The World of Computer Software

home *** CD-ROM | disk | FTP | other *** search

/ The World of Computer Software / World_Of_Computer_Software-02-387-Vol-3of3.iso / v / vsumx303.zip / VSUMX.XDB (.txt) < prev

Wrap

HyperText VSUM | 1993-03-23 | 2MB | 82,083 lines

VSUMX 9303 Copyright (c) 1990-93 by Patricia M. Hoffman. All rights reserved. Patricia M. Hoffman Telephone: (408) 988-3773 3333 Bowers Avenue Suite 130 Fax: (408) 988-2438 Santa Clara, CA 95054, USA BBS: (408) 244-0813 above action activates activation added additional after aliases alias allSafe allocation altered anti-Pascal anti-viral anything appear approximately april attempting attempts august available based becomes become beginning being below besides boundary bulgaria bytes cHKDSK cOMMAND.COM cPAV/N certification changed changes change characters command common contains contain corruption current dark Avenger date/time december decreased decrease delete described detect+ detection Method directory direct discovered discovery diskettes diskette displayed display drive drVirus eff Length encrypted errors error europe executed execute execution experience f-Prot family february file's files first following found functionally general Comments gobbler2 growth hangs hooked iBMAV including increase indicated infected infecting infection infector infects infect information install interrupts interrupt isolated isolation itself january jerusalem keyboard known lProt length listing located master memory messages message nShld naughty Hacker netherlands non-Resident non-resident november occassionally occurred occur october opened originally original origin other overwrite overwriting overwritten panda parasitic partition point previously program's programs program properly received removal Instructions replicate resident result return screen sectors sector september similar stealth stoned strings string submitted sweep/N sweep symptoms systems system table their there these though total trend uTScan uninfected united States unknown updated v Status vBuster vi-Spy variant(s) variants variant version vienna violator viral virexPC viron viruSafe viruScan virus Name virus visible which COLORS=1f,1e,0f,1b,1e,1d,0f,,1f,1f,1f,1f,1f,1f,1e,11,1f,1e,11,18,0f,,,, DISABLECOPY=1 (C)=HyperText VSUM Copyright (c) 1990-93 by Patricia M. Hoffman (408)988-3773 THINSCROLLBAR=1 _CA=Copyright (c) 1990-93 by Patricia M. Hoffman. _CB=All rights reserved. _CD=Patricia M. Hoffman Telephone: (408) 988-3773 _CE=3333 Bowers Avenue Suite 130 Fax: (408) 988-2438 _CF=Santa Clara, CA 95054, USA BBS: (408) 244-0813 _BA=fff5,ffee,45,05, F1:Help _BB=0002,ffc4,00,00,F2:Menu _BC=ffec,ffe1,53,03,F4:Srch _BD=ffed,ffe7,50,03,F5:Print _BE=ffe5,ffe8,4f,04,F7:Color _BF=ffee,ffef,57,06,F8:Viewed _BG=fffb,002d,2d,02,<<- _BH=fffa,002b,2b,00,+>> _BI=fffe,ffd3,58,05,F10:Exit _BJ=fffc,ffd0,42,06,ESC:GoBack _BK=ffe9,ffc0,00,00,F6:Credits _BL=ffef,ffbd,00,00,F9:Files _BM=fff9,ffc3,00,00,F3:Index _BN=ffea,ffa9,00,00,SearchAgain _MA=0000,0000,56,00,VSUM Sections _MB=03c0,0000,57,02,A Word From Patricia... _MC=043f,0000,55,0c,Licensing VSUM _MD=0442,0000,41,00,Authorized VSUM Agents _ME=03c7,0000,43,00,Certification Data and Info _MF=042f,0000,52,05,VSUM Revision History _MG=ffff,0000,00,00,- _MH=0003,0000,49,06,Virus Index by VSUM Virus Name _MI=03c3,0000,4e,07,Common Name Cross-Reference _MJ=03df,0000,54,06,Viral Type Cross-Reference _MK=03c5,0000,4c,00,Length Cross-Reference _ML=03e7,0000,4f,00,Origin Cross-Reference _MM=0418,0000,50,0b,Relationship Charts _MN=03db,0000,44,12,Virus Activiation Dates _MO=ffff,0000,00,00,- _MP=03c6,0000,53,0b,Common Virus List _MQ=0413,0000,45,06,Virus Entry Fields _MR=03dc,0000,4d,00,McAfee Scan-IDs FZPAPN Hyper Patricia M. Hoffman's ySummary List (tmi The Reference for all MS-DOS H y p e r T e x t may not be used in a business, corporation, organization, government, or agent en ment out a negotiated site license. Copyright (c) -93 by Patricia M. Hoffman. All rights reserved. 3 Bowers Ave Suite 130, Santa Clara, CA 95054 Tel: (408)988-3773 PZPAPN Alpha Index 0 P h a ! h b 5 h c Alphabetic Index 5Lo 10 Past 3 310 408 512 595 66A 914 1008 1024 Print 1024 SBC 1067 1210 1226 1241 1244 1260 1308 1385 1392 1452 1575 1605 1661 1720 1804 1835 1840 1963 2153 2559 2560 2623 3040 3445- 4096 5120 7808 A&A Adolf Hitler Adolph African 109 Agena AIDS II AirCop Akuku Alabama Alameda Albania Albanian Alex-368 Alexander Alfa All Sys 9 Ambulance Car Andre Angarsk Animus Anna Ant Anthrax Antimon Anti-D Anti-Tel Anto Aragon Aragorn ARCV 330 ARCV Friends ARCV Xmas ARCV-n Arf Argentina Armagedon Arriba Ashar ASP-472 Astra AT144 Atas Atas II Attack Attention! Aussie Dir Aussie Parasite Australian Australian 403 Australian Azusa Back Bad Boy Badsec Bandit Baobab Barcelona Barrotes Basilisk Beast-N-Black Bebe Beeper Beer Best Wishes Beta Beware BFD Big Joke Bios Bit Addict Black Monday Black Wizard Blinker Bljec Blood Bloody! Bomber Boojum %Killer Bow Boys Brain Brainy Brazilian Bug Breeze Bryansk Burghofer Butt Stink Cadkill Cannabis Cansu Capitall Cara Carfield Carioca Cascade Casino Casper Casteggio Catman Caz CB-1530 CCCP-510 CD Cerburus Chad Chang Changu Mangu Chaos Chaser CheckSum Cheeba Chemmy Christmas Tree Cinderella Civil War Clonewar Close CLS-853 Cmdr Bomber Coffeeshop-1568 Commy Como Copyright Cossiga Costeau CPSU-2535 CPW Cracker Jack Crash Crazy Eddie Crazy Imp Creeper Crew-2480 Criminal Crusher Curse CV4 Cyber CyberTech Dad Dada Damage DAME Dark End Dark Lord Datacrime DataLock Davis Day10 dBASE Deicide Demolition Den Zuk Dest Destructor V4.00 Devil's Dance Dewdz Digger Dima Dir Dir-2 Discom KKiller Dismember Do-Nothing Doctor Qumak 2 DoDo Doom II DOS3 DOSHunter Dot Killer Drop Dutch 555 Dutch Ear Edcl EDV Egg-1000 Eight Tunes Einstein Eliza Emmie End Of Enemy Enigma Enola Evil Evil Empire Exebug Experiments Exunt Father Father Christmas Feist Fellowship Fich Fichv-896 =11-537 Filler Fingers Finnish-709 Fish Fish Flash Flex Flip Flower FoneSex Forger FORM- Freddy ew-692 Frere Jacques Friday 13th Friends Frodo Soft Frogs Fu Manchu Funeral Fungus Geek Gergana Ghostballs Gingerbread Man Gliss Globe Gnose GoldGeld Gosia Got-You Gotcha Grapje Green Joker Gremlin Grither Groen Links Groove Growing Block Grunt-1 Guillon Guppy Ha Hacktic Hafenstrass Hafenstrass 2 Haifa Halloechen Halloween Happy Happy New Year lDays Hary Anto Hell Hellween Hero Hero-394 HH&H Hi HiDos Highlander Hitchcock Holocaust Hominy Horror Horse Hungarian Hungarian 482 Hybryd Hydra Hymn Ice 9 Icelandic Idle Ieronim IKV 528 Incom Infinity Interceptor Internal Intruder Invader Invol Ionkin Iper Iranian Iraqui Warrior Italian 803 Itavir Japanese Christmas Jeff Jerk 11-30 Joanna JoJo JoJo 2 Joker Joker 2 Joshi Joshua Junior Kalah Karin Kemerovo Keydrop Keypress Kiev 483 Kiev 2049 Kiwi-550 Klaeren KLF-356 Kode4 Korea Krivmous Kthulhu Kuku-448 Label Lancs Larry Lazy Leech Legalize Lehigh Liberty Liberty-2 Liberty-1172 Lippi-286 Lisbon Little Br Little Girl Little Pieces Little-139 Loa Duong LockUp Loki Lokjaw Los-693 LowerCase Lozinsky LPT Off Luca-309 Lucifer LV 1.2 Lycee Lythyum LZRQ M.I.R. Macedonia Magnitogorsk 2048 Malaga Malaise Malign Malmsey Maltese Amoeba Mannequin Manola Manta Marauder Mardi Bros Marl Matura Mayak Medical Meditation Mexican Mud MG MGTU Michelangelo Micro 128 Microbes Micropox Miky Milena MiniMax Minimite Ministry Minsk Ghost Mirror Mix1 Mix2 Moctezumas Revenge Monkey Mono Month 4-6 Monxla Monxla B Mosquito MPS 1.1 MPS 3.1 MPS 3.2 MPS 4.01 Mr MSJ MShark MSTU Mugshot Mule Multi-123 Multi-Face Mummy Munich Murphy MusicBug Mutant Mutation Nazgul NaziPhobia NCU LI Necro Fear Necro Shadow Newcom Nina Nines Ninja No Frills NoBock NoInt Nomenklatura Not-586 NPox NTKC Null Set Null-178 Nygus Ohio Oi Dudley Ontario Ontario 730 Ontario III Oropax Otto6 Outland Oxana Pa Parasite Paris Parity Parity Particle Man Path Pathhunt Patient PC Flu PC Flu-2 PCBB Pegg-833 Pentagon Penza Perfume Phantom Phoenix Phoenix 2000 PhoenixD Pi Piazzolla Pila Ping Pong Pisello Pitch Pixel Pixie Plastique Plastique-B Play Tetris Plovdiv 1.1 Plovdiv 1.3 Plumbum Plutto Poem Pogue Pojer Polimer Polish 217 Polish 529 Polish 583 Polish Polish-376 Possessed Pregnant Press Prime Print Problem Protecto Proud PS-MPC Puke-393 QMU Quake Queens Quiet Quick Quirk R-10 R-11 Radyum Rage RAM Random Rattle RaubKopie Reaper Red Diavolyata RefRef Reklama Relzfu Reset Revenge Attacker RIP-699 Rocko Rosen RPVS RSP-1876 RTL4 Ryazan Rybka Sad Saddam Sadist Sandwich Saturday The 14TH Scott's Valley Scream Scroll Scythe SeaCat Self Semtex Sentinel Serena Seventh Son Shadow Shake Shaker Shield Shifter Shirley Sicilian Mob Signs Silence Silly Silly Silly-365 Simple Simulati Siskin Sistor Skater Skew-469 Skull Slayer Slovak Slow Small ARCV Small Small-178 Smiley Socha Solano 2000 thing Sorlec Sorry Soupy Spanish Spanish Fools Spanz Sparse Spyer Squawk Squeaker Squisher Staf Stahl Stanco StarDot 600 StarDot 789 StarDot 801 Stasi Sticky StinkFoot Stone`90 Striker #1 Stupid-1355 Sunday Sunday-2 Suriv 1.01 Suriv 2.01 Suriv 3.00 Suriv 4.02 Surrender SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 Sverdlov SVir Swap Swedish Boys Swedish Disaster Swiss 143 Swiss Phoenix Sylvia SysLock Tabulero Tack Taiwan Taiwan 3 Taiwan 4 Talentless Tao Cheng Tatou Telecom Tequila Terminator Terminator-2294 Terminator-3549 Tester Thimble Timid Timor TMTM Tobacco Todor Tokyo Tolbuhin Tomato Tony Tony Tormentor Tormentor-205 Totoro TPE TPWorm Traceback Traceback 3029 Traceback II Traveller Tremor Troi Tu-482 Tula Tumen Turbo Twin-351 Typo Typo UFA-1201 UnExe Urfydus Uruguay Uruk-hai V-3n V270x V388 V483 V651 V800 V801 V82 V1024 V2000 V2100 V2P2 V2P6 Vacsina VComm VCS VFSI VHP2 Victor Vindicator Violetta Violite Viperize VirDem VirDem-792 VirDem-1542 Vivaldi VMem Voronezh Voronezh-370 Voronezh-Chemist Vote Vriest VVF 3.4 VX-163 W13 Walker Warning Warrior Weak Were Here Westwood Whale Wharps Wild Thing 2 Windmill WinVir Wisconsin Witch Wolfman Wonderful WordSwap World Peace Worm-16850 Worm-17690 WXYC X-2 Xpeh Xuxa Yafo YAM-3599 Yankee Doodle Yankee 2 Yap Year Youth Zaphod Zaragosa Zero Bug ZeroHunt Zherkov ZK900 Zoid ZZ s and Research 382 Recovery 4870 Acid AIDS Amstrad Argentina-102 Bad Brain Banana Blaze Blood Lust Budo Burger Busted Darth Vader Define DisDev Druid Explode Fat Fratricide Groove OW Green Peace Gyro Harakiri Hastings Hellraiser House I-B Itti Kamikazi Leprosy Madismo Mindless MindRiot Mini-45 Nowhere Man Number One Ondra Pascal-4260 Pascal-5220 Pirate Polish-45 Possum Psychogenius Repent Seneca-B Shhs Silver Dollar Simple Minds Skism Small-38 T-1000 TalkingHeads Twin Peaks Tyst V-1n Viper Wonder WWT Yukon PZPAPN MAIN MENU WEL ,E TO A word fPatricia... Using Index Cross-Reference Relationship Chart Revision History Licensing Appendices Exit PZPAPN Index PZPAPN 10 Past 3 5Lo 99% 302 310 334 337 382 Recovery 405 408 439 500 512 557 572 595 621 646 66A 702 834 914 923 981 1008 1024 Print 1024 SBC 1067 1210 1226 1241 1244 1253 1260 1308 1385 1392 1452 1575 1605 1661 1720 1804 1835 1840 1963 2153 2559 2560 2623 3040 3445- 4096 4870 5120 7808 PZPAPN A&A ABC Acid Ada Adolf Hitler Adolph African 109 Agena AIDS AIDS II Aircop Akuku Alabama Alameda Albania Albanian Alex-368 Alexander Alfa All Sys 9 Ambulance Car Amstrad Andre Angarsk Animus Anna Ant Anthrax Anti-D Anti-Tel Antimon Anto Aragon Aragorn ARCV 330 ARCV Friends ARCV Xmas ARCV-n Arf Argentina Argentina-102 Armagedon Arriba Ash Ashar ASP-472 Astra AT144 Atas Atas II Attack Attention! Aussie Dir Aussie Parasite Australian Australian 403 Australian Azusa PZPAPN Back Bad Boy Bad Brain Badsec Banana Bandit Baobab Barcelona Barrotes Basilisk Beast-N-Black Bebe Beeper Beer Best Wishes Beta Beware BFD Big Joke Bios Bit Addict Black Monday Black Wizard Blaze Blinker Bljec Blood Blood Lust Bloody! Bob Bomber Boojum %Killer Bow Boys Brain Brainy Brazilian Bug Breeze Bryansk Budo Burger Burghofer Busted Butt Stink PZPAPN Cadkill Cannabis Cansu Capitall Cara Carfield Carioca Cascade Casino Casper Casteggio Catman Caz CB-1530 CCCP-510 Cerburus Chad Chang Changu Mangu Chaos Chaser CHCC CheckSum Cheeba Chemmy Christmas Tree Cinderella Civil War Clonewar Close CLS-853 Cmdr Bomber Coffeeshop-1568 Commy Como Copyright Cossiga Costeau CPSU-2535 CPW Cracker Jack Crash Crazy Eddie Crazy Imp Creeper Crew-2480 CRF Criminal Crusher CSL Curse CV4 Cyber CyberTech PZPAPN Dad Dada Damage DAME Dark End Dark Lord Darth Vader Datacrime DataLock Davis Day10 dBASE Define Deicide Demolition Den Zuk Dest Destructor V4.00 Devil's Dance Dewdz Digger Dima Dir Dir-2 Discom DisDev KKiller Dismember Do-Nothing Doctor Qumak 2 DoDo Doom II DOS3 DOSHunter Dot Killer Drop Druid Dutch 555 Dutch PZPAPN Ear Edcl EDV Egg-1000 Eight Tunes Einstein EkoT Eliza Emf Emmie End Of Enemy Enigma Enola ETC Exebug Experiments Explode Exunt Evil Evil Empire PZPAPN Fat Father Father Christmas FCB Feist Fellowship FGT Fich Fichv-896 Fil =11-537 Filler Fingers Finnish-709 Fish Fish Flash Flex Flip Flower FoneSex Forger FORM- Fratricide Freddy ew-692 Frere Jacques Friday 13th Friends Frodo Soft Frogs Fu Manchu Funeral Fungus PZPAPN Geek Generic Generic Gergana Ghostballs Gingerbread Man Gliss Globe Gnose GoldGeld Gosia Got-You Gotcha Grapje Green Joker Green Peace Gremlin Grither Groen Links Groove Groove OW Growing Block Grunt-1 Guillon Guppy Gyro PZPAPN Hacktic Hafenstrass Hafenstrass 2 Haifa Halloechen Halloween Happy Happy New Year Harakiri lDays Hary Anto Hastings Hell Hellraiser Hellween Hero Hero-394 HH&H HiDos Highlander Hitchcock Holocaust Hominy Horror Horse House Hungarian Hungarian 482 Hybryd Hydra Hymn PZPAPN I-B Ice 9 Icelandic Idle Ieronim IKV 528 Ill Incom Infinity Interceptor Internal Intruder Invader Invol Ionkin Iper Iranian Iraqui Warrior Italian 803 Itavir Itti IVP PZPAPN Japanese Christmas Jeff Jerk 11-30 Joanna JoJo JoJo 2 Joker Joker 2 Jos Joshi Joshua Junior JW2 PZPAPN Kalah Kamikazi Karin Kemerovo Keydrop Keypress Kiev 483 Kiev 2049 Kit Kiwi-550 Klaeren KLF-356 Kode4 Korea Krivmous Kthulhu Kuku-448 PZPAPN Label Lancs Larry Lazy Leech Legalize Lehigh Leprosy Liberty Liberty-2 Liberty-1172 Lippi-286 Lisbon Little Br Little Girl Little Pieces Little-139 Loa Duong LockUp Loki Lokjaw Los-693 LowerCase Lozinsky LPT Off Luca-309 Lucifer LV 1.2 Lycee Lythyum LZRQ PZPAPN M.I.R. Macedonia Madismo Magnitogorsk 2048 Malaga Malaise Malign Malmsey Maltese Amoeba Mannequin Manola Manta Marauder Mardi Bros Marl Matura Max Mayak Medical Meditation Mexican Mud MGTU Michelangelo Micro 128 Microbes Micropox Miky Milena Mindless MindRiot Mini-45 MiniMax Minimite Ministry Minsk Ghost Mirror Mix1 Mix2 Moctezumas Revenge Monkey Mono Month 4-6 Monxla Monxla B Mosquito MPS 1.1 MPS 3.1 MPS 3.2 MPS 4.01 Mr MShark MSJ MSTU Mugshot Mule Multi-123 Multi-Face Mummy Munich Murphy MusicBug Mutant Mutation MVF PZPAPN Nazgul NaziPhobia NCU LI Necro Fear Necro Shadow Newcom Nina Nines Ninja No Frills NoBock NoInt Nomenklatura Not-586 Nowhere Man NPox NTKC Null Set Null-178 Number One Nygus PZPAPN Ohio Oi Dudley OMT Ondra Ontario Ontario 730 Ontario III Oropax Otto6 Outland Oxana PZPAPN Parasite Paris Parity Parity Particle Man Pascal-4260 Pascal-5220 Path Pathhunt Patient PC Flu PC Flu-2 PCBB PCV Pegg-833 Pentagon Penza Perfume Phantom Phoenix Phoenix 2000 PhoenixD Piazzolla Pif Pila Ping Pong Pirate Pisello Pitch Pixel Pixie Plastique Plastique-B Play Tetris Plovdiv 1.1 Plovdiv 1.3 Plutto Plumbum Poem Pogue Pojer Polimer Polish 217 Polish 529 Polish 583 Polish Polish-45 Polish-376 Possessed Possum Pregnant Press Prime Print Problem Protecto Proud PS-MPC Psychogenius Puke-393 PZPAPN QMU QP3 Quake Quiet Quick Quirk Queens PZPAPN R-10 R-11 Radyum Rage RAM Random Rattle RaubKopie Reaper Red Diavolyata RefRef Reklama Relzfu Repent Reset Revenge Attacker RIP-699 RNA Rocko Rosen RPVS RSP-1876 RTL4 Ryazan Rybka PZPAPN Sad Saddam Sadist Sandwich Saturday The 14TH Scott's Valley Scream Scroll Scythe SeaCat Seneca-B Self Semtex Sentinel Serena Seventh Son Shadow Shake Shaker Shhs Shield Shifter Shirley Sicilian Mob Signs Silence Silly Silly Silly-365 Silver Dollar Simple Minds Simple Simulati Siskin Sistor Skater Skew-469 Skism Skull Slayer Slovak Slow Small ARCV Small Small-38 Small-178 Smiley Socha Solano 2000 thing Sorlec Sorry Soupy Sov Spanish Spanish Fools Spanz Sparse Spyer Squawk Squeaker Squisher Staf Stahl Stanco StarDot 600 StarDot 789 StarDot 801 Stasi Sticky StinkFoot Stone`90 Striker #1 Stupid-1355 Sunday Sunday-2 Suriv 1.01 Suriv 2.01 Suriv 3.00 Suriv 4.02 Surrender SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 Sverdlov SVir Swap Swedish Boys Swedish Disaster Swiss 143 Swiss Phoenix Sylvia SysLock PZPAPN T-1000 Tabulero Tack Taiwan Taiwan 3 Taiwan 4 Talentless TalkingHeads Tao Cheng Tatou TB1 Telecom Ten Terminator Terminator-2294 Terminator-3549 Tequila Tester Thimble Timid Timor TMTM Tobacco Todor Tokyo Tolbuhin Tomato Tony Tony Tormentor Tormentor-205 Tormentor-1072 Totoro TPE TPWorm Traceback Traceback 3029 Traceback II Traveller Tremor Troi TSoft Tu-482 Tula Tumen Turbo Twin Peaks Twin-351 Typo Typo Tyst PZPAPN UFA-1201 UnExe Unk Urfydus Uruguay Uruk-hai PZPAPN V-1n V-3n V270x V388 V483 V651 V800 V801 V82 V1024 V2000 V2100 V2P2 V2P6 Vacsina VComm VCL VCS VFSI VHP VHP2 Victor Vindicator Violetta Violite Viper Viperize VirDem VirDem-792 VirDem-1542 Vivaldi VMem Voronezh Voronezh-370 Voronezh-Chemist Vote Vriest VVF 3.4 VX-163 PZPAPN W13 Walker Warning Warrior Weak Were Here Westwood Whale Wharps Wild Thing 2 Windmill WinVir Wisconsin Witch Wit Wizard 3.0 Wolfman Wonder Wonderful WordSwap World Peace Worm-16850 Worm-17690 WWT WXYC PZPAPN X-2 Xpeh Xuxa PZPAPN Yafo YAM-3599 Yankee Doodle Yankee 2 Yap Year Youth Yukon PZPAPN Zaphod Zaragosa Zero Bug ZeroHunt Zherkov ZK900 ZMT Zoid Zu1 PZPAPN : 5Lo H: , 1993 Poland R: 1,030 - 1,040 4: PRhE - 6.04+, \2.07+, 2.45+ The 5Lo , 1993, and is fPoland. 5Lo is a vof . b5Lo X, the 5Lo at the top of the &, hooking |21. 5Lo qof 1,030 to 1,040 at the end of the a. The =and in the DOS to the =and . The can be in the 4in all 5Lo "92.05.24.5lo.2.23MZ" PZPAPN 10 Past 3 : 10 Past 3 H: keypresses lware devices disabled or interference R: 748 4: PRaCK - .1.4+, 6.0+, 3.93+, V99+, 2.43a+, , NAV 2.1.2+, 25.10+, V99+, The 10 Past 3, or 748, was actually ~much earlier, in early . 10 Past 3 is a vof . The the 10 Past 3 in low , hooking {21 and 6B. , as measured by the DOS not be the 10 Past 3 , it qof 748 at the end of the a. The in the DOS not be . No in the The 10 Past 3 between 15:10 and 15:13 (3:00PM and 3:15PM) every day, at cause the "Ctrl" or "Shift" keys to be invokes enters a character on the . As a , the character input may not be the same as what the intended. ly, it either disables or interfers the functioning of the devices on the days of any month 1st day of any month - 10th day of any month - 16th day of any month - monitor/ 29th day of any month - On the 22nd day of any month, unexpected %s may of 10 Past 3 are: 10 Past 3-B: A 789 of the 10 Past 3 adds 789 (to the . +. It the on the monitor: The in the 4in all 10 Past 3-B : Republic Of South Africa , 1993. PZPAPN : 99% 99 Percent H: seconds set to 14 R: 821 - 835 4: PNE - 6.0+, 2.43a+, \2.07+, V100+, V100+ The 99% . Its , but it s to be V. 99% is a vof . 99% is X, the 99% xone . in the Eor in the O's root qof 821 to 835 the end of the a. The =and in the DOS to not be , but the seconds set to "14". The in the 99% "Het 99%- heeft toegeslagen. . ." is my revenge E.V !" released 6 W\* \" It is what 99% may do PZPAPN : 302 H: 1; TSR R: 302 4: PRsCK - \, VET, 2.42+, 6.00+, 3.93+, NAV 2.1.4+, V99+, The 302 . Its . The 302 is a vof . b302 X, the 302 as a low TSR of 864 (. It hooks the 302 , it qof 302 at the end of the a. The =and in the DOS to the =and . No 8ed in the The 302 Nn't do PZPAPN : 310 H: j; write protect R: 310 4: PRaCK - i, VET, NAV 2.1+, The 310 . Its is a vof . The 310 is X, the 310 hooking {21 and 63 in the |area. the DOS the 310 , it X. If X, it the 310 qof 310 at the end of the a. The =and in the DOS the 310 notice fwrite protected write protect Lby DOS. because the Nn't check for the Uand handle PZPAPN : 334 Made H: May, England R: 334 4: PNCK - .1.4+, 6.00+, The 334 in May, . It is England. is a the 334 X, the 334 check the bthree . in the see if it finds the three . `, it xit. completed process, the the 334 of 334 at the end of the a. The =and in the DOS to the =and . No in the The 334 Nn't to do of 334 are: 334-B: on the 334 very . It wone . ain the Nnot `past the bfive in the qof 334 at the end of the a. The =and in the DOS to the =and . The in the "Made in England" : England PZPAPN : 337 V337 H: May, j; TSR R: 337 4: PRsC - , VET, , IBM , NAV 2.1+, 1.53S+ The 337 Vin May, . 337 is a vof . . It Nnot The 337 is X, the as a low TSR of 944 nby the 337 is , it by 337 at the end of `. The =and in the not be 337 Nnot do PZPAPN 382 Recovery : 382 Recovery 382, Recovery, 382 Recovery.1 H: b382 (of . spurious Ospinning; %failures Taiwan R: N/A 4: ONAK - , NAV, IBM , VET, The 382 Recovery in Taiwan. It is generic vof . ,and . the 382 Recovery X, the check the Efor a . has not . If it finds an a, it xit. If the less , the now be 382 were greater not show any always mthe b382 (of the the all . `in the Eare s, the next Xthe `to . `, however, may or may not later of the 382 Recovery "present on a aare the . In cases, the hang upon Z, requiring the to be re %ed. In cases, spurious on the and the not run. Lastly, the may do nothing but leave the Ospinning, requiring the to be powered off and re Occasionally, the 382 Recovery corrupt IO.SYS, one of the hidden 9has fthe fail. Since the b382 the `cannot be recovered. The the aare permanently lost. `should be Ad or erased and replaced backup copies to be of 382 Recovery are: 382 Recovery.1: A minor of 382 Recovery gequivalent to the differs by See: Burger PZPAPN : 405 Hammelburg, 405-EST H: 1987 `fail to run; b405 (of . Austria or Germany R: N/A 4: ONC - \, IBM , NAV, , VET, \, NAV, or The 405 is an in the C: Oroot E. If the of the . less (, the of 405 :ly cannot recognize are already s, so it attempt to them again. The 405 Nn't carry an =, and Nn't do in the C: Oroot E. However, since it s the b405 (of . `are not recoverable except by replacing them backups or distribution of 405 are: 405-EST: , 405-EST is an of the 405 . The purpose of the alteration is to avoid detection by See: Burger PZPAPN : 408 H: j; unexpected ; write protect Ton write protected R: 408 4: PRfCK - }, VET, The 408 . 408 is a vof . The 408 is in low be no rby the DOS {80, 82, 83, 85, 88, 89, 8A, 8C, 8E, 91, 93, 95, 96, 98, 9C, 9E, A0, A1, A2, A3, A5, A7, A8, AA, AC, AF, B4, B8, and BB all be nby the 408 is , it xany . by 408 at the end of the be no 2in the =and in the DOS [write protect fwrite-protected require 5line input receive 5line input was not 408 Nnot to do PZPAPN : 439 H: Poland R: 439 4: PRhCK - , VET, 1.15a+, 6.00+, 3.93+, NAV 2.1.2+, 25.10+, V99+, The 439 . It is Poland. 439 is a vof . The the 439 the 439 at the top of #the , as rby the DOS ?by 2,064 by the the 439 , it qof 439 at the end of the a. The and in the DOS not be The 439 Nn't to do of 439 are: 439-B: gequivalent to the , 439-B is a minor . A couple (differ fthe : Poland PZPAPN : 500 H: R: 500 4: PRaCK - 1.15a+, .1.4+, 6.00+, 2.43a+, NAV 2.1.2+, 25.10+, \2.07+, 1.53S+ The 500 vof . b500 Since the Nnot reserve the it occupies, and keep it in may [frequent the 500 , it qof 500 at the !of the . The and in the DOS not be The 500 cannot determine it has , so re `may uof a in an to the PZPAPN : 512 512-A, Number of the Beast H: , 1989 crashes; k; TSR R: 512 4: PRCK - , IBM , NAV, , VET, : CleanUp, or The 512 is not the same as the Friday The 13th . The 512 , 1989, by Vesselin Bontchev. It zing is run. becoming , any for any reason sif its is at least 512 the 512 crashes due to unexpected T, as well as k. Damage may `if the runs the /F parameter as the of the in the Eentry not match the actual Kspace used. adjust the ing in damaged The of "Number of the Beast" is because the author of the used a signature of 666 near the end of the to determine if the ais already s. Since 512 adds its 4to the end of `, it is easy to verify sby the 512 by checking for signature. of 512 are: 512-B: to the 512 , except the DOS check in the omitted. The author's signature of '666' has omitted. 512-C: to the 512-B , minor 512-D: to the 512-C , except no longer checks to see if a ahas the Attribute on it before 512-E: to the , such as on video cards. ma 55,104 rby the DOS Nnot use the 666 signature to designate 512-F: , the DOS show any . The "666" signature can be `as offset 1FD. PZPAPN : 557 H: R: 557 - 566 4: PRhE - , NAV 2.1+, The 557 . Its is a b557 at the top of the rby the DOS ?by 624 nby the 557 the 557 , it qof 557 to 566 at the end of the a. The =and in the DOS to the and . One s in all "X[YZ]" The 557 Nn't to do PZPAPN : 572 H: R: 572 4: PRhE - , VET, , NAV 2.1+, .1.4+, 1.53S+ The 572 . Its is a The the 572 at the top of #the , as rby the DOS ?by 1,024 {21 and 24 the 572 the 572 , it qof 572 at the end of the a. The =and in the DOS to the =and It is if 572 of 572 are: 572-COD: A minor of the 572 has three differ. May, PZPAPN : 595 H: R: 595 4: PNCK - 6.04+, The 595 . Its . The 595 is a vof . the 595 X, the 595 xone . in the E. If all of the . `in the already s, the search for a . in the Oroot qof 599 the end of the a. The =and in the DOS to the and is one in the It is if 595 PZPAPN : 621 thing H: R: 621 4: PNCK - IBM , VET, NAV 2.1+, The 621 . Its . 621 is a vof . 621 is X, the search the Oand Efor an , it sby the 621 621 at the end of the a. The in the "Water detected in math-co-processor" "PARITY ERROR" halted" thing wonderful has happened, your PC is alive..." It is what 621 PZPAPN : 646 H: R: 646 4: PNCK - , IBM , NAV, , VET, The 646 . Its is a vof . the 646 X, the xone ain the by 646 the end of the `can be easily identified as always end the hex : "EAF0 s to do nothing except PZPAPN : 66A Satan-B H: failure; "Too many `open" R: 512 4: PNCK - 6.00+, 25.10+, The 66A . Its is a the 66A search the Eto locate all `. As the `are d, the xthem. the 66A qof 512 at the end of the a. The =and in the DOS to the =and The can be in all 66A "66A" The "66A" is used by the to determine if the awas s, and is at the end of the the 66A may fail to or unusual , such as "Too many `open". PZPAPN : 702 H: j; TSR R: 702 4: PRsC - 2.43a+, The 702 . 702 is a of . it is what picky about what it The the 702 as a low TSR of 944 nby the the 702 , it may qof 702 at the end of the a. The =and in the DOS not be . No the 702 It is if 702 PZPAPN : 834 Arab H: j; TSR; ; unexpected Kaccesses to may hang Saudi Arabia R: 834 4: PRsC - , IBM , VET, NAV 2.1+, The 834 . Its is a vof . but not The the 834 the as a low TSR of 1,808 nby the well. At , the access the , altering it. the 834 , it `of a greater 4K in +, however, not be by 834 (, the at the end of the . The =and in the Eis not by the the 834 may notice unexpected accesses to the executing accesses are the accessing the X, or a by the . The xious copy of the , but has later %the fthe in a hang ring during the %process. of 834 are: 834-B: (Arab) to the are greater 1K in before u. Two 4: "nsed Materi" and " Low TSR is 1,792 PZPAPN : 914 Russian Mutant H: R: 914 4: PRhC - , VET, , NAV 2.1+, The 914 . Its . The 914 is a vof . . It Nnot The the 914 at the top of #the |12's not moved. rby the DOS ?by 912 {1C and AC nby the the 914 , it larger 1K in qof 914 the at the end of the a. The =and in the DOS are no in the It is if 914 PZPAPN : 923 Hey You H: may fail to R: 923 4: PRhAK - \, IBM , VET, NAV 2.1+, The 923 . Its 923 is a generic vof . ,and . The 923 is X, 923 at the top of #the rby the DOS @by 944 nby the 923 is , it ,and . X. If X, it 923 to 942 at the end of the Nnot alter in the 8the is part of the "Hey, YOU !!! thing's happening to you ! Guess what it is ?! HA HA HA HA" may be L, the be terminated and the ed to a DOS prompt. PZPAPN : 981 Joe's Demise H: May, R: 981 - 1,932 4: PRhA - , VET, 1.15a+, .1.4+, 1.53S+ The 981 Gin the in May, . Its is a ,and . `, but not b981 X, the 981 at the top of #the |12's not be moved. , as rby the DOS ?by 1,952 21 and 22 nby the , the 981 ,and . for any reason. . by 981 if the smaller 1,934 by 1,015 to 1,025 (. In both cases the at the end of the adding an (to the a. The =and in the DOS not be One can be din all 981 requires MS-DOS 3.00 or later" It is what the 981 may do of 981 are: Joe's Demise: to the has 11 differ. PZPAPN : 1008 Suomi, Oulu H: j; internal stack halt on Helsinki, Finland R: 1,008 4: PRCK - \, NAV, IBM \, NAV, or The 1008 by Petteri Jarvinen of Helsinki, Finland. It is a v, and s referred to as the Suomi The the 1008 the ing in its increasing by 1,008 (. The +cannot be seen by doing a if the is present in %ing a scopy of +may in an internal stack U, and the "halted. effect was noted on the author's test machine is a XT-clone running Microsoft MS-DOS 3.30. , it xany . X, adding 1,008 (to the . The qcannot be seen by doing a if the is present in PZPAPN 1024 SBC : 1024 SBC Ontario II, SBC H: j; intermittent printing problems; Canada R: 1,024 4: PRhAK - , IBM ., NAV 2.1+, 25.10+, : CleanUp, or The 1024 SBC . Its is Canada. 1024 SBC is a ,and . It is on the Ontario The 1024 SBC is at the top of #the &, hooking , as measured by the DOS ?by 3,072 12's moved. At , the +if it was not many as the part of the 00h at the end of , 1024 SBC ,and . for any reason. and . qof 1,024 be hidden if the . The at the end of the A symptom of a 1024 SBC intermittent printing problems printer. Unlike several hide the the DOS 1024 SBC is an , and no the See: Ontario Ontario III PZPAPN 1024 Print : 1024 Print 1024PSCR H: May, 1; Print failure; R: 1,024 4: PRhCK - , NAV, , IBM , VET, The 1024 Print in May, . Its and its , are is a vof . The 1024 Print X, the at the top #the , as measured by the DOS 2,048 and 21 nby the 1024 Print , it over 1K in for any reason. by 1,024 at the !of the 1024 Print =and in the to the 1024 Print , it interfer the functioning of the Print key. Pressing the Print in a Mof the 's CMOS configuration instead of printing the contents of the PZPAPN : 1067 H: ; TSR; R: 1,067 4: PRhCK - , NAV, , IBM , VET, The 1067 . 1067 is vof . It is The a 1067 X, the 1067 as a low TSR of 1,808 or 1,856 nby the . Unlike most are TSRs, the uof the in a in increments of 64K. The may be mapped by utilities as an qin the of the in interpretor. the 1067 , it xone . over 3K in in the X. If E, it may 1067 1,067 (. The at the end of the . The =and in the DOS are no in the A symptom of a 1067 Ylarge may fail due to the of large amounts of large . may receive the Ythem: too big to fit in 1067 Nn't to do PZPAPN : 1210 Prudents H: >, 1989 Kwrite failure; TSR Spain R: 1,210 4: PRE - \, NAV, , IBM , VET, \, NAV, or The 1210, or Prudents , was ~in Barcelona, Spain, >1989. The 1210 is a between May 1st and May 4th of any year, causing Kwrites to be Kverifies, so writes to the Knever between PZPAPN : 1226 V1226 H: k; spurious Lin place of executing; Ospinning R: 1,226 4: PRhC - \, NAV, , VET, 1.53S+ The 1226 by Vesselin Bontchev. is a generic . Nnot +. The 1226 is a self- encrypting , and simple search algorithms work to detect its presence on a The the 1226 the , reserving 8,192 at the top of 1226 is , the attempt to is at least 1,226 before u. The is rather "buggy" and the process is not always entirely successful. Successfully by 1,226 `multiple s, it is unable to determine ais already grow in by an 1,226 (. Eventually, the . grow too large to fit into the 1226 [unexpected . An effect instead of a executing, a line or two of spurious on the M. Lastly, always indicate m8,192 less is actually on the machine. of 1226 are: 1226-B: , 1226-B is a bug fixed of the 1226 Nnot mthe bugs present in the earlier cause Ming of spurious Nstill re xalready `until too large to fit into . It is fairly to 1226D. 1226-B Dropper: is an . drops the 1226-B 1226D: on the 1226 Nnot the kand the Mof spurious . 1226D `over 1,226 , copied, 1226M: (V1226M) to the 1226D , except are not aopen, PZPAPN : 1241 H: j; TSR R: 1,241 4: PRsCK - NAV 2.1+, , VET, 1.53S+ The 1241 . Its is a vof . b1241 X, the 1241 as a low TSR of 1,584 (, hooking |21. Its TSR may 5data" or as part of the 5interpretor in mapping utilities. the 1241 , it X. If X, it sas well. 1241 qof 1,241 at the end of the be no 2to the =and in the DOS It is what 1241 PZPAPN : 1244 H: j; TSR R: 1,244 - 1,258 4: PRsA - NAV 2.1+, , VET, The 1244 . It is where it was ~. 1244 is a vof . ,and . `, it Nnot It is on the The the 1244 as a low TSR of 1,440 (. It {08 and the 1244 , it qof 1,244 at the !of the qof 1,244 to 1,258 at the end of the be no 2to the =and in the DOS . One can be dconsistently in the "CONFIG" It is what 1244 of 1244 are: 1244-B: to the 7the "KATALOG". : Poland See: PZPAPN : 1253 Anticad, V-1, ksgiving H: TSR; BSC; Austria R: 1,253 4: PRsBCKX - , NAV, IBM , VET, : NAV or `and replace The 1253 . It is believed to ated in (or at least to ~in) Austria. 1253 is a generic vof . +. It wthe Iand the The the 1253 the as a low TSR. The TSR be 2,128 , hooking 13, 21, and 60. remain un 0, and @by 2,128 (. At , the of the the 1253 . If the J, the the . sif it hasn't s. The 1253 appends its 4to the end of the a, and 1the bfew (of the be a jump to the appended by 1,253 (, and the makes no attempt to hide the fourth through sixth (set to "V-1" (hex 56 2D 31). Any are accessed while the is present in Newly formatted I, likewise, simmediately. The 1253 is destructive . The author of was able to get it to activate by setting the >24th and executing an The promptly went and overwrote the entire a pattern of 9 of what s to be a fragment. has started to J, the way to stop the Kactivity is to power off the The in the and/or is of special note. fthe in the , the . At , the resides the top of #the &. The be 77,840 (. It can be seen 5. At , any . the 1253 , even on the before the One effect of Oor floppy is the FORMAT 5may in unexpected Kactivity to inactive Os. For example, on the author's formatting a OC:, was always Kactivity to tthe 1253 requires deleting , the the of any Iexposed to the be dis s. If the not dis s, the promptly fthe J. Dis tthe done in the 's full again It is =s for if it Kif an >24th fthe PZPAPN : 1260 V2P1, Chameleon Research H: Minnesota, R: 1,260 4: PNC - Encrypting , IBM , NAV, , VET, : CleanUp, \, or The 1260 not , but is it extremely virulent qd by 1,260 (, and the The encryption key The 1260 is derived fthe is highly modified. was developed as a research by Mark Washburn, who wished to show the community why identification ners do not work in all cases. The encryption used in 1260 is one of many possible cases of the encryption Washburn's later research , V2P2. See: Casper V2P2 V2P6 PZPAPN : 1308 KSpoiler H: j; lost clusters R: 1,308 4: PNCK - NAV 2.1+, 25.10+, The 1308 . Its . The 1308 is a of . the 1308 X, the 1308 search the Efor the a. If an , it it. qof 1,308 at the end of the . The =and in the DOS the 1308 may notice increasing numbers of lost clusters clusters may `, and typically in multiples of 10. PZPAPN : 1385 KPlus 1 H: j; TSR; R: 1,385 4: PRsCK - , NAV 2.1+, The 1385 . Its . 