's a hoax.

The Irina hoax was a "marketing ploy" by a UK publisher, Penguin Books, to promote a new book of  theirs. Guy Gadney, the former head of electronic publishing at Penguin, sent out a "virus alert" in an attempt to stir up interest in their new book. Unfortunately the alert did not make clear that it was a hoax and not supposed to be taken seriously.

The alert claimed to be from a Professor Edward Prideaux at the College of Slavonic Studies in London. The College of Slavonic Studies does not exist, but London's School of Slavonic and East European Studies was reportedly inundated with calls to the fictitious Professor Prideaux.

Although Gadney sent out a second letter explaining that the first was a hoax, it has done little to stop the spread of the alert, and it is now beyond anyone's control.

If you receive the warning about Irina be sure to tell the person who sent the warning to you that it is in fact a hoax, and they should take care not to pass the hoax warning on to anyone else.


Istanbul

Description:

Istanbul is a memory-resident COM and EXE infector.  It infects files on execution.

Both variants are programmed not to infect COM files on 15th of December 2000 if they start with anything except a JMP (E9h) instruction.

Messages in the two variants say, correspondingly:

"Written in the city of Istanbul (c)1993." and "Installed"

"Anti-Virus?? Written in the city of Istanbul (c)1993.", "Installed"

Variants:  Istanbul.1312, Istanbul.1349


Jackal

Description:

Jackal is a multipartite memory-resident virus infecting EXEs, COMs, partition sectors of hard disks and boot sectors of floppy diskettes.  It can also survive a warm reboot (Ctrl-Alt-Del) - it does this by  intercepting the keypress and "faking" a reboot.


Jerusalem

File growth:

COM: 1813 bytes, EXE: 1808 to 1813 bytes.  COM files are not re-infected.  EXE files grow each time they are infected until they are too large to load into memory.  Some EXE files are infected without growing, usually because the genuine EXE is followed by overlays in the same file.  The virus uses 2kb of memory as a TSR.  Occasionally an EXE is not infected correctly and fails to run as soon as it is infected.

Note that there is a bug in Jerusalem which causes it to misinfect some EXE files (such as Windows programs) and overwrite part of their code.  These files will have to be replaced, Dr Solomon's FindVirus will warn you of them.

Description:

Every Friday 13th, when a program is run it is deleted.  On any date, 30 minutes after the virus has installed itself a PC XT system slows down to a fifth of normal speed; on faster machines the slowdown is not as noticeable.  At the same time, if the system is in text mode, a small black rectangle opens up, as a portion of the screen from row 5 column 5 to row 16 column 16 is scrolled up by two lines.

Jerusalem uses functions of interrupt 21h that Novell NetWare requires, and so is incompatible with NetWare.  Possible symptoms of this include workstations becoming disconnected from the network and the generation of large spool files.

Jerusalem disables critical error handling so that any attempt to infect a write-protected diskette does not result in the usual DOS error messages.


Jimi

Aliases:  J&M, Jimmy

Type:  Memory-resident boot and partition sector virus.

Affects:  Floppy and hard disks when booted from a floppy (not necessarily a bootable) diskette.  Any write-enabled diskette accessed can be infected.

File growth:  N/A

Description:

This virus is encrypted using simple XOR with a constant mask (FFh).

The original partition sector (MBR) is saved in sector 6 of track 0. Reads of the partition sector are not stealthed.

On 15th of November (15th of April in .B variant) the virus tries to format track 0 of the HDD using BIOS INT_13/AH=5. This will not work on SCSI and most IDE drives.

The virus does not infect floppy disks which are less than 1.2MB (360k and 720k).


Joshi

Type:  Memory-resident boot and partition sector virus.

Affects:  Floppy and hard disks when booted from a floppy (not necessarily a bootable) diskette.  Any write-enabled diskette accessed can be infected.

File Growth:  N/A

Description:

Floppy disks:  This replaces the boot sector of a diskette with its own code and moves the original boot sector further up the disk.  The boot sector of floppies is moved to a safe place, except on 720kb diskettes

where a bug in the virus causes it to write the body of the virus on to track 40.

Hard disks:  It moves the partition sector and replaces it with its own code.  This causes problems on a few hard disks where the displaced partition overwrites part of the FAT.

Every January 5th it saves the current screen to memory and replaces it with a display in 40-column mode in large type on a blue background with a double-line border, which says

Type 'Happy Birthday Joshi'!

This remains in place until the user types as requested, then the original screen is restored.


Jumper

Aliases:  Sillybop, French Boot, Neuville, 2KB

Description:

Jumper infects the boot sector of floppy disks and the partition sector of hard disks.

If the PC is booted from an infected floppy disk, the virus goes memory resident and infects the partition sector of the hard disk.  The virus infects any floppy disk which is accessed.

The virus copies the original partition sector to Cylinder 0, Head 0, Sector 14.  On floppy disks, the original boot sector is copied to one of the root directory sectors.


Junkie

Description:

Junkie infects the boot sector of floppy disks (720k. 1.2MB, 1.44MB, but not 360k) and the partition sector (MBR) of hard disks.  In addition,  COM files are infected.

The following text is contained encrypted within the virus:   "Dr White - Sweden 1994" and  "Junkie Virus - Written in Malmo...  M01D".

If the PC is booted from an infected floppy disk, the virus infects the partition sector of the hard disk.  When the PC is re-booted, the virus goes memory resident and infects any floppy disk which is accessed and any COM file which is run.

If an infected COM file is run, the virus infects the partition sector and goes memory resident the next time the PC is re-booted.  When infecting the partition sector (MBR) Junkie does not preserve the original sector.


Kaczor.mp.4444

Type: Multipartite virus.

Affects: EXE files on floppy disks; and the partition sector of the hard disk.

File Growth: 4444 bytes.

Description:

This virus is polymorphic; and uses stealth to conceal itself when memory resident.  It infects EXE files on floppy disks; and the partition sector of hard disks when an infected EXE file is run.

The virus intercepts INT_12, INT_13, INT_1C and INT_21.

It is encrypted even in memory.  When a particular section of virus code is needed it is decrypted, executed and then encrypted again.

The word kaczor serves as a password.  When it is typed-in at the keyboard, the virus cleans the partition sector and prints the message:

Zrobione

On a certain date the virus asks for a password; and the correct response is pieck.

On 3 March, Kaczor joggles the screen using the timer interrupt (INT_08).


Kaos4

Description:

Kaos4 infects executables (COM and EXE), increasing files by 697 bytes. The virus was originally distributed by via a posting to the Internet and was found in the wild in many countries.

Is a direct action (non-resident) virus affecting executables in the current directory and in the PATH. It infects one EXE and one COM victim each invocation.

The virus contains string  "[KAOS4 / Kohntark]" and  "*.COM *.EXE PATH=" (which is encrypted using NOT operation). The virus has no INT_24 handler and produces the message "Write protect error writing drive A:" when trying to infect files on a write-protected floppy disk.


Keypress

Type:  Memory-resident file virus.

Affects:  COM and EXE files on execution.  If DOS 2 is running, files are also infected when they are read.

File Growth:  1,232 to 1,487 bytes.

Description:

Every 10 minutes, for a period of two seconds the virus adds five more of the same key to any keypress.

Variants:  a, b, c, d, e, Samsoft.  Samsoft puts a message on the screen.


Lehigh

Type:  Memory-resident file virus.

Affects:  COMMAND.COM on execution of a program or when DOS looks for a file.  The date/time is changed.

File Growth:  None.

Description:

The virus includes an infection counter which counts the number of times (not generations) the virus has replicated.  When the virus creates a copy of itself, the counter is set to 0, and each time it replicates it

 increments the counter, which is then written back to COMMAND.COM on the current disk.

After the virus has copied itself four times it corrupts the disk by writing code from the BIOS to sectors 1 to 32.

On a floppy disk this is difficult to recover from, as both copies of the FAT and the directory will be overwritten.  On most hard disks this will not extend as far as the second copy of the FAT or the root directory, so it is easy to repair.

After the overwriting, a string from the BIOS is displayed.

This was probably the first documented PC virus.  It originated at Lehigh University in the USA and has never been found in the field outside the USA.

Variants:  Another version has a counter of ten, and has not been found outside the USA.


Lemming

Alias: Keeper.Lemming

Type: Memory resident file virus.

Affects: COM and EXE files.

Description:

This virus uses stealth to conceal itself when memory resident.  It is encrypted.  COM and EXE files are infected when they are executed or closed.

The virus filters itself out of infected files when they are opened (this is to avoid detection by scanners, especially in heuristic analysis mode). The virus avoids infecting anti-virus programs from the following list:

TBAVTBSCANNAVVSAFEFPROT

The virus checks for itself in memory by issuing a call, AX=FFFE/INT_21; the correct response is AL=FF.

Lemming.2144 contains the following text:

TBDRV

SP You Will Never Trust Anti-Virus Software Again!!

ThunderByte-1994-Australia.        ver 1.0

[HiTMaN]

"!Packed file is corrupt"

Lemming.2160 contains the following text:

TBDRV

SP

The Rise and Fall of ThunderByte-1994-Australia.

You Will Never Trust Anti-Virus Software Again!!

[LEMMING] ver .99á

"!Packed file is corrupt"

Variants: 2144, 2151, 2160


Liberty

Type:  Memory-resident file virus.

Affects:  An uninfected COM or EXE file on execution.  Date/time and read/write attributes are preserved.  Some versions also install on boot sectors.

File Growth:  COM: 2,858 bytes to 2,868;  EXE: 2,858 to 2,888.

Description:

The virus contains the string  -MYSTIC-COPYRIGHT (C) 1989-2000, BY SsAsMsUsEsL.  There is no payload.

Variants:  Liberty.b, Liberty.c


Maltese Amoeba

Type:  Memory-resident file virus.

Affects:  COM and EXE files on execution,  COM files must be between 450 and 63000 bytes:

File growth:  2498 to 2565 bytes.

Description:

The virus is polymorphic which makes it more difficult for scanners to detect.

The virus includes the following text (partly taken from William Blake's poem Auguries of Innocence):

 To see a World in a Grain of Sand,

 And a heaven in a Wild Flower,

 Hold Infinity in the palm of your hand,

 And Eternity in an hour.

 THE VIRUS 16/3/91

The following text is also included:

AMOEBA virus by the Hacker Twins (C) 1991 This is nothing, wait for the release of AMOEBA II-The universal infector, hidden to any eye but ours! Dedicated to the University of Malta - the worst educational system in the universe, and the destroyer of 5x2 years of human life.

On November 1st and March 15th the payload is triggered on ATs and above. This overwrites the first four sectors, starting from (0,0,1), and repeats this on cylinders 1 to 29.  This is repeated on all floppy drives.  The next time the computer is started the poem is displayed.


MacGyver

Aliases:  MCGY, Mac, MAC22, McGyv, Satan, Shoo, Jerus3

Variants:  2803a-d, 2824, 3160, 4112, 4480, 4643, 4645

Description:

These are memory-resident stealth viruses. They intercept the following DOS functions: 11, 12, 1a, 3d, 43, 4b, 56, 6c.

The 2803 and 2824 variants only infect EXE files.  Others infects both COM and EXE files.  The 4112 variant is a multipartite (it infects files, the partition sector of the hard disk and the boot sector of floppies)

Variant 4112 does not infect the following AV programs:

SCANCLEANPCCILLINZTESTZLOCKCKVICOMMAND

ZLOCKEZLOCKCDEBTPLUS

Virtually all viruses of this family have similar text inside (in most viruses it is encrypted, except in the 4480 variant). This text is from MacGyver.4645:

 * MacGyver  V3.0 *

 Hi!  I am MacGyver

   Written by

      Dark Slayer

 in Keelung. TAIWAN

 Don't Worry,I just

 a Virus. Ha..Ha...

This is displayed on the screen (and is accompanied by music in 2803a-c variants) when the virus triggers. The triggering depends on the date and time.