1385 is a of . +. It Nnot, however, xvery small . The the 1385 the 1385 as a low TSR of 3,376 {13, 21, CC, and F8 nby the 1385 , the +if it was not s, and one in the Oand the 1385 , it X, plus one in the mechanism allows the to spread very quickly. the 1385 qof 1,385 at the !of the . The =and in the DOS . Two in the "c:\ "PATH=" the 1385 It is if 1385 PZPAPN : 1392 Amoeba H: March, TSR; . =s modified Indonesia R: 1,392 4: PRA - \, NAV, , IBM , VET, 1.15a+, \, NAV, or The 1392, or Amoeba, ~in Indonesia in March . The 1392 is a and . +. It copies the b1,089 (of the host ato the end of the s the b1,089 4. An to the end of the a. As `are creation/modification 0to the =the `were Nnot to cause any destructive damage. The s in the is where its of Amoeba was derived "SMA KHETAPUNK - Nouvel Band A.M.O.E.B.A" PZPAPN : 1452 H: j; unexpected R: 1,452 - 1,465 4: PRCK - IBM , NAV 2.1+, 1.53S+ The 1452 . Its is a vof . The 1452 is X, the xall . in the C: Oroot The , however, Nnot Later, is re fthe C: O, the as part of the 5interpretor. qof 1,452 to 1,465 at the end of the are no in the 4in the 1452 may [unexpected require 5line input. For example, Zof the DOS EDLIN in the "Invalid ", and the be terminated. It is what 1452 and disrupt operation. See: Antimon PZPAPN 00/ M PT/ : 1575 1577, 1591, Green Caterpillar H: ; sluggishness of DIR "green caterpillar" s on Taiwan Ontario, Canada R: 1,575 4: PRfAk - , IBM \, NAV, , VET, : CleanUp, or The 1575 ~in Ontario, Canada, in widely reported, and is believed to be fthe Far East, probably Taiwan. It is a vof . ,and . `, and the 1575 X, the in 1,760 to 1,840 the top of , but #the is not reserved, and may be later by an nby the the Oroot the 1575 , it xone . one . on the ever a DOS DIR or COPY Nnot spread =and in the DOS to the =and show an qof between 1,577 and 1,591 at the end of ma green caterpillar the to the Centipede game creature. of 1575 are: 1575-B: to the 1575 . The major difference is reserves the it occupies at the top of is not moved. 1575-C: to the 1575-B, Xin addition to a DOS DIR or COPY 5is issued. may hang 1575-D: Zof an in the C: becoming s. Later the fthe C: in the becoming are copied (both source and target), or a DIR 5is issued. as Green Caterpillar due to the graphic caterpillar and eat all the fthe 1575-E: Zof an in the C: becoming s. The the next X. Its at the top of the &is 1,840 (, hooking 1575-E ,and . a DOS DIR X, or a by 1,575 - 1,591 at the end of the a. The =and the DOS to the =and has to avoid detection by : Australia PZPAPN : 1605 1605-B, 1600, Anti , Tel Aviv H: j; TSR; slowdown R: 1,605 4: PRsA - , NAV, IBM , VET, : NAV, or The 1605 was uploaded to John McAfee's Homebase BBS by an anonymous . The . The 1605 is a vof . `, and it Nnot +. It is roughly on the The the 1605 the as a low TSR of 1,728 {13 and 21 nby the . At , the slowdown by 15-20%. becoming , any . ,or . sby the by 1,605 (in all cases at the !of the a. . by between 1,601 and 1,610 at the end of the replicating, it is carries any damage potential. of 1605 are: 1605-B: by MicroCom in London, England in March in a plain envelope a London postmark. The label on the Jread "Solomon is not related in any way to Dr. Solomon. very to the 1605 . The major difference is by 1,605 to 1,619 See: PZPAPN : 1661 Cascade.1661, Turkey H: j; TSR Turkey R: 1,661 4: PRsCK - VET, The 1661 , in Istanbul, Turkey. 1661 is a vof . `, it The 1661 is X, the as a low TSR of 2,000 nby the , 1661 X. If X, it by 1,661 at the end of the It is what 1661 of 1661 are: 1661-B: as Turkey, Turkey in . It is to the to avoid detection by familiar 1661. : Turkey 1661-C: ~in Turkey in It is to 1661-B. : Turkey See: Cascade PZPAPN : 1720 PSQR H: March, : TSR; . damage on Ad on Friday the 13th Spain R: 1,719 - 1,733 4: PRsA - , NAV, IBM , VET, : NAV, or The 1720, or PSQR , is a of the was ~in Barcelona, Spain, in March ,and . unlike , it xoverlay not be The X, the as a low TSR of 2,048 nby 1720 in the 1720 , it by 1,720 (, and the at the !of the by 1,719 to 1,733 (, and the the end of the a. In both cases, be no 2to the =and in the DOS E. All can be easily identified as the character "PSQR", is the umarker for On Friday the 13th, the 1720 activate the X, it K. More damaging, however, is the 1720 check to see if the has a O. If a Ois present, the and ing in all data on the Kbecoming . The to hang. of 1720 are: 1720-B: ~in Spain in to the . The encryption used in the slightly modified, most detect out any problem. See: PCBB PZPAPN : 1804 H: , 1993 : . Germany R: 1,804 - 1,805 4: PNE - V102+, V102+ The 1804 fGermany in , 1993. 1804 is vof . the 1804 X, the 1804 xone . in the usually qof 1,804 be 1,805 (. The at the end of the a. The =and in the DOS to the =and . No are in the It is what 1804 PZPAPN : 1835 H: R: 1,835 4: PNE - \, IBM 25.10+, NAV 2.1.4+, The 1835 . It is a vof . and is very roughly on the Yankee Doodle . The sample has ated the 1835 X, the 1835 xtwo . in the qof 1,835 at the end of the a. The =and in the DOS not be Two in the can be "*.exe *.*" It is if 1835 PZPAPN : 1840 H: j; TSR; Write protect R: 1,838 - 1,891 4: PRsAK - IBM , VET, C, NAV 2.1+, The 1840 ~and . Its . 1840 is a vof . and . The 1840 is X, the as a low TSR of 2,144 nby the , 1840 X, it by 1,838 to 1,891 (. The at the end of the Two in the can be "NV71. ,MAND" It is if 1840 PZPAPN : 1963 V1963, 1963 OverWrite H: May, R: 1,963 4: PRsAK - , NAV, , IBM , VET, The 1963 in May, . Its . 1963 is a of . ,and . , it hides its regardless of whether the . It is related to the The the 1963 the as a low TSR of 5,136 nby the mark its TSR as " is in fact reserved. 1963 is , it ,and . over 1,963 X. The wthe by writing the b1,963 of the end of amark, and copying into the b1,963 (of the a. (. mthe b2,475 (of the , the difference is due to the . Wheader.) do not in the DOS Zof the DOS "detected. regardless whether the 1963 is capable of dis on the fly. As a unaware of be unable to locate it on using CRC or checksumming techniques. Further, Zof an unaware of 1963 in all becoming It is what 1963 of 1963 are: 1963-B: in May, V. 1963-B is in behavior to 1963. The primary difference is are 48 differ fthe See: Cracker Jack PZPAPN : 2153 H: j; TSR R: 2,153 - 2,217 4: PRsA - 2.43a+, The 2153 . Its is a ,and . . It Nnot The the 2153 the 2153 as a low TSR of 2,672 nby the the 2153 , it qof 2,153 to 2,168 qof 2,203 to 2,217 (. In both cases the at the end of the a. The =and in the DOS not be It is what 2153 PZPAPN : 2559 Yaunch H: k; unexpected Kaccess to R: 2,559 - 2,933 4: PNE - \, IBM NAV, , VET, The 2559 yabout its is un . 2559 is a vof . 2559 is X, the search the Efor a candi If one is d, it xit. If not, it search the B: and C: Estructures for a candi , and 2559 of 2,559 to 2,933 (. The at the end of a 2559 uare large . fail to s due to the having al a large amount of host Xby the . The isn't released until the host completes kmay PZPAPN : 2560 Magnitogorsk H: R: 2,560 4: PRhA - , NAV, VET, IBM The 2560 . It is fthe is a vof . ,and . `, it Nnot The the 2560 2560 at the top of but #the |12's is not moved. {08, 13, 21, and 22 nby the , as measured by the DOS @by 5,184 becoming , 2560 ,and . over 3K in for any reason. qof 2,560 at the end of the a. The =and in the DOS not be The DOS EDLIN fail to function 2560. YEDLIN in the "Invalid L, and EDLIN terminate leaving the at a DOS prompt. 2560 is a . While it Nnot hide it's q, it Nactively employ techniques in order to avoid utilities are unaware of it. It is what 2560 of 2560 are: 2560-B: in May, V, 2560-B's major difference f2560 is +the q, regardless of whether the 2560-C: in May, V, 2560-C's is very to 2560-B. Magnito-3000: on the 2560-C , Magnito-3000 is a 3,000 of the . Its 6,064 (, hooking {08, 13, 21, and 22. It ,and . X, copied, or for any reason. qof 3,000 be hidden the . The at the . The =and in the DOS not be . The in the ,MAND" "AND" Magnum: on the 2560-C , Magnum has avoid "detected by . It reset the =to 1-03-1988 it is . The the "Mr. Lozinsky Just read document on your AIDSTEST (1-Jan-91 ) we release new . (C) TeleFucks, Ltd See: Magnitogorsk 2048 PZPAPN : 2623 H: May, R: 2,623 - 2,633 4: PRhE - 1.15a+, 6.00+, The 2623 in May, . Its . The 2623 is a of . The the 2623 at the top of #the , as rby the DOS ?by 2,864 {21, 22, and 2F by the |12's moved. , the 2623 xa randomly selected . in the the 2623 , it intermittently xone . in the the 2623 qof 2,623 to 2,633 at the end of the a. The =and in the DOS are no in the in 2623 It is what the 2623 PZPAPN 3040 : 3040 3040 H: R: 3,040 - 3,183 4: PRaA - V99+, 6.04+, \2.07+, 2.45+, V99+, The 3040 . Its . 3040 is a vof . ,and . , but not +. It uses techniques to avoid detection. The the 3040 at the top #the as the Nnot allocate the where it resides. to the the 3040 , it may of the . ,and . in the qof 3,040 to 3,183 at the !of the a. The =and in the DOS to the =and . No in the The portion of the performs the function to avoid the detection of . It effectively on the fly are read into , thus avoiding locating the 1due to PZPAPN 3445- : 3445- 3445 H: R: 3,445 4: PRhA - , IBM , VET, The 3445- , or 3445, . Its . 3445- on all configurations, and on most Zof an in a hang. It is a vof . employs techniques to avoid detection. The the 3445- X, one of two things happen. On most , the be hung, and the mto re %the , the 3445- , it at the top of #the and , as rby the DOS ?by 3,488 |12's moved. The 3445- 21 at the top of |01 in low the 3445- , it and . , but not copied. In the case of copying, both the source and target the 3445- qof 3,445 not be in the DOS if the . The at the end of the . The =and in the DOS of a 3445- uare the DOS indicate Ton all the in a hang. PZPAPN : 4096 FroDo H: W, & overlay j; TSR hides crosslinks; 9of data Israel R: 4,096 4: PRsA - \, IBM , NAV, , VET, : CleanUp, \, NAV or The 4096 considered a it is almost in to the The 4096 W, and Overlay `, adding 4,096 the in a into , it execu pif it is COPY or XCOPY is destructive to both data `and execu as it very slowly cross-links `on the K. The cross-linking s so slowly is a lware problem, the "almost in . The cross-linking of `is the of the manipulating the FATs, changing the number of , as well as the issuing think mlost cross-linking if the is in As a side note, if the is present in and you attempt to copy `, the new copy of the not be if the new copy Nnot man execu extension. Thus, one way to dis is to copy off all the a non-execu aextension (i.e., don't use . ,, .SYS, etc.) while the is active in power off the and re fa write-protected, %ed and the is not in Athe `and copy back the Ito the execu s and extensions. The xthe , if done correctly, but still leave the problem of cross-linked are permanently damaged. On or 22 of any year, the 4096 s to be a "bug" in the it goes into a consuming loop. The 4096 in its 4; however, it is never written out to the . Moving to the of a Jand re %ing the in the "FRODO LIVES" 22 is Bilbo and Frodo Baggin's birthday in the Lord of the Rings trilogy. An important note on the 4096 data s, the data to be fine on . However, is later now be corrupted and unpredic s may of 4096 are: 4096-B: to the 4096 , the main encryption mechanism has 0in order to avoid detection. 4096-C: of 4096 is to the . The major difference is the DOS not show any cross-linking of lost clusters. A symptom of Kspace according to a DIR be more Kspace according to the DOS 4096-D: of 4096 is to the 4096-C in behavior. The major difference is it has modified to avoid detection by anti- utilities. 4096-E: of 4096 is to the 4096-C in behavior. The major difference is it has modified to avoid detection by most anti- utilities. Its is 5,648 PZPAPN 4870 : 4870 4870 H: fail to R: 4,870 4: ONAK - 3.93+ The 4870 . It's is not ,and . the 4870 the search the Efor an or . a. The bsuch sby the mthe b4,870 (of the candi by the . If the was 4,870 (or more, be no qin the in the DOS E. If the was less 4,870 in the DOS now be 4,870 (. The in the not be the 4870 checked for a x, and sthe candi if one was d, the terminate and to a DOS prompt. A side note on : the is compressed Wutility, accounts for much of the 4,870 mthe markers of din the b4,870 (of the It is not possible to dis the 4870 as the b4,870 (of the are lost. must be Ad or erased, replaced clean copies. PZPAPN : 5120 VBasic , Basic H: May, West Germany 9; unexpected Kactivity R: 5,120 4: PNAK - \, IBM , NAV, , VET, \, or The 5120 ~in May, . It is a non- generic ,and . is was written in compiled Turbo Basic assembly language. X, the 5120 ,and one . aon the Oand E, followed xone randomly selected . ,or . Eon the 's C: by 5,120 (. . sby the 5120 by between 5,120 and 5,135 Unlike most of the MS-DOS es, the 5120 Nnot intercept Kwrite . Thus, may notice Kwrite no access should be ring for a O, such as the C: Data `may corrupted on , and cross-linking of `may The can be 5120 near the end of the "BASRUN" "BRUN" "IBMBIO. "IBMDOS. "Access denied" is one of the 5120 Nnot , but be ms in a very manner. second is not rhere as the author Nnot ma copy. PZPAPN : 7808 H: May, "Not enough R: 7,808 4: PNA - , NAV, , VET, The 7808 in May, . Its . 7808 is a vof . . It Nnot 7808 is X, the search the Oand Efor a . ,or . x. It xthe ,or . it finds in the by 7,808 (. The at the =and in the DOS to the =and The in the may be re sby 7808. s, an 7,808 to the 7808 may in the "Not enough L, and the Yterminating. in the not be s. An symptom of 7808 take longer to load Xdue to the searching the =and in the PZPAPN : A&A H: ^, 1993 R: 506 4: PRxC - The A&A ^, 1993, and is . A&A is a vof . , but not +. It uses a tunneling technique to avoid detection by monitoring bA&A X, the A&A in a "hole" in low al , hooking |21. , as rby the DOS not be the A&A , it qof 506 at the !of the a. The =and in the DOS to the =and . The can be in the 4in all A&A "{A&A}" It is what A&A may do PZPAPN : ABC H: keystrokes repeated; R: 2,952 - 2,972 4: PRhE - 1.15a+, V99+, 2.43a+, 6.04+, \2.07+, V99+, The ABC . It is the . ABC is a vof . alter . The the ABC X, the ABC at the top of #the &, hooking {16 and 1C. , as measured by the DOS , but 8,960 (. The copy of ed to by the ,SPEC en mental variable may the ABC , it xor alter . and . X. . are not sby the , but may be , adding 4 to 30 may be sby the , adding 2,952 to 2,972 the end of the a. . are not smay be , adding 4 to 30 . The in the DOS to the =and awas in the , but the in the "ABC_FFEA" "Minsk 8.01.92" "ABC" the ABC [keystrokes on the are frequently repeated, as well as ring of ABC are: ABC-2918: A of ABC, is 8,960 (, hooking {16, 1C, and 60. It adding 2,918 to 2,927 . The at the end of the a. The and in the DOS to the =and . Like the alters . , adding 4 to 16 The same in the are ABC-2918B: to ABC-2918, ABC-2918B is a very minor PZPAPN : Acid H: fail to R: 792 4: ONAK - \, IBM , NAV 2.1+, The Acid . Its . Acid is a ,and . the Acid xall of the . in the E. Later, if an X, it start tthe . in the the Acid mhad the (of the host the Acid be no qunless the was smaller (, in case it 792 . The =and in the DOS not be . The can be din all Acid too big to fit in "Acid "Legalize ACiD and Pot" "By: Copyfright Corp-$MZU" PZPAPN : Ada H: j; slow clicking speaker; Argentina R: 2,600 4: PRsCK - , VET, , NAV 2.1+, The Ada Gin Argentina in . Ada is a vof . The the Ada Ada as a low as measured by the DOS ?by 21,296 to 21,312 {08, 13, and nby the Ada is , it are X. If X, it of 2,600 at the be no 2in the =and in the DOS E. The can be "PCCILLIN. "PCCILLIN.IMG" "HATI-HATI !! ADA VIRUS DISINI !! [a slow clicking sound emitted fthe speaker. clicking occasionally 2in pitch. The receive a " Kfull" even Kthe to write to is not actually full. PZPAPN Adolf Hitler : Adolf Hitler Adolf H: R: 475 4: PR?CK - 6.00+, 2.43a+, \2.07+, V100+, V100+ The Adolf Hitler, or Adolf, Its d due to a s in the . It should not be confused the Adolph is no relationship between the two es. Adolf Hitler is a vof . bAdolf Hitler in a "hole" in low , hooking |21. , as rby the DOS not be the Adolf Hitler , it qof 475 at the end of the a. The in the DOS to the =and . The in the 4in all Adolf Hitler "Adolf Hitler" PZPAPN Adolph : Adolph H: May, R: 2,109 - 2,445 4: PNCK - \, NAV, , VET, The Adolph Vin May, . Adolph is a vof . +. Adolph is a of V2P6. Adolph is X, the search the Efor an x. If an d, it Adolph by 2,109 to 2,445 at the end of the It is if Adolph See: V2P6 PZPAPN African 109 : African 109 H: Republic of South Africa R: 109 4: PNCK - ., NAV 2.1+, , VET, The African 109 in the Republic of South Africa by Oliver Steudler and Peter Stoffberg of the Resource Centre. African 109 is a vof . African 109 is X, the African 109 xall `in the E. If +happens to be in sas well. African 109 of 109 (. The at the !of the a. The =and in the DOS to the =and . One can be din the African 109 Nn't do PZPAPN Agena : Agena H: Spain R: 723 - 738 4: PRhAK - The Agena Gin Spain in . Agena is a vof . ,and . the Agena the Agena at the top of #the , as rby the DOS ?by 1,296 {20 and 21 nby Agena in the Agena , it qof 723 to 738 at the end of the a. The =and in the DOS . No in the It is what Agena may do PZPAPN : Ah Tuesday, David-1173 Research H: May, Kformat; Italy R: 1,173 4: PRhC - D: IBM , VET, NAV 2.1+, The Ah, or Tuesday, in May, . Ah is the V1024 , its is Italy. Ah is a very buggy Ah is X, Ah at the top of , but rby the DOS @by 1,216 {08 and 21 nby the Ah is , it over 1K by 1,173 hidden if Ah is =and in the DOS to be un if the was 12:00a, it now be blank. The at the [frequent Ah. frequently is very noticeable. The Ah on Tuesdays, at attempt to format the bfew tracks of the Ah can be easily identified as 8the "(C) David Grant Research PCVRF Disribuite ely!!! ...ah...John...Fuck You!" Ah is believe to created by the same person as several fItaly, pSmack and Enigma. David Grant and the PCVRF had nothing to do its creation. of Ah are: Ah-B: to the xan . . It 7the same as the See: Alfa V1024 PZPAPN : AIDS Hahaha, Taunt, VGA2CGA, Burger.Pascal H: 1989 R: N/A 4: ONA - ., NAV, , IBM The AIDS as the Hahaha referred to as the Taunt by IBM, is a generic . , it Ms the "Your computer now has AIDS", AIDS covering about half of the . The halted, and must be powered down and re %ed to restart it. Since s the b13,952 (of the execu , the `must be Ad and replaced clean copies in order to remove the . It is not possible to recover the portion of the Note: is NOT the Aids Info K/PC Cyborg Trojan. of AIDS are: AIDS B: Very to the AIDS 13,952 . Unlike the `, as well as +, and Nnot activate as the did. Instead, occasionally issue the "I/O U99, PC=2EFD aborted". AIDS- ~at several locations in the May, of the AIDS avoid detection by utilities. Among the to the less two sub Fories on the kmay X, as well as the video mode may be switched to 25 x 40 Black & White fcolor mode. May, See: Number One PZPAPN AIDS II : AIDS II Companion Endangered H: Creates . `; melody; R: 8,064 4: SNA - Spawning , NAV, , IBM , VET, Acorresponding . The AIDS II , or Companion , was ~for the . Unlike generic vs, the AIDS is the to employ what could be called a "corresponding atechnique" of target . ais never 0. The takes advantage of the DOS feature where if a exists in both . ,and . Wform, the . The AIDS II Nnot actually `, instead it stores a copy of the in a corresponding . tries to Yone of his . The . aand the . both mthe same base The method of uis as follows: X, since a corresponding . aexists, the . 8ing the X. The blocates an ain the Eand creates a corresponding (or companion) . always be 8,064 <of the u. The . ais not at all. creating the new . a, the plays a melody and Ms the "Your computer is Aids - Signed WOP & PGT of DutchCrack -" The AIDS II spawns to the . to be X, and the runs out problem. completion of the , control s to the AIDS II . The melody is played again "Getting used to me? Next , use a Condom Since the aremains un , CRC checking cannot detect having One way to manually remove the AIDS II is to check the for mboth an . Wand a . the . ahaving a of 8,064 (. The . `thus identified should be erased. The do not in the PZPAPN AirCop 00H R 0PTH : AirCop H: Washington, BSC; halt; Taiwan R: N/A 4: FR - Floppy , IBM \, NAV, , VET, : CleanUp, M K, or DOS SYS The AirCop Gin the State of Washington in the early us of however, traced back to Taiwan, and Taiwan is probably where it ated. AirCop is a v, and it x360K 5.25" floppy AirCop , the . The AirCop at the top of high . The @by 1,024 the AirCop . AirCop hooks AirCop is , any non-write protected accessed the AirCop . AirCop copy the 719 (Side 1, Cyl 39, 9 on a normal 360K 5.25" J) and replace the a copy of the . If a of a AirCop is viewed, it be missing almost all of the normally in a normal . The remaining "Non- just before the end of the The AirCop do one of two things on depending on how compatible the 's software and lware is . On most , the at random intervals: "Red State, Germ Offensive. AIRCOP." , the "present in the receiving a Stack Overflow Uand the "halted. In case, you must power off the in order to be able to AirCop Nnot AirCop can be removed bpowering off the and re %ing clean, write-protected DOS J. The DOS SYS 5should be used to replace the . Alternately, M Kcan be used cthe power-down and re of AirCop are: AirCop-B: in May, fthe , AirCop-B is of the AirCop . Like the , it wfloppy . The Stack Overflow Uand halt no longer . AirCop-B during the month of , and %ing sfloppy in a flashing, scrolling Mof the is Aircop" The proceed. AirCop-B has to avoid detection by utilities. Utilities can detect AirCop may not be able to detect PZPAPN Akuku : Akuku H: Unexpected Oaccesses R: 891 4: PNAK - 6.04+, \2.07+, V100+, V100+, See note The Akuku , and comes is a vof . and . Akuku is X, the xthree in the E. If three cannot be din the E, the search the Eof the O, as well as the C: O. Both . ,and . s, as well as smaller not be by 891 to 907 (, the at the end of the The =and in the not be the The in the 4, and can be din all "A kuku, Nastepny komornik !!!" fail to the Akuku Man " and terminate Ythem. of Akuku are: Akuku-3: gequivalent to the Akuku has three differ. It switch to the C: all the candi `on the Columbus: on the Akuku , Columbus is an of the . It xone . in the +. Columbus qof 512 at the end of the a. On 12th, of an in the "repeatedly Lon the monitor while the reads the entire "Columbus Raped America. Now I Rape your The is not `as it is in the 4. The in the ,Berlin, Md" "NOT!! The procedure is a bit off. Hehe" : Maryland, Cop-Mpl: Cop-Mpl is a of the Akuku . It xthree . ,or . X. If the not find three xon the O, it search and in the C: structure. Cop-Mpl qof 1,113 to 1,128 at the end of the a. The can be in the "Sorry, I'm copmpletly dead." Cop-Mpl may [very long loads, or Ohas unexpectedly to the C: Metal Thunder: Metal Thunder was May, fItaly. by 892 to 908 Unlike the , Metal Thunder in the X. The "(c) by Metal Thunder IVRL MI" the Metal Thunder [frequent : Italy May, Wilbur: on the Akuku , Wilbur is an the . It xone . in the +. Wilbur qof 512 at the end of the Wilbur mthe "Wilbur sez Hi!" The is not `as it is May, Wilbur-B: on the Wilbur very minor . The in the "Wilbur sez Hi!" : Berlin, Maryland 7Apr92" : Maryland, Wilbur-C: on the Wilbur to avoid detection. The in the "Wilbur sez Hi!" : Berlin, Maryland 7Apr92" : Maryland, Wilbur 2: on the Wilbur-C of Wilbur adds 512 (to the . are two distinct s of the may be fa Wilbur 2 sample. The Mthe "Wilbur sez Hi!" The second Mone of the "I am not an Animal. I am a Human "I am not an Animal. I am Wilbur!" "I am not Akuku. I am a Human "I am not Akuku. I am Wilbur!" The in the "I am not" "I am" "Wilbur sez Hi!" "Akuku." "an Animal." "Wilbur!" "a Human : Maryland, Wilbur 3: on the Wilbur 2 in the Spring of any year, primarily during the month of . In Zof an may in the repeatedly, scrolling down the , while the accesses the "Wilbur sez: Formatting your K. Please stand by." The Nn't actually format the the sample tested. The is not as it is : Maryland, Note: s of all products certified as of detect the base Akuku do not, however, detect the a majority of the PZPAPN Alabama : Alabama Endangered H: , 1989 (see ; FAT Israel R: 1,560 4: PRfET - \, IBM , NAV, , VET, : CleanUp, \, or The Alabama ~at Hebrew University in Israel by Ysrael Radai in , 1989. Its was on 13, 1989. The Alabama increasing by 1,560 (. It however, it Nn't use the normal TSR function. Instead, hooks {09 and 21 in a CTL-ALT-DEL combination is detected, the causes an apparent %, but remains in RAM. The loads 30K under the highest location reported by DOS, and Nnot lower the amount of reported by the BIOS or by DOS. for one hour, the in a flashing box: "SOFTWARE COPIES PROHIBITED BY INTERNATIONAL LAW Box 1055 Tuscambia ALABAMA USA." The Alabama uses a complex mechanism to determine whether or not to xthe b, it checks to see if ain the E, if is one it wit. are no `in the Eis the s. However, s instead of tthe candi a, it instead manipulate the FATs to ex 2the candi out renaming it, so the ends up thinking he is executing one in effect he is actually executing an one. The end are slowly lost on aswapping the on ANY Friday. PZPAPN Alameda : Alameda Mazatlan, Merritt, Peking, Seoul, Yale H: 1987 Floppy %failures; -TOM; BSC California, R: N/A 4: RtF - Floppy \, IBM , NAV, , VET, K, CleanUp, \, NAV, or DOS SYS The Alameda Gat Merritt college in Alameda, California in 1987. The caused no intentional damage, is now at least one now causes floppy Ks to %able a counter has r Qed its limit (Alameda-C The Alameda , and its , all a CTL-ALT-DEL and 5-1/4" 360K es do stay in through a warm re %, and xboth and non- Ks. can be son a warm %even if BASIC is loaded instead of DOS. The saves the real at track 39, 8, head 0. The of the Alameda would run on a 8086/8088 machine, later s can now run on 80286 of Alameda are: Alameda 1.2M: ~in the of Alameda is able to x1.2M 5.25 inch Iin addition to 360K 5.25 inch I. The hang computers using an 8088 processor , allocating 1,024 at the top of #the |12's moved. It Iin the A: performs a CTL-ALT-DEL key combination. Golden Gate: The Alameda a modification so the counter in the has determined it has s500 I. Upon the C: Ois formatted. The counter in the is reset on Qnew : California, 1988 Golden Gate-B: Same as Golden Gate, except the counter has f500 to 30 us before and Iare Golden Gate-C: Same as Golden Gate-B, except can the Mazatlan , and is the most dangerous of the Alameda : A modified of the Alameda the counter in the has determined it has s100 I. Upon , the Jin the floppy Ois reformatted. The SF w5-1/4" : California, >, 1987 PZPAPN Albania : Albania Albania-429, Albania-506, Albania-575, Albania-606 H: failure; R: 429 - 606 (, depending on present 4: PNCK - , VET, NAV 2.1+, Albania is actually a ]of four were '. All of are vs of . general behavior is specific ylisted under one of the Albania es is the Albania xone . in the E. If it may s. The qfor Albania depends on the Albania present, but the always be at the end of the . The =and in the DOS to the =and The can be din all regardless of the present: "PATH=" It is if Albania of Albania are: Albania-429: The smallest of the Albania adds 429 (to the . 8the "ALBANIA" in addition to the Albania-506: Albania-506 adds 506 (to the . w. Like Albania-429, the "ALBANIA" can be din all addition to the Albania-575: Albania-575 adds 575 (to the . w. In addition to the for all members of ], the "albania" the Albania-575 may notice fail to , or random may be kmay Albania-606: Albania-606 adds 606 (to the . w. Unlike members of ], it Nnot always X. It 7the "albania" in addition to the PZPAPN Albanian : Albanian H: May, R: 1,991 4: PRhAK - 1.15a+, 6.00+, 2.43a+, \2.07+, The Albanian in May, . Its . Albanian is a vof . ,and . the Albanian the Albanian at the top of #the &. It Nnot move |12's measured by the DOS ?by 2,000 {08, 17, and 21 nby Albanian in , the +if it was not the Albanian , it for any reason. qof 1,991 at the end of the a. The =and in the DOS to 12/17/89 7:21p. The can be in the "C:\ It is what Albanian PZPAPN Alex-368 : Alex-368 H: R: 368 4: PNC - V99+, 2.43a+, 6.04+, \2.07+, V99+, The Alex-368 . It is fthe . Alex-368 is a of . , but not the Alex-368 xall . larger in the qof 368 the end of the a. The =and in the DOS to the and . The can be in the 4in all Alex-368 "The One Night (c) Alex Hacker" PZPAPN Alexander : Alexander H: Romania R: 1,951 - 1,965 4: PRhAK - 1.15a+, VET, 6.04+, \2.07+, The Alexander . It fRomania. Alexander is a vof . and . The the Alexander X, the Alexander at the top of #the , as rby the DOS ?by 3,088 {08, 21 and 27 nby Alexander in the Alexander , it and . copied, or for any reason. by 1,951 by 1,951 to 1,965 (. In both cases the at the end of the a. The in the DOS not be . The in the 4in all "ALEX0302" The in the , and hence not "Apa depistata in microprocesor Functionarea poate fi compromisa Se recomanda oprirea calculatorului citeva ore pentru uscare" "Alexander" "Constanata" "Romania" It is what Alexander See: CB-1530 PZPAPN : Alfa H: (for R: Varies (see 4: PRhAK - , VET, , IBM The Alfa is actually two closely related similiar characteristics. The two es, Alfa-1150 and Alfa-1202, Btogether differences ed out under the " " section. Both es were , and The an Alfa X, it at the top of #the &. Depending on is present, , as determined by the DOS @by either 1,280 or 1,344 nby the at the top of , as well as nin graphic card an Alfa , it and . small . `. The qs are given Qof the es. In the case of both es, the at the end of the be no 2to the =and in a DOS in the It is if Alfa of Alfa are: Alfa-1150: Alfa-1150, or Yankee Doodle-1150, is the earlier of the Alfa . It adds 1,150 to 1,165 `. . sby the , adding an 1,152 1,280 Alfa-1202: Alfa-1202, or Yankee Doodle-1202, is the later of the Alfa . Unlike Alfa-1150, it not re `. It adds 1,202 to 1,217 is 1,344 Alfa-1712: Alfa-1712 is an of the Alfa at the top of but #the &, not moving |12's by 3,008 (, and , it ,and . X, adding 1,712 to 1,731 The at the end of the a. The =and in the DOS 0to 14-25-12 12:01a. Alfa-Tired: The Alfa-Tired, or Tired, is an of the Alfa . It at the top #the &, not moving |12's ?by 3,760 (, and , it X, adding 1,748 to 1,766 . The the end of the a. The =and in the DOS not be Rust: The Rust . It , as rby the DOS ?by 2,048 (, and nby the be used by the , but not be mapped by most mapping utilities. , Rust X, adding 1,710 to 1,725 (to the . The at the end of the a. The =and in the DOS not be . Rust plays a three note melody Ys a See: Ah Damage Gremlin Lucifer Newcom V651 V1024 PZPAPN All Sys 9 : All Sys 9 H: j; TSR; "Abort, Retry, Ignore ?" %s; unexpected beeps on speaker R: 1,838 - 2,088 4: PRsAK - The All Sys 9, or IOU, . Its . All Sys 9 is a vof . ,and . The the All Sys 9 as a low TSR of 2,576 (. It , All Sys 9 ,and . qof 1,838 to 1,863 at the !of the qof 2,080 to 2,088 at the end of the a. . may be re sby the , adding an 2,080 u. The in the DOS not be . The can be in the 4in all All Sys 9 "All 9 - (c) , Jerry C." "Parity Uat address 14344" "Abort, Retry, Ignore ?" All Sys 9 may [the "Abort, Retry, Ignore ?" pressing any key on the in a %. Beeping be emitted fthe speaker. PZPAPN Ambulance Car : Ambulance Car Ambulance, RedX H: j; graphic M& sound West Germany R: 796 4: PNCK - \, NAV, IBM , VET, : NAV, or The Ambulance Car ~in West Germany in is a the Ambulance Car the attempt to xone . a. The . ato be on the C: one . ain any E, and never the ain the E. It avoids ais normally the ain the root On a random basis, the effect of a graphics Mof an ASCII block drawing of an ambulance moving across the bottom of the graphics be accompanied the sound of a siren played on the 's speaker. Both of effects a graphics capable Madapter. of Ambulance Car are: Ambulance Car-B: to the Ambulance Car, xzero, one, or two . (s) on the qof 796 the end of the are seven differ between and the RedX-Any listed RedX-Any: on the Ambulance Car, the Ambulance Car graphic its accompaning siren X. It wone . on the path and may See: Hafenstrass 2 PZPAPN Amstrad : Amstrad H: , 1989 Portugal R: 847 4: ONCK - \, IBM , NAV, , VET, \, or The Amstrad breported in , 1989, by Jean Luz of Portugal; however, it has of in Spain and Portugal for a year prior to . The is a generic . v, but is not . It +. It is the Pixel Amstrad is X, the Amstrad xthree . in the `not by the The carries a fake advertisement for the Amstrad computer: "=!= Buy AMSTRAD it is THE CHEAPEST ,PUTER you can buy" The Amstrad Nn't do of Amstrad are: Amstrad-End Is Near: The Amstrad-End Is Near is very to the Amstrad . The major difference "=!= THE END IS NEAR!! THE SIGNS OF THE BEAST ARE EVERYWHERE" The ain the by 847 it is qas the part of the host Amstrad-Luz: The Amstrad-Luz is very to the Amstrad . The "=!