Major

Variants:  Major.1644, Major.1692

Description:

Major is a memory-resident appending viruses.  It infects EXE files upon execution.  The virus is encrypted, but not polymorphic.

At 2 o'clock in the morning if the PC is not busy it attempts to patch the file BSV6BSUSR.DAT. The Major.1692 variant also tries to patch BSV6BSAUDIT.DAT.

The following strings are found inside Major.1644:

"The Major BBS Virus created by Major tomwn to DOS"

The following string is found inside Major.1692:

"The Major Virus created by Weed and dedicated to the Quantum BBS in Calgary, AB service users"

Both variants have some names inside, which are apparently some BBS aliases (for example, Santa, Cindy, Herman, Minion, Puppet, Gnat, Image).


Markt

Alias: VCL.Markt, Mediamarkt, VCL-Werbe, VCL-3.DI

Variants:  1533, 1548, 1551

Description:

Markt is a direct action file virus, only infecting COM files. The virus is encrypted, but text close to the end of the virus is not:

"MediaMarkt WerbeVirus '94  (c) MediaMarkt Germany  The Wizard"

On the 9th of September the virus erases the partition sector (MBR) of the first harddisk and overwrites all available logical disks with random memory contents.

Then the virus shows a picture on a screen with a big banner at top "MediaMarkt" (white letters on red background), a skull with the words "-=>  SuXX!  <=-" blinking on the forehead and red eyes.

The message at the bottom of the reads:

"Ups, all Disk's from C: to Z: Trashed! Sorry about that!"

"to ALL Military Inventors its Time to give us the Tachyonator!"


MangeTout

Alias: 1099

File growth:

This is a tricky virus, infecting both COM and EXE files, and adding between 1099 and 1115 bytes to the end of the infected file. It goes memory resident in the Twixt region (above DOS memory but below the top of BIOS memory) by shrinking the last DOS MCB to make room for it. It does not have any stealth mechanism so the file growth is easily visible.

Memory residence:

When it goes memory resident it intercepts three interrupt vectors; 8 (System Timer), 9 (Keyboard Data Ready) and 21h (DOS Services). Ints 8 and 9 are used for the trigger routine and Int 21h is used for infection.  Most of the virus in memory is encrypted, only being decrypted when in use. The code is decrypted to a location in the DOS data segment starting at address 00540h and is executed from that point. This is true of the Int 21h interceptor, the initial residency code and the payload routine. All the time the code is decrypted, the keyboard is disabled by turning off the keyboard interrupt (IRQ 2) in the 8259A interrupt controller. After use, the code is overwritten with words of 0CBBAh so it is no longer visible.

The decryption system makes it very difficult to analyse the virus using DEBUG as this buffer area is overwritten with every DOS call.

Infection:

One file is infected whenever a DIR command is used. This is done by trapping DOS function 36h (Get Drive Allocation Information) which is used when calculating free disk space. You expect a delay at this point, when doing a DIR, so don't notice the time taken to infect. When the file is infected the seconds field of the file date/time is set to 36.


Manzon

Description:

Manzon is a memory-resident executable file infector, infecting  COM and EXE files.  The virus is double-encrypted. It uses function call AX=DCBA/INT_21 to determine whether it is already memory-resident.  If the virus is resident in memory then the answer will be DX=DCBA.

File size growth is variable. It is usually in the range 1430..1488 bytes.  COM files longer than 62000 bytes are not infected.  EXE files may be of any size.  Short files are not avoided.

The Manzon virus uses normal DOS calls (AH=48) to install itself in memory and occupies 1728 bytes of memory.

The virus intercepts Open (3D00), Execute (4B00) and Close (3E) instructions. It infects COMMAND.COM as a normal COM file.

It has a string "MANZON (c) Sgg1F5PZ^V".

The virus cannot work on a PC/XT.

The virus will not infect files with the following names: "F-*.*", "K-*.*", "SC*.*", "TB*.*", "TO*.*", "FV*.*", "FI*.*" and "VI*.*".

Manzon does not intercept interrupt 24 and produces the message "Write protect error..." when trying to infect a file on a write-protected floppy disk.

There are two variants: Manzon.1404 and Manzon.1414


Michelangelo

Description:

Michelangelo infects the boot sector of floppy disks and the partition sector of hard disks.

If the PC is booted from an infected floppy disk, the virus goes memory resident and infects the partition sector of the hard disk. The virus infects any floppy disk which is accessed.

The virus copies the original partition sector to Cylinder 0, Head 0, Sector 7.  On floppy disks, the original boot sector is copied to one of the root directory sectors.

On March 6th, if the PC is an AT or PS/2, the trojan triggers, overwriting the hard disk with nuls: it assumes a geometry of 256 cylinders, 4 heads and 17 sectors per track.

March 6th was the artist Michelangelo's birthday.


Mirea

Alias: Lyceum

Type: Memory resident file virus.

Affects: COM and EXE files (the 1975 variant infects COM files only).

File Growth: See Variants.

Description:

Variants 1766, 1773, 1813, 2087 and 2204 are encrypted.  Variant 4157 is polymorphic.

The virus intercepts interrupts 8, 9 and 21h.  It checks for itself in memory by issuing a call, AH=BB/INT_21; the correct response is AH=AA.  For most variants, infected files are recognised using byte FC at the file end. Infected files also have zero seconds and +100 years in the time-stamp.

Most variants contain a message, in Cyrillic characters, which is displayed if the keyboard is not touched for a long time (about half an hour).  Variant 1832 prints:

Welcome to Lycee of Information Technologies !

Variant 703 drops a 45-byte file called README.!!!.

Variants: 703, 930, 958, 1086, 1766, 1773, 1788, 1800, 1813, 1888a-b, 1901, 1950, 1975, 2087, 2204, 4157.


MISiS

Aliases:  Zharinov, Soft-236, Sea

Variants:  a-d

Description:

MISiS is a stealthing boot sector virus, infecting the partition sector (MBR) of hard disks and the boot sector of floppies.  Variants "a" and "b" save the original partition sector in sector 6 of track 0 (7 for "c", 5 for "d").  The virus body takes less than 1 sector (280 bytes excluding message; 216 bytes for variant "c").

Variants "a" and "c" contain some Russian text:

a: "SEA", "Soft 236-25-35" and "NIKA!"

c: "SEA", "'93.", "!!", "!!!!", "!!!!!"

Variant "b" has message in English (the usual "SEA" is still present):

"YOU ARE SILLY ORGANIC CREATIONI'M AMUSINGGO OUTSIDE!...GOOD BY...

I LOVE F117!HIGHT LOZINSKY!I'M BACK!!!!FREDDY BACK ALREADY!"

Variant "d" has message:

SEA.Moscow.5-29-1992.I think, it is a smallest stealth virus. It occupies memory 002D3-00339.It workes with 1.2M diskette as good as with 360K.It is harmless and do nothing(if you don't use BASIC).You can remove it with overwriting (even in ill computer). Good bye!


Mongol

Alias:  Mongolian

Description:

Mongol is a boot sector virus, infecting the boot sectors of write-enabled floppies and the partition sector (MBR) of the hard disk.

The virus itself occupies 4 sectors. On an infected floppy the body of the virus is stored on the last track, on the hard disk drive it is on track 0.

Mongol has a payload: on the 30th of May the virus overwrites some tracks of the hard disk drive with EB FE bytes and prints the following message (which is encrypted in the virus body):

Mongolian Virus VERSION 1.00

Mongolian Brain Co,Ltd 1992

Today is birthday of my baby!!!


Monkey

Alias: Empire.Monkey

Description:

Monkey infects the boot sector of floppy disks and the partition sector (MBR) of hard disks. The partition sector becomes infected when the PC is booted from an infected floppy disk (even if the floppy disk is not

bootable).  The virus then goes memory resident, infecting floppy disks which are accessed (even if floppy disks are just being read).  The virus uses stealth to conceal itself when memory resident.  Monkey encrypts the  partition sector and stores the encrypted partition sector on cylinder 0, head 0, sector 3;  you should not use FDISK /MBR to remove this virus, as this will make the hard disk inaccessible.

Monkey was written at the University of Alberta in Canada.


Musicbug

Type:  Memory-resident boot and partition sector virus.

Affects:  Floppy (drives A: and B:) and hard disks when booted from an infected floppy disk.

File Growth:  N/A

Description:

Hard disks:  The partition sector looks normal, but at the place where the virus begins is the text  MusicBug v1.06. Macrosoft Corp.. and near the end is  -- Made in Taiwan --.

Floppy disks:  These have 4Kb in lost clusters, which are used to store the virus.

When the virus is in memory it uses stealth techniques to hide. The virus plays a random tune.


Nado

Variants:  Nado.584, Nado.602, Nado.759, Nado.838, Nado.841

Description:

Nado is a small memory-resident parasitic file virus.

Variant 584 infects only EXE files, variant 601 - infects both COM and EXE, other variants infect only COM files.   The virus is encrypted (apart from the 584 bytes variant).

All variants are semi-stealthing, and contain the following strings:

584 - "[ RedViper (c) made by TorNado in Denmark '95 ]"

602, 759 - none

838, 841 - "[ Yitzhak-Rabin 1.00 (c) made by TorNado in Denmark '96 ]",

 "anti-vir.dat"

Nado virus corrupts the files it infects so that they only partially run. Such damaged files can not be repaired properly.

All viruses (except 584) have damaging payloads. Variants 602, 838 and 841 intercept keyboard interrupt (09h) and write garbage to disk whenever the [Del] key is pressed.  They then hang the PC.  Variant 759 does the same when DOS function SetDefaultDisk (AH=0E) is called and the current minute is 55.


Natas

Type:  Memory-resident file, boot sector and partition sector virus (multipartite)

Affects:  Fast infector: COM and EXE files on execution or close (e.g. when copying - both source and destination). COM files longer than 60692 or shorter than 1000 bytes and EXE files longer than 938040 bytes are not affected.

Hard disk's partition sector is infected when an infected program is executed or when booted from an infected diskette. Floppies are infected on read access (e.g. DIR command).

File growth:  4744 bytes

Description:

The virus in infected files is variably encrypted and polymorphic.

The virus demonstrates full stealth - when it is active in memory, it conceals all changes in infected files and disks. Unlike most of full stealth viruses, Natas is able to survive archiving (ARJ, LHArc, PKZip), backuping (BACKUP, PCBACKUP) and transfers of infected files via modem (ZMODEM, XMODEM, etc.). It does not trigger CHKDSK file system errors reports.

When booted from an infected hard disk, with the probability of 1/512th (i.e. approximately once in every 512 boots) the virus triggers and formats all hard disks in the system, thus destroying all data on them. The virus can also trigger when being traced with a debugger.

It contains the following encrypted strings:  Natas,  BACK and MODEM


Necros.1164

Description:

Necros is a memory-resident polymorphic file infecting virus.  It infects COM files by prepending its body to the original file. For EXE files it uses the companion technique.

The virus has two internal strings:

 "Virus V2.0 [FrIEND]i"

and

 "Virus V2.0 (c) 1991 Necros The Hacker

Written on 29,30 June in Tralee, Co. Kerry, Ireland

Happy Birthday, Necros!"

The first string is visible in the memory, the second is encrypted. On the 21st of November the virus beeps and prints the second string.


Neuroquila.mp

Aliases: Havoc, Neuro.Havoc, Wedding

Type: Multipartite virus.

Affects: The boot sector of floppy disks; and the partition sector of hard disks if the PC is booted from an infected floppy disk, or if an infected EXE file is run.

Description:

Neuroquila.mp is a memory resident, multipartiite virus.  Where possible, it loads into the Upper Memory Blocks (UMB) provided by EMM386.

The virus uses stealth to conceal changes it makes to infected partition sectors and floppy disk boot sectors. On floppy disks, the virus formats an additional track and uses this to store the main body of the virus code.

This virus is able to modify some TSR anti-virus programs in memory (for example, TBDRIVER, TBDISK, VSAFE).