= Hello, John Mcafee,please uprade me. Bests regards,Jean Luz" : Portugal , 1989 See: Hell Pixel Silly Silly-365 PZPAPN Andre : Andre Andre-0, Andryushka H: R: 3,568 - 3,648 4: PRhA - 2.43a+, The Andre, or Andryushka, . It fthe . Andre is a of . ,and . . It Nnot is a polymorphic , and a simple search for detection is not possible. bAndre at the top of but #the &. It Nnot move |12's , as the DOS ?by 8,192 (. It Fly hooks {, and mapping utilities show {mapped to the the Andre , it , or a DOS DIR or Copy 5is issued. It Nnot xvery small . `, nor . `larger 64K. `in structure. qof 3,568 to 3,648 at the end of the a. The =and the DOS not be . The in the 4, and are not "Hello!!!" "My is Andryushka" "I come fPerm, Symptom's of an Andre uare DOS DIR 5s may be very sluggish due to the a DIR is issued. alter the of Andre are: Andre-3568: A minor of the Andre , Andre-3568 adds 3,568 - 3,668 (to the . ,and . w. Its is 7,632 7the same as the PZPAPN Angarsk : Angarsk H: R: 238 4: PNCK - 6.00+, 2.43a+, \2.07+, V100+, V100+ The Angarsk . It is fthe . Angarsk is a of . the Angarsk X, the Angarsk xall of the . in the qof 238 at the end of the a. The =and in the DOS to the =and . One can be in the 4in Angarsk Angarsk Nn't to do PZPAPN Animus : Animus Animus-7360, Cookie-7360 H: j; switches `and unexpected accesses to the C: T; TSR; R: 7,360 4: PRsAK - D: IBM , NAV 2.1+, The Animus, Animus-7360, or Cookie-7360 . Its . Animus is a vof . ,and . . Advanced us may The the Animus X, the Animus a low TSR, hooking {22 and 24. @by as much as 70K. the xtwo . in the the Animus , it xtwo . qof 7,360 at the !of the a. The =and in the DOS 9-13-91 10:30a. The can be din all Animus "Animus.id" "com "Animus.exe" Animus is a malicious . As the uof Animus progresses, the switch various s so the Eindicates is the no longer matches the contents of the process both execu and data `. As a , the may not to run, and unpredica . Animus Nnot avoid switching an +, so unexpected warm re %s or shelling of the interpretor may . The switching of the . Wextension possibly s, and all must be tested to determine if 8the are dis s, the actual contents of the `must be determined and re d to proper of Animus are: Animus-7392: Animus-7392 is a later of the Animus It adds 7,392 (to the . =and the DOS 9-13-91 10:31a. Instead of switching start all of the . in the by 7,392 at the !of the all of the the s, it start on the C: PZPAPN : Anna H: Manchester, England R: 742 4: PNCK - V99+, 6.04+, \2.07+, 2.45+, The Anna fManchester, England in . Anna is a vof . the Anna X, the Anna xone . in the qof 742 the at the end of the a. The and in the DOS the =and . The in the "[ANNA] Slartibartfast, ARCV NuKE the French" ma Cool Yule fthe ARcV" "xCept Anna Jones" "I hope you get run over by a Reindeer" "Santas bringin' you a Bomb" "All my Lurve - SlarTiBarTfAsT" "(c) ARcV - England Raining Again" "\ *. *.com" It is what Anna PZPAPN : Ant H: has seconds set to 62 R: 770 4: PNC - 1.15a+, 6.00+, .1.4+, 25.10+, 1.53S+ The Ant . Its . Ant is a vof . , but not +. It is roughly on the the Ant X, Ant xone in the Ant qof 770 at the !of the a. The in the DOS mhad the seconds field set to 62, the umarker. No in the 4in Ant Ant of any year. At , the Mthe and attempt to "MIT Sux!" PZPAPN Anthrax : Anthrax H: R: 1040 - 1279 4: PRAKX - W, & , IBM \, NAV, , VET, : See The Anthrax in the it was uploaded onto several BBSs in a Trojan USCAN.ZIP. It is the second to be din a copy of U during , the "V2100. Anthrax is a generic vof . ,and . The the Anthrax on the K, the xthe ). At , the is not . It write a copy of on the last few of the K. If data existed on those last few of the K, it be destroyed. fthe K, the Anthrax . It remain until the X. At , it xone . ,or . Nnot `in the b, but instead starts to `at the lowest level of the Etree. Later, X, Anthrax ,or . a, searching the Estructure fthe lowest level of the Etree. If the on the floppy O, a . ,or . amay or may not be The Anthrax 4is 1,024 (long, but by 1,040 to 1,279 (. On the author's test , the largest [d was 1,232 always is a multiple of 16. The can be Anthrax "(c)Damage, Inc." "ANTHRAX" A third s in the 4, but it is in the Cyrillic alphabet. Per Vesselin Bontchev, third translates to: "Sofia Since Anthrax wthe must mthe sor rebuilt in order to remove the ucan be done either a low-level format or use of the M for the correct DOS powering off and re %ing write-protected Jfor the . Any . ,or . Anthrax must be dis sor erased. Since a copy of the exist on the last few of the must Anthrax interacts : V2100. If a Anthrax should V2100 , the V2100 check the last few of the Kfor the spare copy of Anthrax. If the spare copy is Anthrax be copied to the It is not if Anthrax carries any destructive capabilities or trigger/ PZPAPN Antimon : Antimon H: R: 1,452 - 1,465 4: PNCK - IBM , Nav 2.1+, 1.53S+ The Antimon . Its . Antimon is a Antimon is X, the Antimon xall in the C: Oroot E. Since +normally resides in E, it sas well. Antimon by 1,452 to 1,465 The at the end of all be no 2in the =and in a DOS The in the Antimon "*.com" "FLUSHOT3. "C:\PANDA\MONITOR. ,TSRMON. ,TSRMONEZ. "= C:\PDPROG" It is what Antimon See: 1452 PZPAPN Anti-D : Anti-D Xuxa-945 H: March, j; TSR; interfers Argentina R: 945 4: PRsC - , VET, o, NAV 2.1+, 1.53S+ The Anti-D, or Xuxa-945, in March, . It is fArgentina. Anti-D is a vof . but it Nnot The the Anti-D X, Anti-D as a low TSR of 1,264 (. It hook 21, and F8. the Anti-D , it qof 945 at the !of the a. The =and in the DOS not be . Two can be din the ,MAND "$$TMP. Anti-D interfers the usage of the "D" key on the , hence the of Anti-D are: Anti-D B: to the Anti-D is a very minor : Argentina See: Xuxa PZPAPN , AP, AP-605, C-605, V605 Research H: j; .BAK and .PAS Sofia, R: 605 4: PNCK - , NAV, ., IBM , VET, : NAV, or The , V605 or C-605, was ~in Sofia, by Vesselin Bontchev. , it was fthe or Poland, but it has since determined to a research written 'over one year before it was ~. The author was not aware it had "escaped" until The is a generic . +. While is not it is in the process of X, the attempt to xtwo `on the Oor on are between 605 and 64,930 `must not mthe read- attribute set. If ameeting the 's selection criteria is d, the b605 (of the 4. The (of the appended to the end of the by 605 (, and begin "PQVWS" as well as 8the "combakpas???exe" at offset 0x17. mhad stamps in the to the If the cannot find two . x, it check the Oand Efor .BAK and .PAS `exist, 4. If the `were .PAS `, the has now lost Pascal source .BAK and .PAS `, the attempt to re them to . `, or . `if a . aalready exists. renaming Nnot work due to a bug in the AP-529: to the 605 , the major differences are AP-529 `over 2,048 529 ly, instead of the .BAK and .PAS `, one .BAK and .PAS Ad if are no of at least 2,048 (on the O. . `on the C: Oroot Emay sby AP-529 fthe A: or B: should be considered a "Research ", as it is not believed to publicly released. See: PZPAPN 400, AP-400 Research H: j; .BAK, .BAT and .PAS adeletion; alteration on Sofia, R: 400 4: PNCK - , NAV, \, IBM , VET, The , or AP-400, was ~in Sofia, by Vesselin Bontchev. It is one of five es or in the ]. Two of the earlier (AP-605) and AP-529, are documented under the ". The listed under separated due to characteristics differing 605 )and 529 The is a generic . +. While is not it is in the process of The Xon a , the attempt to xone . ain the root Oaccessible on the `are is at least 2,048 (, and the be less 64K in . Since +is usually the aon a O, it immediately s. One son the O. The mechanism used to ais to write the 4to the end of the a. A jump is used to Ythe 4before the `do not <stamps in the to the =and If the cannot find a . xon a given O, or two . xon the O, it check for the existence of .BAK, .PAS, or .BAT `. If Ad. deletions root Fories and on the Since Qroot E(as well as the typically not mall of its . sat the same the deletions on different Os and Fories at different uof the include qs of 400 (, unexpected Kaccess to O, and dis ing .BAK, .PAS, and .BAT `. One symptom of an be slightly by the CRC-check the indicate umay . The alteration Nnot 8a live , but throw the off into thinking problem is instead of a v, and if the Kwas a %able K, it now be un %able. The and its #are not believed to publicly released. As such, classified as "Research II are: AP-440: Very to the 400 of the , the major characteristic has a of 440 (. The is no longer by the is an intermediary between AP-480 and the 400 documented AP-440B: on AP-440, 's major difference is xtwo . in the E, and one in the Qof the accessible on the AP-480: to the is the is 480 . It Nnot .BAT `, but .BAK and .PAS. is the latest of the II grouping. AP-480B: on AP-480, 's major difference is xtwo in the E, and one in the Eof all Os accessible on the See: PZPAPN Anti-Tel : Anti-Tel Telecom H: BSC; slowdown Spain R: N/A 4: BRtX - \, IBM NAV, , VET, \, or M- K/P on DOS SYS on %able The Anti-Tel . It is fSpain. Anti-Tel is a vof the ) and . It is extremely destructive Anti-Tel, the at the top of , but #the &. The DOS indicate is 1,024 (less is expected. |12's moved. Anti-Tel is , it xthe I, as well as the ais accessed on the On high density 1.2MB 5.25" I, the 28. The Anti-Tel 0, and continued in 27. Since 27 and 28 are the last two of the root `may be lost portion of the root On double density 360K 5.25" I, the 11. The Anti-Tel 0, and continued in 10. Since 10 and 11 are the last two of the root `may be lost portion of the root Ks, Anti-Tel wthe at Side 0, Cylinder 0, 1. The is continued in the at Side 0, Cylinder 0, 6. The at Side 0, Cylinder 0, Data be lost on the Kimmediately upon if the Khad initialized or formatted placed data in are normally not used by DOS. Anti-Tel is a , it actively to prevent "able to detect it if the . However, is a bug in 4, and it is unsuccessful on I. Anti-Tel hide the %secotr u, so if the utilities not be able to detect Anti-Tel on the is very destructive %s. On the 400th %, it Mthe btwo random data: "VIRUS ANTITELEFONICA (BARCELONA)" II are: Telecom %: Telecom %is the us of the Telecom . Telecom %is very to Anti-Tel, the major difference Nnot like Anti-Tel. Since of Anti- Tel always Telecom us, it is suggested be powered off and re a clean write-protected Kand checked for the Telecom See: Telecom PZPAPN : Anto H: %failure; Divide overflow R: 129 4: PNCK - , VET, NAV 2.1+, The Anto . Its , or , are . Anto is a vof . the Anto X, the Anto xall . in the E, it cannot recognize sby the , so be re the Anto qof 129 uof the Anto present on the host a. The at the the a, and in the case of re dat the end of the a. The =and in the DOS to the =and the last the Anto may notice frequent kor "Divide overflow" scopy of in a hang "Cannot start ,MAND, exiting". PZPAPN Aragon : Aragon H: BSC; R: N/A 4: BRtX - : DOS SYS on I; M- K/P on The Aragon . Its . Aragon is a wthe ) and the I. It cannot be detected on the The fan Aragon J, the Aragon at the top of #the &, moving |12's rby the DOS ?by 1,024 , the Aragon xthe if it was not s. The moved to side 0, cylinder the Aragon , it an unwrite-protected Jis accessed for any reason. In the case of 360K 5.25" I, the moved to Aragon is a . It Fany to read the stored by the be shown instead. As such, no 2in the , or the , cannot be detected on the the PZPAPN Aragorn : Aragorn H: March, 1993 j; write protect Italy R: 1,522 - 1,537 4: PNAK - V102+, V102+ The Aragorn in March, 1993, and is fItaly. Aragorn is a ,and . +. It Ms an Ansi graphics on its 28th of any year. the Aragorn xone . aand one . the E. Due to a bug in the Aragorn wthe ain the E, it in the same bug the Aragorn qof 1,522 to 1,537 the end of the a. The =and in the DOS not be . The are in the 4in all Aragorn "(C) Aragorn-Rome" "*.com *.exe" The last s at the very end of The Aragorn 28th of any year, at in Ansi . The r{color bar} is a representation of the Italian flag: "MUSSOLINI 28 OTTOBRE ANNIVERSARIO MARCIA SU ROMA { color bar } BOIA CHI MOLLA" The is not PZPAPN ARCV 330 : ARCV 330 H: , 1993 England R: 330 4: PNCK - V100+, V100+ The ARCV 330, or 330, , 1993. It is fEngland. ARCV 330 is a vof . the ARCV 330 X, the ARCV 300 xone . in the E. If E, it may the ARCV 330 qof 330 the end of the a. The =and in the DOS to the and . The near the end of all the ARCV 330 "aRcv" The ARCV 330 in the month of of any year. During , the Mthe and hang the "[330] by ICE-9" in the 4, as is the "*.com" PZPAPN ARCV Friends : ARCV Friends H: England R: 839 4: PNCK - 6.04+, \2.07+, V100+, V100+ The ARCV Friends England. ARCV Friends is a vof . +. It is not related to the Friends the ARCV Friends xone . in the 839 at the end of the a. The =and in the DOS to the =and The ARCV Friends 12th of any year, ing in the Mof the on the monitor: [FRIENDS] ICE-9 (c) ICE-9 released 5th ARcV Productions. Dedicated to all my friends" The in the , and is not . The in the PZPAPN ARCV Xmas : ARCV Xmas H: March, 1993 England R: 670 4: PNCK - 6.04+ The ARCV Xmas in March, 1993, and is fEngland. ARCV Xmas is a of . +. It Ms a during the Christmas season. the ARCV Xmas xone . in the Nnot smaller qof 670 at the end of the a. The =and in the DOS . The in the ARCV Xmas 4in all "Happy Xmas fThe ARCV." "*.com *.*" >20th through >25th in years , the ARCV Xmas Mthe "Happy Xmas fThe ARCV." PZPAPN ARCV-n : ARCV-n ARCV-4 H: Manchester, England R: 664 4: PNAK - 6.04+, \2.07+, V100+, V100+ The ARCV-n series of es were fEngland in and es are vs of . and/or . `, and +. The ARCV-4 members of the series included #under " members". The three earliest members, ARCV-1, ARCV-2, and ARCV-3, generated PS-MPC. The ARCV-4 fManchester, England. ARCV-4 is a vof . ,and . the ARCV-4 xthree in the preference given to . over . qof 664 at the end of the a. The in the DOS not be . The can be in the 4in all ARCV-4 "[ARCV-4] Apache Warrior, ARCV Pres." "*.exe *.com" "So Who`s the Best "Oh Well Sorry But The ARCV Are The Best!" "Well Your in Favor It is what ARCV-4 members of the ARCV-n series of es are: ARCV-1: , ARCV-1 is an 826 vof . ,and . , but not +. It wone in the preference given to . qof 826 at the end of the The =and in the DOS not be . The "Long Live The ARCV. MUFC for the League!" "(c) Apache Warrior, ARCV Pres. 92" "Welcome to the REAL World. And the ARCV 1 "[ARCV-1] Apache Warrior, ARCV Pres." "*.exe *.com" : Manchester, England ARCV-2: , ARCV-2 is an 692 vof . . It wone in the qof 692 at the end of the a. The =and in the DOS not be . The "*.exe .. [ARCV-2] Apache Warrior, ARCV. Pres." "Help.. Help.. I`Sinking : Manchester, England ARCV-3: , ARCV-3 is an 657 vof . +. It wfour in the qof 657 at the end of the The =and in the DOS not be . The "[ARCV-3] Apache Warrior." "Yo.." "I`ve Just .. Opps.. Sorry I`m the "Well let me introduce myself.." "I am ARCV-3 , by Apache Warrior." "Long Live The ARCV and Whats an lECU?" "Vote Yes to the Best Vote ARCV.." "*.com .." : Manchester, England ARCV-5: , ARCV-5 is an 475 vof . +. It wone . in the qof 475 at the end of the The =and in the DOS not be . The "[ARCV-5] Apache Warrior, ARCV Pres" "SU*. : England ARCV-6: , ARCV-6 is an 335 vof . +. It wone . in the qof 335 at the end of the The =and in the DOS not be . The "[ARCV-6] Apache *.com" : England ARCV-7: , ARCV-7 is an 541 vof . . It wone . in the qof 541 at the end of the a. The =and in the DOS not be . The "[ARCV-7] Apache ARCV. *.exe" : England ARCV-8: , ARCV-8 is an 679 vof . . It wone . in the qof 679 at the end of the a. The =and in the DOS not be . The "Naughty, Naughty... ARCV Productions Ltd." "[ARCV-8] *.exe" : England ARCV-9: , ARCV-9 is an 745 vof . X, ARCV-9 at the top of , hooking |21. rby the DOS 2,048 ARCV-9 is , it qof 745 at the end of the The be hidden . The =and in the DOS not be . The "[ARCV-9] Apache Warrior. *.com" : England ARCV-10: , 1993, ARCV-10 is an 827 vof . ,and . ARCV-10 at the top of , hooking |21. , as rby the DOS ?by 1,648 ARCV-10 , it ,and . for any reason. qof 827 the at the end of the a. The not be hidden. The in the DOS not be The "[ARCV-10]" "Apache Warrior" "Well its finally here The -= ARCV =-" "Welcome To our New Members The last two may be Las a the . Write protect and the fa write-protected : England , 1993. See: PS-MPC PZPAPN : Arf Rigor Mortis, Thor H: March, Canada R: 1,000 4: PNCK - , IBM \, NAV, , VET, The Arf, Thor, or Rigor Mortis in March, fthe . Arf is a written by RABID, in Canada. is a vof . +. Arf is on the and may identify it as Arf is X, the check to see if +has s. If it is not s, the xit and Mthe "Rigor Mortis !!! I am Hi.pas" checking (and possibly +, the search the Efor one . x. If an d, it "Arf krad krad krad krad krad kr" The proceed to check the B: Ofor a the Arf of 1,000 (. The at the end of the . The can be in the The Arf may not be in the public domain, the sample is not a natural uof the . Its is due to the "Arf" s. Its of Thor is because it is believed to written by a group calling Thor. Note: the sample of was on an . a, and is not a natural may be a research and not in the public domain. of Arf are: Arf-B: Arf-B was in May, . It is fthe United States. s to be an earlier of the Arf Arf-B is X, it check the Efor an x. If an d, it xthe . The B: may be accessed. Whether or not a Mthe "Arf Arf Got you! -- RABID '90" qof 1,000 (, and =and in the not to the =and it has in the , and a hang: WC failure Cannot start ,MAND, exiting" Arf-B usually fail to function ing in a hang. PZPAPN Argentina : Argentina Argentina 1.0 H: j; TSR; Buenos Aires, Argentina R: 1,249 4: PRsC - ., IBM \, VET, , NAV 2.1+, The Argentina Gin Buenos Aires, Argentina, in . Argentina is a vof . . It Nnot The Argentina is X, the as a low TSR of 1,568 nby the Argentina is , it qof 1,249 at the !of the 2in the DOS The Argentina on four =s, at pertaining to the =s. are of patriotic significance in Argentina. The =s and are as follows: May 25th: "25 de Mayo Declaracion de la independencia Argentina Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Jun 20th: "20 de Junio Dia de la bandera Argentina Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Jul 9th: "9 de Julio Dia de la independencia Argentina Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Aug 17th: "17 de Agosto Aniversario de la defuncion del Gral. San Martin Argentina escrito por AfA - benigno - ENET 35 Pulse usa tecla para continuar" Hitting any key in the Xcontinuing. $the , one "Argentina 1.00" PZPAPN Argentina-102 : Argentina-102 H: & truncated to 102 Argentina R: 102 4: ONCK - The Argentina-102 fArgentina in is a v. It sby the Argentina-102 Athe in the and create a 102 The replacement 8pure 4. The =and in the DOS to the =and Two can be in the 4in all Argentina-102 "*.com" Argentina-102 Nn't do , corrupting the PZPAPN Armagedon : Armagedon Arma H: intermittently sent to ,ports s, Greece R: 1,079 4: PRsC - \, NAV, IBM , VET, \, or The Armagedon , by George Spiliotis of A s, Greece. Armagedon is a `, increasing by 1,079 The at the The Xon a , the as a low of 1,392 (, hooking {8 and 21. Any . are later Xare sby the [the "Armagedon the GREEK" "sent to ,ports 1 - 4 at d intervals. Between 5:00 and 7:00, the attempt to use the ,ports to make a phone call to Local yin Crete, Greece. If a connection is made, the phone line remain open until the notices the phone line is in use. (Needless to say, Nn't work if the outside of Greece as dialing 4s are considerably different between countries.) wise is not destructive. of Armagedon are: Armagedon #911: on the Armagedon adds 1,079 (to the . w. The phone number called by the has 0to "911", is the police and emergency services phone number implemented in much of the . The is sent to the ,ports has "Support Your Police". Armagedon-1077: to the Armagedon, adds 1,077 `. Its TSR is 1,392 , and hooks {8 and 21. ~: Greece, PZPAPN Arriba : Arriba 1590 H: R: 1,590 4: PRaA - 6.04+, \2.07+, V100+, 2.45+, V100+ The Arriba . Its , and the may actually written in Arriba is a vof . ,and . but not bArriba X, the Arriba at 9000, hooking {21 and 24. , as rby the DOS not be the Arriba , it qof 1,590 (. In the case of . the at the !of the a. In . , the at the end of the a. The =and in the DOS . No in the It is what Arriba PZPAPN : Ash H: R: 280 4: PNCK - , VET, 1.15a+, .1.4+, 3.93+, 25.10+, , NAV 2.1.4+, The Ash . Ash is a vof . Its the Ash X, the Ash xall of the . in the of 280 at the end of the a. The =and in the DOS to the =and . One in the Ash Ash Nn't do See: Green Joker PZPAPN Ashar : Ashar Shoe_ , UIUC BSC; R: N/A 4: BRt - \, IBM , NAV, , VET, K, CleanUp, \, NAV, or DOS SYS %able The Ashar is a of the Brain . It differs fthe Brain it can xboth floppies and K, and the in the modified to be: "VIRUS_SHOE RECORD, v9.0. Dedicated to the dynamic memories of millions of who are no longer today". However, the is never L. The identification "ashar" is normally dat offset 04a6 hex in the of Ashar are: Ashar-B: (Shoe_ modified so can no longer Os. The v9.0 in the has to v9.1. See: Brain PZPAPN ASP-472 : ASP-472 H: Eastern R: 472 4: PRfAK - ., IBM , NAV 2.1+, The ASP-472 . Its . ASP-472 is a vof . ,and . The ASP-472 is X, the ASP-472 , hooking |21. be no as measured by the DOS ASP-472 has , it for any reason. by 472 at the end of the a. The and in the DOS can be easily identified as end the three character "ASP". ASP-472 Nn't do PZPAPN Astra : Astra Astra-976 H: j; data `truncated; R: 976 4: PRhCK - 6.00+ The Astra, or Astra-976, . It is reported to be fthe . Astra is a of . bAstra X, the Astra at the top of #the |12's not be moved. , as rby the DOS ?by 1,056 nby Astra in the Astra , it X. If X, it the Astra qof 976 at the end of the a. The =and in the DOS not be . The in the Astra 4, and are not "(C) AsTrA, The "(2)" can be dnear the end of all Astra A symptom of an Astra data read/write intent may be truncated by slowly corrupting the 's data of Astra are: Astra-498: , Astra-498 is a 498 of the Astra w.SYS . It sdevice Or is loaded fthe CONFIG.SYS , it .SYS Eentry is accessed, by 498 - 513 uof the a, and 498 u. The at the end of the a. The =and in the DOS to the =and . The can be din all "I like a flower's smell!" "(C) AsTrA,JPN" "(5)" Astra-510: , Astra-510 is a 510 of the Astra and is to Astra-498. It adds 510 to 525 (to the .SYS u, and 510 u. It 7the "I like cold flavour!" "(C) AsTrA, ,JPN" "(5)" Astra-521: to Astra-498 and Astra-510, adds 521 to 536 (to the .SYS the u, and 521 7the "I like fragrant smell of flower!" "(C)AsTrA, "(5)" Astra-1010: , Astra-1010 is a 1,010 of the Astra . Its is 1,072 (, hooking It adds 1,010 (to the . The din the are present in . The "(2)" the end of the Astra 0to "(3)". Nnot truncate data PZPAPN AT144 : AT144 H: 8086/8088 processor R: 144 4: PRfbCK - 2.43a+, 6.00+, The AT144 . AT144 is vof . and function on AT class machines. On XT class machines, the simply hang the The AT144 is X, AT144 a portion of the residing in be no rby the DOS {91, 93, 94, 95, 97, 98, 9A, 9B, 9C, 9D, 9E, 9F, A0, A1, A2, A6, A7, A9, AA, AB, and AF nby the in low AT144 is , it X. If X, it by 144 at the end of the mhad =and in the DOS to the =and AT144 Nnot do An earlier " " of , but it not of AT144 are: AT108: to the AT144 in a "hole" in low , hooking 21. , it of 108 at the of the a. The =and in the DOS to the =and AT114: to the AT144 in a "hole" in low , hooking 21. , it ,and . qof 114 at the !of the a. The remainder of the hex "FF" 3. The in the DOS to the =and Frequent , as well as %failures AT118: to the AT144 in a "hole" in low , hooking 21. , it of 118 at the of the a. The =and in the DOS to the =and AT122: to the AT144 in a "hole" in low , hooking 21. , it of 122 at the of the a. The =and in the DOS to the =and AT140: to the AT144 in a "hole" in low , hooking 21. , it of 140 at the end of the a. The =and in the DOS to the AT149: to the AT144 adds 149 to the . PZPAPN : Atas Atas-384 H: Poland R: 384 4: PNCK - , VET, 6.00+, o, NAV 2.1.4+, 3.93+, 25.10+, V100+, V100+ The Atas . It is Poland. Atas is a vof . the Atas X, the Atas xone the E. The newly qof 384 at the end of the . The =and in the DOS to the =and The 8ed in the Atas are not ,Ok." "ATAS V0.1 Cr.24.01.92" advanced us of Atas may notice "Ok" X. The Mof "Ok" usually of the Atas Atas-400: , Atas-400 is a 400 of the Atas . It adds 400 (to the end of the . w. The =and in the DOS to the =and . The in the ,I like to travel..." "ATAS(Kiev) V3.03 Cr.91.10.11" : Poland See: Atas II PZPAPN Atas II : Atas II Atas-3321 H: , 1993 Poland R: 3,321 4: PRtCK - 6.04+ The Atas II, or Atas-3321, , 1993, and fPoland. Atas II is a +. It is a semi- it hides the bAtas II X, the Atas II at the top of but #the &, moving |12's , as rby the DOS ?by 10,240 {08, 10, 16, 1C, and 21 nby Atas II in the Atas II , it qof 3,321 be hidden . The at the end of `, and the =and in the DOS not be . The in the Atas II "bye < > music" "letters" MBye-Bye" =.===" "ATAS Corporation.(B) ,V1 Created in the Kiev by ATAS." the Atas II "detected on all by the DOS it is . It is what else Atas may do. See: Atas PZPAPN H: May, j; "General Failure Ureading s, Greece R: 1,463 4: PRfAK - , NAV 2.1+, 6.00+, 25.10+, The A Gin A s, Greece, in May, is a and . the A at the top of #the is not reserved. not be . If +was not s, it . No the A , it for any reason. qof 1,463 at the end of the a. The be hidden by the it is . The =and in the DOS not be The in the "TROJECTOR II,(c) Armagedon Utilities, A the A [general failure requiring an Abort, Retry, Ignore, or Fail response. It is Trojector: Probably an earlier of the A , Trojector's 3,776 (, hooking |21. It 1,561 not be Trojector is . The at the end of the The in the "TROJECTOR ]I[,(c) Armagedon Utilities, A "Greetings to Vesselin" Trojector may X, as well as the DOS indicating regardless of whether the : Greece PZPAPN Attack : Attack Attack-1501, Cuban H: j; TSR; "Not enough Cuba R: 1,501 4: PRsC - , VET, The Attack, or Attack-1501, fCuba. is a of . , but not an earlier of the is an The the Attack as a low TSR of 3,552 (. It hooks {13, 21, and the Attack , it xtwo . in the Eany Xor a DOS DIR 5is performed. the Attack typically 1,501 (. The exception is if the was smaller 1,173 (, the of 2,684 (. The =and in the DOS not be The can be din all Attack "The Terminator Attack Now" +ERROR IN DEBBUG" the Attack may notice no longer function ing in a "Not enough of Attack are: Attack-918: An earlier of the Attack zs a 1.2K TSR it is , it two . in the ever any Xor a DOS DIR is performed. mthe 918 (of the host by the Attack-918 , and must be replaced fclean, backups. : Cuba PZPAPN Attention! : Attention! 394, -394, 394 H: clicking emitted speaker on keypress; R: 394 4: PRhCK - \, NAV, , VET, IBM The Attention! and was ~in the is a vof . The the Attention! X, the reserve 416 (at the top of , but #the &. The area, and hooks |21. and ed by the DOS @by 416 (. The is not moved. , a clicking sound be emitted by the speaker a key is pressed on the , such as the EDLIN supplied MS-DOS, receive an "Invalid attempted to be Attention! are X. The exception is very small . by 394 at the end of the 8the : "ATTENTION !" near the !of the PZPAPN Iron Maiden H: j; unexpected access to C: Poland R: 636 4: PNCK - , IBM NAV 2.1+, , VET, The 16th, or Iron Maiden, 16th is a +. It is fPoland. 16th is X, the 16th check to see if the btwo . `in the s. If mn't s, the proceed to xthem. Next, the 16th check the C: to see if it 7two . mn't s, and xthose if d. The was proceed to 16th qof 636 at the end of the be no 2to the =and in the DOS Two can be in the 16th "*.com AA" "=!= IRON MAIDEN" It is what 16th 16th, 8destructive PZPAPN Aussie Dir : Aussie Dir Sdir H: , 1993 j; sluggish DOS Dir Melbourne, Australia R: 550 4: PRhCK - The Aussie Dir, or Sdir, fAustralia in March, 1993. It was Gin Melbourne, Australia in 1993. Aussie Dir was "Sdir", but was not used as it is the of a computer unconnected to . Aussie Dir is a vof . bAussie Dir at the top of #the &, hooking |21. , as rby the DOS ?by 608 |12's not be moved. the Aussie Dir , it in the ever a DOS DIR 550 at the end of the a. The =and in the DOS . The can be in the 4in all Aussie Dir "1 Did David Gerrold ma harley he was one?" "2 Is John Brunner a shocking wave rider?" "3 Is iam Gibson a neurotic romantic?" "4 Is Australian Parasite the Best?" "1:No, 2:Yes, 3: Probably, 4: Absolutley" "AP*. The "AP" can dstarting in the fourth of all is the umarker for the Aussie Dir 7destructive Oon the 29th day of a specific month, due to a bug in the not be PZPAPN Aussie Parasite : Aussie Parasite Australian Parasite H: , 1993 %failures; Melbourne, Australia R: 292 4: PRhCK - \2.07+, V102+, V102+ The Aussie Parasite, or Australian Parasite, in Melbourne Australia in 1993. Aussie Parasite is a vof . the Aussie Parasite the Aussie Parasite at the top of #the and , as rby the DOS ?by 320 Aussie Parasite in the Aussie Parasite , it qof 292 the at the end of the a. The and in the DOS not be . The in the 4in all "Australian Parasite" kfrequently , and the fail to %copy of of Aussie Parasite are: Dorn: on the Aussie Parasite Dorn is a 377 . Its is 448 hooking |21. Dorn adds 377 (to the . w, the at the end of the a. The in the 4in all "Kill Dorn W. Stickle" "(C) Australian Parasite" : Australia 1993. on the Aussie Parasite }is a 369 . Unlike Assie Parasite, it is vof . +. El wthe in the is executing, adding 369 (to the . El is unable to determine s, it many s. The El the on the top portion of the monitor Xin the evening: "Night of the Living pt: El Misstress of the Dark Assembler ming: Australian Parasite (Enough said) Loves to Tonya H and Dianna G" The in the . The : Australia 1993. Grue: on the Aussie Parasite Grue is a 338 . Its is 400 hooking |21. Grue adds 338 (to the . w, the at the end of the a. The in the 4in all "It is pitch black. You are likely to be eaten by a Grue." : Australia 1993. PZPAPN Australian : Australian Clipper H: j; TSR Australia R: 1,413 4: PRsA - , NAV, ., VET, IBM The Australian . It is fAustralia. Australian is a vof . and . . It Nnot +. It is on the 1720 bAustralian X, the as a low TSR of 1,392 nby the Australian is , it occasionally ,and . by 1,413 at the !of the by 1,413 to 1,425 at the end of the In both cases, be no 2to the =and in the Australian 8one in the "CLIPPER" It is if Australian PZPAPN Australian 403 : Australian 403 403, Zeroto-O H: ; TSR; `do not function Australia R: 403 4: PRsCK - , IBM NAV, , VET, The Australian 403 by Colin Keeble of Australia. is a The the Australian 403 X, the as a low TSR of 720 (. The hook , the replace two . in the a copy of the any X. The replaced of 403 (, and =and in the to the =and . Needless to say, the replaced since 8the Nnot do of Australian 403 are: Zeroto-0: to Australian 403, has 10 differ fthe g, its TSR is 736 (, hooking Zeroto-0 is , it X. As the replaced a 403 =and to the =and PZPAPN Australian : Australian Australian H: , 1993 Australia R: 153 4: PNCK - V102+, V102+ The Australian , or Australian -153, , 1993 cits Hin Australia in the same month. Australian , and its listed #, are non- the Australian the Australian xone . in the E. A hang may the Australian qof 153 at the !of the a. The =and in the DOS not be . The can be viewed in the 4in all Australian adding an (to the of Australian Australian -142: A 142 of the Australian : Australia , 1993. Australian -142B: to Australian -142, has a few differ. : Australia , 1993. Australian -143: A 143 of the Australian : Australia , 1993. Australian -147: A 147 of the Australian : Australia , 1993. Australian -150: A 150 of the Australian : Australia , 1993. Australian -162: A 162 of the Australian . The "AP" can be `starting in the 4th )of the : Australia , 1993. PZPAPN Azusa : Azusa Hong Kong H: BSR; LPT1 & ,1 ports may be disabled Hong Kong R: N/A 4: BRtX - \, NAV, IBM , VET, : CleanUp, M- K/P, F K/MBR on DOS 5 The Azusa . Its is believed to be Hong Kong. is a and the The the Azusa , the at the top of , but #the &. The moves the report 1,024 (less zed on the . At , the xthe the a copy of the Azusa . A copy of the is not stored by the Azusa is , it are accessed on the write intent (i.e., a as output, or read/write intent) or to re the Jvia CTL-ALT-DEL. Iare by copying the to track 40 and writing a copy of to the . On 360K 5.25" I, the end up in the middle of the K, possibly corrupting The Azusa keeps track of how many s the %s, the disable the ,1 and LPT1 ports on the , and reset its counter. A later in the ports functioning again. of Azusa are: Azusa 2: fHong Kong. The portion of Azusa 2 is 2,048 at the top of uof high-density in severe cross-linking of `and invalid clusters, as well as 0 Fories. CTRL-C may fail to function, as well as may hang the . Disabling of ,1 and LPT1 may See: Evil Empire PZPAPN : Back H: clock runs backwards R: 528 4: PRtCK - , IBM , VET, , NAV 2.1+, The Back . Back vof . Its bBack X, Back at the top of the @by 528 (, as measured by the DOS {08 and 21 nby the , it X. If X, it by 528 The Back at the end of the The "Back " can be din all The Back affect the operation of the by running the clock backwards. For example, `created became stamps in the fbefore the became . Re %ing the in the clock ing to the normal expected =and See: Blinker Shaker PZPAPN Bad Boy : Bad Boy Bad Boy 2 H: May, R: 1,000 4: PRtCK - , NAV, , IBM , VET, 25.10+, The Bad Boy in May, V. Bad Boy is a vof . , it The Bad Boy is X, the at the top of , but #the nby the is not moved. If the became %ing rby the DOS ?by 3,072 (. If Bad Boy became by executing (not @of 3,072 , but ?by 6,704 (. The is due to a low zed by the Bad Boy is , the by 1,000 at the `. Occasionally, by 1,001 (. The =and the not be 8two , the d, natural us of the are not Lby the "The bad boy halt your "The Bad Boy , Copyright (C) The Bad Boy on a random basis, at to hang the . The hang is followed by the scrolling several s of repeated 3, and halt of Bad Boy are: Bad Boy 2: A later of Bad Boy, Bad Boy 2 Nnot the TSR zed if the became %ing The hang, scrolling of 3, and halt may still , but not as frequently. The in the "Make me better!" "The Bad Boy 2.0, Copyright (C) Bad Boy, the d samples of Bad Boy 2. See: Boys PZPAPN Bad Brain : Bad Brain H: fail to R: 576 4: ONCK - 2.43a+, .1.4+, 1.53S+ The Bad Brain . Its . Bad Brain is a of . +. It corrupts all Bad Brain is X, the Bad Brain xone . on the Oin the 2nd or lower sub fthe O's root the Bad Brain mthe b576 the 4, so be no 2in the in the DOS . The =and the DOS The in the Bad Brain 4, and thus are not "SKISM*" "BadBrains" the Bad Brain not function Ythem. The ed to the DOS prompt upon Since the Bad Brain s the !of the host cannot be dis sand should be replaced clean backup copies. PZPAPN Badsec : Badsec 905, Backfont H: ; bad or lost clusters; unexpected accesses to R: 765 4: PRhE - , IBM NAV, , VET, The Badsec . Its . Badsec is a of . The the Badsec at the top of #the &. It Nnot move 12's , as by the DOS ?by 4,384 nby the the Badsec , it qof 765 the end of the a. The =and in the DOS not be the Badsec may notice the access unexpectedly. accesses , a bad or a lost cluster may , hence the kmay as well. Topsy-900: , Topsy-900 is on the Badsec . It is fthe Topsy-900 zing at the top of #the 2,736 to 5,472 (, and by the , Topsy-900 may sporatically. qof 900 at the end of the PZPAPN Banana : Banana Trivial-Banana H: %failures Sweden R: 139 4: ONCK - , VET, NAV 2.1+, 1.15a+, 25.10+, The Banana . It is fSweden. Banana is a of . . It corrupts the the Banana X, the Banana xall of the . in the E. Banana s the b139 (of the w, so were larger 139 smaller . The =and in the DOS not be The can be in the all Banana "BANANA, 4d by Morbid Angel -92 in Stockholm/Sweden" "*.com" Banana no longer function Since the !of the host , it is not possible to dis should be replaced clean, copies. See: Mini-45 PZPAPN Bandit : Bandit Research H: May, Italy R: 1,641 4: PNE - , VET, IBM NAV 2.1+, The Bandit in May, . Bandit is fItaly. It is a vof . Bandit is X, Bandit search the Oand Efor an x. If an d, it s. Bandit 1,641 at the end of the The =and in the DOS not be Bandit 8the , the second of at the end of "*.