Neuroquila encrypts the partition sector.  As a result, the hard disk becomes inaccessible if the PC is booted from a DOS system disk.  If FDISK /MBR is used to remove this virus, the hard disk will become inaccessible.

Neuroquila is, in some respects is similar to the Tequila.mp virus; hence its name.  It was written by the virus writer calling himself Neurobasher (author of Tremor and Nightfall). Neuroquila.mp [.a] contains a string (which is displayed a couple of months after the PC becomes infected):

<HAVOC> by Neurobasher'93/Germany

- GRIPPED BY FEAR - UNTIL DEATH US DO PART!


Nightfall

Aliases: N8Fall, Neurobasher.N8Fall

Type: Memory resident file virus.

Affects: COM and EXE files.

File Growth: See Variants

Description:

Nightfall is a memory resident polymorphic virus.  Where possible, it loads into the High Memory Area (HMA) provided by HIMEM.SYS or the Upper Memory Blocks (UMB) provided by EMM386; but the short memory dispatcher is always located in low memory.

It uses steatlh to conceal itself when memory resident and is also a fast infector (infecting files not only on execution, but also when copied or opened).

Nightfall avoids infecting files containing the strings AV, PL, CH and MI.  In addition, it disables VSAFE (the TSR which comes with Central Point AntiVirus and Microsoft AntiVirus) by patching it in memory.

The virus requires at least a 386 processor; some specific commands are used by the polymorphic engine in the virus decryptor.

The 5815 variant of Nightfall sometimes drops the Nightfall.cmp.527 resident companion virus in EXE files.  This companion deletes itself after it runs. It avoids infecting files on floppy disks (probably because it is slow).

Nightfall was written by German virus writer calling himself Neurobasher (author of Tremor and Neuroquila). The virus contains the following text:

     Any means necessary for survival

      _ N8Fall/2XS by NeuroBasher _

By the perception of illusion we experience

                 reality

Art & Strategy by Neurobasher 1994 - Germany

I don't think that the real violence has even

                started yet

Variants: 4518a-b, 4527, 5767, 5815

Due to the pre-fetch queue in the second layer of encyryption the 5767 variant of Nightfall does not work on Pentium processors.


No_Frills

Type: Memory resident file virus.

Affects: COM and EXE files.

File Growth: See Variants

Description:

No_Frills infects COM and EXE files when they are executed, opened or copied.  The 1358 variant infects COM files only.

The virus intercepts INT_21 functions 3D (Open), 43 (Get Attribute),4B (Execute), 6C (Extended Open; not used by .1358). It checks for itself in memory by issuing a call, AX=5432/Int_21h; the correct response is AX=1005 (.813, .815, .843), AX=1006, (.950), AX=1007 (.835, .840), AX=1301 (.1358).

No_Frills does not infect files starting with SC (for example, SCAN.EXE).

Files are misinfected quite frequently by the No_Frills viruses.

This family of viruses is related to X-Fungus. The following strings are found in these viruses:

813:  +-No Frills by Harry McBungus-+

815a: +-No Frills 1.01 by Harry McBungus-+

815b: +-No Frills by Harry McBungus-+

835:  +-NF3.0-H.McB-[PuKE]-+

840:  no strings

843:  +-No Frills 2.0 by Harry McBungus-+

950:  +-K-Lame Kreation by Harry McBungus-+

1358: Kcat 3.01 ñ 5%  -  By Sir Twist & Thunderbird, with Many Thankz to Harry McBungus whose coded we politely nicked.

Variants: 813, 815ab, 835, 840, 843, 950, 1358


No_Frills.Dudley.1153

Type: Memory resident file virus.

Affects: COM and EXE files (variant 1358 infects COM files only).

File Growth: 1153 bytes.

Description:

This is a memory resident polymorphic virus.  It is a fast infector, infecting files when they are executed, opened, copied or renamed.

The virus intercepts INT_21 functions 3D (Open), 4B00 (Execute),56 (Rename) and 6C (Extended Open).  It checks for itself in memory by issuing a call, AX=5454/Int_21h; the correct response is AX=0.

All infected files start with the bytes 71 00 - this is an infection marker for COM files.  EXE files are marked by EP (50 45) in the checksum field of the EXE header.

This virus does not infect files starting with SC (for example, McAfee's SCAN.EXE).  It contains the string:

"<[Oi, Dudley!][PuKE]>"


Nov17

Aliases: November_17th, BigMouse

Type: Memory resident file virus.

Affects: COM and EXE files (except the 584 variant, which infects COM files only).

File Growth: See variants.

Description:

Nov17 is not encrypted (except variants 900, 998 and 1007).  All unencrypted host files have the marker MZ as the last two bytes of the file (except Nov17.584; and in the 864 variant, the marker is 11 bytes below the end of file).

The most common variants of this virus (768a, 800a, 855a) do not use a simple jump to transfer control to the virus. They push two words on to the stack (code segment value and offset of the viral code) and then do a far return, which transfers control to the beginning of the virus.

Variants 768, 800, 855, 864, 880 contain the following string, close to the end of the file:

SCAN.CLEAN.COMEXE

Encrypted variants (900, 998 and 1007; variant 1006 is a virus 'wannabe' (or intended virus) and does not work properly) use INT_FF to decrypt themselves; and carry a list of anti-virus programs they do not infect (the first 4 letters):

SCANCLEAVIRSF-PRCPAV

Variants: 584, 690, 706a-b, 768, 800a-c, 855a-b, 864, 880, 900a-c, 998, 1006, 1007

Variants of this virus have the following payloads (all disk-oriented payloads use INT_26 to overwrite the beginning of the current drive; the only exception is Nov17.706, which uses INT_13):

584 erases CMOS on Wednesdays, if the current hour is in the range 13..16.

690 erases the first 8 sectors of the current drive, on  8 July.

706 overwrites the first 11 sectors of the current drive (but not C and D drives), on the 1st of any month.

768a,c,d and 800a erase the first 8 sectors of the current drive, between 17 and 30 November.

768b erases the first 8 sectors of the current drive, on the 8 July.

800b erases the first 8 sectors of the current drive, on 1 January.

855 erases the first 8 sectors of the current drive after 500 keypresses, between 17 and 30 November.

864 erases the first 8 sectors of the current drive, between 10  and 30 July.

880 erases the first 4 sectors of the current drive after 100 keypresses, between 17 and 31 October.

900a  prints  G+A=, Press a key to go on  (if current year is greater than 1993), on 23rd of any month.

900b,c print the 900a message, but only on 23 November.

998 sometimes overwrites sectors on the current drive, in April.

1007 prints the message:

BigMouse and Anna love each other

Press any key to go on

on 23rd of November.


Nuclear

Alias: WordMacro.Nuclear, WordMacro.Alert, WM.Nuclear

Type:  Word macro virus.

Description:

A Word .DOC file, containing a description of another Word Macro virus (Concept) was uploaded to one of the publicly accessible ftp directories at the USA internet provider netcom.com. The file in its turn appeared  to be infected with a new Word Macro virus - Nuclear.

Similar to Concept, Nuclear infects NORMAL.DOT when an infected document is opened. Then it infects all the documents being saved using File/SaveAs. Unlike Concept, all macros in Nuclear are "execute-only"  i.e. protected (encrypted) in such a way you cannot view or modify their source code. (You still can see the macros' names in Tools/Macro though).  We, nevertheless, succeeded in decrypting the macros and thus, in analysing and understanding the virus.

An infected document or NORMAL.DOT contains nine macros named AutoExec, AutoOpen, DropSuriv, FileExit, FilePrint, FilePrintDefault, FileSaveAs, InsertPayload and PayLoad. The main effect of the virus, besides replication, is that if a document is being printed and system clock seconds counter is in between 55 and 59 seconds (i.e. with a probability of approximately 1/12th), two lines are added to the document and are subsequently printed at the end of the last page:

And finally I would like to say:

STOP ALL FRENCH NUCLEAR TESTING IN THE PACIFIC!

The virus was also supposed to drop a "normal" (i.e. COM/EXE/NewEXE infecting) virus named PH33R (pronounced `fear'), but due to a whole set of bugs it fails to achieve this. By the way, the virus it is supposed to drop has nothing to do with the old Suriv virus family. The confusion is completely due to the fact the macro to do this is called DropSuriv.  'suriv' is nothing but 'virus' reversed and the only thing in common between the Suriv viruses and DropSuriv macro is the name.

Another payload conceived by Nuclear author should be triggered on April 5 any year. The destructive macro named Payload was supposed to damage (truncate to 0 bytes) system files IO.SYS, MSDOS.SYS and COMMAND.COM.  Fortunately, once again due to the virus author - the Payload macro does not work either due to bugs in it.

The virus also causes some side effects such as error messages if you choose <Cancel> from File/Print or File/SaveAs.


NYB

Aliases: New York Boot, B1

Type:  Memory-resident boot and partition sector virus.

Affects:  Floppy and hard disks.

Description:

NYB infects the boot sector of floppy disks and the partition sector (MBR) of hard disks. The partition sector becomes infected when the PC is booted from an infected floppy disk (even if the floppy disk is not bootable). The virus then goes memory resident, infecting floppy disks which are accessed (even if floppy disks are just being read).  The original partition sector is re-located to cylinder 0, head 0, sector 17.  On floppy disks, the original boot sector is re-located to one of the root directory sectors.  The virus uses stealth to conceal itself when memory resident.

NYB can crash a PC if the hard disk is written to at midnight (00:00).


NoInt

Alias: Bloomington

Type:  Memory-resident boot and partition sector virus.

Affects:  Floppy and hard disks.

Description:

Noint is one of the many variants of the Stoned virus.  Noint infects the boot sector of floppy disks and the partition sector (MBR) of hard disks. The partition sector becomes infected when the PC is booted from an infected floppy disk (even if the floppy is not bootable).  The virus then goes memory resident, infecting floppy disks which are accessed (even if floppy disks are just being read).  The virus uses stealth to conceal itself when memory resident.  The original partition sector is re-located to cylinder 0, head 0, sector 7.  On floppy disks, the original boot sector is re-located to one of the root directory sectors.


Odious.569

Description:

Odious.569 is a non-encrypted virus which only infects COM files. The virus does not go memory-resident, and appends itself to files. It always infects COMMAND.COM.

On any Monday in May the virus makes characters on the screen disappear (it does this by clearing their definition in the current font).

The virus contains the following internal strings: "The Creeper Virus V2.0", "*.com", "c:\chklist.*" and "c:\command.com".


One_Half

Aliases:  FreeLove, Slovak Bomber, Explosion II

Type:  Memory-resident file and partition sector virus (multipartite)

Affects:  Fast infector: COM and EXE files on execution, open, rename etc. Hard disk's partition sector is infected when an infected program is executed.

File growth:  3544 bytes

Description:

The virus in infected files is variably encrypted and polymorphic.

The virus demonstrates stealth capabilities - when it is active in memory, it conceals all changes to infected hard disk's partition sector and file size increase.

Partition sector is infected when an infected program is executed. COM and EXE files are infected on virtually any access to them - it's a fast infector.

The most nasty feature of One_Half is its payload. When a hard disk is infected, the virus calculates the position of the last cylinder of the last DOS partition. Then every time the computer is booted, the virus encrypts two disk's cylinders starting from the last two cylinders and moving towards the begining of the partition. The pointer to the last encrypted cylinder is updated in the infected partition sector. When the pointer falls below approximately one half of the total number of cylinders in the partition (i.e. when half of the disk partition is encrypted), the virus triggers, provided the date is multiple of 4. In the case the virus displays the message

Dis is one half

Press any key to continue ...

Variants: There is another variant of the virus 3577 bytes long.


Orsam

Description:

Orsam is a variant of Ginger.  It comes from Australia. By performing tricks wit the partition sector it exploits a bug in DOS.  This means a clean boot is *impossible* from floppy disks formatted with version 4, 5, or 6 of MS-DOS.