* *.exe ww "!!PCBANDIT!!" Bandit is on the Enigma s to be a research See: Enigma PZPAPN Baobab : Baobab H: India R: 1,641 - 1,651 4: PRhE - \, VET, 1.15a+, 3.93+, 25.10+, NAV 2.1.4+, The Baobab . It is fIndia. Baobab is a vof . bBaobab X, the Baobab at the top of #the &. It Nnot move |12's rby the DOS 2,560 nby the Baobab the Baobab , it qof 1,641 to 1,651 at the end of the a. The Baobab , adding an 1,648 =and in the DOS to the =and the last of the It is what Baobab may do PZPAPN Barcelona : Barcelona H: 2; TSR Spain R: 1,792 4: PRsC - ., NAV 2.1+, , VET, The Barcelona fBarcelona, Spain, in . Barcelona is a vof . on the bBarcelona X, the Barcelona as a low TSR of 2,096 (. It Barcelona is , it qof 1,792 at the !of the a. The =and in the DOS to the The can be in the in Barcelona "CATALUNYA" "CATALUNYA LLIURE" "FORA LES FORCES D`OCUPACIO" "MORT ALS TERRORISTES TRICORNUTS" It is if Barcelona carries any damage potential. See: PZPAPN Barrotes : Barrotes H: ; vertical bars & %failure; corrupted Spain The R: 1,310 4: PRhAK - 6.04+, V100+, V100+ The Barrotes ~in The s to ated in Spain. Barrotes is a vof . W, and overlay bBarrotes X, the Barrotes at the top of #the &, hooking |21. and , as rby the DOS ?by 1,600 |12's be moved. , the Barrotes copy of in the C: Oroot Eif it was not the Barrotes , it W, and overlay qof 1,310 at the end of the a. The and in the DOS not be The in the Barrotes 4in all "c:\ 5.com" "l7SO" The Barrotes 5th of any year. At , the vertical bars across the M, and the at the DOS prompt: BARROTES por OSoft" s, the write a portion of its 4to the . The next the fthe K, the fail. PZPAPN Basilisk : Basilisk H: March, 1993 ; DOS <seconds = 62 North America R: 1,639 - 1,653 4: PRhAK - \2.07+, NAV 2.1.4+ The Basilisk in March, 1993, and is fNorth America. Basilisk is on the R-10, R-11, and Sunday 2 and is a vof . ,and . +. It should be considered a as it on open, as well as hiding the bBasilisk X, the Basilisk at the top of #the &, hooking {21, 22 and 27. , as rby the DOS ?by 3,408 12's not be moved. , Basilisk the Basilisk , it larger 2K in for any reason. qof 1,639 (. . qof 1,639 to 1,653 (. In both cases, the be hidden by the . The at the end of the . The =and in the DOS not to be , but actually seconds field set to 62. The in the Basilisk 4in all "Basilisk v1.0" "Packed ais corrupt" "(c) YAM/RABID International" "The slave thinks he is released fbondage" to find a stronger set of chains" the Basilisk Tdetected on the Basilisk See: Sunday-2 PZPAPN Beast-N-Black : Beast-N-Black Beast H: in \DOS Emay be R: 429 4: PNCK - , VET, , NAV 2.1+, The Beast-N-Black ~in the is a vof . the Beast-N-Black search the Efor all , and xthem. it completes E, it attempt to xall . in the root Eof the the Beast-N-Black qof 429 (. The at the end of the . The =and in the DOS not be . The can be in the 4of all ,\DOS\*. "Beware the Beast-N-Black" "(C) , Night Crawler - SKISM/PHALCON" The Beast-N-Black is malicious. It all . in the DOS Eon the of Beast-N-Black are: Beast-N-Black B: gequivalent to the has three differ. : Canada May, Public Enemy: on the Beast-N-Black wall . `in the Eand the Oroot X. It adds 429 (to the +. The at the end of the a. The can be in all Public Enemy ,\DOS\*. "Public enemy number one" PZPAPN : Bebe H: j; long Kaccess on . clicking on speaker and R: 1,000 - 1,019 4: PRCK - , IBM C, NAV 2.1+, The Bebe fthe . Bebe is a s as a Bebe is X, Bebe search and xall on the and E. If +resides in the E, it Bebe by 1,000 to 1,019 at the end of the a. The mhad =and in the DOS to the =and Since Bebe searchs the E, and wall . Zof an in a long, slow load much access while the Bebe is a Nn't be mlike one. X, it portion of for awhile, the activate. At , it emit a "click" on the speaker, and the be hung. Bebe Nnot on 386 class , on those Zof a Bebe- in a hang. PZPAPN Beeper : Beeper Russian Mirror H: 1; beeps on speaker; R: 482 4: PRCK - V99+, 6.00+, 2.43a+, .1.4+, 3.93+, C, VET, \, NAV 2.1+, The Beeper, or Russian Mirror, ~in the . It was not until to previous samples not replicating. Beeper is a vof . +. It can corrupt the The the Beeper the Beeper in low , hooking |21. , as rby the DOS not be the Beeper , it Xtwice in a row. qof 482 at the end of the a. The =and in the DOS to the =and . No in the the Beeper [the Kbecoming corrupted, ing in an "Invalid specification" to access it. s of may notice a "beep" be emitted fthe speaker PZPAPN : Beer Beer-2794 H: ^, 1993 R: 2,794 - 3,069 4: PRtA - The Beer, or Beer-2794, ^, 1993, and fthe . Beer is a ,and . , but not bBeer X, the Beer at the top of but #the &, moving |12's , as rby the DOS ?by 4,096 nby Beer in , the Beer ,and . qof 2,794 qof up to 3,069 (. In both cases the at the end of the a. The =and in the DOS not be It is what the Beer of Beer are: Beer-2850: A 2,850 of the Beer 4,096 (, hooking |21. It ,and . , but not of 2,850 (while . by up to 3,125 (. The at the end of the a, and the =and in the DOS not be ^, 1993. PZPAPN Best Wishes : Best Wishes Best Wish, Wishes H: anot modification R: 970 4: PRtCK - \, NAV, , VET, The Best Wishes and is believed to be fthe . Best Wishes is a vof . is a , Best Wishes B, is 1,024 The the Best Wishes X, the high , but #the &. The be moved. @by 61,440 @by 61,360 , and the be modified. modification and still Best Wishes is , the a probability of 50%. by 970 the end of the near the end of the m ... Best Wishes!" Best Wishes Nnot restore the =and in the , so all <stamps set to the =and Two of a Best Wishes uare may anot ais actually on K, as well as kon every fourth of Best Wishes are: Best Wishes B: An earlier of Best Wishes, 1,024 . The major differences are modified. Zof a . in the most likely s, but the hang. Best Wishes C: An of Best Wishes, not hang the by the Zof . , however, usually in a hang. PZPAPN : Beta Phalcon H: R: 1,117 4: PNC - IBM , NAV 2.1+, The Beta . Its . Beta is a vof . . It Nnot a Beta X, the Beta xup to three . in the qof 1,117 (. The at the end of the be no 2to the =and in the DOS . No in the It is if Beta See: Ministry PZPAPN Beware : Beware H: Moscow, R: 442 4: PNC - ., NAV 2.1+, , VET, The Beware . It s to ated fMoscow. Beware is a vof . . It Nnot the Beware X, the Beware search the Efor an +over 2K in x. If it is d, the Beware the Beware qof 442 (. The at the end of the . The =and in the DOS . The can be in the 4in all Beware "BEWARE ME - 0.01," "Copr (c) DarkGraveSoft - Moscow The Beware on the bMonday of any month, at on the PZPAPN : BFD BFD-452 H: BSC; . ; high density Imay fail to R: 452 4: ORhEB - 6.00+, , NAV 2.1.4+, The BFD ~in the is a multi-partite and . . It should be considered a do not many , and it `on open. It spreads very quickly. The the BFD xthe if the Ois a floppy O. It access the C: the C: , the at the top of #the DOS , as by the DOS ?by 2,048 nby BFD in . The should note BFD can %ing J. The same the BFD , it , as well as a non-write protected Jis accessed. qregardless of whether the . The BFD writing its 4to the . Wheader area of the many =and in the DOS . No the the BFD I, it s the . The be missing the usual DOS . In the case of high density 5.25" fthe fail, in a hung BFD Nn't to do of BFD are: BFD-452: A 452 of the BFD PZPAPN Big Joke : Big Joke H: R: 1,068 4: PNC - ., IBM , NAV 2.1+, The Big Joke . Its . Big Joke is a `. It Big Joke is X, the xone in the Big Joke qd in by 1,068 the end of the a. The =and in the DOS to the =and The Big Joke to the L, it is written one line at a to the center of the completes, it be repeated until the is re %ed. The "At last . ALIVE I guess your computer is sby the Big Joke Release 4/4-91 Lucky you, is the kind Be more careful while duplicating in the future. The Big Joke , killer strike The Big Joke rules forever." The can be Big Joke, as well as the ctwo ,MAND" Big joke, in its currect Nnot do Mits PZPAPN : Bios H: j; continuous R: 2,048 4: PRhAK - 6.04+, V100+, V100+ The Bios, or Ned, . Bios is vof . ,and . +. It employs techniques to avoid detection. The the Bios the Bios at the top of #the &, hooking 09, 1C, and 21. , as by the DOS ?by 8,336 the Bios , it ,and . by 2,048 hidden Bios is . The the !of . and the end of . . The =and in the DOS not be . The in the 4and cannot be seen in "Mr.Watshira Sae-eu KMIT-NB =12/28/ BIOS" the Bios may notice the DOS to re %the in a continuous series of re ring. PZPAPN Bit Addict : Bit Addict H: The R: 477 4: PRaCK - 2.43a+, 6.04+, V100+, 1.53S+, V100+ The Bit Addict fthe . Bit Addict is a vof . The the Bit Addict X, the Bit Addict in Video Card a hook to in low nby the . The DOS not indicate any the Bit Addict , it qof 477 at the end of the a. The in the DOS not be . The can be in the 4in all Bit Addict "BIT ADDICT" "The Bit Addict says" "You ma good taste for Ks, it was delicious !!!" It is what may do PZPAPN Black Monday : Black Monday Borderline, Monday H: j; TSR; stamp Kuala Lumpur, Malaysia R: 1,055 4: PRsAK - , NAV, IBM , VET, : CleanUp, or The Black Monday ~in Fiji in . It is reported to be widespread in Fiji and locations in the Far East and Asia. is a generic ,and . The the Black Monday X, the as a low TSR of 2,048 the , any the Black Monday by 1,055 the end of the `. . by 1,055 to the end of the Nnot `multiple The Nnot hide the <stamp to the and awas The can be din all `near the !of the "Black Monday 2/3/90 KV KL MAL" Black Monday X, at attempt to format a portion of the of Black Monday are: Black Monday-B: gidentical to Black Monday, has six differ. While . `still by 1,055 by 1,055 to 1,069 Black Monday-C: ~in Malaysia in , Black Monday-C s to be an earlier . Like Black Monday-B, . qof 1,055 (while . qof 1,055 - 1,069 (. Unlike the of Black Monday, X. It frequently hang the X, and the . mhad =and in the DOS to the =and Borderline: Borderline is a smaller of the Black Monday by 781 at the end of the a. The =and in the DOS to the =and may , adding 781 for TSR is 2,048 , and hooks 08 and 21. It is if it PZPAPN Black Wizard : Black Wizard H: j; music R: 2,051 4: PNE - , NAV, i, IBM , VET, The Black Wizard . Its . Black Wizard is a of . . It is on the Enigma and Yankee 2 Black Wizard is X, the search the Efor an x. If one is d, it Black Wizard 2,051 at the end of the be no 2in the =and in a DOS . Two can be the "*.exe *.*" "Black Wizard" in the playing the tune "Turkey In The Straw" on the speaker, followed by the executing. Black Wizard may be a research , and not in the public domain, as the sample is not a natural rence of the See: Enigma Yankee 2 PZPAPN Blaze : Blaze H: 1; TSR; %failure R: 284 4: ORsAK - \, VET, 25.10+, NAV 2.1+, 6.04+, V100+, 1.53S+ The Blaze . Its . Blaze is a vof . and . the Blaze xthe btwo . ,and btwo . in the E. If E, it may it has , it za low TSR of 65,584 (. The "The Eternal Blaze unleashed...Beware!" "[JD]" the Blaze mthe (of the host the Blaze The can be be no 2to the in the DOS , but the =and to the =and Since the Blaze s the !of the host cannot be dis must be replaced backup copies. the Blaze may fail to +has of Blaze are: MSK: The MSK, or Midnight Serial Killer, is a 252 of the Blaze . It wthe bthree . `in the X, as well as the C: mthe b252 by the MSK 4. The =and in the DOS to the <. The in the "The Midnight Serial Killer is roaming in your computer..." "Beware!" "[JD]" "*.exe" The may be PZPAPN Blinker : Blinker Blinker-496, Prague.Blinker H: ; spurious Prague, Czechoslovakia R: 512 4: PRhCK - , IBM , NAV 2.1+, The Blinker . It ated in Prague, Czechoslovakia. Blinker is a +. It is on the Back , and may identify it as such. The Blinker is X, the Blinker at the top of #the , as rby the DOS ?by 528 {08 and 21 by Blinker in |12's moved. Blinker is , it xany . X. If X, it sas well. Blinker qof 512 (. The at the end of the be no 2to the =and in the DOS It is what Blinker of Blinker are: Blinker-496: Blinker-496 is a 496 of the Blinker . It 7the "Joker". may receive the Umeesages for no apparent reason , both of require a response to abort, retry, ignore, or fail: "Bad Ureading device CON" "Bad Uwriting device CON" See: Back Shaker PZPAPN Bljec : Bljec Bljec3, Bljec3B, Bljec4, Bljec4B, Bljec5, Bljec5B, Bljec6, Bljec6B, Bljec7, Bljec7B, Bljec7C, Bljec8, Bljec8B, Bljec9, Bljec9B H: May, Write fault Ton device PRN; %failures R: 231 - 374 4: PNC - , NAV, , IBM , VET, The bBljec Vin May, . In , six were , four of them fItaly. Bljec is actually a es. All of the es are vs of . exception of Bljec3 and Bljec4, do not typically +. Bljec es mark `by checking for two NOP instructions (9090h) at the very !of the The description #applies to Bljec6, the differences for the rlater in entry. Bljec6 is X, the search the Oand Efor three . by 276 (, the at the !of the a. The =and in the to the =and Bljec6 may hang the X, or may simply refuse to function of Bljec are: Bljec3: Probably the earliest member of Bljec3 wthe bfour . `in the ever an X. If bfour . `are already s, it not `in the by 231 at the !of the a. The =and in the to the =and . A symptom of an Bljec3 is may receive the "Write fault Uwriting device PRN" It is what Bljec3 was to write to the printer. in a hang. particular sample of Bljec3 was fItaly Bljec3B: , Bljec3B is a 236 of the Bljec3 Bljec4: fthe NCSA in , Bljec4 is to Bljec3. It wthe bfour . in the cthe uof the hang usually Bljec4 by 247 at the !of the mhad in the DOS to the =and in a hang ring. Bljec4B: in May, , Bljec4B is a 252 of the Bljec4 May, Bljec5: fthe NCSA in , Bljec5 is to Bljec4. Its major difference is `is 267 Bljec5B: , Bljec5B is a 272 of Bljec5. Bljec6: See description is 276 Bljec6B: in May, , Bljec6B is a 281 of the Bljec6 May, Bljec7: fItaly in , Bljec7 xthe third, fifth, and sixth . `in the `are already s, nothing more Bljec7 by 287 at the end of the a. The =and in the DOS to the =and . Like Bljec3, write fault Ton device PRN may be Bljec7B: Bljec7B was . It is a 292 of Bljec7. Bljec7C: Bljec7C was . It is a 440 of Bljec7. xno more three . in any E, and resets the clock to 2-27-1989 8the "Digital F/X - Created on 2/5/92 by Phoney Phreak" "*?.com" kmay frequently are Bljec8: Bljec8 was fItaly in . It to Bljec7, the exception qis 358 (, and be no in the =and in the DOS Efor Bljec8B: in May, , Bljec8B is a 363 of the Bljec8 . The in the DOS May, Bljec9: to Bljec8, Italy in . Its qis 369 (, and no 2in the =and in the DOS s. Unlike Bljec8, it not usually not the root Bljec9B: to Bljec9, Bljec9B is a 374 Bljec-XYZ: on the Bljec adds 441 to the . w. It 7the 1.0 - Buddy and Chloe 5/27/89" "?*.com" "XYZ 1.0 - 5/27/89" , 1993. See: Sad PZPAPN Blood : Blood Blood2 H: %s and/or cascading effect Natal, Republic of South Africa R: 418 4: PNCK - , IBM , NAV, , VET, The Blood by Fridrik Skulason in It was ~in Natal, Republic of South Africa. are two , Blood and Blood2. is a vof . the Blood X, it xone . in the C: Oroot E. The newly qd in by 418 (. If the just +, a cthe %, executing an in a cascading effect of the cursor down the The next . in the accessed followed by the hanging. Spurious on the on the line #the line. Zof an hang. of Blood are: Blood2: to Blood, the major difference k, and the cascading cursor effect no longer Nnot hang the 15th. PZPAPN Blood Lust : Blood Lust Trivial-Blood Lust H: %failures Sweden R: 302 4: ONCK - , VET, 1.15a+, NAV 2.1+, The Blood Lust . It is fSweden. Blood Lust is a of . +. It s the !of the Blood Lust is X, the Blood Lust xall of the . in the E. If E, it the Blood Lust mthe b302 (of the by the 4. Unless the smaller be no smaller be no 2to the =and in the DOS The in the Blood Lust and are not "*.C*" "Hi! is the Blood Lust striking." "Sorry to tell you, but your The may be Lby the circumstances. See: Mini-45 PZPAPN Bloody! : Bloody! Beijing, H: Extended Taiwan R: N/A 4: BRtX - \, NAV, IBM ., VET, : CleanUp, or see The Bloody! , and reports were V, Taiwan, and the is a vof floppy as well as the fa floppy or Bloody! , the at the top of #the @by 2,048 (. The be moved. The much longer expected. The simmediately if it was not the source of the At the %, the maintains a counter of how many s the Ohas , the Mthe during the "Bloody! Jun. 4, 1989" 4, 1989 is the =of the confrontation in Beijing, China between Chinese students and the Chinese Army in many students were killed. later be Lon every sixth 128 %limit has Qed. The in the 4, so it is not in the Bloody! is , the xany is accessed. not be enough to cause the xthe be missing all of the normal DOS are normally din the . The moved to 11 on 360K I, a part of the root E. If were root Eentries in , those be lost. On the K, the moved to side 0, cylinder 0, For floppies of 360K, unusable or corrupted as the Nnot take into account the existence of For I, Bloody! can be removed by powering the off and %ing clean, write-protected J. The DOS SYS 5should Qof the To remove the Bloody! fthe the should be copied back to its position. The option is to backup the `on the Kand low level format the O. In the case of DOS 5.0, the can be rebuilt by using the DOS FDISK the undocumented /MBR option. of Bloody! are: Bloody!-B: in May, equivalent to the . It has avoid detection by most utilities. May, PZPAPN : Bob ew-718 H: R: 718 - 1,414 4: PNCK - ., NAV 2.1+, , VET, 2.43a+, The Bob . Its , are . Bob is a vof . the Bob xall the in the Eof the usually qof 718 the was less (, its 1,416 (. The at the of the . The =and in the DOS not be The can be din all Bob "*. *. +MKS_VIR. terminated normally" It is if the Bob PZPAPN Bomber : Bomber Bomb H: May, ; sluggish DOS DIR 5s; beeps & %failures; Malaysia R: 2,204 4: PRhCK - The Bomber, or Bomb, fMalaysia in May, is a vof . employs technology to avoid detection. It 31st, Malaysia's Independence Day. the Bomber the Bomber at the top of #the |12's not be moved. rby the DOS ?by 3,072 {1C, 20, 21, and 22 nby the Bomber the Bomber , it . It of the . in a a DOS DIR issued. the Bomber qof 2,204 hidden if Bomber is . The the !of the =and in the DOS Bomber is an , and no the The Bomber 31st, Malaysia's Independence Day. On 31st, the emit three beeps and the "! I AM THE STEALTH BOMBER ! I BELONG TO THE NEW GENERATION OF ,PUTER VIRUSES. LIKE THE STEALTH BOMBER, I GO UNDETECTED BY ENEMY RADAR DO NOT PANIC I AM SHOWING OFF HOW EASY I CAN EVADE YOUR ANTI VIRUS SYSTEM - I DO NO HARM" Bomber Nn't do malicious Ming its . However, the Bomber %failures s, as well as "detected by the DOS Bomber is . Lastly, the DOS DIR be very sluggish. of Bomber are: Messy: fMalaysia in May, , Messy is a of the Bomber . The major 2between the two es is Messy emit more beeping on 31st, and Mthe "MESSY VIRUS CATCH ME IF YOU CAN !!! HA..HA..HA!!!" PZPAPN Boojum : Boojum H: May, R: 340 - 350 4: PRhE - , NAV 2.1+, The Boojum in May, . Its . Boojum is a the Boojum the Boojum at the top of #the |12's not be moved. rby the DOS 368 nby Boojum in the Boojum , it qof 340 to 350 at the end of the a. The in the DOS not be . No in the 4in Boojum Boojum Nn't do PZPAPN %Killer %Killer H: BSC; %failures; inaccessible R: N/A 4: BNX - : DOS SYS on I, Norton KDoctor on The %Killer . Its %Killer is a vof the ) and is attempted to be %Killer J, the %Killer be read into , and the fail, Ming the "Non- Replace and press any key ready" has replaced the J, and struck a key, the the proceed. If the Jwas a non-write protected J, the %Killer it, . At same , the sthe it as well. %Killer [frequent failures I, as well as the Khaving inaccessible due to %Killer fthe in the same The damage to the can be repaired using various Kdiagnostic pNorton KDoctor. I, the DOS SYS 5can be used to replace the PZPAPN : Bow 5856 H: May, R: 5,856 4: PRhAK - 1.15a+, 6.04+, \2.07+, The Bow, or 5856, in May, is a vof . ,and . The a Bow X, the Bow at the top of the &, not moving |12's , as measured by the DOS ?by 5,888 (. The Bow {1C and 21. the Bow , it ,and . X, as well as qof 5,856 at the end of the a. The =in the DOS not be , but the may be to a different value. Two in the 4in Bow "TRUS" "bow!" It is if the Bow PZPAPN : Boys H: May, acreation R: 500 4: PRCK - , NAV, , VET, , IBM The Boys in May, '. It is a vof . and The the Boys Boys . Unlike most be no mapping utilities not indicate is in as no {are Boys is , any . larger by 500 at the end of `. The can be Boys: "The good and the bad boy." The at the end of Boys is a malicious X, it alter the attribute (of . setting the attribute. The . lists the E. If the to copy back the missing . , a " acreation since the `still exist. The . has hidden can be recovered by removing the attribute. of Boys are: Boys 2: on the Boys , Boys 2 is a vof . Boys 2 is X, Boys 2 search the Efor an x. If one is d, it s, and Aone . fthe E. Boys 2 qof 500 at the end of the . The can be in the "The good and the bad boy." See: Bad Boy PZPAPN Brain : Brain Pakistani, Pakistani Brain, Clone, Nipper H: 1986 Extended ; volume label -TOM; three contiguous bad (floppy ); BSC Pakistan R: N/A 4: BRt - \, IBM , NAV, , VET, K, CleanUp, \, NAV, or DOS SYS The Pakistani Brain ated in Lahore, Pakistan and by moving the contents of the to an location on the K, marking those 3 clusters (6 bad in the FAT, and writing the 4in the One sign of a Khaving s, at least , is the volume label 0to "(c) Brain". sign is the label "(c) Brain" can be (the ) on an , taking up between 3K and 7K of RAM. The Brain is able to hide detection by intercepting any might interrogate the and re Fing the read to the elsewhere on the K, thus be unable to see the The Brain sfloppies, however the can now Ks. the "(c) Brain" label removed to make them ler to detect. of Brain are: Brain-B: ( KBrain/Houston Brain-C: Brain-B the "(c) Brain" label removed. Clone: Brain-C but restores %copyright label. Clone-B: Clone modified to destroy the FAT 5/5/92. Nipper: fSpain in Ks. The 7the in the "Welcome to the Dungeon (c) 1999 NIPPER SOCIEDAD GAMBERRISTICA VIVA LA PIRATERIA. Dedicated to the memories of See: Ashar PZPAPN Brainy : Brainy H: R: 768 - 1,531 4: PRsCK - IBM , NAV 2.1+, , VET, V99+, 3.93+, The Brainy . It is '. Brainy is a vof . +. It is on the Warrior The Brainy is X, the Brainy at the top of #the nby the Brainy |12's moved. , as by the DOS ?by 1,552 the Brainy , it xall . qof 768 to 1,531 (. Unlike most es, the Brainy inserted into the a, possibly in the middle. The can be dat the end of the 4in all Brainy "eAWRREI!R" Brainy usually not 386 processor, and may hang the It is if Brainy See: Warrior PZPAPN Brazilian Bug : Brazilian Bug H: May, Brazil R: 1,343 4: PNCK - i, IBM , NAV, , VET, 6.04+, The Brazilian Bug Gin May, . It is fBrazil, and may =back to late is a vof . , but not the Brazilian Bug is X, the xall . in the it completes tall the , it Mthe * HELLO FRIEND WE ARE SORRY TO INFORM YOU THAT YOUR SYSTEM IS VERY ILL AND WILL NOT SURVIVE " MUCH LONGER YOU UNFORTUNATELY HAVE - THE BRAZILIAN BUG - FOR WHICH THERE IS NO CURE WE HOPE THIS WILL NOT BE AN INCONVENIENCE TO YOU LOVE, $ THE MAGIK MUSICIANS" The host complete the Brazilian Bug qof 1,343 at the end of the a. The =and to the =and . All of the in the PZPAPN Breeze : Breeze H: The R: 358 4: PNCK - 6.04+, \2.07+, V100+, V100+ The Breeze , and is fThe . Breeze is a vof . +. It is written by the same author as the Deicide the Breeze X, the Breeze xone . in the E. If E, it may the Breeze qof 358 the !of the a. The =and in the DOS not be . The can be in the 4in all Breeze "Dutch [Breeze] by Glenn Benton" Breeze Nn't to do See: Deicide PZPAPN Bryansk : Bryansk H: ; Read- attribute set R: 673 4: PNCK - 6.04+, \2.07+, V100+, V100+ The Bryansk . It is fthe . Bryansk is a the Bryansk X, the Bryansk check the =and . If it is not a Friday before 15:00 (3:00PM), the xone . in the E. If an acannot be din the E, it move upward in the Estructure searching for a . until it r Qes the root the Bryansk qof 673 (. The at the end of the a. The =and in the DOS not be . The can be in the 4in all Bryansk "BRYANSK , BITE 0.01 (C)" On any Friday before 15:00 (3:00PM), the Bryansk `, instead it set the Read- attribute on for `using the aspecification "*.*". PZPAPN : Budo H: fail to Finland R: 890 4: ONA - V99+, 2.43a+, 6.04+, \2.07+, V99+, The Budo fFinland in . Budo is a ,and . , but not the Budo may xone . ,or . in the The ed to the DOS prompt. mthe b890 by the Budo 4. Unless the host was smaller . In the case of smaller . The =and in the DOS . The can be in the "BUDO V1.2 TH HV FINLAND PQ" "FLOW LIKE A RIVER - STRIKE LIKE THUNDER" Budo destroys the w, and be replaced fclean, backups. PZPAPN Burger : Burger 404, 505, 509, 537, 540, 541, 542, 560, 560-B, 909090h, CIA, CIA-2 H: 1986 not run West Germany R: 560 4: ONAK - , NAV, IBM , VET, The Burger, or 909090h, was written and copyrighted in 1986 by Ralf Burger of West Germany. is extinct in the "public domain". is a ,and . the Burger X, the attempt to xone in the C: Oroot E. To determine if the s, the checks to see if the bthree (of the . aare three NOP instructions (909090h). If the bthree (are the NOP instructions, the goes on checking until it finds an a. If no aexists, the s all the . `in the root Eto . `and checks those it finds x, it s the b560 (of the 4. At , the the to run either end or hang the never as the bportion of the destroyed. the Burger fail to the +, or the copy of `can be easily identified by the "909090B8 026A245" hex sequence in the bnine (of all `cannot be must be replaced fa clean source. of Burger are: 404: to the Burger 's actual is 404 b560 bnine 8the hex : "909090B8 026A245". 505: to the Burger 's actual is 505 b560 bnine 8the hex : "909090B8 026A3A0". 509: to the Burger 's actual is 509 b560 bnine 8the hex : "909090B8 026A3A4". 540: to the Burger 's actual is 540 b560 bnine 8the hex : "909090B8 026A3A3". 541: to the Burger s the 560 actually 541 start the hex sequence: "909090B8 026A3A4". 542: to the Burger s the 560 actually 542 start the hex sequence: "909090B8 026A3A5". 560-B: to the Burger s the b560 , and the is 560 (. The end of the 7the : "his awas downloaded fthe Vir". in all d samples. start the hex : "909090B8 026A3B2". CIA: Gin the to the Burger . The bnine (of all `in hex "909090B8 026A3A5". The actual 541 b560 CIA-2: ~in May, is a minor the CIA See: 382 Recovery 405 Dewdz VirDem VirDem-1542 Wonderful PZPAPN Burghofer : Burghofer H: Switzerland R: 525 4: PRhCK - IBM , VET, NAV 2.1+, The Burghofer , in Switzerland. Burghofer is a vof . bBurghofer X, Burghofer at the top of but #the as measured by the DOS @by 528 nby the Burghofer is , it X. If X, it by 525 (, the at the end of the The =and in the not be Burghofer 8the "GS/02" at the fourth thru eighth (of the Burghofer Nn't do PZPAPN Busted : Busted H: /corrupted R: 571 4: ONE - D: IBM , VET, NAV 2.1+, .1.4+, 2.43a+, 1.53S+ The Busted . Its , are . Busted is a the Busted xall . in the has completed tall . in the E, the too big to fit in mthe b571 by the , permanently damaging them. be no 2to the unless the . smaller (, in case the (. The =and in the DOS Several are Sin all d samples. "Busted!" on Leprosy-B." x PCM2" "Busted, Strain A, 1.08y" "(Psychogenius), Busted Nnot to do $replicating, destroying the . PZPAPN Butt Stink : Butt Stink H: , 1993 North America R: 540 4: PNE - V102+, V102+ The Butt Stink , 1993, and is probably fNorth America. Butt Stink is a vof . the Butt Stink xall of the . in the 540 at the end of the a. The =and in the DOS . The in the Butt Stink "You know what?" "Your Butt Stinks!!!" "And YAM can't stand it!" The last three lines of forms a Lon the monitor PZPAPN Cadkill : Cadkill Milous H: R: 1,163 4: PRhAK - IBM , NAV 2.1+, 25.10+, The Cadkill . Its . Cadkill is a generic vof . and . The Cadkill is X, the Cadkill at the top of #the , as measured by the DOS @by 2,048 {1C, 21, and 24 nby the Cadkill is , it ,and . X. If X, it by 1,163 (. The at the end of the It is what Cadkill PZPAPN Cannabis 00k R PTk : Cannabis Cannabis 2, Cannabis 3 H: BSC; The R: N/A 4: BRh - Floppy \, VET, .1.4+, NAV 2.1.4+, : DOS Sys on The Cannabis fthe . Cannabis is a vof floppy . The :submission of Cannabis, the usually in a indicating Kis a non- J, and to replace it Kand press any key. Replacing the J, or removing it and allowing the %to proceed fthe in the %completing. At , Cannabis at the top of #the DOS measured the DOS be 2,048 (less expected. Cannabis is , it xany non-write protected Jexposed to the s360K mthe moved to 9, and the Cannabis 4written to 0, the location of the . Since 9 is normally part of the root 9may Cannabis is a very buggy , and it . As a , the was re by the The Cannabis occasionally Mthe "Hey man, I don't wanna work. I'm too right now..." , along the word "Cannabis". of Cannabis are: Cannabis Dropper: A very small . 8ed the Cannabis nothing but the Cannabis Cannabis 2: Cannabis 2 is a of the Cannabis has the bug fixed prevented Cannabis I. It 7one : "CANNABIS". where the DOS number is normally in the . It uses 1,024 , rather 2,048 (required for the . Cannabis 2 is a very poor replicator, and not likely to widespread problem. : The Cannabis 2 Dropper: A very small . 8ed the Cannabis 2 Nnothing but the Cannabis 2 : The Cannabis 3: Cannabis 3 is a minor of the Cannabis 3 . Like Cannabis 2, it 7the one : "CANNABIS". : The Cannabis 3 Dropper: A very small . 8ed the Cannabis 3 Nnothing but the Cannabis 3 : The PZPAPN Cansu : Cansu Sigalit, V-Sign H: BSC; ; graphic Turkey R: N/A 4: BRXh - Floppy , VET, , NAV 2.1+, : M- K/P or DOS 5.0 F- K/MBR on DOS SYS %able The Cansu fCanada in . It is fTurkey. Cansu is a vof the ) and bCansu %ed, the Cansu at the top of but #the , as rby the DOS by 2,048 (. The uses Cansu is , it xthe accesses the K. It xany non-write protected are accessed Cansu wthe K, it saves (of the in its s Side 0, Cylinder 0, 1. The is too large to fit entirely in the , so the remainder of the is written to Side 0, Cylinder 0, 4 and 5. On I, the saves 38 (of the and s the . The remainder of the be stored in the last two of the root E. For example, on 360K 5.25" 10 and 11 8the remainder of the Cansu is slightly polymorphic, and a wildcard search necessary to detect the . Since the and are not saved, dis ushould be performed by replacing the clean copies using utilities intended for purpose. The Cansu Ma V-shaped block character graphic on the monitor the . The graphic is accompanied by a hang. PZPAPN Capitall : Capitall H: j; TSR Poland R: 927 4: PRsCK - , VET, 1.15a+, 6.00+, 3.93+, 25.10+, V99+, The Capitall fPoland in is a vof . +. It uses an encryption mechanism used by the Cascade , so it is possible utilities identify it as Cascade. the Capitall as a low TSR of 1,952 {1C, 21, and 28 nby Capitall in the Capitall , it X. If X, it the Capitall qof 927 at the end of the a. The in the DOS not be It is what Capitall may do PZPAPN : Cara H: j; TSR; Spain R: 1,025 4: PRsCK - D: IBM , VET, NAV 2.1+, The Cara . It is fSpain. Cara is a vof . +. It alters do not 8a live The Cara is X, Cara at the top of @by 3,048 {13 and 21 the Cara . At , Cara +if it was not s, and alter the Cara is , it are by 1,025 at the end of be no 2in the =and in the DOS Cara mthe "CARA" in the fifth thru eighth (of the is the marker used by the to determine if the already can be dnear the end of `are: es en memoria! Disco es xado. Reemplaza " Clandestino Auto- Reproductivo Anti- CARA" CARA's of the is an attempt to es by providing a new PZPAPN Carfield : Carfield H: j; TSR; R: 1,508 - 1,522 4: PRsA - , IBM , NAV, , VET, 1.53S+ : CleanUp, or The Carfield fthe NCSA in Its Hand Carfield is a vof . ,and . `. It Nnot on the Sunday The Carfield is X, the as a low TSR of 1,744 (. The Carfield is , it ,and . by 1,508 at the !of the by 1,508 to 1,522 the at the end of the be no 2to the =and in the DOS The Carfield on Mondays. It hook in addition to . It Mthe "Carfield!" while it is See: Sunday PZPAPN Carioca : Carioca H: TSR; . R: 951 4: PRsC - , IBM \, NAV, , VET, The Carioca vof . `, it Nnot The the Carioca X, the as a 1,280 )low TSR. nby the . The @by 1,312 , any . exception of the Carioca show an of 951 at the end of the mthe chex character at the very end of the a: "2EFF1E1A010203CD21". It is if Carioca 7any damage potential. PZPAPN Cascade : Cascade BlackJack, Fall, Falling Letters, 1701, 1704, 1701 Mutation, 1704 Format, 1704-B, Cascade-1621, Cascade-1706 H: , 1987 TSR; falling letters; . j; random re Germany R: 1,701 or 1,704 4: PRsC - Encrypting . \, IBM , NAV, , VET, : CleanUp, , or was a Trojan horse was disguised as a was supposed to turn off the Num-Lock light the %ed. The Trojan horse instead caused all the 3on the to fall into a pile at the bottom of the . In late 1987, the Trojan horse was one into While the had a of 1,701 (and would xboth true IBM PCs and clones, a variation exists of is 3 (longer xtrue IBM PCs. Both es are gidentical in all respects. Both of the fairly unique qualities: Both use an encryption algorithm to avoid detection and complicate any attempted analysis of them. The mechanisms are sophisticated randomization algorithm incorporating machine checks, monitor s, presence or absence of a clock card, and the season of the year. The activate on any machine a CGA or VGA monitor in the months of , or >in the years 1980 and 1988. of Cascade are: 1701 Mutation: of has had two (modified in order to avoid detection. 1701-B: Same as 1701, except it can activate in the Fall of any year. 1701-Yap: on the Cascade adds 1,701 (to the . w. Its TSR is 2,048 (, and hooks The encryption mechanism has slightly to avoid detection by utilities. 1704 Format: Like the Cascade , but the Kis formatted s during the months of , and >of any year except , 1989. 1704-C: Same as Cascade-B except can activate in >of any year. 1704-D: Same as the 1704, except the IBM selection has disabled so it can xtrue IBM PCs. 17Y4: to the Cascade 1704 , the difference is one )in the Cascade-1621: on the Cascade adds 1,621 (to the . w. Its TSR is 1,936 (, and hooks Y.BAT in the scrolling of the "Insufficient Kspace", and the .BAT anot executing. Cascade-1706: on the Cascade adds 1,706 (to the . w. It is employs a 2,064 hooking {1C and 21. The at the end of Cascade-B: to the Cascade , except cascading Mhas replaced at random intervals Cunning: on the Cascade , a major 2to the it now plays music. See: 1661 JoJo PZPAPN Casino : Casino Casino-B, Casino-C H: T; slot machine game; damaged Malta R: 2,332 - 2,346 4: PRhCK - , IBM NAV, , VET, The Casino by David Chess of IBM. Casino was ~in Malta. is a vof . The Casino is X, Casino at the top of , as rby the DOS @by 37,568 to 37,632 (. 