DOS 3.3 or Novell DOS 7 formatted disks will be able to clean boot.

For this reason, a DOS 3.3 clean boot up disk becomes a useful component of every tech support team's emergency biscuit tin.


Parity.b

Type:  Memory-resident boot and partition sector virus.

Affects:  Hard and floppy disks.

File growth:  N/A

This stealth boot and partition sector virus can survive a warm reboot (<Ctrl><Alt><Del>).  It does this by intercepting the Ctrl-Alt-Del key  sequence and "faking" a reboot.  For this reason it is necessary to do a proper cold-boot (power-off) when dealing with this virus

When booted from an infected disk, the virus stays memory-resident and infects hard and floppy disks being read (e.g. via the DIR command). If an uninfected floppy is write-protected, the virus will perform an infinite loop when trying to infect it, hanging the computer.  The virus demonstrates stealth techniques, concealing changes made to boot and partition sectors.

If no disks are infected during approximately one hour, the virus triggers and on the next keystroke displays the message:

PARITY CHECK

and hangs the computer.

Variants: There are three slightly different variants.


Pasta

Description:

Pasta is a boot sector virus, infecting the partition sector (MBR) of hard disks and the boot sector of floppies.  It uses complex jump constructions in an attempt to avoid detection by heuristic methods.

The virus moves the original partition sector to sector 6 of track 0 on the hard disk.  On floppies the original boot sector is moved to head=1, sector=3.

The virus has no internal strings and received its name because of the weird programming techniques (it jumps all over the place).  The virus has no payload.


Pathogen

Type:  Memory-resident file virus

Affects:  COM and EXE files on execution or on access via DOS Fn 6Ch: Extended Open/Create. COMMAND.COM and some antivirus programs are avoided. It does not infect files shorter than 32 bytes. COM files longer than 56,000 bytes and EXE files longer than 512,000 are not infected.

File growth:  Variable, 4004-4804 bytes

Description:

The virus is variably encrypted and highly polymorphic.

Whenever an infected program is executed and the virus installs itself memory resident, an internal generation counter is increased. So, all the files infected by this virus copy will have the counter increased by one. When the generation counter reaches 32, it is zeroed (i.e. restarted) and the virus triggers.

When any executable file (i.e. .COM or .EXE) is being run or accessed via DOS Extended Open/Create function call, 32nd generation virus will patch CMOS to disable floppy drives.

If, additionally, the current day is Monday and the time is between 5 p.m. and 6 p.m., the virus will display the message:

Your hard-disk is being corrupted, courtesy of PATHOGEN!

  Programmed in the U.K. (Yes, NOT Bulgaria!)  [C] The Black Baron 1993-4.

    Featuring SMEG v0.1:  Simulated Metamorphic Encryption Generator!

      'Smoke me a kipper, I`ll be back for breakfast.....'

        Unfortunately some of your data won`t!!!!!

Then the virus will disable keyboard and trash first 256 cylinders of the hard disk.


Peter2

Description:

Peter 2 when triggered on the 27th of Feb will display the following text:

  Do not turn off power, or you will lost all of the data in Hardisk!!!

  WAIT for 1 MINUTES,please...

it then asks 3 questions on Pop stars and soccer if answered correctly it gives the message

  Congratulations!!! YOU successfully pass the quiz|

  AND NOW RECOVERING YOUR HARDISK.......

which it does, if incorrect answers are given it trashes the FAT.


Ph33r.1322

Aliases:  WordMacro.Nuclear.1332, Kamikaze

Description:

Ph33r (pronounced "fear") is a memory-resident COM and EXE file infector. The virus is not encrypted.  It also infects NE executables ('New Executable' format used by Windows 16-bit EXE files).  It does not infect COM files shorter than 1024 and longer than 60000 bytes.

All infected NE executables are given the timestamp 3-10-92, 3:10:00a after being infected (which is the same timestamp that Windows 3.10 files have).

This virus was written by Australian group of virus writers VLAD (Virus Labs and Distribution).  The Word macro virus WM.Nuclear.a had a payload to drop this virus but fails because of numerous bugs.


PHX

Aliases:  Pux, PUX, Tracker

Description:

PHX is a memory-resident appending virus, infecting COM and EXE upon execution.  The most common variant is PHX.965.  It has a complex payload, which has almost no effect.  Sometimes the virus changes one bit in memory, but it open happens rarely. Variant PHX.965 contains a short string "PHX".

This virus does not work on XT computers, as it uses 80286 instructions. The PHX.1289 variant only works under DOS version 3.

Variants:  PHX.823, PHX,965, PHX,1015, PHX,1289, PHX,1295, PHX.1360


Pindonga.3580

Description:

Pindonga is an appending parasitic file infecting virus. The virus is memory-resident and polymorphic, infecting EXE and COM files. Only COM files starting with JMP (E9) are infected.

The virus was named because of strings contained within itself: (the first string is encrypted in the virus body, the second is not):

"PINDONGA Virus V4.3 (Hecho en ARGENTINA)".

"PINDONGA virus (Programado por OTTO en ARGENTINA 16977"

The virus payload is triggered on 25th February, 21st March, 27th August, and the 16th of September and it erases the harddisk.  To get the date the virus uses direct access to the CMOS/clock ports (70h, 71h).

When the virus execution is finished it does not bother to restore the initial jump of the host COM file, it just jumps to where the original JMP used to point.


Pinworm

Alias:  Virogen.Pinworm

Type: Memory resident file virus.

Affects: COM and EXE files.

File Growth: See Variants.

Description:

Pinworm is a memory resident polymorphic virus infecting COM and EXE files which are executed.

The virus removes the files CHKLIST.MS and CHKLIST.CPS (MSAV and CPAV integrity database files, respectively) and is also able to corrupt executable files of anti-virus products named *AV.*, *.OT.*, *SCAN.* (NAV, F-PROT, SCAN).

The payload of the most common Pinworm virus (the 2150 variant) activates on the 1st of any month.  The virus creates a sub-directory called PIïWérM.ûg! containing a number of files. These files have spaces in the file names and form a short text:

I hope y

ou have

enjoyed

your inf

estation

by the

mighty P

inworm p

arasite

Fuck you

all!

úúúúúúúú (this is ASCII 250)

-ûirogen

The virus also contains a string:

v1.00 - Coded by ûirogen in April 1994

CHKLIST.MS CHKLIST.CPS

Variants: 1800, 2400, 2150, 2171, 2371, 2566, 2585, 2780


Pirates Hat.2360

Type:  Memory-resident file virus

Affects:  EXE files on execution.

Description:

This highly polymorphic virus infects EXE files on execution.  It uses a very complicated mechanism to build a decryptor for itself.

This virus contains an internal string:  "[For pirates...  (C)1993-94 nessuno] sono solo stronzate". It is visible only in  memory, as all infected EXE files are encrypted.

Some intended infected files (less than 1 in 200) are damaged during the infection process and will hang if executed. The virus frequently sets negative values for the CS register in the EXE file header, so if the PC

 has a lot of free RAM (for example 620kb or more) the virus might hang the PC.

This virus has been found in the wild at least once in the Netherlands.


PKZ300 trojan

Aliases:   PKZIP 3.00 trojan horse

Description:

In May 1995 news first broke that a trojanised version of PKZIP was being distributed. The file (PKZ300B.ZIP or PKZ300.ZIP) purported to be a beta version of a new edition of PKZIP, the popular compression/decompression tool.

PKZIP300 trojan is an executable file inside self-extracting ZIP archive named PKZ300B.EXE (size is 178981 byte). The self-extracting archive contains the following files:

  PKZINST .EXE 5328 bytes (uncompressed length)

  WHATSNEW.300 2417

  COMPRESS.000 124005

  COMPRESS.001 116260

  FILE_ID.DIZ 101

The first file - PKZINST.EXE is a HLL (High Level Language) program apparently written in Pascal, which is a trojan. When started it prints:

 "Initializing, this may take a few minutes...."

and then issues the command  "format c: >NULL". In most versions of DOS this command will do nothing, just because the program asks for confirmation. Redirection ">NULL" is also wrong, as for DOS it should be ">nul". If you try to interrupt the trojan with Ctrl-C it sometimes prints:

 "Thanks for waiting, moron. You shouldn't have fucked with us."

Then, the machine should be rebooted.  After reboot the hard-drive is still accessible and no data is damaged. We have failed to find any conditions under which the data is lost.

The trojan also has the following strings inside:   "2PKZIP (R) Install Utility   Version 3.00b 4-05-950Corp. 1989-1995 Pkware Inc. All rights reserved.!Pkzip Reg.  U.S. Pat. and Tm. Off.-", "COMSPEC", "Could not execute COMMAND.COM", "deltree /y c:\ >NULL".

It is extremely unlikely that you will ever come across this trojan horse.


Predator

Alias:  Predator 2

Variants:  Predator.2424, Predator.2448

Description:

Predator is a memory-resident stealth multipartite virus, infecting COM and EXE files, the partition sector (MBR) of hard disks and the boot sector of floppies.  It is a fast infector - it infects not only on execution, but when files are opened for access as well.

Predator takes up 6 sectors on track 0 of the hard disk drive or the last track of the floppy disk.

The virus is slightly polymorphic (it uses a set of different encryption algorithms) and uses tunneling when trying to infect the partition sector and boot sector.  The virus only infects COM files longer than 1000 bytes and shorter than 62088 bytes.   It does not infect EXE files with overlays.

It does not infect the following antivirus programs: F-PROT, SCAN, CLEAN, VSAFE, CPAV, and NAV.

Predator contains a number of internal strings: "Predator virus #2  (c) 1993  Priest - Phalcon/Skism", "THE PREDATOR", and "Here comes the Predator!".  The second and third string are encrypted inside the virus.

Another string is also held in the virus:  "TORPNACSAELCFASVVAPC.VANOCED". This represents the names of programs not affected by the virus (read from right to the left).

Infected partition sectors and boot sectors always start with the following hexadecimal sequence: FA BF 14 7C B8 32 00 B9.


Pretentious.680

Alias:  Gdynia.680

Description:

Pretentious is a parasitic non-resident appending *.COM infector. Infected files become 680 bytes longer and have their time stamp set to 62 sec (like the Vienna virus).  This change to the time stamp is not noticable when doing a normal DIR of infected files.

When an infected program is run, the virus changes the current DOS disk to C: and infects one file in the current directory on C:. The DOS default drive is not restored to what it was before, but changed to C:. That means if you run an infected program on drive A:, for example, you are returned to the current directory on drive C:.

The virus does not propagate if there is no C: drive. The virus does not infect files shorter than 255 bytes and longer than 64,000 bytes. It avoids infecting any file with the filemask ??MM????.COM.  This means

it will avoid infecting COMMAND.COM

The presence of the virus is pretty obvious: any month but January when an infected program is run the virus will display the following text:

"Windows 95 may be dangerous.

OS/2 is the best operating system!

I'll prove it soon..."

The above text is kept encrypted in the virus body. It also contains non-encrypted text  "Gdynia 1996 * v1.0 *" (Gdynia is a large city in Poland).  All the text messages are verified by a checksum by the virus and if they are found to be modified (in other words, if the checksum does not match) the virus reboots the computer.

This virus was distributed widely via the amateur "Packet Network", meaning that the potential for copies of this virus spreading are quite large.  The packet network sends binary files in a manner similar to UUE as mail, with multiple copies spreading out on BBSes worldwide.  Many BBSes process such files automatically, and append them to their download areas - so even if the file is not read, and decoded as original mail, there is a danger of infection at a later date by a user downloading the infection from a BBS.


Quandary

Aliases: IHC, Parity.boot.enc, Newboot_1, Boot-c

Description:

Quandary is a stealthing boot sector virus, infecting the boot sectors of floppies and the partition sector (MBR) of hard disks.  The virus only takes up one sector and in fact the infected partition sector looks very similar to an infected floppy disk boot sector.