3,152 in low be used by the , and 00, 23, and 30 area. Casino is immediately in the C: root Casino is , it any of three events . If the issues a DIR or a Nan internal DIR 5, one . ain the ly, if the Ys an , a . s. Lastly, Casino by an for any reason. Casino 2,332 to 2,346 (. The q, however, is mostly hidden if the qof 1 to 16 (, but occasionally one may show a qof up to (. The Nnot alter the =and in the If Casino is and the DOS ed for If the */F option is used, Casino 15, and play a slot machine game "DISK DESTROYER . A SOUVENIR OF MALTA mjust DESTROYED the FAT on your However, I ma copy in RAM, and I`m giving you a last chance to restore your precious data. WARNING: IF YOU RESET NOW, ALL YOUR DATA WILL BE LOST - FOREVER!! Your Data depends on a game of JACKPOT CASINO DE MALTE JACKPOT" If the looses the game, Casino trash the of Casino are: Casino-B: to the Casino , the major trash the before playing the slot machine game |21 is by the Casino-C: to Casino-B, the major Nnot trash the before playing the slot machine game, and it is possible for the to win, avoiding 9. If the wins the game, the "BASTARD ! You're lucky - but for your own sake now SWITCH OFF YOUR ,PUTER AND DON`TURN IT ON TILL TOMORROW!!!" hang May, PZPAPN Casper : Casper Chameleon H: 9(see R: 1,200 4: PNCK - Encrypting . , NAV, IBM , VET, 1.53S+ : NAV, or The Casper by Fridrik Skulason of Iceland. The . Casper is a generic vof . the Casper X, the attempt to xone . in the and by 1,200 at the end of the . The Casper 7the cannot be seen in as Casper uses a complex self- encryption mechanism: "Hi! I'm Casper The , And On 1st I'm Gonna Fuck Up Your KREAL BAD! In Fact It Might Just Be Impossible To Recover! How's Grab Ya! <GRIN>" 1st, btrack of the Owhere the was f. Later to access the in " ring. The Casper on the . Unlike , it is self-encrypting. The self-encryption mechanism employed is to the encryption mechanism used in the V2P6 , and requires an algorithmic approach in order to identify it as are not any identifying in the of Casper are: Casper Dropper: Casper Dropper is the Scopy of the Casper . Executing in an uof a . in the the Casper . The S. The for Casper See: 1260 V2P2 V2P6 PZPAPN Casteggio : Casteggio H: Casteggio, Italy R: 2,881 - 2,900 4: PRhAK - 6.04+, \2.07+, V100+, V100+ The Casteggio fItaly in its in the public domain in Casteggio, Italy. Casteggio is a vof . ,and . the Casteggio the Casteggio at the top of #the , as rby the DOS ?by 3,008 {1C and 21 the Casteggio , it qof 2,881 to 2,900 at the end of the a. The =and in the DOS not be . No in the It is what Casteggio PZPAPN Catman : Catman H: BSC; R: N/A 4: BRtX - , NAV, , VET, 25.10+, : See The Catman , two samples of were not viable es. Catman is fthe . It is a and the The Catman in the form of a "dropper" If the dropper Xon a O, the of the Catman. The 71. If was part of a, the be corrupted. The remainder of the be placed in the second of the band second on the If the Catman dropper was Xon the K, the copy the is part of the second copy of the Catman Nnot fthe or the . The way it can spread, at least in its present form, is by executing the dropper a computer Catman , the usually in a hang. Likewise, %ing fthe in a hang. Catman can be removed fthe copying back the 71 to side 0, cyl 0, 1. For I, the DOS SYS can be used to replace the . Non- Ishould be dis sby copying all `using the DOS COPY 5, and reformatting the K. In any even, were damaged due to the not be able to be recovered, and should be replaced fbackup copies. PZPAPN : Caz H: Spain R: 1,204 4: PRhAK - IBM ., NAV 2.1+, , VET, The Caz ~in Spain in . Caz is a vof . ,and . bCaz Xon a , the Caz at the top of but #the , as rby the DOS 2,048 {08, 21, and 2F nby the . At , the check the copy of in the C: Oroot E, and if not already the Caz is , it 1,204 not be able to be seen in s if the . Caz at the end of `. The can be +CLEAN." allocate all , such as utilities. [unexpected stack overflow successfully Yat a later . An symptom of Caz us is if the , the DOS indicate Ton all It is what Caz it is probably related. of Caz are: Caz-B: , Caz-B is equivalent to the Caz . It has two differ fthe : Spain See: Zaragosa PZPAPN CB-1530 : CB-1530 1530 H: R: 1,530 - 1,544 4: PRhAK - IBM , VET, NAV 2.1+, The CB-1530 . Its , are . CB-1530 is a vof . ,and . It is on the , and software may detect it as such. The CB-1530 is X, the at the top of #the , as measured the DOS ?by 3,696 {21 and 27 nby CB-1530 in |12's moved. CB-1530 has , it very small ones) qd in by 1,530 qd in by 1,530 to 1,544 In both cases, the at the end of the be no 2to the =and in the DOS E. One : "CB". It is what CB-1530 See: Alexander ; Edcl Father PZPAPN CCCP-510 : CCCP-510 H: ^, 1993 R: 510 4: PNCK - \2.07+, V102+, V102+ The CCCP-510 ^, 1993. It is fthe . CCCP-510 is a the CCCP-510 X, the CCCP-510 xone . in the 510 at the end of the a. The =and in the DOS to the =and . The can be in the 4in all CCCP-510 "*** CCCP - 75! ***" "DoomsDay..." "*.com" It is what CCCP-510 PZPAPN : CD Thursday The 12th H: Kwrite protect Germany R: 2,161 - 2,175 4: PRhA - , VET, IBM NAV 2.1+, 1.53S+ The CD fGermany. CD is vof . ,and . `, and +. On Thursdays are the 12th day of the month, it The CD is X, CD at the top of , but #the , as measured by the DOS ?by 2,448 nby the , CD ,and . was less 2,161 to 2,175 at the end of the fwrite protected in a write protect Uas the Nnot intercept Ucondition. On Thursdays are the twelveth day of the month, it Mthe every fourth VirCheck V1.2 (C) Be aware of those worms out , violating your machine on Friday 13th = it's tomorrow! Special ks to Ross M. Greenberg, Patricia M. Hoffmann and John McAfee Press any key to continue... The Nnot do Mthe the highlighted box in the center of the . If the strikes any key, the were of CD are: Thursday The 12th: to CD, 's major on open as well as in Iceland, and was PZPAPN Cerburus : Cerburus H: j; dog's head graphic; ; interfers .BAT R: 1,353 4: PRaCK - 6.04+, \2.07+, V99+, The Cerburus . Its place of . Cerburus is a vof . over 2K in The the Cerburus X, the Cerburus , hooking {21, 28, and 60. be no rby the DOS Cerburus is , it in the a DOS DIR issued. 1,353 at the !of the a. The =and in the DOS not be the Cerburus may notice a graphic dog's head on the upper half of the M. The head move fleft to right, wiping out the contents of the Mas it passes. At the same , the Lat the top of the "***CERBURUS***" The is not the can be in the all Zof .BAT `may be interfered Cerburus is may produce odd s. It is particularly noticeable in batch Zof the DOS DIR PZPAPN : Chad H: 0to 00-00-80 00:00; England R: 751 4: PNCK - , VET, 6.00+, 3.93+, 25.10+, V99+, 1.53S+ The Chad . It is fEngland. Chad is a the Chad search the Eto locate a previouly x. If one is d, it sby the the Chad qof 751 at the end of the a. The in the DOS to be blank or missing, it has actually set to 00-00-80 00:00. The can be in the Chad 4in all "Software "WOT!! No Anti - "CHAD Against Damaging es ... Save Our Software. The Chad Mthe 10th generation of the PZPAPN Chang : Chang H: R: 1,701 - 1,773 4: PRhAK - The Chang . Its . Chang is a of . ,and . the Chang the Chang at the top #the &. It move |12's , as rby the DOS by 1,760 nby Chang in the Chang , it X. If qof 1,701 to 1,773 at the end of the a. The =and the DOS not be The can be in the all Chang "YOU CAN CHANG SOMETHING OF THE PROGRAM I HAVE GIVEN UP MY COPYRIGHT, AND I HAVE LEFT SOME SPACE FOR YOU. THANKS!TOO MANY WRITE PROTECT!!!" It is what Chang may do of Chang are: Chang-B: gequivalent to the is slightly modified. Chang 007: Behaviourly to the Chang Chang 007's is 23,312 (, hooking |21. It adds 23,310 - 23,325 (to the W, and w. Its position in the aand are the same as for the . Most of the 23,310 plus adds to `consists of hex zero : Canada PZPAPN H: ; TSR China R: 3,072 - 3,104 4: PRsAKX - W, & 6.00+, V100+, 1.53S+, V100+ The C . It is fChina. C kha is a vof . ,and . +. It wthe X, the C as a low TSR of 3,392 (, hooking {08, 13, and 21. , it xthe if it was not the C , it for any reason. qof 3,072 3,091 to 3,104 (. In both cases, the the end of the a. The =and in the DOS not be . The can be in the 4in all C "Welcome!" "Auto-Copy Deluxe R3.0" "(C)Copyright . Mr. YaQi. C kha China" "No one can Beyond me!" "Invalid ULoading Operating "Missing Operating "New Century of Computer Now!" It is what C PZPAPN Changu Mangu : Changu Mangu JKTK H: BSC; India R: N/A 4: BRtX - 1.15a+, \2.07+ : DOS SYS on I, M- K/P on , DOS FDISK /MBR for DOS 5.0 The Changu Mangu, or JKTK, ~in India. Changu Mangu is a vof the ) and 360K 5.25" . It Nnot the of high density The the Changu Mangu at the top of #the DOS &, moving |12's , as rby the DOS ?by 10,240 , the Changu Mangu xthe it was not sby the the Changu Mangu , it the of non-write protected, 360K 5.25" are accessed. The moved to cylinder 39, side 1, Changu Mangu Nn't to do PZPAPN Chaos : Chaos H: >, 1989 ; TSR; bad ; BSC England R: N/A 4: BR - K, CleanUp, or DOS SYS breported in >, 1989 by James Berry of Kent, England, the Chaos is a vof floppy and the Chaos , it s the out copying it to an location on the 8the "Welcome to the New Dungeon" "Chaos" "Letz be cool guys" The Chaos flag the "full of bad upon most of the supposed bad are still readable. It is what the criteria is. PZPAPN Chaser : Chaser H: R: 980 - 994 4: PNE - 2.43a+, \2.07+, The Chaser . Its . Chaser is a vof . the Chaser X, the Chaser xone . in the it has hang . The not be run. the Chaser qof 980 to 994 at the end of the a. The =and in the DOS not be . No in the 4in Chaser PZPAPN : CHCC H: R: 2,664 - 2,678 4: PNAK - 6.04+, V100+, V100+ The CHCC . CHCC is a vof . ,and . the CHCC X, the CHCC xone . ,and one . on the 2,664 to 2,678 at the end of the a. The =and in the DOS not be . The the 4in all CHCC WSYSBAT" "ChCC" The second very near the end of the It is what CHCC PZPAPN CheckSum : CheckSum CheckSum 1.00, CkSum H: Poland R: 1,233 4: PRhCK - , VET, NAV 2.1+, The CheckSum . It is fPoland. CheckSum is a vof . The the CheckSum X, the CheckSum at the top of #the |12's moved. , as measured by the DOS ?by 1,264 nby the the CheckSum , it the CheckSum of 1,233 at the end of the be no 2to the =and in the DOS the CheckSum [frequent , and later the again. of CheckSum are: CheckSum 1.01: to the CheckSum is one )shorter, adding 1,232 (to the . : Poland CheckSum 1.01B: to CheckSum 1.01B, has six differ. : Poland CheckSum-1569: on the CheckSum it can Its is 1,600 (, hooking ,and . adding 1,569 (to the . The at the end of the a. Most ing in a "Divide overflow" Uand the ed to the DOS prompt. PZPAPN Cheeba : Cheeba H: R: 1,683 - 1,698 4: PRsAK - 1.15a+, 2.43a+, 25.10+, The Cheeba . Its . At the it was were two Cheeba es. The is a vof . +, and #. The second, Cheeba-B, is a vof . ,and . +, and is listed under " The the Cheeba X, it at the top of #the , as rby the DOS ?by 3,392 |12's not moved. nby the Cheeba Cheeba is , it xthe target +, are copied. It not . The source aof the copy operation not be Cheeba 1,683 to 1,698 at the end of the a. The =and in the DOS are no in the Cheeba It is if Cheeba . It uses a complex encryption mechanism. of Cheeba are: Cheeba-B: Very to the Cheeba , the major difference Cheeba-B is are copied. Like Cheeba, the target s, the source the copy operation Cheeba-1691: gequivalent to the Cheeba-B listed 's main difference is it adds 1,691 - 1,706 (to the . March, Cheeba-1691B: to Cheeba-1691, adds 1,691 - 1,706 (to the . minor March, See: Chemmy PZPAPN Chemmy : Chemmy H: R: 1,691 - 1,706 4: PRhAK - 2.43a+, The Chemmy . Its . Chemmy is a vof . ,and . bChemmy X, the Chemmy at the top of but #the , as rby the DOS by 3,392 |12's moved. nby the Chemmy the Chemmy , it are copied. The source not be the target the Chemmy qof 1,691 to 1706 at the end of the . The =and in the DOS not be Chemmy is an , and no the It is what Chemmy may do of Chemmy are: Chemmy-B: Chemmy-B is a minor of the Chemmy , and gequivalent. See: Cheeba PZPAPN Christmas Tree : Christmas Tree Tannenbaum, XA1, 1539 Endangered H: March, destruction Germany R: 1,539 4: PNCX - , NAV, IBM , VET, : NAV, or The Christmas Tree, or XA1, ~in March by Christoff Fischer of West Germany. is an encrypting 1st of any year, the Christmas Tree activate, destroying the ) of Ks the X. During the period >24th until 1st of any year, X, the Ma full picture of a christmas tree. PZPAPN Cinderella : Cinderella H: j; TSR Finland R: 390 4: PRsCK - , NAV, , IBM ., VET, The Cinderella ~in Finland in Cinderella is a vof . The Cinderella is X, the as a low TSR of 560 nby the Cinderella is , it for any reason. by 390 The at the end of the a. The can be "cInDeReL.la" Cinderella Nn't do of Cinderella are: Cinderella-B: gequivalent to the has two differ. : Finland PZPAPN Civil War : Civil War H: The R: 244 4: PNC - 6.04+, V100+, 2.45+, V100+ The Civil War , and fThe . Civil War is a vof . , but not +. Later pCivil War II v1.1 and Proto-T, listed under , are vs of . , and may +. The Civil War III v1.0 . Later s of the Civil War S, and listed under the TPE entry as software most likely identify the encryption engine rather present. the Civil War xone . in the qof 244 at the end of the a. The =and in the DOS not be The in the 4in all Civil War "Civil War, (c) Dark Helmet" "*.com" of Civil War are: Civil War II v1.1: , Civil War II v1.1 is a later of the Civil War The at the top of #the , as rby the DOS ?by 1,024 nby the Civil War II v1.1 is , it any reason. qof 599 at the end of the a. The =and in the DOS not be . The in the 4in all "Civil War II v1.1," "(c) 06/03/ Trident/Dark Helmet, The : The Civil War III v1.0: in March, 1993, Civil War III v1.0 is a later of the Civil War The at the top of #the , as rby the DOS ?by 1,200 nby the Civil War III v1.0 is , it ,and . for any reason. qof 901 the end of the a. The =and in the DOS not be . The in the 4in all "Civil War III v1.0," "(c) Dec , [ DH / TridenT ]" : The March, 1993. Proto-T: , Proto-T is on the Civil War , and s to be an earlier of the Civil War II v1.1 . It Nnot match the description of the rumored Proto-T was circulated on BBSes starting in . Proto-T the top of #the and , as rby the DOS ?by 1,280 nby Proto-T in Proto-T is , it qof 695 at the end of the a. The and in the DOS not be . The in the 4in all Proto-T is sick." "[PROTO-T by Dumbco, INC.] Proto-T s access the Kinstead of becoming access ends, the be inaccessible until the is re See: TPE PZPAPN Clonewar : Clonewar H: Hidden . `created; WC failure executing . R: 247 4: SNE - Spawning 1.15a+, V99+, 2.43a+, \2.07+, 6.04+, V99+, The Clonewar . It s to be fthe . Clonewar is a spawning or companion the Clonewar X, the Clonewar xone . in the Eby creating a hidden, read- the same base . The hidden, companion of 247 (and its =and be the and it was created. The din all of the companion The 8the of the companion a, and the Wextention. Clonewar may receive the WC failure" , and are ed to the DOS prompt. Clonewar Nn't do , but it Ninterfer operation. of Clonewar are: Acme: , Acme is a 923 the Clonewar . The companion creates of 923 the read- hidden attributes set. The same din the s in . Acme not always X, but s play a repeated a series of tones on the speaker while leaving the Ospinning. PZPAPN Close : Close H: %failure on C: R: 662 - 672 4: PRhE - , VET, , NAV 2.1+, .1.4+, 1.53S+ The Close . Its . Close is a vof . eventually corrupt one of the `required %the fthe C: The the Close Close at the top of #the , as rby the DOS ?by 784 the Close , it qof 662 to 672 at the end of the a. The in the DOS not be . Two in the Close "C:\IO.SYS C:\IBMBIO. "Close .." The Close was intermittently activate, at Mthe "Close .." on the corrupt either C:\IO.SYS or C:\IBMBIO. ,. The be hung. to re %the fthe C: fail as one of the hidden `is corrupted. tor replacing all the Close , the should replace the hidden `on the C: Ousing the DOS SYS PZPAPN CLS-853 : CLS-853 H: ; unexpected clears R: 853 4: PRhAK - 1.15a+, 2.43a+, 6.04+, \2.07+, V100+, V100+ The CLS-853 . CLS-853 is a vof . ,and . bCLS-853 X, the CLS-853 at the top of #the &. It {08, 13, and 21. |12's not be moved. , as the DOS ?by 1,120 the CLS-853 , it and . qof 853 at the end of the a. The =and the DOS not be . No are in the the CLS-853 [the "cleared unexpectedly The , "CLS", refers to symptom of the PZPAPN Cmdr Bomber : Cmdr Bomber H: May, j; TSR R: 4,096 4: PRhC - V99+, \2.07+, 2.45+ The Cmdr Bomber in May, . It ', and is believed written by the same person whom wrote the . Cmdr Bomber is unusual in the method in complicates the detection process for using certain s of technology. the Cmdr Bomber X, the Cmdr Bomber as a low TSR of 2,752 nby the Cmdr Bomber the Cmdr Bomber , it by 4,096 (. The the ma number of garbled (at the in the Zof the jumping to a location in the middle of the awhere the 4. In effect, the in the middle of the a. The =and in the DOS not be The can be in the Cmdr Bomber ,MANDER BOMBER WAS HERE" "[DAME] [DAME]" is not related the the Bomber Malaysia. PZPAPN Coffeeshop-1568 : Coffeeshop-1568 Coffeeshop 1 H: Sweden R: 1,568 4: PRhA - 6.04+, V99+, 1.53S+ The Coffeeshop-1568 . It is probably fSweden. Coffeeshop-1568 is a of . ,and . , but not +. It is not ;Mutating Engine, are two as Coffeeshop and Coffeeshop 2 do use the mutating engine. See the entry for DAME for Coffeeshop The the Coffeeshop-1568 X, Coffeeshop-1568 the top of #the &, not moving |12's measured by the DOS ?by 1,824 nby Coffeeshop-1568 is , Coffeeshop-1568 ,and . by 1,568 at the end of the a. The =and in the DOS not be . One in the 4in all "CoffeeShop" It is if Coffeeshop-1568 See: DAME PZPAPN H: N/A R: N/A 4: G - Generic The is not actually a specific , but a general category or group of can be genericly detected by software using ner technology. It was implemented by McAfee Associates in The es detected by the detection mechanism in are generally vs. es may be malicious. be detected as the include: Friday The 13th Hastings Possum Revenge Attacker Thimble Violetta New es may be detected by mechanism are not documented in . If you detect a , and it match one of the es, please submit a sample to the author of for analysis and inclusion in PZPAPN Commy : Commy H: <seconds R: 998 4: PNCK - 6.00+, 2.43a+, \2.07+, V100+, V100+ The Commy . It is fthe . Commy is a +. It 9PM (21:00). the Commy X, the check the . If the is before 9PM, the pass control to the host and not . If The is 9PM or later, the xone . in the Ebefore passing control to the host the Commy qof 998 at the end of the a. The =and in the DOS to be the seconds field set to 44, 46, 60, or 62. The in the 4in all Commy "The DIRTY ,MY said .." "PATH=" It is what Commy PZPAPN : Como Como-Lake H: Italy R: 2,022 - 2,035 4: PNE - 6.00+, }, NAV 2.1.2+, 2.43a+, \2.07+, V100+, V100+ The Como, or Como-Lake, , and fItaly. Como is a vof . the Como may in the about a 1 in 7 probability. qof 2,022 to 2,035 at the end of the a. The =and in the DOS not be . The in the 4in Como is the" ,O-LAKE" "(rel. 1.1)" "I'm a non-destructive developed to study the worldwide" "diffusion rate. I was released in by a software" "group near Como lake (north Italy)." "Don't worry about your data on K. My activity is limited "to auto-transferring into `. Perhaps you've got" "many s. It's your task to find and Athem." "Best wishes." "Pres a key to Ythe PZPAPN Copyright 00X T ~PTX : Copyright V1193 H: R: 1,193 - 1,208 4: PRhCK - , IBM 1.15a+, C, NAV 2.1+, The Copyright . It is the . Copyright is a vof . The the Copyright X, the at the top of #the , as rby the DOS ?by 1,200 nby the Copyright |12's moved. the Copyright , it 1,193 to 1,208 at the end of the `. Copyright =and in the DOS to the =and The can be in the Copyright "(C) 1987 American Mega s Inc.286-BIOS" "(C) 1989 American Mega s Inc" "(c) COPYRIGHT 1984,1987 Award Software Inc." "ALL RIGHTS RESERVED" The d due to the fake copyright . American Mega s and Award Software had nothing to do ' creation. It is if Copyright of Copyright are: Copyright-1205: , Copyright-1205 is a 1,205 of the Copyright Its is 1,216 (, moving |12's . Like the , it hooks it is , Copyright-1205 X, adding 1,205 to 1,220 to the . The at the end of the a. The =and in the DOS to the =and . The can be in the Copyright-1205 4in all "(C) Software Developed by Maxi" "Lena All Rights Reserved" "(c) COPYRIGHT 1984,1987 Award Software Inc." "ALL RIGHTS RESERVED" Ungame: , Ungame is a 766 of the Copyright . Its is 768 (, and it hooks {08 and 21. , it ,and . of 766 at the end of the mthe structure of . u. The =and in the DOS to the =and . The can be in the 4in all Ungame "Come On, no. 51, You is up." "Ungame(C)Dr" PZPAPN Cossiga : Cossiga H: j; video mode 2to 40 columns; don't Italy R: 875 - 899 4: PNE - , VET, o, NAV 2.1+, The Cossiga . It is fItaly. Cossiga is a the Cossiga X, the Cossiga search the Efor the . If an xit. it has completed , the switch the video mode to a 40 column M, and the block letters: "COSSIGA ?! NO GRAZIE! By Amissi dee Panoce (c) PADOVA" The host function, instead the ed to the DOS prompt. the Cossiga qof 875 - 899 (. The at the end of the . The =and in the DOS not be . The can be in the 4in Cossiga "*.*" "*.exe" "AXI TY" See: Friends PZPAPN Costeau : Costeau H: , 1993 R: 512 4: PRE - 6.04+, \2.07+ The Costeau , 1993. Its . Costeau is a of . bCosteau X, the Costeau in the DOS Data area in , hooking |21. , as rby the DOS not be the Costeau , it qof 512 at the end of the a. The =and in the DOS not be . The can be in the 4in all Costeau "COSTEAU" "End.MZ" It is what Costeau may do PZPAPN CPSU-2535 : CPSU-2535 Protecto-2535 H: ^, 1993 R: 2,535 4: PRtA - \2.07+, V102+, NAV 2.1.4+, 2.45+, V102+ The CPSU-2535 ^, 1993, and is is a vof . ,and . , but not bCPSU-2535 X, the CPSU-2535 at the top of #the &, moving |12's , as rby the DOS ?by 3,088 nby CPSU-2535 in the CPSU-2535 , it qof 2,535 the end of the a. The =and in the DOS not be . No in the It is what CPSU-2535 See: Protecto PZPAPN : CPW H: .Exe interference Chile R: 1,459 4: PRhAK - V99+, 6.04+, \2.07+, The CPW . It is fChile. CPW is a vof . ,and . bCPW X, the CPW at the top of but #the &, hooking {16 and 21. , as rby the DOS ?by 2,000 (. Interupt 12's not be moved. , the copy of in the C: Oroot by the if it was not the CPW , it qof 1,459 at the end of the a. The =and in the DOS not be . The in the 4in all CPW "Este a fue hecho en Chile en por CPW." "C:\ "Feliz cumplea os CPW" "You are here CPW!" "ULS" the CPW for awhile, it activate. Upon , it Mthe at the DOS prompt, one character at a . The 3of the replace the 3the is typing on the "You are here CPW!" The character substitution continues until the hits an ALT+key combination on the , such as ALT+C. An effect of the in the .Exe fthe kmay PZPAPN Cracker Jack : Cracker Jack NeCrop H: May, Italy R: Varies \2.07+, The Cracker Jack, or NeCrop, in May, V. Cracker Jack is an ICE it has release the 1963-B into the . See the entry for 1963 for a description of the dropped See: 1963 PZPAPN Crash : Crash 1075, Russ-1075, DBF blank Rumored H: R: 1,075 \, NAV, IBM , VET, The Crash or 1075 has had many samples over the last few months. The samples were fthe . All samples of " do not on an XT or 386 personal computer. Instead, the crashes the sample X. It may under configurations. PZPAPN Crazy Eddie : Crazy Eddie England H: England R: 2,600 - 2,715 4: PRtAKX - W, & , IBM , VET, NAV 2.1+, The Crazy Eddie fEngland. Crazy Eddie is a multi-partite the ,, and . The the Crazy Eddie xthe it was not s. The locates a copy of its 4on the cylinder 0, side 0, 2-4, and alters the . The Nn't , and s, the Crazy Eddie %s the the K. At , Crazy Eddie at the top of &, moving |12's and , as rby the DOS ?by 17,408 {00, 10, 14, and nby the Crazy Eddie is , it ,and . xone in the a DOS DIR 5is performed. Crazy Eddie of 2,600 to 2,715 at the end of the . The =and in the DOS . One in the 4in all "Crazy Eddie" Crazy Eddie is a destructive on Monday The 28ths as well as on 28th. On =s, it corrupt the PZPAPN Crazy Imp : Crazy Imp H: may dis R: 1,445 4: PRtCK - NAV 2.1+, The Crazy Imp . Its . Crazy Imp is a If the Crazy Imp not be able to detect it on are read into The the Crazy Imp X, the Crazy Imp the top of #the 12's moved. , as rby the DOS by 4,096 {1C and 21 nby the . The ed to by the ,SPEC en variable, usually if it was not sby the Crazy Imp the Crazy Imp , it many qas the hides the is not qof 1,445 at the end of the a. The can be in the is not "Crazy imp" "v2.0" rearlier, Crazy Imp is a X, hides the q, and dis are read into Zof an is not aware of in the uof all . on the out any "detected on the If you think you , power off the and re fa write-protected, J, and check the for the It is if Crazy Imp of Crazy Imp are: Crazy Imp-1402: as Crazy Imp v1.5, Crazy Imp-1402 is an earlier of the Crazy Imp . Its is 6,144 (, hooking {1C, 21, and 22. are qof 1,402 at the !of the a. The q, however, is hidden by the it is . The =and in the DOS to be un may "dis ". The seconds field in the set to "62". The are in the Crazy Imp-1402 "Crazy imp" "v1.5" Crazy Imp-B: to the Crazy Imp has two differ. PZPAPN Creeper : Creeper Creeping Tormentor H: R: 475 4: PRhCK - NAV 2.1+, , VET, The Creeper, or Creeping Tormentor, . Its . Creeper is a of . The Creeper is X, the Creeper at the top of #the |12's moved. , as rby the DOS by 1,024 {1C and 21 nby the the Creeper , it X. If X, it s. Creeper qof 475 at the !of the . The =and the DOS The Creeper looks for the Tormentor , checking for the "TORMENTOR". It is if Creeper of Creeper are: Creeper-B: gequivalent to the Creeper has one May, PZPAPN Crew-2480 : Crew-2480 2480, V2480 H: %s; graphic Finland R: 2,480 4: PNCK - , IBM NAV, , VET, The Crew-2480 . It was ~in Finland. is a non- vof . over 10K in . It the Crew-2480 X, the xone . aover 10K in if the month is through May. sby the , the by 2,480 at the end of the . The =and in the to the =and $the a Crew-2480 umay Later Zof the same may be successful. During the months of through >, Crew-2480 Xduring period, the Ma formatted making reference to the Van Cracking Crew". of Crew are: Crew-2480 B: on the Crew-2480 Nnot Mthe graphic, it is present in the . Instead, a hang upon Crew-2480 C: on the Crew-2480 minor PZPAPN : CRF H: R: 270 4: PNCK - \, VET, .1.4+, NAV 2.1.4+, The CRF . Its Hare . CRF is a vof . the CRF X, the xall `in the Oand E. If by 270 at the end of the . The =and in the DOS to the =and . Two in the `: "OZR3" and "*. It is if CRF PZPAPN Criminal : Criminal H: j; TSR; R: 2,615 4: PRsCK - , NAV 2.1+, The Criminal . Its . Criminal is a vof . The the Criminal X, the Criminal a low TSR of 480 {21, D0, and EA. An TSR of 3,712 zed, nany , the Criminal xthe bthree . `in the sample of Criminal by the author of , it Nnot . Further, it is xious fthe sample, not d samples. the Criminal by 2,615 (. The at the end of the . The =and in the DOS Criminal may notice the DOS indicate +has a s if the It is if Criminal of Criminal are: Criminal-B: to the one . Nnot xmore three . in a E. Its is 470 (. Nineteen (differ fthe PZPAPN Crusher : Crusher H: ; cross-linking of The R: 2,048 4: PRhEX - V99+, The Crusher . It is . Crusher is a vof the ) and . . It employs techniques to avoid detection. The the Crusher the Crusher xthe . It writes an un Scopy of the 4to Side 0, Cylinder 0, 2 thru 5, and alters the Xthe next fthe K. It Nnot The next fthe K, the Crusher at the top of but #the , as rby the DOS by 2,064 nby Crusher in the Crusher , it qof 2,048 be hidden is active in . The in the DOS not be . The in the "Crusher" "You are damned" "Bit Addict / Trident" The Crusher Mthe it is cross-linking of PZPAPN : CSL MicroElephant V6 j; "Bad exist Eastern R: 457 4: PRtCK - ., NAV 2.1+, , VET, The CSL, or MicroElephant, is a vof . bCSL X, the at the top of the |12's moved, however to be no rby the DOS CSL has , it X. If X, it s. CSL qof 457 at the end of the a. The =and in a DOS not be . The can be in the "Microelephant V6 by CSL" CSL may [the "Bad ", and a to the DOS prompt, the over 64K in . The . themselves mnot but it is the ing the CSL Nn't do and interfer of CSL are: CSL Beta: CSL Beta, or MicroElephant Beta, is to the CSL , CSL Beta adds 381 (to the . not restore the host <in the DOS , so a be noted. It 7the "26.07.91.Pre-released Microelephant by CSL". CSL V4: CSL V4, or MicroElephant V4, is to the CSL , CSL V4 adds 517 to the . w. The =and in the DOS . The ctwo in the "Microelephant V4" and "by CSL". CSL V5: CSL V5, or MicroElephant V5, is to the CSL , CSL V5 adds 457 (to the . w. It 7the in its "Microelephant V5 by CSL". PZPAPN Curse : Curse Smiley Worm H: corrupted Northern California, R: N/A 4: BRt - , NAV 2.1+, 1.15a+, VET, , IBM 24.00+, \2.07+ : CleanUp, or DOS SYS on The Curse reported in samples did not ing to be incomplete. The bworking sample of the Curse a public domain uat a college in Northern California in . Curse %is a 360K 5.25 inch , as well as . It is a aling it is The the Curse , the Curse xthe . The mmarked four bad in the , and transferred the and three bad . The sby the . At the Curse , allocating 4,096 fthe top of #the |12's moved. , the Curse x360K 5.25 inch are accessed for any reason. As K, the marks four bad, and places the and three wthe Curse %may notice upon mthe hours set to zero, instead of the actual value stored in CMOS for the clock. For example, if the clock on %is 21:30.00, %ing Curse K, the read 0:30.00. Curse %hides the uon 360K 5.25" Fing to read the to the . As a not be able to detect the Curse . It Nnot, however, hide the uof the PZPAPN : CV4 H: R: 321 4: PNCK - 1.15a+, 2.43a+, The CV4 . Its . CV4 is a of . the CV4 X, the CV4 xone in the E. If it may the CV4 qof 321 at the end of the a. The =and in the DOS not be . The can be din the 4in all CV4 ,VIRUS 1.0" The Lon the monitor CV4 Nn't do Mits PZPAPN Cyber : Cyber H: R: 1,092 - 1,106 4: PNAK - The Cyber . It s to be fNorth America. Cyber is a of . ,and . the Cyber X, the Cyber search the Eto locate an . If one is d, the wit, and Yruns. If an awas not d, the search the for an x, and the Cyber qof 1,092 (. . qof 1,092 to 1,106 (. In both cases, the at the end of the a. The =and in the DOS not be The can be din the Cyber all "*.com *.exe" "A trip into the realm of intelligent replication..." The Cyber Nn't do of Cyber are: Cyber-946: A 946 of the Cyber wone . in the qof 946 at the end of the a. The =and in the DOS not be . The can be in the 4in all Cyber-946 "*.com *.exe" PZPAPN CyberTech : CyberTech CyberTech-A H: ; removal of The R: 1,066 or 1,076 4: PNCK - 2.43a+, V100+, V100+ The CyberTech, or CyberTech-A, The s to be The . CyberTech is a vof . the CyberTech X, the CyberTech xone . in the 1,066 or 1,076 at the end of the qd in by 1,066 had 10 (of validation by the removed. The =and in the DOS The CyberTech Mthe "CyberTech - Strain A (C) John Tardy of Trident" >31, , the Mthe and dis xthe athe is executing "The previous year you sby a out knowing or removing it. To be gentle to you I decide to remove myself fyour . I suggest you better buy of McAfee to ensure yourself complete security of your precious data. Next could be a malevolent May I say goodbye to you now All of the in the , as is the "chklist.cps" CyberTech may interfer the functioning of the Central Anti- of CyberTech are: CyberTech-B: on the CyberTech adds 1,205 or 1,215 (to the . the exception of +. In the case of +, it part of the slack (hex 00) area in the be no q. It Ms the "CyberTech - Strain B (C) John Tardy of Trident" The >31, 1993, Mthe same as the and dis xthe is executing. : The (?) PZPAPN : Dad H: j; TSR; Argentina R: 897 4: PRsC - \, IBM , NAV, }, VET, 2.43a+, 25.10+, The Dad Gin Argentina in May, . It is a vof . , but not bDad X, the Dad as a low TSR of 1,232 (. It hook {21 and F8. becoming xany . X, and Mthe on the "DAD WAS HERE" the Dad qof 897 (. The at the of the be no 2to the =and in the DOS is unable to determine it has a, so it `, adding an (for The can be din the 4in all Dad "Argentina!" ,MAND ,A:TMP$$TMP. "Que dia es hoy?" "PRIMERO DE ABRIL!!!" "(C) DAD DAD WAS HERE" PZPAPN : Dada H: may fail to R: 1,358 - 1,372 4: PRsE - , VET, , NAV 2.1+, 1.15a+, The Dada . Its . Dada is a of . The the Dada as a low TSR of 2,048 (. Most mapping utilities show it as an in the of the in- 5interpretor. and 21 nby Dada in . The alter the ceiling for conventional , so mabout 64K of conventional . The remaining conventional the Dada , it qof 1,358 to 1,372 at the end of the . The =and in the DOS to the =and . The can be in the "PATH=. As a of the Dada ' alteration of conventional Zof . over 64K in may not Yin the way the expects. Unpredic Tmay PZPAPN Damage : Damage Damage-B H: May, effects; " Italy R: 1,063 4: PRhAK - \, IBM , VET, C, NAV 2.1+, The Damage Vin May, . Damage is on the Diamond of V1024. It is a vof . ,and . bDamage Xon a Damage at the top of #the , as measured by the DOS by 1,120 {08 and 21 nby the Damage is , it ,and . over 1K in X, it by 1,063 at the end of the a. The however, be hidden if Damage is . If the in the Ewas 12:00a, its be blank Lif Damage is The DOS not find Tas it Damage is Damage is 14:59:53. At ma large, multi-color diamond in the center of the M. The diamond break up into smaller diamonds shoot around the cleaning off the Occasionally, the Damage format a section of the formatting to read a amay damaged, or if the to write to one of areas. Damage mthe near the end of the "DAMAGE of Damage are: Damage-B: Damage-B is a 1,110 of Damage, +. The be 1,152 Two can be "Jump for joy!!!" "DAMAGE-B!!" Damage-B may be detected as Lucifer by as it is very See: Alfa Lucifer V1024 PZPAPN : DAME Coffeeshop, Coffeeshop 2, CryptLab, DarkStar, Dedicated, Dedicated 2, Dedicated 3, Encroacher, Encroacher 2, Fear, MTE, MTE Spawn, MTE Spawn 2, Questo H: Kwrite failures; warm re R: Over 3,000 4: PNCK - V99+, , VET, 6.00+, The DAME, or ;Mutating Engine, was . DAME is not actually a , but rather a polymorphic encryption engine is used as part of the entry. The encryption produced by the encryption engine is extremely complex, no more three (remaining constant d samples. As a engine can be identified by the presence of the encryption engine . One has be included in separate entry uses engine: Pogue . e(s) using DAME are: Coffeeshop: , Coffeeshop is a vof . uses a modified of the ;Mutating Engine. It at the top of , as rby the DOS ?by 12,288 (, and , it X, adding 3,820 - 3,974 . The at the end of `. The in the it is not "Amsterdam - COFFEESHOP!" : Amsterdam, The Coffeeshop 2: , Coffeeshop 2 is on the Coffeeshop . Its usage of is the same as for the Coffeeshop , it X, adding 3,845 - 3,977 . The at the end of `. The in the are not in most "Amsterdam = COFFEESHOP!" : Amsterdam, The CryptLab: The CryptLab s to be fthe . CryptLab is a vof . CryptLab X, the search the Efor x. It may xup to eight . Zof an the CryptLab qof 2,982 to 3,227 at the end of the a. The in the DOS not be . The in most samples of the "CryPtLAB: THE SELECT CHOICE FOR ALL YOUR VIRUS AND TROJANRESEARCH NEEDS!" "-URNST KOUCH." DarkStar: A DarkStar xup to four . in the X. If E, it may DarkStar qof 2,971 to 3,235 (. The at the end of the a. While usually be fully 8an un Scopy of the Ssamples 8the "NightMare Labs, United Kingdom" "- DarKStaR -" : England , 1993. Dedicated: A Dedicated xup to four . in the X. If E, it may DAME qin excess of 3,100 (. The at the end of the a. While usually be fully 8an un Scopy of the Ssamples 8the "We dedicate little to Sara Gordon who wanted to her." Dedicated Nnot do Dedicated 2: , Dedicated 2 is on the Dedicated . Unlike the Dedicated , Dedicated 2 is a of . . It at the top of #the , as rby the DOS ?by 5,120 Dedicated 2 adding 3,582 to 3,758 The at the end of the a. The =and in the DOS not be . The in the 4, and not be in most "We dedicate little to Sara Gordon," "who wanted to mit corrected--" "learn to before you touch M_t_e" Dedicated 3: , Dedicated 3 is the Dedicated 2 . Dedicated 3 is a vof . ,and . . Its is 5,120 (, hooking |21. Dedicated 3 ,and adding 3,539 to 3,717 The at the end of the a. The =and in the DOS to the =and . The in the 4, and not be in most "We dedicate little to Sara Gordon," "who wanted to mit corrected--" "learn to before you touch M_t_e" Encroacher: A Encroacher xone . in the X. If E, it may Encroacher qof 3,227 to 3,483 at the end of the be no 2to the =and in the DOS . The are usually in the 4in Encroacher "ENCROACHER is here" ,chklist.cps C:\ .\VSAFE. Encroacher may interfer the functioning of Central anti- it is zed in its default zation Encroacher 2: to Encroacher, minor Fear: A v, Fear xup to four . in the X. If E, it may Fear qin excess of 3,000 at the end of the be no 2to the in the DOS the Fear Scopy of the Fear samples 8the "Fear Created 2-5-92 by PkaHerONE" ,You mnothing to fear except FEAR the Fear [warm ring unexpectedly, or general failure Twriting to a non-existant all the `in the hang March, MTE Spawn: , MTE Spawn is a non- spawning or companion uses the Dark Avenger Mutating Engine for its encryption. xone . in the E, creating a 6,666 to 6,746 the same base companion mthe read- , and hidden attributes set, and its =and be the =and . The not be Zof an MTE Spawn in a hang five . `in the the companion not be Xunder of DOS due to a minor bug in . To dis uof MTE Spawn, simply Athe hidden companion MTE Spawn 2: , MTE Spawn 2 is a non- spawning or companion uses the Dark Avenger Mutating Engine for its encryption. xone . in the E, creating a 2,754 to 2,894 the same base companion mthe read- , and hidden attributes set, and its =and be the =and . The not be Zof an MTE Spawn 2 in a hang five . `in the the companion not be Xunder of DOS due to a minor bug in . To dis uof MTE Spawn 2, simply Athe hidden companion Questo: A Questo xfour . in the X. If E, it may Questo qof 2,971 to 3,227 at the end of the be no 2to the in the DOS . The are usually in the 4in Questo "Questo sistema stato infettat*. "MtE 0.90" See: Groove Pogue PZPAPN Amilia, Black Avenger, Boroda, Eddie, Diana, Rabid Avenger, VAN Soft, ;1801, ;-C, PS!KO, Evil Men, ;.1E, Dark Quest H: , 1989 TSR; . W, .SYS Davis, California, R: 1,800 4: PRsAK - \, IBM , NAV, , VET, : CleanUp, \, NAV or ;was ~in the at the University of California at Davis. It W, and overlay +. The into , becoming , and is extremely prolific at tany execu for any reason. includes using the DOS COPY and XCOPY 5s to copy `, both the source and the target end up qd by 1,800 The Nperform malicious damage. The maintains a counter in the Qsixteenth s, the randomly on the a portion of the 4. If the randomly selected is a portion of a or data a, the or data be corrupted. and data corrupted by a are permanently damaged and cannot be repaired since the is lost. If you are ;, shutdown your computer and fa Write Protected Jfor the carefully use a dis call instructions. Be sure to mfinished dis The 7the words: "The copyright 1988, 1989", as well as the written in the city of Sofia. Eddie lives where in bears no resemblance or ity to the es, even ;are: Amilia: on the , Amilia adds 1,614 to the . ,and . w. It +. The at the end of , as rby the DOS be 1,632 n. The Amilia ^2nd, at becoming , and a hang "AmiLiA I Virii - [NukE] Released Dec91 Montreal (C) NukE Development Software Inc." $the , the can be in the "antideb" "AmiLiA I Virii - [NukE] i99i By Rock Steady/NukE" : Montreal, Canada Boroda: ;-D, one : "B O R O D A". It adds 1,800 (to the w, and 1,800 to 1,814 (to the , as rby the DOS be 3,696 {21 and 27 n. As ;, it modify the , and of the a copy of , thus damaging ;.1E: ;-D, 1,800 (to the . w, and 1,800 to 1,814 (to the In both cases, the at the end of the . The "Eddie lives... where in "Diana P." was written in the city of Sofia" "(C) 1988-89 ;.1E notice be slightly , and `may slowly corrupted. +, the ='s format may be f"mm/dd/yy" to " y#mm#dd", and the ":" character in the 0to " ;-B: Very to the , the major difference is be re adding 1,800 (to the in high instead of low TSR. din the 4include: "Eddie lives... where in "Diana P." was written in the city of Sofia" "(C)1988-1989 ;-C: Very to the adds 1,800 to 1,814 The copyright notice is different, having 0to: "(C) 1988-89 ;-D: is very adding 1,800 to 1,814 `. It has the same copyright notice as ;-Romanian: fRomania. The major , adding 1,800 to 1,814 (to the . It 7the same : Romania ;1801: to the , the major difference is has an effective of 1,801 (, one )longer . Like ;-B, it at the top of instead of "a low TSR. It not, however, re N. The same and Dark Quest: The Dark Quest is a 1,800 the . Dark Quest's is 3,696 (at the top of #the &, hooking {21, 22, and 27. It adds 1,800 (to the . w, and 1,800 to 1,815 (to . . The at the end of the a, and the =and in the DOS not be hide the q. The as the keeps a counter . The can be in the 4in all Dark Quest "Never buy Quest computers again!" "iana P." is not dangerous stamp." "All new software seriosly danger" Evil Men: ;-D, "The evil men do !" was written in the city of Sofia" "(C) 1988-89 "Diana P." Kang Yong: The Kang Yong is a 1,947 of Dark Avenger. Unlike members of group, it re . Kang Yong's 3,984 (at the top of #the DOS &, hooking {21 and 27. It adds 1,947 (to the . w, and 1,947 to 1,961 (to . . Re add an 1,947 (. The at the end of the a, and the =and in the DOS not be Nnot hide the q. The as the keeps a counter The can be in the "If you are a thieve man , lives... where always!" "You must good man!" "Kang Yong II" was adjustted in 'Commputer Home' of KOREA" "(C) 1988-89 ,LSR+KYL : Korea PS!KO: The PS!KO ;was . It is fthe . It addes 1,803 to 1,817 w. The can be "The Ps!ko "The Ps!ko - Written in the USA," "(C) by SiTT and The Viola" of an uby PS!KO include . failing to , and frequent PS!KO-1459: The PS!KO-1459 on the PS!KO-1687 #. PS!KO-1459's 3,040 (at the top of #the DOS &, hooking {21 and 27. It adds 1,459 (to the . w, and 1,459 to 1,473 (to . . In both cases, the at the end of the a, and the =and in the DOS not be hides the . The DOS Ton all PS!KO-1459 is are no in the PS!KO-1687: The PS!KO-1687 on the PS!KO-1800 #. PS!KO-1687's 3,472 (, hooking {21 and 27. It adds 1,687 (to the . w, and 1,687 to 1,701 (to . . In both cases, the at the end of the a, and the =and in the DOS not be Nnot hide the it is are no in the PS!KO-1800: The PS!KO-1800 on the PS!KO . PS!KO-1800's is 3,696 hooking {21 and 27. It adds 1,800 (to the . w, and 1,800 to 1,814 (to the . w. In both cases, the at the end of the a, and the =and in the DOS not be Nnot hide the it is . The can be "The Ps!ko "SiTT" "The Ps!ko - Written in the USA, by SiTT and The Rabid Avenger: Rabid Avenger was ~in the the . Its portion is at the top of #the &, and is 3,696 {21 and 27 are by 1,800 by 1,806 to 1,823 (. In both cases, the at the end of the din the 4include: "<- ks to the "Eat us!" "(C) RABID International Development Corp!" Killer Test" so as to avoid detection by utilities are able to detect VAN Soft: VAN Soft was Vin May, 'and is on the . The major now: "V.A.N. Soft & M PRESENT:SOFIA" "VAN& by 1,800 at the end of the by 1,806 to 1,824 at the end of the See: 1963 CB-1530 Outland QP3 V651 V1024 V2000 PZPAPN Dark End : Dark End H: j; TSR; !of C:; interfers R: 1,188 4: PRsAK - 6.00+, \2.07+, V100+, 2.45+, V100+ The Dark End . Its . Dark End is a vof . ,and . bDark End X, the Dark End as a low TSR of 1,200 (, hooking |21. It as part of the 5interpretor in many mapping utilities. the Dark End , it and . qof 1,188 at the end of the a. The =and in the DOS not be . The can be in the 4in all Dark End "(c) Dark End." The Dark End 15th of any year. At , the of the C: the Dark End interference punexpected clearing of the and the cursor flickering. kmay unexpectedly. PZPAPN Dark Lord : Dark Lord Dark Lord-B, ManOWar, T H: May, R: 923 4: PRhAK - , NAV 2.1+, 25.10+, The Dark Lord in May, . It is '. Dark Lord is a vof . The Dark Lord is X, the at the top of #the , as measured by the DOS by 1,616 {21 and 24 nby Dark Lord. Dark Lord is , it ,and . by 923 to 936 at the end of the +is an exception, q, the the stack space on the end of Dark Lord 8the "Dark Lord, I summon thee! MANOWAR" The second near the end of Dark Lord Nnot on 386-class . On those Zof an in a hang. It is if Dark Lord of Dark Lord are: Dark Lord-B: Very to Dark Lord, fthe NCSA collection differs in 1 )internally fthe Lord the goes , if it was not already the exception of by 921 - 935 See: T PZPAPN Darth Vader : Darth Vader Darth-1, Darth-2, Darth-3, Darth-4, Darth-5 Research H: May, R: 200 - 345 4: ORCK - NAV 2.1+, , VET, The Darth Vader es were in May, Darth Vader is actually a ]of four are very . All of es are are copied. a Darth Vader Darth Vader . Latter, as . are copied, the target . Depending on the particular Darth Vader , the target may meither the !of the , or an area of hex 00 by the in the E, and the =and not be Darth Vader es do not perform any malicious damage, are usually damaged and ;are: Darth-1: The bDarth Vader , Darth-1 is 270 . It s the b270 of . are copied . Darth-1 The can be din the ,Darth Vad". Darth-2: Darth-2 is a 345 of Darth-1. Unlike Darth-1, it s 345 (of hex 00 in copied . the ,Darth Vader". Darth-2 and later Darth-3: Darth-3 is to Darth-2, but it is 255 Darth-3 , it s 255 (of hex 00 the : "Darth Vader". Darth-4: Darth-4 is a shorter of Darth-4, it is 200 Nnot 8any Darth-5: Darth-5 is very to Darth-4. Like Darth-4, it is 200 Nnot 8any . Darth-5 copied if the 8ed at least 200 (of hex 00 PZPAPN Datacrime : Datacrime Extinct H: , 1989 j; floppy Kaccess; formats any day fOct 13th to Dec 31st R: 1,168 4: PNC - \, IBM , NAV, , VET, \, NAV, or The Datacrime is a , and is as the 1168 . The Datacrime is a `. The Vshortly its release in March, 1989. The attach to the end of a . a, increasing the by 1168 (. The (of the host are stored off in the 4and replaced by a branch instruction so Xbefore the host . In order to propagate, the searches through Fories for . +and attaches to any `(except for where the 7th letter is a D). s are searched before the floppy Os are checked. The continue to propagate until the 12th of any year, . The decrypted thing like: "DATACRIME VIRUS" "RELEASED: 1 MARCH 1989" Note: ASCII A low-level format of the done. Tin the make . random and often make the crash Unlike the of Datacrime, the Datacrime Nnot , or `, until 1st of any year. Lastly, if the computer is using an RLL, SCSI, or PC/AT Kcontroller, all of the Datacrime are not able to successfully format the K, according to Jan Terpstra of the of Datacrime are: Datacrime-B: The Datacrime-B is a of the Datacrime . The differences are the effective of the is 1,280 and instead of : The , 1989. Datacrime II: The Datacrime II is a of the Datacrime . The major characteristic 1are the effective of the 1,514 (, and it can now xboth . an encryption mechanism in . Datacrime II Nnot format Ks on Mondays. : The , 1989. Datacrime IIB: A of the Datacrime II Datacrime IIB wgeneric . ,and . +, adding 1,917 (to the . The differs fDatacrime II in the encryption method used by the to avoid detection has : The , 1989. Datacrime IIC: on the Datacrime IIB wone . Wor . aon the C: by 1,480 by 1,604 to 1,981 (. In both cases, the the end of the PZPAPN DataLock : DataLock DataLock 1.00, V920, DataLock-1043 1; "out of handles" R: 920 4: PRtEK - Wand , IBM \, NAV, , VET, : CleanUp, or The DataLock, or V920, ~in many locations in the starting on is a generic vof . `, but it +if it is The the DataLock X, the at the top , but #the find 2,048 (less is expected. the , any . sby the qof 920 (, and rin the 0to the =and . The at the end of `. The , indicating the , can dat the end of all "DataLock 1.00" DataLock =, if DataLock , it prevent the fopening man extension ending "BF". to open `, such as .DBF in an "out of ahandles" of DataLock are: DataLock-1043: is a "bug-fixed" of the DataLock . It was ~in the Washington DC/Virginia area of the by Brian Seborg in May, . DataLock-1043 ,and . over 9K in while the qof 1,043 at the end of the qof 1,043 uof the a, and an 1,043 uof the a. The spread `due to a bug in . The din the removed. DataLock-1043 is destructive. It for one hour. At , it Os A:, B:, and the second physical if it exists. : USA DataLock-D: of DataLock is a minor of the DataLock . Like the , it adds 920 (to the . w. It +if it is X, but not are 10 differ fthe . Unlike the , it May, PZPAPN Davis : Davis G: May, j; beeping & Malaysia R: 1,776 - 1,965 4: PRhE - The Davis fMalaysia in May, . Davis is vof . it has for 15 to 30 minutes. The the Davis the Davis at the top of #the &. It Nnot move |12's rby the DOS ?by 1,776 {08 and 21 nby the Davis Davis is , it qof 1,776 to 1,965 the end of the a. The =and in the DOS not be 15 to 30 minutes the Davis , it start Ming the accompanied by 3 beeps every few minutes: DAVIS V1.01 Author : Davis : mm/dd/yy VIRUS STATION COPY Hi ! How are you today ? Don't worry about ! DAVIS VIRUS follow you forever and ever ! Don't care me! I really do not damage your Kor data. .make Funny to you Davis Nnot do malicious Ming its disruptive PZPAPN Day10 : Day10 Day/10, SYP R: 674 4: PNCK - IBM , NAV 2.1+, The Day10 . Its . Day10 is a vof . +. It is destructive the Day10 X, the xone . in the E. If in the E, it may s. Day10 of 674 (. The at the end of the a. The =and in the DOS to the =and . The can be in the "DM? Day10 Xif the =is evenly di by 10 (day=10, 20, or 30). On days, Zof an in the Day10 of the PZPAPN dBASE : dBASE DBF Extinct , 1988 ,& .OVL j; corrupt .DBF `; TSR; FAT and root New York, R: 1,864 4: PRC - ,and Overlay \, IBM , NAV, , VET, \, NAV or The dBASE Gby Ross Greenberg of New York. ,& .OVL `, and corrupt data in DBF by randomly transposing (in any open .DBF a. It keeps track `and (were transposed in a hidden a(BUG.DAT) in the same Eas the .DBF a(s). The restores (if the ais read, so it nothing is wrong. the BUG.DAT ais 90 days old or more, the the FAT and root Eon the detected, if you remove the dBASE and replace it a clean copy, your .DBF were during the period you were useless since are garbled on the Keven would Las expected by the sdBASE PZPAPN Define : Define G: May, %failures Australia R: 30 4: ONAK - , IBM , VET, The Define . Its source distributed in a FidoNet echo in May, . Define is a vof . ,and . , and may Define is X, Define xthe in the a copy of (of the . If the s, it simply previous u. Unless the in the Eis smaller be no . The in the =and in the to the =and The Define corrupt wthem since s the (of the host no longer function usually ing the to the DOS prompt. If s, the fail to Define is on the Mini-45 . It Nnot do of Define are: Define-B: to the Define is a minor several differ. Define-256: Define-256 is a 256 of the Define . Much of the Nn't do , and the base 4is very in the (of the a Define-256 X, the xthe in the E. If the previous u. The =and in the DOS : South Africa See: Mini-45 PZPAPN Deicide : Deicide Glenn ; FAT R: 666 4: ONC - 6.04+, \2.07+, V100+, 2.45+, V100+, See note The Deicide is a `, but not +. Later of Deicide are es, and are #under Deicide is X, the search the Efor an . If an d, the b666 (of the . If the newly was 666 more, show in the was smaller (, its now be 666 (. The may be Lby the If the Nnot find an in the E, it Mthe double spaced, and of the "DEICIDE! Glenn (666) says : BYE BYE HARDDISK!! Next be carufull illegal stuff" The can be din all `, along the is not experimental was written by Glenn Benton to see if I can make a while learning machine for 2,5 months. (C) 10-23- by Glenn. I keep on going making ses." of Deicide are: hood: Written by the same author as the Deicide hood is a of . +. It one . ain the qof 477 at the !of the a. The =and in the DOS . The can be in the 4in all Br hood hood...' 'I am seeking my br s "DEICIDE" and "MORGOTH"...' dmy br "MORGOTH"!!!' dmy br "DEICIDE"!!!' '*** Glenn Benton ***' Deicide 2: as Deicide-1335, Deicide 2 is a 1,335 of the Deicide . It wone . in the qof 1,335 at the !of the be no 2to the =and in the DOS . The in the 4in all Deicide 2 "Suck my dick, Steffie!" : The Deicide-2405: on the Br hood of Deicide, Deicide-2405 wone . X, adding 2,405 (to the a, and Ms a on the The at the !of the and be no 2to the =and in the DOS different may be Lby the , all of . Many of the are insults to various researchers. : The Deicide-2570: on the Br hood of Deicide, Deicide-2570 is fairly to the Deicide-2405 . It adds 2,570 (to the . w, the at the !of the are 8ed in the , and one is X. Many of the mesages are of a sexual nature in : The Deicide-B: on the Deicide no longer s the it has sall of the . `in a Note: Most of the products certified as of detect the base Deicide do not, however, detect a majority of the See: Breeze PZPAPN Demolition : Demolition j; TSR; R: 1,585 4: PRsCK - , NAV 2.1+, The Demolition . Its . Demolition is a vof . bDemolition X, the Demolition as a low TSR of 1,904 (. It the Demolition , it qof 1,585 (. The at the end of the a. The =and in the DOS . The can be in the 4in Demolition "UZD(T!EFNPMJUJPO" The Demolition hang the ais later X, it in a hang. It is if the Demolition 7any damage potential. PZPAPN Den Zuk : Den Zuk Search, Venezuelan , 1988 ; floppy format; TSR; BSC Indonesia R: N/A 4: RtF - Floppy \, IBM , NAV, , VET, K, CleanUp, \, NAV, or DOS SYS The Den Zuk is a vof 360K 5-1/4" I. The xany Jin a floppy is accessed, even if the Jis not %able. If an attempt is made to %the snon- Den Zuk into even failed. purple "DEN ZUK" graphic a CTL-ALT-DEL is performed if the has a CGA, EGA, or VGA monitor. While the Den Zuk did not cause any damage to the maintain a counter of how many s the %ed, and the counter r Qes its limit, the floppy in the Ois reformatted. The counter in of the is usually in the range of 5 to 10. The can be din the the Den Zuk "Welcome to the C l u b --The HackerS-- Hackin' All The The HackerS" The Jvolume label of Imay be Y.C.1.E.R.P., s if the Den Zuk removed a Pakistani Brain ubefore tthe Den Zuk. The Den Zuk remove an Ohio ubefore tthe Den Zuk. The Den Zuk t to be written by the same person or persons as the Ohio . The "Y.C.1.E.R.P." the Ohio , and the in many respects. of Den Zuk are: Den Zuk-RPKS: A minor of Den Zuk, of the on track 40 well as the to avoid detection Den Zuk detection May, See: LZRQ Ohio PZPAPN : Dest Dest-1 R: 323 4: PNCK - 1.15a+, .1.4+, 6.00+, 2.43a+, NAV 2.1.2+, 25.10+, \2.07+, 1.53S+ The Dest, or Dest-1, . Its . Dest is a vof . two later s of , one of is a . The later s of the #under the Dest X, the Dest xone . in the qof 323 at the end of the . The =and in the DOS to the =and . One in the "*.com" Dest-1 Nn't do of Dest are: Dest-2: A later of the Dest or Dest-1 adds 478 (to the . w. The =and in the DOS not be are no in the Dest-3: A later of Dest-2, Dest-3 is a vof . ,progams. X, it at the top of #the decreasing by 2,192 {21 and 22 qof 491 at the end of the The =and in the DOS to the and . Dest-3 Nn't do PZPAPN Destructor V4.00 : Destructor V4.00 Destructor R: 1,150 - 1162 4: PRtAK - \, NAV, , IBM , VET, The Destructor V4.00 ', and is a vof . and . the Destructor V4.00 X, the at the top #the |12's is moved. be 1,216 (less what is expected on the , the +if it is not already Destructor V4.00 is , it qd in by 1,150 (. . by 1,154 to 1,162 (. In both cases, the at the end of the Nnot alter the <in the E, and it makes no attempt to hide the The can be "DESTRUCTOR V4.00 (c) by ATA It is what Destructor V4.00 N, if PZPAPN Devil's Dance : Devil's Dance Devil's Dance-B >, 1989 j; FAT 9; TSR Mexico R: 941 4: PRsCKT - , IBM , NAV, , VET, : NAV, or The Devil's Dance >, 1989, by Mao Fragoso of Mexico City. Devil's Dance is a of . +. It can be very destructive. The Devil's Dance is Devil's Dance as a low TSR of 1.2K. {09 and 21 nby Devil's Dance , Devil's Dance xall . in the E. If the Devil's Dance, it be re Devil's Dance is , it xany the Devil's Dance by 941 Qlater re ing in an q. The at the end of =and in the DOS run, any subsequent warm-re (CTL-ALT-DEL) may in the myou ever danced the devil under the week light of the moon?" PRAY FOR YOUR DISKS!!" The Devil's Dance is destructive. b2,000 keystrokes, the starts changing the colors of any Lon the monitor. The changing of colors of s start to immediately b5,000 keystrokes, the erases the bcopy of the FAT. At is re %ed, it Mthe and again destroy the bcopy of the FAT, allow the %to proceed. of Devil's Dance are: Devil's Dance-B: to the Devil's Dance . The major difference is run very slowly, %. On %, the may receive the "Specified ,MAND search Ebad". PZPAPN Dewdz : Dewdz %failure R: 601 4: PNCK - , IBM \, VET, NAV 2.1+, The Dewdz is a +. It is on the Burger group of es, and utilities identify it as such. Dewdz is X, the search the C: Oroot Efor an x. If one is d, it s. Dewdz qof 601 at the !of the be no 2to the =and in the DOS . The can be seen the "OUSE BBSTEMP" "*.com *" Mthe "Kewl Dewdz!" are X, and the to be hung. If the presses CTRL-C, processing usually continue. %failures the Dewdz +on the See: Burger PZPAPN Digger : Digger 9; unexpected R: 1,475 4: PNCK - 1.15a+, 6.00+, 2.43a+, \2.07+, V102+, V102+ The Digger . It is fthe . Digger is a +. It corrupt . the Digger xone on the C: O. It starts in the C: Oroot E, and slow work its way down the Estructure. . sby the Digger 1,475 at the end of the The =and in the DOS not be . The can be in the 4in all "C) DIGGER" The Digger corrupt . it encounters it is searching for a . corrupted be completely s to be It is what Digger may do and corrupt PZPAPN : Dima requiring 5line input may not function Ms "9pm" R: 1,024 4: PNAK - 6.00+, v99+, 2.43a+, \2.07+, V99+, The Dima . It is fthe Dima is a vof . ,and . the Dima xall of the . ,and . in the E. If E, it the Dima qof 1,024 at the end of the a. The =and in the DOS to the and . The din all Dima "*.exe" "OMtE" "The -9pm-." "Call the Dima & Dima corporation if it be difficult." The Dima at 21:00 or 9PM, at of an in the Mof the and a hang ring: "9pm" the Dima [problems executing require 5line input, in the not functioning PZPAPN : Dir j; TSR; sluggishness of DIR R: 691 4: PRsCK - , IBM \, NAV, , VET, The Dir . It ated in the . The Dir is a vof . The the Dir the as a low TSR of 1,008 nby the . If +is not already s, it the Dir , it a DOS DIR 5is performed. It Nnot Z, or `are a DIR 5is performed, the din the be a pause in the output of the DIR while the the output continue. by 691 qcannot be seen performed if the . The at the end of =and by the the Dir receive the DOS Xon a . If the is not not be Zof the DOS the /F option 9of the Nnot 8any mechanism. PZPAPN Dir-2 : Dir-2 Creeping Death, FAT lost clusters; acopy; cross linked rby DOS fclean R: N/A 4: ZRAK - , NAV, , VET, , IBM : CleanUp, or Low level format reformat The Dir-2, or FAT, was reported in ', Hungary, Poland, and Yugoslavia in . The copy analysed of was fTamas Szalay of Budapest, Hungary. The Dir-2 is a uses a completely new technique for replicating, and moves very quickly through exposed . It is very difficult to detect, not having many or measurable The Dir-2 the computer K, and a X. Since the Ys the hidden the X. The in low , in the area where the configuration y(IO and MSDOS) is normally %completes, , by be 1,552 (less expected. If the views mapping utilities. The "CONFIG" area be 1,552 larger expected. At the of the %, the by the as well, if it was not already Dir-2 is , any non-write protected accessed on the s. The places its 4in the last cluster of I. On the K, the in a unused cluster. The encrypts the ers for the execu `on the K, and copies them to an unused area of the E. The ers are to the 4on the Viewing the in a normal E. All execu indicate s and <stamps. In fact, the mnot at all. If the Ys one of the , the X(due to the the E). Using the ers to the actual location, the Dir-2 load the Y, so it is The major symptom of a Dir-2 uis the effect the has on the powering off and %ing clean DOS to copy in the `not "copied . The newly copied 8the in the last cluster of the to use backup . Executing DOS in a large number of lost clusters ddue to the 2in the E. All execu "cross-linked on the same is the location of the 4on the K. If the /F parameter is used, permanent 9of all execu be the . Note Zof the DOS not indicate any or cross-linking of due to the presence of the If you suspect you ma Dir-2 u, power off the and cold -clean write-protected DOS and check for the on the K. Be careful to not Yany fthe Kas the out an utility to detect and remove Dir-2, it is possible to manually dis by copying all execu to non-execu The should be powered off and re fa clean, write protected out executing any the K, backup the re `and your data The should be low level formatted. reformatted, restore the backup and re the re of Dir-2 are: CD10: gequivalent, is a minor undetec CD11: gequivalent to CD10 and the is an minor CD12: gequivalent to the members of es, it is a minor Dir 2-910: to the members of stores its 4on the last two of the O. Executing the in the uof the C: Oand root Fories. Its is 1,632 PZPAPN Discom : Discom TSR; . R: 2,053 4: PRsA - , IBM , VET, : CleanUp, or The Discom . The location where the sample was . Discom is a vof . ,and . `, and on the , and fthe Sunday . As such, utilities may identify 8ing both and Sunday. Nnot exhibit or the of either the or Sunday The the Discom the as a 2,304 TSR. {08 and 21 nby the , the ,and . 2,053 (and mthe at the !of the by 2,059 to 2,068 at the end of the All chex character 11121704D0. Unlike many Nnot exhibit a slowdown for 30 minutes, and no "black window" s. Discom , at random intervals, send random 3to the ,ports, as well as write portions of to random on the PZPAPN DisDev : DisDev `corrupted; . `truncated and/or dis R: 6,144 4: ONE - 1.53S+ The DisDev . Its . DisDev is a the DisDev X, the DisDev xall of the . in the of 6,144 (, having replaced a pure copy of the DisDev =and in the DOS to the =and . The can be in the DisDev "<*>-==> DisDev -Copyright (c) 1066 ScumSoft- <==-<*" "disdev" "DisDev" "Fucking "Portions Copyright (c) 1066 ScumSoft!!" DisDev has sall of the . `in the E, executing an in the X"dis ing" fthe DOS The mset the hidden attribute, ing in effect. to replace the aby copying a clean copy of the fail acreation The DisDev Mone of the ctwo "DisDev" "Fucking U 202 at 0:00F1" PZPAPN KKiller KKiller Computer Ogre, KOgre, Ogre , 1989 Bad blocks; ; BSC; TSR; encryption of Taiwan Milpitas, California, R: N/A 4: BRtT - \, IBM , NAV, , VET, K, CleanUp, \, NAV, or DOS COPY & SYS The KKiller is a spreads by writing copies of to 3 blocks on either a floppy or K. The Nnot care if blocks are in use by an or are part of a blocks be marked as bad in the FAT so cannot be . The is patched so %ed, the Xand it can attempt to xany new Ks exposed to the The keeps track of the elapsed Kusage since initial u, and Nno harm until it has r Qed a predetermined limit. The predetermined limit is 48 hours. (On most KKiller Qits limit in 1 - 6 weeks of its initial the limit is r Qed or exceeded and the is re %ed, a Lidentifying ,PUTER OGRE and a 1st. It says to leave alone and proceeds to encrypt the by alternately XORing Ah and 0 5h, effectively destroying the yon the K. The recourse KKiller has activated and Sthe entire Kis to reformat. The Lupon , and can be in the KKiller -- 1.00 by ,PUTER OGRE 04/01/89 Warning!! Don't turn off the power or remove the Jwhile KKiller is Processing! PROCESSING Now you can turn off the power. I wish you Luck!" It is important to note L, if the is turned off immediately it may be possible to salvage `on the Kusing various utility destroys the %, FAT, and Eblocks. KKiller can be removed by using McAfee Associate's M CleanUp utility, or the DOS SYS 5, to Ks or %able floppies. On non- floppies, `can be copied to non- sfloppies, followed by reformatting the sfloppies. Be sure to re %the fa write-protected Jbefore to remove the bor you be re sby the Note: KKiller may mdamaged one or more `on the it wrote a portion of its 4to 3 blocks on the corrupted `cannot re xthe , however should be replaced backup copies since the 3 blocks were Note: Do not use the DOS DISKCOPY to backup Ias the new backup 8the as well. PZPAPN Dismember : Dismember seconds = "62" Sweden R: 288 4: PNCK - V99+, 6.04+, \2.07+, V99+, 1.53S+ The Dismember . It is fSweden. Dismember is a the Dismember xall . `in the between 4,096 and 65,024 before qof 288 at the end of the a. The seconds field of the in the DOS set to "62", the umarker of the . One the Dismember Nn't to do PZPAPN : DM DM-400 k; write to R: 400 4: PRfCK - , IBM , NAV 2.1+, The DM, or DM-400, It is fthe . DM is a DM is X, the DM in low Fly remapping {21 and 24. It place a portion of video , such as on a video card, if it is rby the DOS not be the DM , it qof 400 at the end of the be no 2to the =and in the DOS . The can be in all "(C) A symptom of a DM fwrite protected in a hang "left spinning. The write a copy of to the It is what DM of DM are: DM-B: referred to as DM 1.01, DM-B is a 400 of the . It Nnot 8the "(C) 8ed in the DM 1.01B: on the DM-B , DM 1.01B is , and has modified to avoid "detected by most utilities familiar group of 7the : "(C) 1.01 DM." DM 1.04: DM 1.04 is a 400 of the X. It Nnot 7the : "GIiokMO". DM-330: referred to as DM 1.05, DM-330 is a 330 of the DM-B . It . It Nnot 8any identifying PZPAPN Do-Nothing : Do-Nothing The Stupid , Nothing Extinct , 1989 j; TSR (see Israel R: 608 4: PRfC - , NAV, IBM , VET, \, NAV, or breported by Yuval Tal of Israel in 1989. The `, but bone in the E, whether it was sor not. The Do-Nothing , always address 9800:100h, and can . The Nnot protect area of any way, and area it in , removing the The Do-Nothing Nno apparent damage, nor Nit affect operation of the in any observable way, thus its See: Saddam PZPAPN Doctor Qumak 2 : Doctor Qumak 2 Dr Qumak 2 9; "Write protect Krakow, Poland R: 1,079 4: PRtCK - 6.04+, \2.07+, 2.43a+, The Doctor Qumak 2 . It is fKrakow, Poland. Doctor Qumak 2 is a vof . +. It is a destructive The the Doctor Qumak 2 at the top #the &, moving 12's , as by the DOS ?by 2,064 {12, 13, and 21 nby Doctor Qumak 2 in the Doctor Qumak 2 , it for any reason. qof 1,079 at the end of the a. The =and in the DOS not be The Doctor Qumak 2 under two conditions, the condition "very destructive, slowly corrupting . The keeps track of how many Kwrite operations since it became 100 write operations , the modify three (in the next written to it has modified manner, it Mthe "The famous cooperation strikes again: IT IS DOCTOR QUMAK II! Watch out for the next fKrak w, Poland!" is not as it is in the The second condition under Doctor Qumak 2 activate is during the months of thru >of any year. During months, on Sundays the 9th of the month, the simulate a "Write protect to write to a PZPAPN : DoDo Birdie R: 408 4: PRbCK - NAV 2.1+, VET, The DoDo, or Birdie, . Its . DoDo is a vof . The the DoDo the DoDo in video card nby the the |area. the DoDo , it qof 408 the end of the a. The =and in the DOS not be . One can be din the "Birdie Hop!" DoDo Nn't do of DoDo are: Pig: The Pig is a 407 of the DoDo "one )shorter, the major difference . The is: "GIP". Pig-B: gequivalent to the Pig has three differ. PZPAPN Doom II : Doom II G: May, writes Taiwan R: 1,252 4: PRbAK - \, IBM , NAV, VET, The Doom II fthe NCSA. Doom II is a ,and . The Doom II is X, Doom on the 's video card, along a hook to in low {1C, 21, 24, and 98 nby the many , Doom II ,and . by 1,252 at the end of the a. The Nnot hide the q, nor is the =and in the , a . sby Doom qslightly more in , such as by 1,253 or 1,254. s to be due to a bug in the Doom II may attempt to write to the due to the in the video card , thus making it un , typically the monitor be blanked and the locked out. kare prevalent the Doom IIB , but more frequently Doom II, the switches fa graphic to a It is if Doom II of Doom II are: Doom II-B: A re-engineered of the Doom II Taiwan, Doom II-B is a vof . and . . Doom II-B ,and . 