Part of the beginning of the virus is encrypted (34 bytes).  This is an attempt to avoid detection by heuristic scanners (the most suspicious actions of the virus code are encrypted - memory installation and interception of Int_13).

The virus infects write-enabled floppies when they are accessed. Before infecting the floppy the virus checks to see whether it has already been infected.  It then analyses the diskette parameters (number of FATs, number of root directory entries, number of sectors per FAT, number of reserved sectors).  The limitations applied allows the virus to infect only standard 1.44MB floppies.

Quandary is stealth virus and the original floppy boot sector is saved at the very end of the root directory (head=1, sector=15 on track 0).  On the hard disk the original partition sector (MBR) is stored in sector 15 (0F) of track 0.


Queeg

Type:  Memory-resident file virus

Affects:  COM and EXE files on execution or on access via DOS Fn 6Ch: Extended Open/Create. COMMAND.COM and some antivirus programs are avoided. It does not infect files shorter than 32 bytes. COM files longer than 54,232 bytes and EXE files longer than 512,000 are not infected.

File growth:  Variable, 4300-6100 bytes

Description:

The virus is variably encrypted and highly polymorphic.

Whenever an infected program is executed and the virus installs itself memory resident, an internal generation counter is increased. So, all the files infected by this virus copy will have the counter increased by one. When the generation counter reaches 32, it is zeroed (i.e. restarted) and the virus can trigger.

If an executable file is (.COM or .EXE) is run or accessed via DOS Extended Open/Create function call on Sunday between noon and 1 p.m., the 32nd generation virus triggers with the probability of 1/32nd. It displays the message

           QUEEG

(C)  The Black Baron 1994

  Featuring:  SMEG v0.2

  Better than life.....

and trashes first 256 cylinders of the hard disk.


Query

Aliases: Qrry, Essex

Type: Boot sector virus.

Affects: The boot sector of floppy disks; and the partition sector of hard disks when the PC is booted from an infected floppy disk.

Description:

For self recognition, the virus uses bytes CD AB at offset 170h in the infected sector.

Query has a payload; in December, it overwrites the first three cylinders of the first hard drive and then hangs the machine.


Quicky.1376

Aliases:  Quicksilver, Quickie, V.1376

Description:

Quicky is a memory-resident file infector, infecting EXE files which begin with the characters 'MZ' - but not EXE files which begin with 'ZM'.  The virus is encrypted.

The virus intercepts interrupts 21h (DOS functions 4B00h - execute and 3Eh - close) and 13h (disk i/o). It also introduces two its own functions on Int_21h - C001 and C002, which change its behaviour. The first turns off the virus int_13h code, the second turns it on.

The virus has the following string contained within itself:

"CHKLIST.TAVANTI-VIR.DATCHKLIST.MS"

This string represents the filenames of files created by various anti-virus products.  Quicky deletes these files.


Quox

Type:  Memory-resident boot and partition sector virus.

Affects:  Floppy and hard disks.

File growth:  N/A

Description:

This stealth boot and partition sector virus has no intended payload.

When booted from an infected disk, the virus stays memory-resident and infects hard disk and diskettes being accessed (e.g. DIR command). The virus demonstrates stealth technique, concealing changes made to infected boot and partition sectors.

Since the virus uses some 80286+ specific instructions, it would not operate properly on pre-80286 computers (most of XTs).


Reverse

Aliases: Red Spider, Reverce

Variants:  a-b

Description:

Reverse is a memory-resident COM and EXE infector.  The body of the virus is not encrypted (only the text is).

When the virus infects COMMAND.COM it places itself in zero-filled area of the file without increasing its length.

The virus does not infect files which have the string "Sell" at offset 2ch from the beginning of the file ("Sell" is the name of a Polish antivirus researcher, and this measure might have been taken to avoid infecting his antivirus programs).  As well as this files shorter than 2000 bytes and longer than 63500 bytes are not infected.

Variant "a" of this virus has the following texts inside:

"Reverse-948  Created by Renata G. from Lubin City in Sept 1993"

Variant "b" has two different strains with the following texts:

"Red Spider Virus created by Garfield from Zielona Gora in Feb 1993"

"K6W-S-P=>Z.G.=>Fizyka (c) SV ! Pozdrowienia dla kumpli z FIZY!1.5.94"

Both variants include the common string "moc.dnammoc exe.niamcn".  This strings contains the reversed filenames of COMMAND.COM and NCMAIN.EXE.  It is from this that the virus gets its name.


Ripper

Aliases: Jack the Ripper

Description:

This is a boot/partition sector virus, infecting partitions on hard disks and boot sectors on floppies. On hard disks it occupies the partition sector and sector 0, 0, 8, and copies the original partition to 0, 0, 9. On floppies, it uses the last two directory sectors.

Ripper employs full stealth - with the virus in memory, the partition looks normal, just as if it was not infected. Encrypted in the virus is the following phrase:

FUCK 'EM UP!

(C) 1992 Jack Ripper

The payload is disk trashing, but in a very clandestine way. There is approximately a 1 in 1000 chance that the virus will read  through the disk and after every 1024 bytes it switches the next two bytes around.  This has the effect of corrupting data or programs, which might not be detected until a program refuses to load or a record in a data file cannot not be found.  At this stage it is likely that any set of backup disks or tape would have been used at least twice since the payload had triggered, leaving the user with no way of restoring the uncorrupted data files or programs.


RPS

Aliases:  RPS2, Matteo, FIFTY BOOT

Variants:  a-c

RPS is a boot sector virus, infecting the partition sector (MBR) of hard disks and the boot sector of write-enabled floppy diskettes.

If the virus is active (memory-resident), any attempt to write to the infected MBR will cause the execution of the virus payload. The payload erases the contents of CMOS and tries to overwrite the beginning of both harddisks (if a second hard disk is present).

The first step of the payload (the CMOS overwriting) works, but the second (hard disk overwriting) has a bug and will most likely always fail (depending on the BIOS implementation). The PC then hangs.

Variant .b of this virus does not erase the CMOS, but the attempt to overwrite the hard disk is still there (and still buggy).  Variant .c is an intended virus (known as a "wannabee") and does not work properly.


Russian Flag

Aliases: Russian Hook, Russian Flag, Ekaterinburg, Ekaterin, Slydell.

Type:  Memory-resident boot and partition sector virus.

Affects:  Write-enabled hard and floppy disks if the computer is booted from an infected (not necessarily bootable) floppy.

File growth:  N/A

Description:

This boot and partition sector virus infects the hard disk when booted from an infected floppy.  Diskettes are infected on read access (eg. DIR command).

On the 19th August the virus displays a Russian Flag on the screen. This appears to be a commemoration of 19th August 1991 when there was a communist military coup in Russia.

The text  "Ekaterinburg" can be found encrypted inside the virus.


Sampo

Aliases:  Turbo, Wllop, 69

Type:  Memory-resident boot and partition sector virus.

Affects:  Floppy and hard disks.

File growth:  N/A

Description:

This boot and partition sector virus infects hard disks when booted from an infected floppy. Then it infects diskettes on read access (e.g. DIR command).

When active in memory, the virus stealths the infected partition sector but does not do this with infected floppies.

Sampo is able to "survive" warm reboot (<Ctrl><Alt><Del>).  It does this by intercepting the Ctrl-Alt-Del key sequence and "faking" a reboot.  It is therefore important that a cold-boot (power-off) is performed.

If a write-protected diskette is accessed on a computer infected with Sampo, the virus fakes the boot sector infected with Telefonica.A using stealth-like mechanism. This can cause Telefonica false positives on a Sampo infected PC.

On 30th of November, after approximately two hours since the computer was booted the virus triggers and displays the following message:

        S A M P O

       "Project X"

Copyright (c)1991 by the

SAMPO X-Team. All rights

reserved.

University Of The East

Manila


Sarampo

Aliases: Cavaco, Infector

Type: Memory resident file virus.

Affects: COM and EXE files.

File Growth: See Variants

Description:

If the size of the file being infected is a multiple of 256 bytes, the virus miscalculates the entry point of the file and the infected file will not run (although it can be detected and cleaned).

The virus intercepts Int_1Ch (timer) and Int_21h (DOS services). To check for itself in memory, the virus issues a call, AH=ED/Int_21h; the correct response is AH=FD.

The payload activates on April 25, December 25 and October 12. It is not destructive - it just garbles the screen and hangs the machine.

Variants: 1371, 1450, 1470

Variant 1371 contains the following text:

c:\command.com

Do you like this Screen Saver ?  I hope so.

Created by Sarampo virus.

Variant 1470 has the following text:

c:\command.com

Do you like this Screen Saver ?

Cavaco - A virus created by The Portuguese Government


SatanBug

Type:  Memory-resident polymorphic file virus

Affects:  COM and EXE files

File growth:  Variable 4kb - 5kb

Description:

The virus infects files on execution, generating an increase in file size of between 4kb and 5kb.

The following string appears in the virus:

  "Satan Bug virus - Little Loc".

This virus targets two anti-virus programs, McAfee Scan and Central Point Anti-Virus, in an attempt to avoid detection.  The true identity of the virus author, who also wrote Natas, is known to the authorities.

Source code for this virus is available on the Internet, so there are many variants of this virus (for instance SatanBug.1568 which only infects COM files, and SatanBug.Fruitfly which is a non-resident direct action infector through PATH=


Satria

Alias: Stoned.Satria

Type: Boot sector virus.

Affects: The boot sector of floppy disks; and the partition sector of hard disks when the PC is booted from an infected floppy disk.

Description:

This is a rather primitive virus, intercepting INT_13 only.  It uses 1 Kb of RAM and occupies just one sector on the disk.  For self recognition, the virus uses bytes BE BF at offset 1Bh in the infected partition or boot sector.

Variants: a-c


Sayha.4000

Aliases: SAYAWAT, Watpu

Type: Memory resident file virus.

Affects: COM and EXE files.

File Growth: 4,000 bytes.

Description:

Sayha.4000 is partially encrypted.  It is a fast infector, infecting files when they are executed, opened or copied. Partially encrypted.

The virus intercepts INT_16 and INT_21 functions 3D (Open), 6C00 (Extended Open).

It contains the  strings: SW Error  V2f Sayha Watpu and displays the message Sayha Watpu.


Screaming Fist II

Aliases: Screamer, EMF, Fist, Enemy

Type: Memory resident file virus.

Affects: COM and EXE files.

File Growth: See Variants.

Description:

This is an encrypted virus, infecting COM and EXE files when they are executed, opened or copied.  In COM files the virus always sets the fourth byte to be one byte less than the second byte. All infected EXE files are recognized by analysing the IP field in the EXE header - infected files always have IP=1.  COM files are infected only if they are in the range 300..64000 bytes.

The virus intercepts Int_24 and INT_21 functions 3D (Open), 43 (Get Attribute), 4B (Execute) and 56 (Rename).  The virus checks for itself in memory by issuing a call, AX=FFFF/Int_21h; the correct response is AX=0.

All variants do nothing but replicate.

Variants: 692, 696, 724, 732, 838

They contain the following strings:

692, 838: "Screaming Fist IIC:\COMMAND.COM"

696, 732: "C:\COMMAND.COM Screaming Fist IIV"

724: "C:\COMMAND.COM EMF IIV"


SheHas

Aliases:  Titz, Breasts

Description:

SheHas is a boot sector virus infecting boot sectors of floppies and the partition sector (MBR) of the hard disk.

SheHas uses up 16k of memory and assumes that the computers always  have at least 640k of RAM (it will hang on any other machine).

The virus has a string " Virginia / Shirley --- She has BREASTS, yes  she has!!!".

The original partition sector (MBR) is stored in sector 3 on track 0. On the floppy disk the original boot sector is at the end of the disk (for  1.44MB: track 79, side=1, sector=6).  However, SheHas misinfects 360K  floppies assuming that all floppy disks have 80 tracks.

The SheHas virus has no payload.