1,252 at the end of the May, PZPAPN : DOS3 ^, 1993 R: 661 4: PNA - 6.04+, \2.07+ The DOS3 ^, 1993. Its . The DOS3 is a vof . ,and . , but not the DOS3 X, the DOS3 xall of the . ,and . the the exception of qof 661 at the end of the a. The in the DOS not be . The in the DOS3 in all "Still using DOS 3?" "You need to upgrade, you loser!" The btwo may be Las a on the monitor Xon computer uses Ms-Dos 3.0 to Ms-Dos 3.3. PZPAPN DOSHunter : DOSHunter The R: 483 4: PRhCK - V99+, 6.00+, 2.43a+, \2.07+, V99+, The DOSHunter . It was ~in The . DOSHunter is a vof . the DOSHunter at the top #the , as rby the DOS ?by 1,408 nby the the DOSHunter , it qof 483 at the !of the a. The =and in the DOS not be . No in the The DOSHunter 26th of any year, at trash the b128 of the PZPAPN Dot Killer : Dot Killer 944, Killer, Dot Eater j; removal of all dots (.) Koszalin, Poland R: 944 4: PNCK - \, NAV, , IBM , VET, The Dot Killer ~in Koszalin, Poland in . It is a vof . the Dot Killer X, the xone ain the by 944 (. The at the end of While the Dot Killer 4to attempt to avoid tthe ed to by the ,SPEC en mental parameter, logic 7a bug and Nnot function . If +, or the ed to by ,SPEC, is in the sjust like any the Dot Killer , it remove all dots (.) fthe of Dot Killer are: Dot Killer B: to Dot Killer, Dot Killer B's major difference is at %ing +, a happy face character on the left side of the line, travel across the line to eat the period (.) the attempted to eating the period, the happy face travel back across the until the period. PZPAPN : Drop R: 1,131 - 1,163 4: PRhAK - 6.00+, 2.43a+, \2.07+, V102+, V102+ The Drop . It is fthe Drop is a vof . ,and . The the Drop Drop at the top of but #the , as rby the DOS by 3,600 nby the the Drop , it for any reason. qof 1,131 1,153 to 1,163 (. In both cases the at the end of the a. The =and in the DOS to the and . No the It is what Drop may do PZPAPN Druid : Druid `corrupted; fail to Y; long accesses R: 317 4: ONC - V99+, The Druid . It is a vof . , but not +. It s the !of the w, permanently corrupting them. the Druid X, the Druid xall of the . in the it has completed tthe . `in the E, it move up one Eat a in the Estructure, , until it finally the Oroot E. It avoids the Druid normally not . The exception is if the was smaller , the . The =and in the DOS not be . The can be the 4in all "DRUID, 4d by Morbid Angel/Line Noise" Druid notice long Kaccesses X. The long Kaccess is due to the in several Fories. not function PZPAPN Dutch 555 : Dutch 555 555, Quit- R: 555 4: PRhAK - , IBM , VET, NAV 2.1+, .1.4+, : CleanUp, or The Dutch 555 Zwienenberg of the was accidentally released into the public domain by its author in It is a vof . ,and . The the Dutch 555 X, the at the top , but #the &. The is not moved, the DOS show a of 560 nby the the Dutch 555 , it and . +, as by 555 at the end of the a. The and in the DOS to the =and Nnot do of Dutch 555 are: Dutch 555-B: gequivalent to the has four differ PZPAPN Dutch : Dutch 1; write protect R: 124 - 126 4: PRAK - \, VET, 6.04+, The three comprise the Dutch group were fThe . All three are techniques the es in the es. two are included under Mini-97 are related to the Dutch The Bhere is the 126 Dutch -126. The , both of 124 (, are #in the The Dutch the in a DOS buffer address 0:063A. by the be no and the Dutch , it X. If X, it by 126 at the end of the a. The =and in the DOS to the =and expect 5line input , as did not provide the input. fwrite-protected in a "write protect fDOS. Nnot do of Dutch Dutch -115: , Dutch -115 is a 115 . It xall . `in the qof 115 at the end of the a. The in the DOS to the =and . Frequent Dutch -117: , Dutch -117 is a 117 . It xone . the qof 117 at the end of the a. The in the DOS to the =and . One can be in the : The Dutch -124: A later of the Dutch -124 is a 124 , frequent and a . a, or an already a, is Zof any fthe A: in a hang has the is expecting O. Dutch -124 is a poor replicator, and xmost . Dutch -124B: Dutch -124B is a later of Dutch -124. Unlike members of ], it xboth . ,and . us do not very often. be damaged, and later Zof them in a hang in all cases. See: Mini-97 PZPAPN : Ear G: May, Twriting to device AUX; Ear quiz played R: 1,024 4: PNAK - VET, 6.00+, The Ear Gin the in May, It is a vof . ,and . the Ear X, the Ear check to determine if more two sub Fories exist on the O. If are not at least two Fories, the attempt to write to device AUX, and normally in an U. No If two sub Fories exist, xall of the ,and . in the E, and the the Ear of 1,024 at the end of the a. The =and in the DOS not be The Ear provide the a quiz on a part of the human ear X. The "PHALCON/SKISM [Ear-6] Alert! Where is the $ 1. External Ear 2. Middle Ear 3. Inner Ear" The "$" in the second line be replaced one of the c: "Auditory Canal", "Lobe", "Hammer", "Eustacian Tube", "Auditory Nerve", or "Cochlea". If the replies correctly, the "Wow, you know your ears! Please resume work." If the replies incorrectly, the "You obviously no nothing about ears. Try again study." The in the and are not in the "[Ear-6] Dark Angel" of Ear are: Anti-Print: on the Ear , Anti-Print is a vof . bAnti- Print X, the Anti-Print at the top of #the , as rby the DOS ?by 1,248 , Anti-Print qof 593 the at the end of the a. The =and in the DOS to the =and . The in the Anti-Print "PRINT. Wdetected in "=> Anti-PRINT detonation <=" the Anti-Print , it trash the Oif PRINT. X, along Ming the as a frequently ^, 1993. Quake-O: on the Ear , Quake-O wup to three Wor . in the qof 960 at the end of the be no 2to the =and in the DOS . The in the Quake-O "[Quake-O]" "By Dark Angel of PHALCON/SKISM '92" "Assistance by Demogorgon on Quake-O routines" "Albeit" ".. *.exe *.com" Suicide: on the Ear , Suicide wup to five Wor . in the qof 2,048 at the end of the be no 2to the =and in the DOS . The in the Suicide W.. [Suicide]" "Written by Dark Angel of PHALCON/SKISM" "Ross M. Greenberg blows goats." "Your PC has sby the Suicide "I would dis xmyself, but I despise DOS 2.X" "Upgrade now!" "Brought to you by PHALCON/SKISM" now kill myself. Press D to "PHALCON" "SKISM" lat work to make your life" "living hell" PZPAPN : Ed Finland R: 779 - 794 4: PRtAK - V99+, 3.93+, 6.04+, \2.07+, The Ed . It is fFinland. Ed is a vof . ,and . +. It spreads quickly on X, the Ed at the top of #the &, moving |12's , as rby the DOS ?by 1,584 {12, 21, and 24 nby Ed in the Ed , it ,and . for any reason. qof 779 the at the !of the by 779 to 794 at the end of the a. The in the DOS not be . No in the It is what Ed PZPAPN : Edcl Edct R: 1,600 - 1,615 4: PRhAK - , NAV 2.1+, The Edcl . It is ', and is related to the CB-1530 . Edcl is a vof . ,and . and employs techniques to avoid detection. bEdcl X, the Edcl at the top of but #the , as rby the DOS ?by 2,048 |12's moved. {09, 13, and 21 nby Edcl in the Edcl if it was not the Edcl , it very small ones, qof 1,600 to 1,615 at the end of the . The =and in the DOS not be . One can be din the "EDCL" The in the Edcl WBACKUP. "Hi to Eastern Digital." "Greetings to Mister L." "Megafuck to Mihai Sirbu -- MicroTimSoft." ners the Edcl in the "noticed on . `, but not on . `. . `may to be , the same utility be able to detect the . The interfer the operation of the BACKUP. of Edcl are: Edcl-B: gequivalent to the Edcl , Edcl-B is a minor . It has 21 differ fthe Edct: to the Edcl Nnot hook |13. Like Edcl, it adds 1,600 to 1,615 (to the . ,and . Zand aopen. Two in the WBACKUP. "Megafuck fEastern Digital" The "EDCL" in the 0to "edct". See: CB-1530 PZPAPN : EDV Cursy, G: 1988 BSC; 9; unusual crashes France R: N/A 4: BRX - , IBM , NAV, , VET, K/P, CleanUp, or NAV The EDV, or Cursy, Gin Le Havre, France in 1988 by Jean-Luc Nail. At , it was d the Cursy Later, in , it was ~separately and d the EDV is a vof floppy the EDV the at the top of high . The value ed by , any Kaccessed by the J, it moves the to side 1, track 39, moving the , it copies the absolute 0, the of the EDV are accessed. In the case of Ks, the move absolute 0 (the ) to side 1, track 39, 8 as it were a 360K 5.25" floppy moving the ssix , the EDV activate. Upon , the access the |to disable the the b3 tracks of Kon the , starting Ks. Ks, it rings a bell, no? fCursy" Upon , the must power off the machine and re Jin order to regain any control over the machine. The cidentification s at the very end of the sfloppy Ks and the it cannot be seen if the is in "MSDOS Vers. E.D.V." Jean-Luc Nail has the EDV or Cursy is quite 6in the Le Havre area of France, al it is outside of France. PZPAPN Egg-1000 : Egg-1000 , 1993 R: 1,000 - 1,014 4: PRhEK - The Egg-1000, or Egg, , 1993. Its . Egg-1000 is a vof . `and bEgg-1000 X, the Egg-1000 at the top of #the &, hooking {21 and 6C. , as rby the DOS ?by 1,280 12's not be moved. , the +if it was not the Egg-1000 , it for any reason. qof 1,000 to 1,014 at the end of the a. The =and in the DOS not be The in the 4in all Egg-1000 "[EGG]-1000 "eat cry sleep pizza cash getbackjack" "chickens are good" "ribbitribbitmefrogufrogwefrog" "egg" It is what Egg-1000 PZPAPN Eight Tunes : Eight Tunes 1971 j; music; West Germany R: 1,971 4: PRsA - , NAV, IBM : NAV, or The Eight Tunes, or 1971, by Fridrik Skulason of Iceland. is a generic vof . W, and overlay The +, or . smaller by between 1,971 - 1,985 @by 1,984 present. Nnot cause damage; however, it is disruptive. , it play 8 German folk songs at random intervals thirty minutes PZPAPN Einstein : Einstein j; TSR R: 878 - 892 4: PRsE - IBM , NAV 2.1+, , VET, The Einstein . Its . Einstein is a vof . bEinstein X, the Einstein as a low TSR of 1,136 (. The hook the Einstein , it qof 878 to 892 (. The at the end of the be no to the =and in a DOS Two can be in the 4in Einstein "exe "Einstein" It is what Einstein , or its damage potential. PZPAPN : EkoT <seconds = 62 R: 2,000 4: PRtCKX - 6.0+, 2.43a+, V100+, V100+ K/P + The EkoT . Its . EkoT Uis a multi-partite wthe ) and . bEkoT X, the EkoT xthe . A copy of the be stored at Side 0, Cylinder 0, 5. The EkoT location (Side 0, Cylinder 0, and the cthree . EkoT The next %s the fthe the EkoT at the top of #the &, moving |12's , as rby the DOS ?by 2,048 nby the EkoT the EkoT , it target . are copied. It Nnot Zor open. qof 2,000 be hidden . The the !of the a. The seconds field in the in the DOS be set to "62". The may not Eis listed in the The EkoT is a full , dis are loaded into . As a , checksumming and are unaware of the detect its presence it is It is what EkoT PZPAPN Eliza : Eliza R: 1,193 - 1,194 4: PNCK - , IBM , VET, C, NAV 2.1+, The Eliza . Its . Eliza is a Eliza is X, the xone . in the Nnot always do . If in the E, it may Eliza qof 1,193 or 1,194 at the !of the +, however, is an exception as it not many had =and in a DOS The can be in the Eliza W*.* MJ" It is if Eliza PZPAPN : Emf G: March, North America R: 404 4: PNCK - , VET, , NAV 2.1+, 1.53S+ The Emf in March, . It is fNorth America. Emf is a vof . +. It is possibly related to the Scream the Emf X, Emf search the Eto locate an x. If one is d, it sby Emf. in the E, Emf may the Emf qof 404 at the end of the a. The =and in the DOS . The in the Emf ,Screaming Fist (c)1" Emf Nn't to do of Emf are: Emf-625: A 625 of the Emf wone . in the qof 625 at the end of the The =and in the DOS not be . The in the 4in Emf-625 ,Screaming Fist (c)10/91" : North America See: Scream PZPAPN Emmie : Emmie G: May, d on the may be repeated, Israel R: 2,702 4: PRhCK - , VET, 3.93+, 1.15a+, The Emmie Gin Israel in May, . It is a +, employing techniques to avoid detection. The the Emmie the Emmie at the top of #the |12's moved. , as rby the DOS by 2,752 {01, 09, 10, 17, and 21 by Emmie in , if not sby the the Emmie , it may . It Nnot the Emmie qof 2,702 at the end of the a. The if Emmie is . The =and in the DOS not be The can be in the Emmie "My is Emmie, I am Eddie's sister." ".com . "It'll tire you too much." the Emmie notice . The repeat a character entered on the PZPAPN End Of : End Of Israel R: 783 4: PRhCK - 6.00+, 3.93+, 25.10+, V99+, The End Of . It is fthe . End Of is a vof . bEnd Of at the top of #the ?by 800 (, and End Of is , it a DOS DIR 5is issued. qof 783 at the end of the a. The =and in the DOS not be . The can be din the 4in all End Of "*.com" "end of" It is what End Of may do PZPAPN Enemy : Enemy G: March, R: 712 - 1,396 4: PRhAK - , NAV 2.1+, .1.4+, 25.10+, 1.53S+ The Enemy in March, . Its . Enemy is a vof . ,and . The an Enemy X, the Enemy at the top of #the , as rby the DOS ?by 2,048 by Enemy in , the Enemy on the Oand C: Oif it was not the Enemy , it ,and . the Enemy 712 - 1,396 at the end of the a. The =and in the DOS The Enemy is an , but the can be Snear the end of the "ENEMY" It is if Enemy of Enemy are: Stranger: to the Enemy , the Stranger adds 746 - 1,435 (to the ,and . w. The in the Stranger "I am a stranger in a strange land..." "C:\ The can be Snear the end of the "ranger" See: Scream PZPAPN Enigma : Enigma Cracker Jack Italy R: 1,755 4: PNE - , NAV, , IBM , VET, The Enigma , by Alberto Colusa of Italy. is a vof . `. The sample of was not a natural of the "on a . a, so the may actually be a research Enigma is X, one . the sby the by 1,755 (. The at the end of 8the is the voice of the Enigma the spirits of the hell are coming back!" "(C) by Cracker Jack * Italy * *.exe" "newenigmavir" It is not if Enigma See: Yankee 2 Bandit PZPAPN Enola : Enola R: 1,864 - 1,878 4: PRtA - , VET, 1.15a+, The Enola . It is Russia. Enola is a vof . ,and . aopen, Z, or copy. the Enola the Enola at the top of #the &, moving |12's , as rby the DOS ?by 2,048 08 and 62 nby Enola in the Enola , it xor alter ,and . X, or copied. In the case of copying `, both the source and target . Enola Nnot always `, it s alter the adding less not function , and may cause %s or the Enola qof 1,864 to 1,878 the end of the a. The =and in the DOS not be . The can be in the in all Enola "comexe" "Enola Gay is now flying to SoftPanorama !" It is what Enola may do PZPAPN Argentina R: 628 - 642 4: PRhE - , NAV 2.1+, .1.4+, The Gin Argentina in is a vof . The X, the , hooking |21. , any attempt by the DOS in an L. The may be "Exec failure" or "Bad ly, if the the Read- attribute set, it reset the attribute. the , the by 628 to 642 the at the end of the a. The =and in the DOS the =and . No in the PZPAPN : ETC E.T.C. G: May, R: 700 4: PRfCK - , IBM , VET, C, NAV 2.1+, The ETC 'in May, . ETC is a vof . ETC is X, the in low hooking |00. be no the DOS ETC xthe it finds in the E. If +, it by 700 at the end of `. The =and in the to the =and ETC xone . in the 8the , (c) ETC" "E.T.C. VIRUS, 3.0, Copyright (c) 1989 by E.T.C. Co" The last dnear the end of all ETC Nnot do PZPAPN E-92, Dutch 424, V-92B, j; TSR; %failure; "Invalid Ospecification" ; beeping R: 421 4: PRsCK - ., IBM , VET, C, NAV 2.1+, The V-92 is a vof . V-92 as a low TSR of 420 nby the becoming V-92 by 421 the end of the `. The process of in a hang uprocess is complete. V-92 hang. are expecting 5line input may Mthe "Invalid Ospecification" and terminate continue to function normally. In the year V-92 . In Xthe repeatedly issue the accompanied by beeping, scrolling the V/92 4EVER!" in the , and cannot be viewed V-92 are: V-92B: as Dutch 424, is three longer V-92 PZPAPN : Evil P1, V1701New, Live Death 3 failure; +header R: 1,701 4: PRhCK - , NAV, o, VET, : NAV, or The Evil is of , and was to the author of document in by Vesselin Bontchev. is one of a ]of three may be referred to as the P1 or Phoenix es is documented separately due to varying characteristics. The Evil is a , generic vof . `, and +. It is the most advanced of the three es in the Phoenix The Evil, or V1701New, is a later of the PhoenixD The the Evil the ehigh reserving 8,192 nby the @by 8,192 Evil check to see if the O's root 7a copy of +. If a copy of sby Evil by part of the binary zero portion of the , and changing the header . The +residing in the C: Oroot becoming , the attempt to X. Evil is a better replicator either the Phoenix or PhoenixD, and was successful in `in all cases on the author's by 1,701 Evil is not able to recognize it has a, so it may re `several in an 1,701 "appended to the Like PhoenixD, Evil for any reason, in addition to X. The simple act of copying a . in both the source and target . the Evil [problems executing in a warm re %of the ring. The , however, not perform either a RAM check or request =and , if an autoexec.bat ais not present. is not related to the Cascade (1701/1704) The Evil employs a complex encryption mechanism, and ners able to look for simple hex be able to detect it. is no simple hex 6to all ssamples. of Evil are: Evil-B: is an earlier of Evil, and is a rather poor replicator. It was not too viable as hang the exception of the Runme.Exe the author . The Runme.Exe awas probably the release adistributed by the 's author. listed in 9008 as V1701New-B) See: Phoenix PhoenixD Proud PZPAPN Evil Empire : Evil Empire Evil Empire-A BSR; Alberta, Canada R: N/A 4: BRtX - \, IBM , VET, NAV 2.1+, : CleanUp, or M- The Evil Empire ~in Alberta, Canada, in is a vof floppy and the ). It on the The Evil Empire well as xthe . The at the top of , but #the &, and |12's be moved. be 2,048 (less expected. The having moved the to cylinder 0, side 0, 6, and writing a copy of to cylinder 0, side 0, 0 (the location). Evil Empire is , it Inon- write protected are accessed on the moved to is part of the root The AT", can be dnear the end of the floppy as well as in the Imay be damaged Evil Empire due to the 10 of the E. If root Eentries were be lost. A note on dis tEvil Empire: copying the 6 to in the s, but it now be a non- K. If s, Norton KDoctor can be used to correct the situation. may detect Evil Empire as Azusa. of Evil Empire are: Evil Empire-B: on the Evil Empire is 1,024 (. It moves the to cylinder 0, side 0, 3, and replaces the a copy of copy extend to 2 as the longer (. On I, the move the 11. Evil Empire-B is a fully , no . The , however, may be AT LIVE F See: Azusa PZPAPN Exebug : Exebug Swiss BSC; ; inability to access Switzerland R: N/A 4: BRtX - \2.07+, NAV 2.1.4+, 2.45+ : Norton KDoctor on The Exebug, or Swiss It is believed to be fSwitzerland, it has reported fAustralia as well. Exebug is a and the ). It uses techniques to avoid detection on both the Kand The fan Exebug the Exebug at the top of #the &, moving |12's by 1,024 , the . The be moved to the last of Side 0, Cylinder 0 of the K. The s Side 0, Cylinder 0, was the location of the the Exebug , it on non-write protected is accessed for any reason. On 360K 5.25" I, the be moved to Side 0, Track 40, 1. On 1.2M 5.25" I, the be moved to Side 0, Track 80, The Exebug uses techniques to avoid detection by software. to access either the or a , the present the Exebug, access the %ing fa write-protected, DOS in the "inaccessible. The receive the "Invalid Ospecification" due to the having the last 2 (of the location. Norton KDoctor can successfully resolve problem, rendering the Kaccessible again. PZPAPN Experiments : Experiments Experiments-755 ^, 1993 R: 755 4: PNE - The Experiments, or Experiments-755, ^, 1993. It is fthe . Experiments is a vof . the Experiments X, the Experiments xall of the . in the xvery small . qof 755 the at the end of the a. The and in the DOS not be . The can be in the 4in all Experiments - Small experiments path 2.1 It is what Experiments may do PZPAPN Explode : Explode G: May, Kcylinder 0; %failure R: 229 4: ONCK - , NAV 2.1.2+, 6.04+, \2.07+, The Explode in May, . Its . Explode is a very destructive the Explode b229 (of all . in the E. It access the cylinder 0 binary zeros. process has completed, the Land the be hung: "Your Ois about to explode!" fthe Kor an fail. If the J, the be successful, but the be unaccessible. the Explode mthe (of the host the Explode The =and in the DOS to the =and . The ,Your Ois about to explode!" too big to fit in "UABBS -/\-] Ajax [-/\-" PZPAPN Exunt : Exunt R: 148 4: PNC - The Exunt . Its . Exunt is a vof . Nnot xall . the Exunt X, the Exunt xone . in the of 148 at the end of the a. The =and in the DOS to the . The in the Exunt Exunt Nn't do PZPAPN : Fat G: March, 1993 atruncation; R: 6,540 4: ONE - The Fat in March, 1993. Its . Fat is a corrupts the . the Fat X, the Fat xone . in the and a filler of hex 00 usually not , but instead may show a @. The b6,540 (of the be the 4. The =and in the DOS to the =and . The can be the 4in all Fat "hitohana" "karu ba" "rb C:\ * .* FAT TABLE E" "8RROR" the Fat not function . The DOS Ton most, if not all, PZPAPN Father : Father 0to 11-08-91 4:15p R: 1,449 - 1,463 4: PRhAK - \, IBM 1.15a+, 3.93+, NAV 2.1.2+, The Father . Its . Father is a ,and . . It is on the bFather X, the Father at the top of #the &. It Nnot move 12's , as by the DOS ?by 1,616 {1C, 21, and 27 nby the , Father +if it was not the Father , it qof 1,449 qof 1,449 to 1,463 (. In both cases the at the end of the . The =and in the DOS 0to 11-08-91 4:15p. The can be in the 4in Father "In of my father." "(C)Nduk '91" It is what Father may do See: CB-1530 PZPAPN Father Christmas : Father Christmas Choinka j; lost cluster; cross-linking of `; graphic and Poland R: 1,881 4: PNCK - , IBM , NAV, , VET, The Father Christmas, or Choinka, Gin Poland in on the , and is a vof . the Father Christmas the xone ain the If no `exist in the E, the follow the path to find an by 1,881 at the end of the the Father Christmas may notice cross-linking of `and lost clusters. During the period >19th-31st of any year, activate. On a christmas trees graphic is Lon the monitor the Merry Christmas a Happy New Year for all my lovely friends FATHER CHRISTMAS If the graphic is L, the must strike a key in order to mthe Xfinish running. See: NTKC PZPAPN : FCB R: 384 4: ONAK - 1.15a+, VET, 6.00+, 3.93+, 25.10+, P, NAV 2.1.4+, V99+, The FCB, or 384, . It is is a vof . ,and . It is unusual in it uses acontrol blocks (FCBs) instead ahandles in the process of the FCB xone in the E. The select . `before . `for u, and E, it may the FCB mthe b384 of the host the FCB 4. The =and in the DOS to the =and 8the "401 wany . ,or . aon any writeable Device" The FCB Nn't do are permanently corrupted and must be replaced fclean, backup copies. PZPAPN Feist : Feist 1; unexpected R: 670 4: PRfAK - , VET, NAV 2.1+, The Feist . Its . Feist is a vof . ,and . The the Feist . As such, be no nby the the Feist , it qof 670 at the end of the a. The =and the DOS to the =and . The can be in the 4in all Feist "R.Feist" the Feist [unexpected Tinclude, but are not limited to, divide overflow Tand data reading or writing to the PZPAPN Fellowship : Fellowship 1022, Better World, Fellow Australia TSR; . Malaysia R: 1,019 - 1,027 4: PRsE - \, NAV, IBM , VET, : CleanUp, \, NAV, or The Fellowship or 1022 ~in Australia in Fellowship is a generic vof . `. It Nnot ,or overlay The the Fellowship X, the as a 2,048 )TSR in low ?by a corresponding 2,048 now be controlled by the , the by between 1,019 and 1,027 (. The at the end of 8the very close to the end of the is dedicated to all fellow PC s on Earth Toward A Better Tomorrow And A Better Place To Live In" "03/03/90 KV KL MAL" is believed to ated in Kuala Lumpur, Malaysia. of Fellowship are: Fellowship-B: on the Fellowship adds 1,019 to 1,034 (to the . w. The at the end of the , and the =and in the DOS to the =and . The din the : Malaysia PZPAPN : FGT j; loss of CMOS Setup R: 651 4: PNCK - , NAV 2.1+, The FGT . Its . FGT is a vof . the FGT X, the FGT search the Efor up to two `are d, the xthem. The host the FGT qof 651 (. The at the of the . The =and in the DOS FGT can be easily identified as always start cASCII "PSQRVW" FGT may [the machine loosing of its CMOS setup y. In particular, the clock may m"lost power", ing to a default =, and the invalid. setup can be easily fixed the Setup utility or firmware setup facility on the PZPAPN : Fich FichV, CHV 2.1, 903 H: j; TSR; France R: 903 4: PRsCK - \, IBM , NAV, , VET, The Fich GFrance in is not a particularly viable since d samples further . It is possible sample is corrupted. sample of Fich is as a 1,216 )low TSR. It hook |21. At , it adding 903 (to the !of the . The "Fichier introuvable" xup to three . in the Eif the sample is again X. Later in the spreading to The the DOS COPY used, but if the source and target `are in the qof 903 the at the !of the The =and in the not be the If Fich sample, . The "Fichier introuvable" is not sample. may hang The Fich during the month of March, at may bsix Qtrack of the "CHV 2.1 vous a eu" translates fFrench to English as "CHV 2.1 got you". of Fich are: Fich-B: to the Fich . The fthe is never L. It has six different fthe Fich-C: to Fich-B, as an of Fich-B. d samples of are, however, S. The difference the Fich-B nby the : France, Fich-897: on the Fich differs in . Its TSR is 2,256 (, hooking {21 and 24. It in the X, and well as the target are copied. It adds 897 (to the . at the end of the a. The =and in the DOS not be . The in the "*.exe **F W1.0 vous a eu **" : France, See: Fichv-896 PZPAPN Fichv-896 : Fichv-896 Fich j; TSR; France R: 896 4: PRsCK - VET, NAV 2.1+, The Fichv-896 ~in France in Eric Richet. Fichv-896 is a vof . +. It is on the Fich The the Fichv-896 X, the Fichv-896 as a low TSR of 1,200 {21, 24, and nby the . If +was not sby the , it the Fichv-896 , it in the ly, it xthe Xif it is a . larger 2K in the Fichv-896 qof 896 (. The at the of the . The =and in the DOS not be . Fichv-896 is an , and no in the d samples. Fichv-896 See: Fich PZPAPN : Fil G: March, 9of data R: 1,658 4: PRhCK - \, NAV 2.1+, 1.53S+ The Fil in March, . Its , or , is . Fil is a vof . bFil X, the Fil at the top of the rby the DOS ?by 4,112 {09, 1C, and 21 nby the Fil if it was not the Fil , it may X. Data and overlay `may either sor corrupted are accessed. The Fil adds 1,658 (to the . w. The at the end of sby the be no 2to the =and in the DOS The 8ed in the Fil are usually not as the encrypts them: "pCbYTE" "bANDIT" "dEMORALIZED yOUTH" "tHIS IS THY PRESENT WORLD" "SAID THE fLAME TO THE sPARK" "tHOU ART MYSELF" "MY IMAGE" "AND MY SHADOW" "i HAVE CLOTHED-*MYSELF IN THEE" "AND THOU ART MY VEHICLE TO THE DAY" "bE-*WITH US" "WHEN THOU SHALT RE" ,E MYSELF AND OTHERS" "THYSELF AND ME" The Fil may corrupt data `accessed write intent on PZPAPN =11-537 =11-537 0to 8-17-88 2:08a R: 537 - 553 4: PNE - 1.15a+, VET, NAV 2.1+, V99+, .1.4+, 6.00+, V99+, The =11-537 . Its =11-537 is a vof . =11-537 xone . in the 537 to 553 at the end of the . The =and in the DOS 0to 8-17-88 2:08a. One in the =11-537 Nn't to do PZPAPN Filler : Filler BSC; Hungary R: N/A 4: BRhX - , IBM , VET, : M- K/P or DOS SYS for The Filler . It was reported in the public domain in Hungary in . Filler is a and the ). Filler is a it is not be able to detect its uof the , and mdifficulty detecting its presence on fa Filler J, the Filler at the top of #the @, but rby the DOS ?by 8,192 (. The , if it was not Filler. the Filler , it xnon-write protected Iexposed to the . The uof the Jusually is accessed for reason. The Filler write a copy of to the last track of the is not normally accessable by DOS. It store the track. The alters the to the The Filler is a it is ning not detect the presence of the Filler using ning technology. CRC- checking may be able to determine . In the case of the , if Filler , neither CRC- checking or ning be able to determine the Filler 's presence. If you suspect you ma Filler u, power down your and , write protected J, and check the software. It is what Filler might do PZPAPN Fingers : Fingers V08-15, KEZB G: May j; TSR; Germany R: 1,322 4: PRsAK - , IBM , VET, NAV 2.1+, The Fingers ~in Germany in May, . Fingers is vof . ,and . The Fingers is X, the as a low of 1,728 (. It hook 21. If the , the hook Fingers is , it ,and . X. If X, it by 1,322 to 1,337 (. Fingers dat the end of . The =and in the DOS Fingers 8the "CRITICAL ERROR 08/15: TOO MANY FINGERS ON KEYBOARD ERROR." Fingers and the has entered 3000 fthe , the Mthe second and the be halted. PZPAPN Finnish-709 : Finnish-709 709, Swedish-709 Finland R: 709 4: PRhCK - IBM ., NAV 2.1+, The Finnish-709 Mikael Larsson of Help Centre, Sweden. It is Finland. Finnish-709 is a vof . The Finnish-709 is at the top of #the , as rby the DOS ?by 2,560 |12's moved. {1C and 21 nby the , Finnish-709 by 709 (. The at the end of be no the =and in the DOS Finnish-709 Nn't do of Finnish-709 are: Finnish-357: on the Finnish-709 is a re-written, smaller . Its is 2,048 (, hooking qof 357 at the end of the a. The =and in the DOS to the =and Like the , it Nn't do : Finland PZPAPN : Fish Van Fish es, Fish 6, G: May j; monitor/ Mflickering; West Germany R: 3,584 4: PRsAK - \, NAV, IBM , VET, : CleanUp, NAV, or The Fish ~in May . At the it was reported to be widespread in V, and it is ated in West Germany. It is a generic v, and remain through a warm re %(CTRL-ALT-DEL). The can be dby searching for the "FISH FI" ing near the end of the The "FISH FI" may later dis fthe The the Fish the zing into the low . If |13 has not , it hook |13. If it can hook |13, it take up 8,192 . If the cannot hook |13 because an is already using it, it be 4,096 |13 is not n, and the the cause a random warm re %, thus allowing it to +and hook |13. Warm re %s do not to randomly |13 has , all . ,and . are for any reason by 3,584 (. The cannot be seen by Eif the is in , if a 5is run on an detect `. If run the /F option, it in lost clusters and cross-linking of The slows down video writes, and flickering of the monitor Mcan be noticed on an perform CRC checking cannot detect the uof the by the Fish if the bypass software write-protect mechanisms used to protect a The Fish is a modified of the 4096 it is more sophisticated in it constantly re-encrypts . Viewing show s of several fish are present. It is what the Fish to check to determine if the year of the of Fish are: Fish II: on the Fish is 4,096 Fly hooking mapping utilities not indicate any {are , it ,and . qof 3,584 be hidden . Fish II is polymorphic, and no in the 4. The encryption is fthe in order to avoid detection by familiar but not 1993. PZPAPN Fish : Fish Chinese Fish G: March, Zfailures Taiwan Eastern R: N/A 4: BRaX - , VET, , NAV 2.1+, .1.4+, K/P or DOS 5.0 F K/MBR on DOS SYS on The Fish ~in the Eastern March . The s to fTaiwan. Fish %is a and the The the Fish , the xthe The Fish wthe bwriting a copy of the starting at Side 0, Cylinder 8. The 4is two long. The copied to Side 0, Cylinder 0, The wthe at Side 0, Cylinder 0, Fish , it xany non-write protected is accessed on the . On double density 5.25 inch I, the at Side 0, Cylinder 39, 3. The Fish in the location, as well as at Side 0, Cylinder 39, 1 and 2. On high density 5.25 inch I, the Side 0, Cylinder 79, in the location and Side 0, Cylinder 79, 1 and 2. the Fish notice no longer function , hanging the Y. At s, the may be "Hello! I am FISH, please don't kill me. Congratulation 80th year of the Republic Of China Building, Fish help to kill stone Written by Fish in NTIT. TAIWAIN 80.10.18" can be in the outside of the location. See: Generic PZPAPN Flash : Flash ; video flicker West Germany R: 688 4: PRfA - , NAV, IBM , VET, : NAV, or The Flash in West Germany. Flash is a generic v, and `, but not The the Flash the . 976 in high , and a corresponding 976 (. A mapping of indicate Flash is {00, 23, 24, 30, ED, F5, and FB are now in reported by DOS, as well as low used by the operating and TSRs Flash is ,or . Xit is a candi =for u. An always be supon `are are greater always 688 a graphics capable monitor may notice a flicker ring at seven minute intervals. The causes effect by manipulating blanking bits every seven minutes. PZPAPN : Flex , 1993 ; write protect North America R: 491 4: PRhCK - \2.07+, V102+, V102+ The Flex , 1993. Flex is a vof . +. It is fNorth America. bFlex X, the Flex at the top of #the , as rby the DOS by 1,008 {09 and 21 nby the Flex the Flex , it qof 491 at the end of the a. The =and in the DOS not be . The in the 4in all Flex "[FLEX]" The Flex Mthe the monitor: "Flex-It-Up gal!" msex!" "Admiral Bailey" in the PZPAPN : Flip Flip-2343 West Germany T; possible Switzerland R: 2,343 4: PRhABKX - \, NAV, IBM , VET, : CleanUp, or The Flip, or Flip-2343, Gin West Germany in . It is a generic v, and W, and overlay as well as alter the ) and Ks. It is important to note the Flip is not xive The the Flip X, it in high as reported by the 5as well as ?by 3,064 (. At , the copy of in the C: Oroot be apparent . The be slightly modified. If the fa floppy, +on the floppy the be noticeable. Flip , any . ,or . show a qof 2,343 (. If a uses an overlay a, the overlay Flip may ing in alinkage data `may corrupted. On the second of any month, were Kand man EGA or VGA capable Madapter may [the Mon the monitor "horizontally "flipped" between 16:00 and 16:59. greater 32 mega 9of the Klogical ing. s, a larger 32 mega (may be to be slightly less 32 mega Flip can be passed between `, and floppy do not transfer the of Flip are: Flip-2153: to the Flip an effective of 2,153 (. Its portion at the top of is 2,672 (. The major difference between and the Flip-2153 can fthe Flip-2153B: to Flip-2153, 's major can now becoming Flip-2153C: to Flip-2153B, has to avoid detection by utilities. Flip-2343B: to the Flip is 2,864 (, hooking |21. a, it is able to both . ,and . out the needing to be fthe Prism: to Flip-2153, to avoid detection by most utilities were aware of the Flip . Like Flip-2153, it adds 2,153 (to the . ,and . X. As members of ], it wthe PZPAPN Flower : Flower G: May, R: 883 - 897 4: PNE - 1.15a+, 6.00+, : CleanUp, or The Flower, or 880, in May, . Its . Flower is a of . the Flower search the Efor an d, the xit. it has completed tthe or if no awas d, the host was now run. the Flower qof 883 to 897 (. The at the end of the . The =and in the DOS not be The in the Flower "FLOWER" "Support the power of women Use the power of man Support the flower of woman Use the word FUCK The word is love" released 7 W\* \" Flower 11th of any year, at a trojan . The trojan Mthe PZPAPN FoneSex : FoneSex , 1993 to dial modem R: 688 4: ONA - V102+, V102+ The FoneSex , 1993. Its . FoneSex is a ,and . the FoneSex X, the FoneSex xall of the . ,and . in the unless were smaller case . The =and in the DOS not be has completed tall of the . ,and . in the E, it Mone of the to the DOS prompt: "Out of too big to fit in The FoneSex 7the in its "*.* *.exe \ \dos *.com d" "Out of "9034600" "4545388" "2888100" "6809100" "9038181" "4540759" "8840758" "8965581" "6804900" "4075240" "9038700" "7868482" The seven digit numeric are interpretted as phone numbers by the , and the attempt to send a dialing 5sequence to the ,ports in order to activate a modem. PZPAPN Forger : Forger j; TSR R: 1,000 4: PRsE - , VET, NAV 2.1+, .1.4+, 1.53S+ The Forger . Its . Forger is a vof . bForger X, the Forger as a low TSR of 3,376 (. It {13, 21, and CC. At , it search the locate two , and them. the Forger , it X. It xone . the Forger sall . on the O, it start on the C: the Forger qof 1,000 (. The at the end of the be no 2to the =and in the DOS Forger is an . One the "*.exe" The in the "Socha dsk" It is what Forger PZPAPN FORM- : FORM- Form, Form %, FORM-18 BSC; clicking noise speaker Switzerland R: N/A 4: BR - \, NAV, , IBM , VET, : CleanUp, M K, NAV, or DOS SYS The FORM- , or Form %, is a floppy and . It was Switzerland. FORM- , the as well as seek out and xthe K. The floppy %may or may not be successful, on the author's test ffloppy FORM- never succeeded, instead the would hang. It should be noted by the author of document as a binary a, and it may damaged in The 8ed in the FORM- binary by the author of document: "The FORM- sends greetings to everyone who's reading .FORM Nn't destroy data! Don't panic! Fuckings go to Corinne." , however, may not in all cases. For example, I did not find anywhere on a Form the FORM- may notice clicking noise may be emitted fthe speaker on the 24th day of any month. can be removed the same technique as used vs. b, power off the clean write-protected J. The DOS SYS 5can be used to recreate the . Alternately, fMcAfee Associates may be used to recreate the of the FORM- Form II: on FORM-18, in May . It is gequivalent to FORM-18, to avoid detection by most anti- utilities. May, FORM-18: to the FORM- , FORM-18 on the 18th day of the month, at clicking be heard the speaker on clock and CMOS. out a clock most likely not mthe clicking FORM-Canada: to the FORM-18 a minor alteration. On I, it locates the remainder of the 4and the btwo , unused on the marking them as bad : Canada PZPAPN Fratricide : Fratricide ^, 1993 fail to North America R: 647 4: ONA - \2.07+, NAV 2.1.4+, V102+, V102+ The Fratricide ^, 1993, and to be fNorth America. Fratricide is a . It permanently corrupts the . the Fratricide X, the Fratricide xfour . Wor . in the preference for . `. It not it has completed tfour the either be ed to the DOS prompt, or the may be too big to fit in the Fratricide mthe (of the host by the , permanently corrupting the since the !of the ais not saved by the . The =and in the DOS not be $the , the in the "Oh, life. I apologize for terrible thing." "It is for a chance. I'm a person "Fratricide - Murders a br "-- By Cone -- be ready to see more" Under conditions, the bfour may be Las a by the PZPAPN Freddy : Freddy j; TSR Brazil R: 1,870 - 1,884 4: PRsAK - 6.00+, V99+, 2.43a+, V99+, The Freddy and is fBrazil. Freddy is a vof . and overlay `. It +. It is on the , and may identify it as such. bFreddy X, the Freddy as a low TSR of 2,912 (, hooking |21. It one . in the the Freddy , it Xby the , plus one in the qof 1,870 by a much smaller amount as the of the slack (hex 00) area at the end of of 1,870 to 1,884 (. In all cases, the the end of the a. The =and in the DOS not be . The are in the 4in all Freddy "$322/vv" ly, the in the "Freddy Krg" It is what Freddy , but it 8destructive See: PZPAPN ew-692 ew-692 R: 692 - 1,362 4: PNC - , VET, , NAV 2.1+, 1.53S+ The ew-692 . Its , is ew-692 is a vof . . It Nnot ew-692 is xall in the it completes tall of the . in the E, it start tthe . on the C: the root E. Needless to say, process s in a very long Kaccess. ew-692 normally by 692 at the of the a. The exception is in the case where the host was less (, the 1,364 be no 2to the =and in the DOS The can be in the all ew-692 maa" "*.