Shoo

Description:

This virus infects EXE files, adding 2824 bytes to them, and preserving the file's date and time.  It only infects files larger than or equal to 2808 bytes.  If the virus is memory resident,the change in file size is concealed, so we call the virus semi-stealth.  It adds 100 years to the file date as a self-recognition code.

Infection is triggered by functions 3dh (open file), 43h (get or set attribute), 4bh (load and execute),56h (rename) and 6ch (Dos 5 open or create).

The virus tunnels interrupt 21h (Dos) and interrupt 13h (Disk Bios), using single stepping.  This is to stop memory resident behaviour blockers from noticing that anything suspicious is going on.

If you run CHKDSK, the fact that the file size change is stealthed, will fool CHKDSK into thinking that there is an inconsistency between the file size and the size that it deduces from the FAT chain. As is so often the case, there is no real problem, but trying to fix this "problem" might cause logical damage to the infected files.  Many stealth and semi-stealth viruses have gotten the reputation of damaging the FAT, when actually it is this effect.

The payload of the virus is to repeatedly play a tune on the PC speaker - the tune is an unknown one (perhaps Taiwanese).  The trigger is for the system date to be two months after the date that the file was infected.

The virus is unencrypted, but when it infects an EXE file, it stores the header words (SS, SP, IP and CS) in an encrypted form.  This is presumably to make repair more difficult.

Quite a lot of the techniques that the virus uses, were taken from Jerusalem.  But this is not just another clone of that virus.

One very interesting feature of this virus is, if you try to run a program, then it is infected by the virus.  But if there is a file with the same name but a .SHW extension on the same disk and subdirectory, then the file is not infected.  This is the property that gives the virus it's name. There is another virus that does the exact same thing.  Unfortunately, with 3200 possibilities to choose from, it is not possible for human memory to dredge up exactly which virus does this.  Presumably the purpose of this was to allow the virus author to have the virus running on his own computer, without infecting his important files.


Sibylle.858

Type: Memory resident file virus.

Affects: EXE files.

File Growth: 858 bytes.

Description: In all infected files, SP=55A, IP=2D.  The virus intercepts INT_21 and INT_2F.

The virus has a payload which puts a silly looping construction in the AUTOEXEC.BAT. Its text is visible at the very end of any infected file:

@:\AUTOEXEC.BAT

@echo off

:b

echo Looking for Sibylle...

goto b


Starship

Type: Multipartite virus.

Affects: COM and EXE files; and the partition sector of the hard disk when an infected file is run. (The virus does not infect COM files shorter than 1,917 bytes or longer than 62,202 bytes; or EXE files shorter than 1,917 bytes or longer than 512,000 bytes.)

File Growth: In the range 2,616 and 2,648.

Description:

Starship was first found in Russia, in January 1991.  It looks like a research virus, although it was reported 'in the wild' for a while.  As far as we know, the virus is now extinct, as it fails to work on DOS 5.x or DOS 6.x.

The virus contains just one string, >STARSHIP_1< (visible only  in memory).

The size  of memory  block occupied  by the  virus is 2,816  bytes.  Part of  the virus memory image is encrypted using the XOR function  (approximately 60%  of the total virus).  This section is decrypted and used only while  infecting files.   After the infection of each file the XOR mask is changed.

The virus intercepts interrupts 13h, 20h, 21h and 27h.

On the hard disk, the virus occupies six sectors; the first sector contains a decryptor for the other five sectors.

When an infected file is run, the virus checks to see if it is already memory resident.  To do this the virus analyses memory location 0000:04B0, where a special virus dispatcher should be present.  It then uses tracing to get the original BIOS interrupt 13h entry point.  After this it modifies the partition table in the partition sector.

The virus does not store a copy of the original, clean partition sector:  it modifies just three bytes in the partition table, so that the partition sector loads the virus instead of the original DOS boot sector (this infection method has since become known as 'self-partitioning').

When the PC is re-booted, the virus intercepts interrupt vectors 13h (low-level disk I/O) and 21h (DOS service).  During  the re-boot the virus is  stored in video memory, at address BB00:0.  It has a special routine to  restore the contents of video memory if it has been changed. Then the virus waits for execution of any program.  When this program terminates, the virus moves itself to the low memory area.  If the program stays resident, the virus expands its memory block and puts itself there.  After this, the virus infects any COM or EXE file created on floppy drives (for example, using the COPY command).  For this reason, Starship doesn't intercept INT_24.

This virus has one special feature - it  does  not modify any executable file  on the hard disk.  This was probably one of the first attempts to defeat integrity checkers.   The viruses which use this type of infection process have become known as 'slow infectors'.   They infect only those things which the user expects to change in the normal course events.

Starship was one of the first polymorphic viruses.  For example, it uses different machine code representations for the XCHG AX, SI instruction  (0c687h, 0f087h, 96h).  The decryptor of the virus contains no constant fragments longer than two bytes.

There is a counter for the number of re-boots (one byte), located at offset 1FCh in the first virus sector.  This counter is initialized with a random value in the range  0 . . 20h.  Sometimes it is initialized with 0FFh, in which case the payload  will not be activated (there is a probability of approximately 30% that this will happen).

The payload is activated when the counter is 80 and a few hours have passed since the last re-boot (the delay depends on the number of disk accesses).  The virus plays music tones and drops colored points (ASCII=250, without affecting the screen background.  Each tone and point corresponds to one disk access.  Colored points appearing at random screen positions does not affect pseudographics symbols on the screen.

Sometimes spaces are substituted for dots.

The virus has one other interesting feature.  It does a load-and-execute of an unknown procedure, from sectors 2 . .6 on cylinder 0, head 0 of the hard disk.   Code  from  these sectors is executed only if its checksum is valid.  This space, between the partition sector and the first partition (which normally starts at cylinder 0, head 1, sector 1) is usually unused and filled with zeroes.  Since the virus itself puts nothing on these sectors,  this procedure must be external; perhaps it either should have been present, or was put there by some other program, trojan or virus.  Or perhaps it was a built-in mechanism for 'mating' viruses?

Starship uses special tricks to complicate disassembly and analysis.


Stat

Alias:  Azusa.d

Description:

Stat is a boot sector virus, infecting the partition sector (MBR) of hard disks and the boot sector of floppy disks.  The virus does not use stealth to try and hide itself.

Stat occupies just one sector, and looks the same in both the partition sector and in the boot sector, so even an infected partition sector always starts with a JMP over the BIOS parameters block.

Stat replaces the original MBR code and do not store it elsewhere on the hard disk.  On floppy disks it puts the original floppy boot sector in the very last sector of a floppy, on the last track, head=1.

The virus infects both 720k and 1.44MB floppies, and has no internal strings.  The virus has no payload.


Stoned

Aliases:   New Zealand; Marijuana; Australian; Hawaii; Hemp; Sanded; San Diego; Smithsonian; Zapper; Sex Revolution

Type:  Boot and partition sector virus.

Affects:  Floppy and hard disks when the computer is booted from an infected not necessarily a bootable) diskette.  The virus copies itself to the hard disk partition sector; any write-enabled diskette accessed in drive A: is infected.

File growth:  N/A

Description:

There is one chance in eight that each time a computer is booted from an infected disk that the message  "Your PC is now Stoned" will be displayed.  This can be found in the boot sector of infected diskettes and the partition sector of hard disks, together with "Legalise Marijuana"

The boot sector of diskettes is moved to (0,1,3).  On 360Kb diskettes this is the last directory sector, which the author believed to be safe. However, on higher capacity diskettes the original boot sector overwrites part of the directory.  On a small number of hard disks the original partition sector will overwrite part of the FAT (0,0,7).

Variants:

There are a number of variants, as it is easy to patch the message.

Zapper:

Using the system clock as a randomiser, 1 infection in 256 triggers the payload.  This overwrites the first 16 tracks of the disk followed by the message  I ZAPPED YOU!.

Sanded:

The message reads  Your PC is now sanded.

Swedish Disaster:

The message reads  The Swedish Disaster 1.

Sex Revolution 1.1 and 2:

The message reads  Export of Sex Revolution ver 1.1 (or ver.2.0).

Rostov:

When this infects a diskette it overwrites 8 sectors starting at (8,0,0). On the next infection it does the same on cylinder 9, and so on.  Some Western Digital controller cards write data to the partition sector; this will overwrite the original virus message on an infected hard disk and be transferred when the virus replicates.

Stoned-8:

When this infects a hard disk the original partition sector is copied to (0,0,8) and the partition code is replaced.  On floppies, the original boot sector is copied to (0,0,5).  If the PC is in graphics modes there is a 1 in 16 chance of a message in a non-Roman language being displayed.

Stoned-16:

When this infects a hard disk the original partition sector is copied to (0,0,16) and the partition code is replaced.  On floppies, the original boot sector is copied to (0,1,3).  On floppies larger than 360kb the original boot sector overwrites part of the directory.

Damien:

This is almost identical to Swedish Disaster.  It contains the text  Damien Virus (Beta-Test Release 0.1) Written by Metal Thunder 1991 (c) IVRL (Head quarter - Milan Italy).

Laodung:

When this infects a hard disk the original partition sector is copied to (0,0,8) and the partition code is replaced.  If the virus is in memory, diskettes seem to be empty.  There is a 1 in 128 chance that it will play a tune.

Noint:

This is based on Stoned but with major differences.  The partition sector is stealthed, so it will appear normal when read.

Other variants include: Teraz, b, c, d, e, Sonus, Nulls, Donald, Flushed, In love, stoned-floppy, Mexican, WD1 to WD7.


Swiss Boot

Aliases:  Swiss, Swiss army, Armee

Variants:  a-c

Swiss Boot is a boot sector virus, infecting the boot sectors of write-enabled floppies and the boot sector of the hard disk.

The virus does not stealth itself, and takes 3 disk sectors (one in the infected boot sector and two - with the virus body).

The original boot sector and two sectors of virus body are saved in the first 3 clusters of the floppy disk.  On the 1.44MB floppy that is absolute sectors 33-35, on 720k - 14-16. The virus marks them as used in the FAT, so CHKDSK will complain "2 lost allocation units found in 2 chains".

On the 2nd, 7th, and 11th of February (variants .a, .c, .b respectively) the virus prints a message and overwrites the hard disk:

 a.: "Schaft die Schweizer Armee ab!"

 b.: "Auslander raus aus der Schweiz!"


Taipan.438

Description:

There are 2 versions of Taipan.438: a and b.

Taipan.438 is an unencrypted appending infector, containing the string  "[Whisper presenterar Tai-Pan]".  Variants a and b differ only in the first 39 bytes which are zero in Tai-Pan.438b (in fact the "b" version is a damaged but still working "a" version).

Taipan.438 infects files on execution.


Taipan.666

Alias:  Doom2Death

Description:

Infects only EXE files (MZ) being executed shorter than 64768. To detect itself in memory the virus uses INT_21 AX=7BCF (the correct response will be AX=7BCF).   Taipan.666 contains the following internal strings:

 "Your version of DOOM2.EXE matches the illegal RAZOR release of DOOM2 Say bye-bye HD The programmer of DOOM II DEATH is in no way affiliated with ID software. ID software is in no way affiliated with DOOM II DEATH."


Tchechen

Variants:  1909, 1919, 3430, 3470, 3560

Description:

Tchechen is a memory-resident, encrypted virus.  It is also polymorphic (apart from the first two variants).  It infects COM and EXE files upon execution.

All variants (except the 1909 variant) trojanize the partition sector (MBR) by putting code which will print on 22nd-25th of every month:

HALF YEAR OF WAR HAS GONE. IT STILL DOES.

MASS MURDER RECOGNIZED BY THE WORLD COMMUNITY.

ACCEPT MY CONGRATULATIONS! ENJOY THE WORLD'S NEW ORDER!

THE TCHECHEN, v.2.0 (C) RUSSIAN BEAR. 1995, JUNE

Variant 3470 also contains the substring "v.2.0 spec"

Variants 1919, 3430 and 3470 were deliberately programmed to complicate a repair - all repair data is scattered all over the file and encrypted with different keys.

Variant 3560 contains anti-emulation code in an attempt to make analysis and detection more difficult.


Telefonica

Alias:  Campana, Kampana.

Telefonica infects the boot sector of floppy disks and the partition sector of hard disks.

If the PC is booted from an infected floppy disk, the virus goes memory resident and infects the partition sector of the hard disk. The virus infects any floppy disk which is accessed.

The virus copies the original partition sector to Cylinder 0, Head 0, Sector 7.  It stores additional code on sectors 6 and 7.  On floppy disks, the original boot sector is copied to one of the root directory sectors.

If the virus is memory resident, it uses stealth to conceal itself.  If the partition sector is examined, the virus displays the original, clean partition sector; and if sectors 6 and 7 are examined, the virus displays sector 5.

After 400 boots from an infected hard disk, the trojan triggers, overwriting the hard disk with garbage and displaying the message

Campana Anti-TELEFONICA (Barcelona)

(this text is encrypted in the virus).


Tentacle

Description:

Tentacle is an in-the-wild Windows virus.  Tentacle was spread on the alt.cracks Usenet newsgroup, attached to a posted file called DOGZCODE.ZIP. Tentacle is a direct action file virus, which infects Windows programs (we have confirmed this with Windows 3.1, 3.11 and 95)

Each time an infected program is run, one file in the current directory becomes infected, followed by two files in the Windows directory.  The payload acts between midnight and quarter past midnight: a program that becomes infected within this time has its standard icon changed to an icon of a tentacle (rather like those seen in the game "Day of the Tentacle").  This change is not immediately obvious.  It is not until you attempt to change the icon, delete the icons in the program group and attempt to replace them, or if you run and minimize the program that the tentacle icon will display itself.


Tequila

Replication:

When an infected .EXE file is run, the virus installs itself on the partition sector and on 5 sectors at its far end, patching the data to reduce the partition by 6 sectors. Thereafter, when the computer is booted, the virus goes memory resident and almost every .EXE file run is infected, except those with V or SC in the name. This avoids programs like VIR???? or ???SCAN, as these are often self-checking Anti-Virus programs.

Recognition:

Files grow by 2468 bytes, but if the virus is in memory, this is concealed from both DIR, and programs which only look at the file sizes to detect changes.  The virus is variably encrypted, with a self-changing header which, with the dual infective mechanism, makes the virus hard to recognise and remove.  It also clashes with Windows.

Effects:

Three months later, on the same day of the month that the infection took place, the virus displays a large, coloured graphic in blocks followed by the message:

 "Execute: mov ax, FE03/int 21. key to go on!"

If the user does this, the virus responds:

Welcome to T.TEQUILA'S latest production.  Contact T.TEQUILA/P.o. Box 543/6312 St'hausen/Switzerland.  Loving thoughts to L.I.N.D.A. BEER and TEQUILA forever!


Three_Tunes.1784

Aliases: 3tunes, JuneTunes, Pichincha, PC Byte Bandit

Type: Memory resident file virus.

Affects: COM and EXE files.

Description:

This virus was first reported in a small province Pichincha in Ecuador.

Three_Tunes.1784 is encrypted.  It uses stealth to conceal itself when memory resident.  It is also a fast infector, intercepting Open (3d) and Execute (4B00) DOS functions.

The virus intercepts Int_01 (trace), Int_1Ch (timer), Int_21h (DOS services), INT_24h (critical errors).  The virus checks for itself in memory by issuing a call, AX=FE01/Int_21h; the correct response is AX=01FE.

To recognize files which it has infected already, the virus checks two bytes at offset eof-69 (-45h); all infected files contain 0E 1F at this location.

The virus does not check the extension of the opened file and assumes all files which start with an E9 byte to be COM files suitable for infection.  As a result, the virus can corrupt data files.  It will also corrupt NE executable files; and DLLs, because it regards all files starting with "MZ" as being EXE files.

The payload activates in June.  Any infected program will either play one of three built-in melodies or just execute the host file.  Music is played with the probability 75%.


Tornado

Type: Memory-resident, stealth boot sector virus.

Description:

Tornado is a boot sector virus which uses stealth techniques. The virus infects the boot sector of floppy disks and the partition sector (MBR) of hard disks. The virus is encrypted with a variable encryption key.

Upon infection the original hard disk partition sector is saved at: Cylinder 0, Side 0, Sector 14

On floppy disks the original boot sector is saved at

   5¼" 360k: Track 0, Head 1, Sector 3

   5¼" 1.2MB: Track 0, Head 1, Sector 14

   3½" 720k: Track 0, Head 1, Sector 5

   3½" 1.2MB: Track 0, Head 1, Sector 14

Hard disks are infected if the PC is booted from an infected floppy disk. If the virus is active in memory the DOS CHKDSK command indicates 1024 Bytes less conventional memory.  Tornado infects every floppy disk in drive A: and B: upon access.

Under certain conditions Tornado can shift the screen display from right to left continuously.  This screen shift is halted by pressing the ESC key.

The virus contains the following encrypted text which is not displayed: "TORNADO".


Track Swap

Aliases: X-Boot, Trkswap

Type: Boot sector virus.

Affects: The boot sector of floppy disks

Description:

This virus uses 1Kb of RAM and occupies one sector on the disk.  The virus swaps the 9 first sectors (both heads 0 and 1) on cylinders 0 and 39 of floppy disks, which is how it gets its name.

Track Swap intercepts Int_13h (disk I/O) and Int_09 (keyboard).  When [Ctrl]-[Alt]-[Del] is pressed the virus infects the floppy disk in drive A: if there is a disk in the drive.  For self recognition, the virus uses bytes 33 FF at the very start of the infected sector.


Trakia

Aliases: Ugur, Corgi, TEKRAR

Type: Memory resident file virus.

Affects: COM and EXE files (but see description below).

File Growth: See Variants.

Description:

Variants 561 and 570 infect COM and EXE files; variant 661 infects EXE files only.  Variant 1070 infects COM and EXE files when they are run, but also infects all EXE files in the current directory when programs are run.

Only interrupt 21h is intercepted.  The 561 and 570 variants check for themselves in memory by issuing a call, AX=4343/Int_21h; the correct response is AX=3434.  Variant 661 uses FE43 -> 3434.  Variant 1070 uses 4288 -> 4288.

This virus has no payload.

Variants: 561, 570, 661, 1070

Variant 570 blanks the date and time of all files it infects.


Tremor

Type:  Memory-resident file virus

Affects:  This virus infects COM and EXE files on execution and almost on any access.  COM files are infected only if they start with 0E9h byte (JMP instruction).  COMMAND.COM is infected specifically, and is located using the COMSPEC environment variable.

File growth:  4000 bytes

Description:

The virus is variably encrypted and highly polymorphic.

When an infected program is executed the virus stays memory-resident, possibly in UMB or Extended Memory (if available) and infects COMMAND.COM. The virus demonstrates full stealth technique: if it is memory-resident, no changes to infected files are visible.

In approximately three months after intruding to a computer the virus triggers. On every warm reboot via Ctrl-Alt-Del the virus displays the following message:

 -= T.R.E.M.O.R. was done by NEUROBASHER /May-June'92 Germany =-

 MOMENT OF TERROR IS THE BEGINNING OF LIFE

Additionally, if more than 255 files were created or opened (e.g. via COPY command) since last system reboot, the virus starts to salute every DOS call with a random sound and screen display tremor.


Trojector

Alias: Athens

Type: Memory resident file virus.

Affects: COM and EXE files.

File Growth: See variants.

Description:

Trojector is an encrypted virus.

It checks for itself in memory by issuing a call: AH=BB/Int_21h; the correct response is AH=18.

The virus has no payload but the following strings (specific to each variant) are found in the virus:

1463: "TROJECTOR II,(c) Armagedon Utilities, Athens 1992"

1561: "TROJECTOR ]I[,(c) Armagedon Utilities, Athe"

Variants: 1463, 1561


Uruguay

Type:  Memory-resident file virus

Affects:  COM and EXE files on execution, open or create. Files shorter than 512 bytes and longer than 57344 bytes are not infected. COMMAND.COM and some antivirus programs are avoided.

File growth:  4879 bytes.

Description:

This variably encrypted and extremely polymorphic virus is able to survive warm reboot (Ctrl-Alt-Del).  It does this by intercepting the Ctrl-Alt-Del key sequence and "faking" a reboot. It is therefore important that a proper cold-boot (power-off) is performed when dealing with this virus. It is a semi-stealth virus: infected files size growth is concealed  if the virus is memory resident.

If an infected program is being executed when the virus is already memory-resident, then with the probabilty of 1/256th the virus triggers and displays the message followed by a random tune:

'Uruguay-#6' Virus

Programmed in Montevideo (URUGUAY) by F3161. 11/92.

This is a research virus - DO NOT DISTRIBUTE.

The virus can also trigger on warm reboot.

Variants: Currently there are ten variants known: Uruguay.1 through to Uruguay.10. They differ in the level of polymorphism, infected files growth and messages displayed. Earlier versions are less polymorphic and cannot survive warm reboot.


Unashamed

Type: Boot sector virus.

Affects: The boot sector of floppy disks; and the partition sector of hard disks when the PC is booted from an infected floppy disk.

Description:

Unashamed uses 1Kb of RAM.  On infected hard disks the original partition sector is re-located to cylinder 0, head 0, sector 14.  The location of the original boot sector on floppy disks depends on the geometry of the floppy disk:  cylinder 0, head 1, sectors 3, 5 or 14 (one of the last sectors of the root directory).

For self recognition of infected disks, the virus uses bytes 05 1A at offset 1BBh in the infected partition or boot sector.

The virus checks the system timer and sometimes turns the monitor into 40 column mode and prints the following message in the upper left corner:

the UNashamed Naked!


Urkel

Type: Boot sector virus.

Affects: The boot sector of floppy disks; and the partition sector of hard disks when the PC is booted from an infected floppy disk.

Description:

Urkel uses 2Kb of RAM and occupies just one sector.  Infected sectors always start with EB 22 90.  On hard disks, the original partition sector is re-located to cylinder 0, head 0, sector 5.  On 1.44Mb floppy disks, the original boot sector is re-located to the very end of the root directory, cylinder 0, head 1, sector 15 (sector 3, 5 or 14 on other floppy disks).

The virus is encrypted.  When the virus gets control it moves itself to segment 9F80, decrypting the body on the fly (the virus assumes that all PCs have 640k of RAM because segment 9F80 is just 2Kb below the 640Kb limit).

For self recognition Urkel uses byte 23 at offset 1FDh in the infected partition or boot sector.

It display the string Urkel if the disk is being written to and the current hour is 0 (12pm).  This string is visible only in memory, at 9F80:1F7.


V-Sign

Aliases: Cansu, Sigalit

Type:  Memory-resident boot and partition sector virus.

Affects:  Floppy and hard disks.

File growth:  N/A

Description:

This boot and partition sector virus infects hard disk and diskettes on read and write access (e.g. DIR command).  V-Sign is slightly polymorphic: it changes order of some instructions on every infection, resulting in six slightly different "incarnations".  The virus is able to detect disks infected with Stoned virus. In this case V-Sign removes Stoned from the disk to reinfect it with itself.  If the virus succeeds in infecting 64 disks since the last system boot, it triggers: a big V-sign is displayed on the screen and computer hangs.


V2P6

Type:  File virus.

Affects:  A COM file on execution of an infected file.

File growth:  1,900 to 2,400 bytes.

Description:

This virus is so polymorphic that there is not even a consistent sequence of two bytes for signature scanners to identify.

This virus is in the same family as Chameleon.


Vinchuca.925

Type: Memory resident file virus.

Affects: COM files.

File Growth: 925 bytes.

Description:

This is an encrypted virus which infects COM files being run. It uses a prepending infection method.

It intercepts only Int 21h.  To check for itself in memory the virus issues a call, AX=35E3/Int_21h;  the correct response is BX=3775.

The payload activates when an infected file is run on the 3rd of any month. The virus displays the following message box:

Virus ViNCHuCa  V1.0  1993.

Creado por MURDOCK.

Buenos Aires ,Argentina.

Su PC tiene Mal de Chagas....jajaja...

On 3rd of July, it additionally overwrites the contents of the first hard disk (cylinders 0 to 256, heads 0 to 3, 17 sectors) and hangs.  The string inside the virus reads:

Saludos para SaTaNiC BRaiN y Patoruzu


Walker.3846

Aliases: Sleep_Walker

Type: Memory resident file virus.

Affects: COM and EXE files.

File Growth: 3845 bytes.

Description:

The virus infects COM and EXE files on execution.  It is not encrypted. This virus is able to remove itself from infected files.

The virus intercepts Int_16h (keyboard) and Int_21h (DOS services).  It checks for itself in memory by issuing a call, AX=4B56/Int_21h; the correct response is AX=5641.

The payload displays a man walking from the right to the left of the screen. The picture of the man is formed from coloured pseudo-graphic symbols. The virus is clearly demonstrative.  Most of the virus code relates to this demo routine.

The virus also contains the following text, near the beginning:

WALKER 1.00 - This absolutely harmless and selfdestructive

program is written by UJHPTTLZ in the city of Istanbul, 1992


Wazzu

Alias:  WM.Wazzu, WinWord.Wazzu, WordMacro.Wazzu

Description:

Wazzu is a Microsoft Word macro virus.  This virus only contains one macro, AutoOpen. Since the name of the AutoOpen macro is the same in all language versions of MS Word, this is the first virus that will replicate equally effectively in all International versions of Word.

Wazzu has an interesting payload - when the infected document is opened, the virus calls a routine three times.  Each time there is a 20% probability that the virus will move one word in the document to a random place in the document.  There is then a 25% probability that the virus will also insert the word "wazzu" at a random point in the document.  The virus then returns to the beginning of the document.

Wazzu was accidentally distributed by Microsoft for a short while via an infected file on their website, and also on two CD ROMs: The September 1996 Microsoft Solutions Provider CD ROM and Letz Fetz on the Internetz.


W-Boot

Alias:  Floss

Type:  Boot sector virus infecting boot sectors of floppy diskettes and the partition sector (MBR) of hard disks.

File growth:  N/A

Description:

The Floss virus stores the original partition sector (MBR) at sector 7  on track 0.  It contains no text strings within its body, and has no  payload.

It is important when repairing this virus infection to boot from a clean write-protected DOS diskette (as when the virus is memory-resident it will prevent the infected partition sector from being rewritten).


Werewolf

Aliases:  Claws, WeWo

Variants:  658, 678, 684a-b, 685, 1152, 1168, 1208, 1361, 1267, 1500a-b

Description:

The first variants (658-685) only infect EXE files.  Later variants are memory-resident and infect both COM and EXE files. All of them are encrypted.

Werewolf.1500a and Werewolf.1500b always mark their victims with 6 seconds in the file time stamp.

Werewolf.1500 intercepts Int_21h and Int_13h.  Interrupt 13h (disk i/o) is used for a payload.  When a sector is written to the disk the virus changes a single byte in it with approximate probability equal to 3/100000 (this results in very slow and dangerous corruption of harddisk data).

This payload works immediately after infection and continues permanently, without any triggering date.

Werewolf.1500a has the following strings inside:

WULF

1996 WereWolf

TBMEMXXXTBCHKXXXTBDSKXXXTBFILXXX

CLEAN AVP TB V SCAN NAV IBM FINDV GUARD FV CHKDS F-

Werewolf.1500b has the following strings inside:

TBMEMXXXTBCHKXXXTBDSKXXXTBFILXXX

[WULF](c) 1995-1996 WereWolf

CLEAN AVP TB V SCAN NAV IBM FINDV GUARD FV CHKDSK F-

The mentioned antivirus programs are not infected.


WM.Bandung

Alias: WM.Concept.j

Description:

Bandung is a fairly common macro virus. It was written in Bandung,

Indonesia (probably by the author of Npad). It contains the following

macros:

  AUTOEXEC,

  AUTOOPEN,

  FILESAVE,

  FILESAVEAS,

  TOOLSMACRO,

  TOOLSCUSTOMIZE.

On December 21-31 the virus displays:

 "Reading menu...Please wait !"

and deletes contents of subdirectories WINDOWS, WINWORD and WINWORD6.

Then the virus creates a file C:\PESAN.TXT and puts there the following

text:

 "Anda rupanya sedang sial, semua file di mesin ini

 kecuali yang berada di direktori WINDOWS dan WINWORD

 telah hilang, jangan kaget, ini bukan ulah Anda, tapi

 ini hasil pekerjaan saya...Barang siapa yang berhasil

 menemukan cara menangkal virus ini, saya aka" + "n memberi

 listing virus ini untuk Anda !!! Dan tentu saja saya akan

 terus datang kesini untuk memberi Anda salam dengan virus-

 virus terbaru dari saya...selamat !   Bandung "

The virus also has the following strings inside:

 "Fail on step 29296 "

 "Err@#*(c)"


WM.Extra

Aliases: Clock, WordMacro.Extra, WinWord.Extra

Type: Macro virus.

Affects: Microsoft Word for Windows documents, by use of Word for Windows macros.

Description:

WM.Extra's macros are encrypted (execute-only).  Although the virus was written for the German version  of Word for Windows, it still replicates under other language versions.

The virus has an demonstrative, but innocent, payload.  If the following conditions are met:

year   > 1996

minute >   39

day    >   25

the virus displays the digital clock every two minutes.

WM.Extra includes the following macros (the length, in bytes, is given in brackets):

ACTION 	(1168)

ÖFFNEN	(200)

AUTOEXEC	(333)

AUTOOPEN	(322)

SPEICHERN 	(210)

EXTRASMARKO	(13)

DATEISCHLIEßEN 	(101)

DATUMUNDUHRZEIT	(241)

DATEIDOKVORLAGEN	(13)

DATEIALLESSPEICHERN 	(78)

DATEISPEICHERNUNTER	(1116)


WM.Npad

Aliases: Npad, Jakarta, WinWord.Npad, WordMacro.Npad

Description:

NPad is a fairly common macro virus.  It appears to have been written in Bandung, Indonesia and contains the following text:

  'D0EUNPAD94, v.2.21, (c) Maret 1996, Bandung, Indonesia

  'Macro MsWord virus, multiplatform, multi versi

The virus has just one macro - AutoOpen. Some variants have partially corrupted macros (.c) and they are only able to infect NORMAL.DOT but do not travel further.

The virus adds a variable called NPad328 in the "Compatibility" section in WIN.INI which is used as a counter. When this counter reaches the 23 virus shows the following string:

   "D0EUNPAD94,  v.2.21,  (c)  Maret  1996,  Bandung,  Indonesia"

on the screen when a document is opened.

Variants: a-c


WXYC

Description:

WXYC is a boot sector virus infecting the boot sector of hard disks and the boot sector of floppies.  WXYC is unusual in this regard as most boot sector viruses infect the partition sector (MBR) rather than the boot sector of hard disks.  The hard disk is infected by attempting to boot off an infected floppy disk.  Any write-enabled disk accessed on an infected PC is infected with the virus.

The original DOS boot sector is stored on track 0, sector 3 of the hard disk drive.  On floppy disks the original boot sector is stored at track 0, head 1, sector 7 for 720k floppy disks, and sector 9 on 1.44 Mb.

The virus does not use stealth techniques to hide itself.  Sometimes (this depends on the time) the virus displays "WXYC rules this roost!" when the computer is rebooted.

There is a string inside the virus body which never gets displayed: "JAM WXYC".  This is used by the virus for self-recognition.


XM.Laroux

Alias: Laroux

Type: Excel macro virus

Description:

XM.Laroux (an Excel Macro virus) is the first macro virus for Microsoft Excel which actually works. The virus intercepts Excel's Auto_Open automacro. When an infected spreadsheet is opened, the virus activates and checks whether the system is already infected. If not, the virus creates an Excel file named PERSONAL.XLS in the Excel default startup directory XLSTART (e.g. C:\MSOFFICE\EXCEL\XLSTART) and copies itself there. The spreadsheets and macros from that directory are automatically loaded whenever Excel is run. From then on, every spreadsheet being opened or created on an infected system will become infected with the virus.

XM.Laroux does not have any intentional payload - it just replicates. The virus works under Excel versions 5 and 7, running under Windows 3.x, Windows 95 and Windows NT. It does not work on Apple Macintosh.

Infected spreadsheets contain a hidden sheet named 'laroux'.


XPEH

Type: Memory-resident file virus.

Affects: COM and EXE files being executed or searched for via DOS Find First/Find Next calls. COM files shorter than 288 bytes and longer than 61815 bytes as well as COMMAND.COM and AIDSTEST.EXE (a  Russian anti-virus program) are not infected.

File Growth:    4016 bytes.

Description:

This virus uses several layers of complex enough self-encryption and demonstrates certain anti-debugging techniques. The name XPEH is of Russian origin and should be pronounced as "HREN" - some Russian characters look similar to English ones, although often sound differently. The word XPEH (hren) literally means "horse radish" but is often used in Russian swearing in rather different meanings.

The virus was designed not to activate until March 1991, being presumably propagated passively before the date (e.g. via software copying, downloading from a BBS, etc.). But due to a bug the virus is inactive on January and February of any year. At any other time on execution of an infected program the virus stays memory resident and infects COM and EXE files being executed or looked for via DOS Find First/Find Next calls with the probability of 1/4th (i.e. approxiamtely one of every four files).

The virus is semi-stealth - infected files size increase is concealed. Starting on September 1991, if a file with no extension or having one of the .BAK, .LEX or .TXT extensions is found via DOS Find First/Find Next calls, the virus can trash the file's contents with the probability of 1/4th. Every four consecutive bytes of a trashed file are XOR'ed with the hex pattern 90958D85, which stands for XPEH in Russian alternative cyrillic character coding.

Variants: There are eight other XPEH variants known. They differ in activation and triggering dates, infected file size growth and encryption complexity. Some of them do not trash text files and are able to infect COMMAND.COM.  One of the latest XPEH variants contains the following encrypted Russian text:   "Further development of XPEHs is suspended due to the virus author getting a permanent job."


Yale

Aliases:  Alameda; Merritt; Peking; Seoul; Yale Boot

Type:  Memory-resident boot sector virus.

Affects:  Diskette in drive A:.  When the computer is booted from an infected (non necessarily bootable) floppy, the virus goes TSR.  When the diskette is replaced and Ctrl-Alt-Del pressed, the keystrokes are intercepted and the replacement diskette is infected.  The virus takes up 1kb of RAM.

File Growth: N/A

Description:

The original boot sector is moved to track 39, side 0, sector 8; any data is overwritten.  The virus contains code for formatting track 39, but an essential part is missing in all known versions so the format does not happen.


Yankee Doodle

Alias:  Vacsina, YD

Type:  Memory-resident file virus.

Affects: COM files on loading; EXE files smaller than 63Kb are first converted to COM files (without a name change) and then infected the next time they are executed.  Read/write attributes are preserved, but date/time is not.

File Growth:  COM: 1,207 to 1,213 bytes.  Converting EXE to COM files grows them by typically 132 bytes.

Description:

When a file is infected drive A: is accessed, even if the infected program doesn't.

There is no payload, other than a beep when a COM file is infected.

Variants:  There are 16 versions, each with a different file growth, including several Vacsina variants; there is little functional difference from the original.

In the case of the Vacsina variants, both COM and EXE files are infected and grow from 2,772 to 2,900 bytes.  Date/time is preserved.  At 5pm the virus plays Yankee Doodle.

For Help on Help, Press F1

For Help on Help, Press F1