* *.com" ,MAND.MKS_VIR" It is ew-692 PZPAPN Frere Jacques : Frere Jacques Frere , Frere Jacques-B, Frere Jacques-C, Frere Jacques-D, Two Tigers G: May music (Frere Jacques) on Fridays California, R: 1,808 - 1,822 4: PRA - \, NAV, IBM , VET, : NAV, or The Frere Jacques ~in May, . It is a generic W, and Overlay `. It Nnot on the The X, the in low . The occupies 2,064 (, and attaches |21. becoming , Frere Jacques xany by between 1,808 (and 1,822 `always by 1,813 Frere Jacques , as well as execu `increasing in intermittently , thus ing in the possible loss of data. On Fridays, the Frere Jacques , and play the tune "Frere Jacques" on the speaker. of Frere Jacques are: Frere Jacques-B: to Frere Jacques, play the tune "Frere Jacques" on the speaker every few minutes on Fridays. On Fridays, it ma 2,112 )TSR in 08, 21, and 22 Frere Jacques-C: Frere Jacques-C differs fFrere Jacques-C by two in its 4. Unlike the Frere Jacques, play music every few minutes on any day of the week. Its TSR is always 2,064 {08 and 21 Frere Jacques-D: Frere Jacques-D is to Frere Jacques-C, however it play music on Fridays, and the delay before the music starts is longer. On Fridays, its TSR is 2,064 {08 and 21 see: PZPAPN Friday 13th : Friday 13th Friday The 13th ,, South African, , 1987 j; floppy Kaccess; adeletion Republic of South Africa R: 512 4: PNC - \, IBM , NAV, , VET, \, NAV, or The Friday 13th ed in South Africa in 1987. Unlike the (Friday the 13th) es, it is not , nor Nit hook any `, but not +. On a, the looks for two `on the C: Oand one on the A: O, if is extremely fast, and the indication of propagation ring is the access light "on for the A: O, if the :default Ois C:. The . The u, must be less 64K in On every Friday the 13th, if the host X, it is of Friday 13th ,are: Edge: to the QFresh Edge has three differ. It 7the "v w x". Friday 13th-B: same, except xevery the Eor in the path if the is in the path. Friday 13th-C: same as Friday 13th-B, except "We hope we mn't inconvenienced you" ever the Friday 13th-D: Friday 13th-D was fthe NCSA. adds 418 to 432 w. It all . , except the ever an mhad =and in the to the =and . The be be at the end of the a. On Friday The 13ths, the Friday 13th-NZ: fDr. Henry Wolfe of New Zealand , Friday 13th-NZ is a minor of the Friday 13th . It `in the X, adding 623 to 634 (to the . The actual of the however, is 350 (. The the end of the a. It Nnot on Friday The 13ths. QFresh: fSweden in , QFresh is a 615 of the Friday 13th . It wall . in the of 615 to 628 at the end of the a. The =and in the DOS not be 8the in the QFresh "ENET_INF" : Sweden -B: A 542 of Friday 13th, of the . in the X, along Ming the "WARNING ! THIS PROGRAM IS INFECTED WITH VIRUS-B! IT WILL INFECT EVERY . ,FILE IN THE CURRENT SUBDIRECTORY!" qof 542 to 555 at the end of the a. The =and in the DOS not be $the , the can be in the 1988. PZPAPN Friends : Friends R: 1,362 - 1,377 4: PRtE - , VET, , NAV 2.1+, .1.4+, 1.53S+ The Friends . Its . Friends is a vof . and spreads very quickly. bFriends at the top of but #the &, moving |12's , as rby the DOS ?by 2,096 21 and 24 nby Friends in , the Friends xone . in the the Friends , it or batch a DIR 5is performed, or any reason. In the case of the DOS COPY 5, the target sif it is an . the Friends qof 1,362 to 1,377 (. The the end of the . The =and in the DOS not be . Three in the 4in Friends "GSJFOET!PG!NBJT!boe!DMBVEJB!TDIJGGFS" The S, but un the gets its "FRIENDS!OF!MAIS!and!CLAUDIA!SAHIFFER" It is if Friends See: Cossiga PZPAPN Frodo Soft : Frodo Soft Warsaw, Poland R: 563 4: PNCK - V99+, 2.43a+, V100+, \2.07+, V99+, The Frodo Soft . It is fWarsaw, Poland. Frodo Soft is a vof . +. It should not be confused the 4096 or Frodo are not related. the Frodo Soft xone . in the E, it may the Frodo Soft qof 563 at the end of the a. The =and in the DOS not be . The in the 4, and hence not "*.com" "Gmks*.exe" "(c) Frodo Soft" It is what Frodo Soft of Frodo Soft are: Frodo Soft-458: An earlier of the Frodo Soft wone . qof 458 the at the end of the a. The in the ?com" "mks ?.exe" "(c) Frodo Soft" : Warsaw, Poland PZPAPN Frogs : Frogs Frog's Alley G: March, ; FAT & Edamage; Kvolume label 2; long Kaccess R: 1,500 4: PRCK - , NAV, , VET, IBM The Frogs, or Frog's Alley, in March, David Grant of the is a vof . Frogs is in low, unreserved {09, 20, 21, and 2F nby the , Frogs +and one ain the becoming , Frogs xone . Xor a DIR performed. In either case, long Kaccesses be noticeable either X, or as the DIR 5completes. . `are was 1,500 or more Frogs 1,500 (, and the =and in the to the =and . The at the Frogs on the 5th day of any month. Xon the 5th, the "(V) AIDS R.2A - Welcome to Frog's Alley !, (c) STPII Laboratory - Jan again be ever a DIR performed. The L, the remove the `and fthe still be accessible until removed, or the is no longer in is no longer in , the Mthe volume label "s Alley !" and a DIR 5is performed. The K's FAT and root multiple symptom's of Frogs are long Kaccess executing or performing DIR 5s, as well as occasional unexpected accesses to the B: intensive applications hang Frogs is active in of Frogs are: Frogs-B: to the the "Diabolik!" near the end of the in all PZPAPN Fu Manchu : Fu Manchu 2080, 2086, Fu Manchu-B G: March, 1988 .SYS, .BIN, . ,, & . R: 2,086 (. `) & 2,080 (. 4: PRsA - \, IBM , NAV, , VET, , NAV, or The Fu Manchu attaches to the !of . or the end of . xany execu poverlay, .SYS, and .BIN `as well. It s to be a rewritten of the possible creation =of 3/10/88. A marker or id usually is 'sAXrEMHOr', uses the 'rEMHOr' portion of the identify One out of sixteen in a zed, and a random amount of , the , "The world hear fme again!" is Land the %s. Lon an a warm re Nn't survive in 1, 1989, the monitor the buffer, and add derogatory comments to the s of various politicians. comments go to the buffer, so effect is not limited to the M. The in the are is very in the of Fu Manchu are: Fu Manchu-B: gthe same as Fu Manchu, seven in order to avoid detection by products. see: Taiwan 3 PZPAPN Funeral : Funeral j; music; Eastern R: 921 4: PRhAK - 6.00+, 3.93+, NAV 2.1.2+, V99+, The Funeral . It is fEastern V. Funeral is a ,and . bFuneral X, the Funeral at the top of #the , as rby the DOS ?by 976 {08 and 21 by the , the the %copy of +if it was not the Funeral , it qof 921 at the end of the a. The =and the DOS to the =and the Funeral for 1 hour, it play a short funeral march on the speaker, and . The funeral march is the same as the tune played by the ZK900 PZPAPN Fungus : Fungus X-Fungus G: May, Australia R: 1,422 4: PRhAK - \, VET, 1.15a+, The Fungus Gin Australia in May, . It is vof . ,and . +, and employs techniques. bFungus X, the Fungus at the top of #the , as rby the DOS by 2,048 {08 and 21 nby the |12's moved. the +, if it was not the Fungus , it intermittently ,and . of 1,422 not be if the . The the end of the a. The =and in the DOS Several can be in the 4in Fungus "*X-Fungus by Harry McBungus*" "*Nugga!*" "*Greets SCP*" "*Greets RABID*" "* Patricia: Grow ming knowledge *" "*Grease me!*" "*Epileptic Downer*" $the the Fungus the DOS PZPAPN : Geek H: R: 450 - 466 4: PRfAK - , NAV 2.1+, 2.43a+, 6.04+, \2.07+, The Geek . It is the . Geek is a vof . bGeek X, the Geek . It Fly hooks {, and no to the Geek to map various utilities. the Geek , it by 450 by 456 to 466 (. In both cases the at the end of the a. The =and in the DOS . One in the Geek "GEEK" Geek on the 29th day of any month, at a random on the PZPAPN Generic : Generic H: N/A R: N/A 4: G - Generic The Generic is not actually a specific , but a general category or group of can be genericly detected by software using ner technology. It was implemented by McAfee Associates in The es detected by the Generic detection mechanism in are generally on the not all of them are related to es may `, or both . ,and . be malicious. While most of the es are them are vs. may be detected as the Generic include: Beast-N-Black Father Christmas Ghostballs Grither Infinity Iraqui Warrior Lisbon MSTU NTKC Polish 217 Polish 583 R-10 Socha Traveller VHP2 Viperize New es may be detected by mechanism are not documented in . If you detect a Generic , and it not match one of the es, please submit a sample to the author of for analysis and inclusion in PZPAPN Generic : Generic G: N/A R: N/A 4: GBX - Generic : DOS SYS or M may detect es using techniques look for functions or characteristics in the may identify such es as "generic may be identified by as Generic %, and are identified in separate entries in Fish Guillon Keydrop Queens Tony Windmill If you detected as a generic not match one of the , please submit a copy of it on to the author of for inclusion in the next release. PZPAPN Gergana : Gergana Gergana II, Gergana III, Gergana IV, Gergana-222, Gergana-300, Gergana-450, Gergana-512, Gergana-182B G: May, R: 182 4: PNCK - \, IBM NAV, , VET, The Gergana in May, . It is Gergana is a vof . Gergana is X, Gergana xthe in the E. If Gergana, it be re The search the currect Oand Efor an one is , the xit, increasing the by 182 (. The at the end of the . The =and in the to the =and Gergana may xthe . in the all . in the to be a bug in the Gergana Nnot do of Gergana are: Gergana-182B: on the )Gergana has one differs. It Gergana-222: A 222 of Gergana, not re `. Like Gergana, mhad =and 0to the =and . It xvery small `. The can be `: "Gergana II -BUL3" and ,". The at the Gergana-300: A 300 of Gergana, mhad in the DOS E. It xvery small . `. The can be `: "Gergana /", "III", and "*. ,". The at the Gergana-450: A 450 of Gergana, to Gergana-300. It at the ,", "GERGANA", "-IV e", and s. Press [Enter] to continue." Gergana-512: A 512 of Gergana, xtwo . `(but not in the by 512 at the !of the be no in the =and in a DOS . The can be "Gergana V" "For nice call [359][032] 557-643." "[Enter] to continue." Typically, fail to Ming random PZPAPN Ghostballs : Ghostballs Ghost %, Ghost ,, Ghostballs.1 Extinct , 1989 Moving graphic 9; BSC Iceland R: 2,351 4: PNCB - \, IBM , NAV, , VET, : CleanUp, , NAV, or `& DOS SYS The Ghostball, Ghost %, and Ghost es were , 1989 by Fridrik Skulason of Iceland. The Ghostballs wgeneric . `, as well as altering Ghostballs is X, Ghostballs search the Efor an If an d, it s, the increasing the by 2,351 (. The at the end of Ghostballs 8the "GhostBalls, Product of Iceland Copyright (c) 1989, 4418 and 5F10 MSDOS 3.2" Ghostballs alters the , replacing it to the Ping Pong however, are very to the Ping Pong , and random 9may The Ghostballs was the could both case) and the s, the [s the bouncing ball effect of the Ping Pong . If the to remove the u, it again corrupted the next The Ghostballs on the 4of two The . vportion consists of a modified of the . The portion of the on the Ping Pong To remove , turn off the computer and re fa write protected Jfor the use either M the DOS SYS 5to replace the on the K. Any `must be erased and replaced clean copies fyour distribution of Ghostballs are: Ghostballs.1: gidentical to the Ghostballs differs by 4 PZPAPN Gingerbread Man : Gingerbread Man Bad Seed G: March, 1993 <seconds = 60 Australia R: 2,774 4: PRatAX - W, & `& replace The Gingerbread Man, or Bad Seed, Gin Australia in March, 1993. Gingerbread Man is a multi- partite ,and . as well as the . Its ing mechanisms are very advanced, and it is bGingerbread Man X, the Gingerbread Man , hooking {13 and 21. , as rby the DOS not be . It xthe ), altering two (and writing a copy of the 4starting at side 0, cylinder 0, 2. The alteration to the is hidden as the present an copy of the ever it is attempted to be accessed. Later, fthe K, the Gingerbread Man at the top of , but #the &, moving 12's , as rby the DOS not be ?by 3,072 the Gingerbread Man , it ,and . ed to by the ,SPEC en mental variable (usually are , or copied. In the case of copies, both the source and target the Gingerbread Man qof 2,774 at the end of the a. The qis not as the hides the q, as well as ever are accessed. The and in the DOS seconds field to 60, the umarker for the The are un in the and may be viewed in `, and on cylinder 0 of is not "PTT (You can't catch the Gingerbread Man!" "Bad Seed - Made in OZ!" ,SPEC=" "MEM" "10/23/92" Since the Gingerbread Man is a full , dis "on the fly", checksumming be unable to detect the it is . The lock up the if the determines a debugger is in use. PZPAPN Gliss : Gliss Germany R: 1,247 4: PNCK - , VET, NAV 2.1+, The Gliss fGermany in . Gliss is a vof . the Gliss X, the search the Efor an x. If one is d, it xit, and placement not exact #, and " as the base of the . has just "Dies ist ein Demonstrations-Computer So gerade eben wurde das von diesem befallen. Der VIRUS hangt sich an alle `- in Laufwerk A - mit der Extention . ,an. Die me bleiben aber ablauffahig. Falls Sie Fragen zu Computerviren oder =nsicherheit und =nschutz beim Einsatz von Personal Computer haben, fordern Sie unsere ysbroschure : - Der sichere und kontrollierbare PC - an. Gliss & Herweg GmbH inusstrabe 7-11 D-5020 Frechen-Konigsdorf" If an ais not d, the placement not exact "Alle Com - me in Laufwerk A sind mit diesem VIRUS schon infiziert! Falls Sie Fragen zu Computerviren oder =nsicherheit und =nschutz beim Einsatz von Personal Computer haben, fordern Sie unsere ysbroschure : - Der sichere und kontrollierbare PC - an. Gliss & Herweg GmbH inusstrabe 7-11 D-5020 Frechen-Konigsdorf" the Gliss qof 1,247 at the end of the a. The =and in the DOS . All of the can be viewed in Gliss Nnot do PZPAPN Globe : Globe Read- , Hidden . R: 6,610 4: SNE - Spawning 6.00+, 2.43a+, V99+, The Globe . It is a spawning or companion . Its the Globe X, the Globe xone . in the E. It by creating a . the same base 8the 4, and be 6,610 the Read- and Hidden attributes set. It 7the "Glo" 3 M.00" "PATH" WKCO" fBorland's Turbo C compiler. the Globe PZPAPN Gnose : Gnose }h3, V-20 G: May, j; hidden . `; write protect on write protected I; TSR Ireland R: 1,164 4: SPRsAK - & Spawning 2.43a+, NAV 2.1.4+, \2.07+, The Gnose, }h3, or V-20, Gin Ireland in May, is a vof . ,and . uses two different mechanisms to `. It is both and spawning. The the Gnose as a low TSR of 2,608 (. It {03, 1C, and 21. , it xone . in the the Gnose , it X. . sin a manner by the Gnose qof 1,164 at the !of the a. The in the DOS not be sin a spawning manner, companion hidden . `created by the . The companion . be 1,164 mthe same base the . . The companion =and be the =and uof the . The companion, hidden . 8a copy of the Gnose Gnose is an , and no the `. The in the "GNOSE. Wexe" V2.0 [FrIEND]S" the Gnose may notice receive write protect on write- protected PZPAPN GoldGeld : GoldGeld , 1993 Germany R: 612 4: PRtAK - \2.07+, V102+, V102+ The GoldGeld , 1993, and fGermany. GoldGeld is a vof . and . may identify it as a PS-MPC since it uses a encryption mechanism. bGoldGeld X, the GoldGeld at the top of #the &, moving |12's , as rby the DOS ?by 2,048 nby GoldGeld in the GoldGeld , it and . qof 612 at the end of the a. The =and in the DOS not be . The in the GoldGeld "Es ist nicht alles Gold, was gl The "EEK" can be in the 4in all It is what GoldGeld PZPAPN Gosia : Gosia Poland R: 466 4: PRCK - ., IBM , NAV 2.1+, The Gosia . It is fPoland. Gosia is a vof . The Gosia is X, the Gosia in a "hole" in be no . At , the xall . in the Gosia is , it xany . has not sby the Gosia 466 at the !of the be no 2to the =and DOS . The can be in the "Gosia" The Gosia Nnot do PZPAPN Got-You : Got-You j; hidden `created; 1printer setup; cancels network printer re Fion; unexpected printing of Mcontents; last Ocan't be accessed Belgium R: 3,052 - 3,067 4: PNE - 1.15a+, NAV 2.1+, .1.4+, The Got-You fBelgium. Got-You is a vof . s on Os C: through Z: during the bhalf of the year. During the second half of the year, it Got-You is X, the check the =to determine what the :month is. If the :month is thru , the randomly select a fC: thru Z: where it search for an . x. The searches down through the Estructure, and wthe it locates. Got-You by 3,052 to 3,067 at the end of the a. The =and in the not be 8the "G OT YOU" through >, Got-You . During period, the , performing any one of five different behaviors. behaviors s is randomly selected by the . The five behaviors are: 1. The check to see if the computer is on a network and has access to a network printer. If the computer has access to the network printer, it 2its setup. 2. The check to see if the computer is on a network, and cancel any re Fion allows access to a network printer. 3. The print the computer's Mcontents to the printer, to the having pressed the print key. 4. The determine what Os are by using the DOS list of lists y, and disable the last Oso it is not accessible. 5. The create a hidden, 10,240 aon a randomly selected d "G OT YOU. x ", and 8random data 4exists in the for deleting it is not called in the Got-You 4to check if monitoring packages are , and if it thinks one is present. To do , the checks for 6ly monitored to be in the same segment of . It 4to try to determine if a debugger is "used, and if . Lastly, 4to keep the searching too long for a PZPAPN Gotcha : Gotcha ; write protect The R: 879 4: PRhAK - , IBM NAV 2.1+, The Gotcha fThe Gotcha is a vof . ,and . The Gotcha is X, Gotcha at the top of #the @by 1,136 by the Gotcha is , it ,and . very small ones, sby Gotacha 879 (, and mthe at the end of the The can be din all the Gotcha "GOTCHA!" It is if Gotcha of Gotcha are: Gotcha-A2: gequivalent to the has two differ. Like the it adds 879 `. The at the end of `. Gotcha-A2 [write protect fwrite protected Gotcha-B: Gotcha-B is a 881 of Gotcha, adding 881 `. As at the end of Nn't [write protect accessing on write protected Gotcha-E: Gotcha-E is a 607 of the Gotcha . It adds 607 (to the . w. The "GOTCHA!" can be dat the end of all `. Gotcha-E 7hex character several pDatacrime, Datacrime II-B, Yankee 2, Syslock, and included in the for the purpose of confusing various ners as to is present on the by having the ner detect us on while missing the entirely on May, Gotcha-627: Gotcha-627 is a 627 of the Gotcha It adds 627 . The at the end of the a. The portion of Gotcha-627 requires 912 at the top of but #the , as rby the DOS amount. Gotcha-732: Gotcha-732 is a 732 of the Gotcha It adds 732 (to the . w. The at the end of the The portion of Gotcha-732 requires 992 at the top of #the , as rby the DOS amount, and n. The "GOTCHA!" can be dat the end of all Gotcha-906: Gotcha-906 is a 906 of Gotcha, adding 906 `. The at the end of uses 1,168 at the top of #the &. One symptom of Gotcha corrupted is no space on the See: Legalize PZPAPN Grapje : Grapje 1012 + 27, 1039, Dutch 1039 Mscrolling; long loads The R: 1,039 4: PNCK - , NAV 2.1+, The Grapje, 1012 + 127, 1039, or Dutch 1039 Jan Terpstra of The . Grapje is a vof . Grapje is X, the search the Elooking for an x. If an d, it s. If +exists in the E, it may Grapje. If an awas not in the Grapje search the Estructure looking for an Grapje by 1,039 (. The at the !of the be no 2to the =and in the DOS E. The can be the Grapje "*.com" "GRAPJE!!" in a hang. hang s, two . sby Grapje, instead of the usual one. , Grapje effect X. Randomly, Grapje fill the buffer random data , scrolling the s, the way to stop it is to re %the ly, the Mthe "GRAPJE!!" repeatedly, scrolling the 30 days melasped since the started to Ythe . Unless the started to Ythe right before midnight on the last day of a month, and at exactly the right split second, never be seen. PZPAPN Green Joker : Green Joker Green ; beeping R: 743 4: PNCK - \, VET, 1.15a+, .1.4+, 3.93+, 25.10+, 1.53S+ The Green Joker, or Green, . Its . Green Joker is a non- vof . +. It may be related to the Ash the Green Joker xall of the . in the E. If E, it the Green Joker qof 743 at the end of the a. The =and in the DOS to the =and The Green Joker usually on the , the be accompanied by beeping on the speaker. The may be Lby the "Fail on INT 24" "Impotence Ureading 's dick Abort, Retry, Ignore, Fail?" too big to fit in "JOKER!" "Cannot load ,MAND, halted" The can be in the , along ctwo "Joker!" Green Joker Nn't do Mits See: Ash PZPAPN Green Peace : Green Peace R: 15,022 4: ONE - The Green Peace fa United States source. is a . It is a research , its source, as well as an aarrived as the submission. Green Peace is s, the xall . in the b15,022 . If the . smaller 15,022 (, its be 15,022 (. Larger many q. The =and to the =and . All 8the near the !of the "Green PeaceGreen Peace" tall of the . `in the E, the scroll the Mand Mthe "Green Peace" in the middle of the . The to be hung until CTRL-C is hit several Two `can be Fories Green Peace. `are d INH and W. The INH 7a list of all `in the s. 7. 7a pure copy of the Green Peace The sample is a . "drops" the Green Peace . It Nnot 8the , but instead 7the "GREEN". Green Peace Nnot do host) and Ming its PZPAPN Gremlin : Gremlin Greemlin G: May, slowdown; =s may dis R: 1,146 4: PRhAK - D: IBM \, NAV, , VET, The Gremlin, or Greemlin, in May, by the PCVRF. is a vof . ,and . +. Its The Gremlin is X, the at the top of #the |12's not moved. The hook {08 and 21. Gremlin is , it ,and . X. If X, it by 1,146 at the end of the . The be hidden by the if Gremlin is The in the if it was 12:00A. The "greemlin" can be din all may notice a slight slowdown in speed of Gremlin is a destructive . It on the A:, B:, and C: Os on 14th of any year. See: Alfa PZPAPN Grither : Grither j; C: & D: R: 774 4: PNCK - , IBM \, NAV, , VET, The Grither , by Paul Ferguson of the is a vof . Grither is X, the xone . ain the sif it exists in the Grither by 774 (, the at the end of the The =and in the not be by the The Grither can be extremely destructive. a probability one out of every eight s an X, the may activate. On , Grither !of the C: and D: Os of the K. Effectively, corrupts the s, and E, as well as the Grither is roughly on the PZPAPN Groen Links : Groen Links Green Left G: March, j; TSR; music Amsterdam, Holland R: 1,888 4: PRsA - , IBM \, NAV, , VET, The Groen Links reported in Amsterdam, Holland, in March is a vof . `. It Nnot +. It is a of the is listed separately here as it is a different and exhibits different characteristics. The the Groen Links X, the as a low TSR of 1,872 {21 and CE nby the , it ,and . by 1,893 at the of the a. . by 1,888 to 1,902 at the end of `. As many of the qby 1,888 (on subsequent us. : "GRLKDOS". for 30 minutes, it may play "Stem op Groen Links" every 30 minutes. The of the tune translates to "Vote Green Left", Green Left "a political party in Holland. See: PZPAPN Groove : Groove As/corrupts data don't function %failures Germany R: 3,646 - 3,708 4: PRhAK - 6.00+, 2.43a+, o, NAV 2.1.2+, The Groove . It was ~in Germany, where it is reported to be in the public domain. Groove is a vof . ,and . uses a slightly modified of the Dark Avenger Mutation Engine (DAME) for encryption. the Groove Groove at the top of #the &. It the Groove , it X. It , but very small ones. qof 3,646 to 3,708 The at the end of the a. The and in the DOS the =and The Groove 7the are usually are not "Dont wory, you are not alone at hour... is NOT dedicated to Sara its dedicated to her Groove (... s my a test be ready for my Next Test "C:\NAV_._NO C:\NOVIRCVR.CTS C:\NOVIPERF.DAT .\CHKLIST.CPS C:\TOOLKIT\FILES.LST C:\UNTOUCH\UT.UT1 C:\UNTOUCH\UT.UT2 C:\VS.VS" The second set of are the s of data `for the utilities targetted by the author of : Symantec's Norton Anti- , Certus' Central Anti- , Dr. Solomon's Anti- Toolkit, Fifth Generation ' Untouchable, and XTree's . The attempt to corrupt or are present. $the deletion or 9of the data the Groove difficulty executing usually not function , giving unpredic s. If %failures may See: DAME Pogue PZPAPN Groove OW : Groove OW & truncated; graphic M; lost clusters; C:\ +replaced; %failures; fail to function R: 1,214 4: PNEK - V100+, V100+ The Groove OW . Its . Groove OW is a and the copy in the C: Oroot E. It is not related to the Groove the Groove OW xthe copy of in the C: root Eas well as one . in the E. It Ma graphic the "Sara's Groove". the Groove OW of 1,214 (and 8pure 4. The and in the DOS be the and . The in the 4in all Groove OW "*.exe c:\ 5.com .. Darkest avenger" "Isnt dedicated to Sara Gordon" "Its dedicated to her GROOVE!" sby the Groove OW ma large number of lost clusters. The creates three lost clusters %failures fthe PZPAPN Growing Block : Growing Block -1361, -Yellow TSR; . j; gradual @s in Australia R: 1,363 4: PRsAK - , VET, , IBM NAV 2.1+, The Growing Block ~in Australia in It is a vof . ,and . +. The a graphic effect was produced ~sample. samples do not produce the same "growing block" graphic effect. The Growing Block is the in low {08, 09, and 21 nby the 's 1,632 TSR. The allocate a 4,096 )block of low as well, be marked as ,MAND Data. Growing Block is , it ,and . by 1,363 at the !of the by 1,361 to 1,375 at the end of the a. The =and in the to the =and Growing Block [a gradual decreasing of Growing Block is X, the allocate an 4096 )block of low , slowly eating away . An symptom is the DOS fail to it is ing in the "Invalid ", and EDLIN ending See: PZPAPN Grunt-1 : Grunt-1 H: R: 344 4: PNCK - 6.04+, \2.07+, V99+, 1.53S+ The Grunt-1 . It is fthe . The Grunt-1 is a vof . the Grunt-1 X, the Grunt-1 xone . in the of 344 at the end of the The =and in the DOS not be . The in the 4, and is not "[GRUNT-1] -=> Agent Orange '92 <=- *.com .." The Grunt-1 1, 1993. At , the random on the O(C:, D:, and E:). of Grunt-1 are: Grunt-1B: , Grunt-1B is gvery 7the same . Grunt-1B adds 346 (to the Grunt-3: ^, 1993, Grunt-3 is a later of the Grunt-1 . It wone . in the :or a higher qof 473 at the end of the a. The =and in the DOS not be . The in the Grunt-3 "[GRUNT-3] -=> Agent Orange `92 <=-" is a hot LZ ... Eradicating the Enemy!" ^, 1993. PZPAPN Guillon : Guillon BSC; ; possible FAT damage; internal stack overflow Buenos Aires, Argentina R: N/A 4: BRX - ., IBM : M- K/P, or DOS SYS on The Guillon Gin Buenos Aires, Argentina in . Guillon is a vof the ) and the I. It it has fthe J, but not it is the Guillon , Guillon , as well as , as measured by the DOS by 4,096 , the Guillon xany non-write protected Jexposed to the . The Guillon expects Ito be 360K double density I, and any and format may in damage to the , corrupting and data is later fthe K, the Guillon as well, however it not Iaccessed on the . At ?by 6,144 plus (, the number increasing by $the , and Guillon [internal stack overflow hang. PZPAPN Guppy : Guppy TSR; . %failures R: 152 4: PRsCK - , IBM \, NAV, , VET, The Guppy in late by Paul Ferguson of Washington, DC. Guppy is a vof . The the Guppy the as a low TSR by 720 , any . of at least 100 Guppy. by 152 to the !of the . a, and 150 to the end of the <stamps in the to the =and Guppy , it s. If the is later Guppy +, the fail and a "Bad or Missing 5Interpreter" fail to Guppy. For example, YEDLIN. it was Xon my ed in a consistent "Invalid , and EDLIN ending `can be identified as hex character : 3ECD211F5A5B58EA of Guppy are: Guppy-B: Almost identical to Guppy, are a few PZPAPN : Gyro %failure R: 512 4: ONCK - 2.43a+, 6.04+, \2.07+, V100+, V100+ The Gyro . Gyro is a non- the Gyro X, the Gyro xone The search the O, the O, and the B: Olooking for a it has , it either to the DOS prompt or Mthe ing the to the DOS prompt: "Bad the Gyro mthe (of the host by the Gyro The host is permanently corrupted as the save the b512 (of the qunless the host smaller , in case the . The in the DOS not be $the , the in the "*.com *" "GYROzs" sby the Gyro %failures PZPAPN : Ha Warsaw, Poland R: 1,458 - 1,472 4: PRhAK - V99+, 6.04+, \2.07+, The Ha . It is fWarsaw, Poland. Ha is a vof . and . X, the Ha at the top of #the , as rby the DOS by 1,456 nby Ha in , the Ha ,and . qof 1,458 to 1,472 at the end of the a. The in the , and hence not "ha! It is what Ha may do PZPAPN Hacktic : Hacktic truncated to 83 hidden; `fail to The R: 83 4: ONE - The Hacktic fThe Hacktic is a is a later Hacktic 2, is a the Hacktic X, the Hacktic xone . in the be truncated to (, and 8the Hacktic 4. The . fthe Eas it mthe hidden attribute )set. The =and in the DOS be set to the =and Hacktic Nn't do , destroying the of Hacktic are: Hacktic 2: , Hacktic 2 is a non- vof . +. It xone . in the qof 93 at the !of the a. The =and in the DOS 0to the =and . Hacktic 2 Nn't do , and Nn't to be in the public domain. : The PZPAPN Hafenstrass : Hafenstrass Hafen Germany R: 809 4: PNE - ., NAV 2.1+, , VET, The Hafenstrass, or Hafen, Hafenstrass is a vof . . It is fGermany. the Hafenstrass xone . in the on the O. It Nnot always xan . X, so the uprocess is what sporatic. the Hafenstrass qof 809 (. The at the end of the be no 2to the =and in the DOS . No the the Hafenstrass s the The Hafenstrass create 22 )hidden hidden are four "lower case. The 8the "Hafensta e bleibt!" of Hafenstrass are: Hafenstrass-1191: on the Hafenstrass , and Hafenstrass 2 , adds 1,191 (to the . X, it Ma graphic ambulance car moving across the bottom of the fleft to right. Qes the right side of the , it Mthe word "BOOM!" in graphic block letters "No more RedX !!!" #it in normal Mfont, bright : Germany Hafenstrass-1191B: gequivalent to Hafenstrass-1191, has one differs. : Germany Hafenstrass-D: on the Hafenstrass intermittently xone . in the Eor a higher Eon the 781 at the end of the a. The =and in the DOS Hafenstrass-D Nnot create hidden See: Hafenstrass 2 PZPAPN Hafenstrass 2 : Hafenstrass 2 j; ambulance car graphic siren R: 796 ,), 1,641 4: PNA - , NAV 2.1+, The Hafenstrass 2 location. , like the Hafenstrass, is vof . . A major distinction is Hafenstrass 2 is actually a , Ambulance Car. The Ambulance Car Hafenstrass 2 is X, the Hafenstrass 2 xone . and one . in the later Ys one of the , one or two . in the Of the . ,and . sby the Hafenstrass 2 the . 8the full Hafenstrass 2 . The were sas a of executing a Hafenstrass 2 Ambulance Car is dropped by Hafenstrass 2. Hafenstrass 2 qof 1,641 (. The at the end of the be no 2to the and in the DOS . No in the sas a of a Hafenstrass 2 qof 796 (due to the presence of the Ambulance Car . Ambulance Car at the end of the Hafenstrass 2 may [unexpected Zof an Ambulance Car amay in a graphic ambulance "run fleft to right along the bottom of the , accompanied a "siren" noise on the speaker. See: Ambulance Car Hafenstrass PZPAPN Haifa : Haifa j; TSR; Israel R: 2,351 - 2,372 4: PRsAK - , NAV, The Haifa Gin Israel in . Haifa is a vof . ,and . The Haifa is Xon a Haifa as a low of 2,512 {09 and 21 nby the Haifa ' TSR. At , the ed to by the ,SPEC mental variable s, as well as the copy of in the C: Oroot E. On 386 hang hang usually on 8088 processor Haifa is xthe btwo in the by 2,351 to 2,372 at the end of the 2to the =and in the DOS Haifa employs a complex encryption mechanism to complicate disassembly of the and determination of identification encryption mechanism s in copies of the same having different u, such as duplicate copies of on C: and A: different The Haifa adds the ctwo lines of ASCII to the end of .DOC two lines are in the and not "OOPS! Hope I didn't ruin Well, nobody reads stupied DOCS anyway!" of Haifa are: Mozkin: Gin Israel in May, , Mozkin is the Haifa the encryption has can recognize Haifa may not be able to detect Mozkin. On 80286 Zof a Mozkin in the +and the "KIRYAT MOZKIN!!! LOCAL PROCESS INDUSTRY. VIRUS DONE BY: SIBEL ,TEACHES HOW TO MANAGE SHEEP? ks for using Turbo Anti PLEASE JMP FE00:0" Lthe be hung. On 8088 , Mozkin in low X, hooking |21. becoming , it ,and . by 2,358 to 2,373 at the end of the PZPAPN Halloechen : Halloechen Hallo , 1989 TSR; . j; garbled input West Germany R: 2,011 4: PRsA - , NAV, IBM , VET, : NAV, or The Halloechen was reported by Christoff Fischer of the University of Karlsruhe in West Germany. The is a generic . is reported to be widespread in West Germany. The Halloechen , the any . Wor . is run unless the awould be greater 64K in , or the =falls in the :month and year. determined to be a candi =for u, and is less 62K in as well as having a =outside of the :month and year, it is s. In the process of the a, the qd so it is a multiple of 16 (ends on a paragraph the 2,011 4are `are run, input fthe is garbled. PZPAPN Halloween : Halloween Happy Halloween j; very slow loads; Run R: 10,000 4: PNAK - , VET, NAV 2.1+, The Halloween, or Happy Halloween, . Its , or , is Halloween is a vof . ,and . the Halloween X, the search the Efor an over 10K in x. If one is d, the Halloween xit. If an ais not d, the search the Efor an over 10K in If an d, it If all of the candi ,and . over 10K in s, the may receive the , and be ed to the DOS prompt: "Run U002 at 0:0511" Halloween 10,000 (. The at the !of the a. The =and in the DOS . The can be in the 4of Halloween "*.*" "ALL GONE" "Happy Halloween" The Halloween 31st. At a 10,000 a blank be created in the =and 8pure 4. The receive the "Run U150 at 0:0AC8" Halloween [extremely slow loads X. It is not unusual for loads to last 2 to 5 minutes. PZPAPN Happy : Happy R: 412 4: PNCK - 3.93+, , NAV 2.1.4+, The Happy . Its . Happy is a vof . the Happy X, the Happy xone . ain the E, as well as one . ain the C:\DOS E. The k you for running the Happy Warning !!! and C:\DOS might be the Happy qof 412 at the end of the a. The =and in the DOS to the =and . The can be seen in the 4in all Happy . The )of Happy be a hex "FF" character, is the umarker. PZPAPN Happy New Year : Happy New Year Happy N.Y., V1600, 1600, Dear Nina >, 1989 TSR; . j; floppy %failures; bad or missing 5interpreter R: 1,600 4: PRsAK - \, NAV, , IBM }, VET, The Happy New Year, or V1600, ', and is a vof . ,and . `. It The the Happy New Year X, the as a 2,432 (low TSR. nby the . At , the make a slight alteration to the floppy , and not show a qas the a portion of the hex 00 section of the a. The floppy Nnot 8a copy of the , and is not xious. Happy New Year is , it ,and . by 1,600 (and mthe at the end of the The can be "Dear Nina, you make me write ; Happy new year!" "1989" is not Lby the the Happy New Year may fail to receiving a "Bad or missing 5interpreter" son the It is if Happy New Year carries any destructive capabilities. of Happy New Year are: Happy New Year B: to Happy New Year, has five differ fthe . Unlike Happy New Year, if it is Xfor reason. PZPAPN Harakiri : Harakiri G: May, Sweden R: 5,488 4: ONAK - , VET, , NAV 2.1+, 1.53S+ The Harakiri in May, . It s to be fSweden due to the in the . Harakiri is a wboth . ,and . Harakiri is X, the Harakiri search the Efor x. Assuming the . `in the are , and W, B. W, C. W, and D. W, the Mthe "--> \A. Ej Infekterad...! --> \B. Ej Infekterad...! --> \C. Ej Infekterad...! --> \D. Ej Infekterad...! too big to fit in The "Ej Infekterad...!" translates fSwedish to English as "Not s...!". If the finds less four . it can start `until it has sfour Z. If the encounters an already it is searching for x, it Mthe aAlready all of the . ,and . `in the s, the Mthe "Your PC is alive and the HARAKIRI All of the can be seen in the Harakiri PZPAPN lDays lDays R: 662 4: PRhCK - .1.4+, 6.00+, 2.43a+, V100+, V100+ The lDays . Its lDays is a vof . +. It bears ity to the Red Diavolyata lDays X, the lDays at the top of #the &, hooking |21. , as rby the DOS ?by 960 |12's moved. lDays , it qof 662 at the end of the a. The in the DOS to the =and . The can be in the 4in all lDays "It's ldays night!" PZPAPN Hary Anto : Hary Anto Hary j; TSR; R: 983 - 997 4: PRsCK - , IBM C, NAV 2.1+, The Hary Anto . Its . Hary Anto is a vof . The Hary Anto is X, Hary Anto as a low TSR of 1,328 (. The Hary Anto is , it qof 983 to 997 at the end of `. The =and in the DOS the =and . The can be Hary Anto: "HWI_Tm" Occasionally, the Hary Anto at the top of the starts "WeLcOmE tO hArY aNtO" not be `as it is PZPAPN Hastings : Hastings longer function R: 200 4: ONCK - , VET, The Hastings ~in the . Hastings is a vof the ain a E. It may Hastings is X, the find the ain the E. If has not sby the Hastings , it xit. Hastings mthe (of the host 4. The 2unless the was smaller (, in case the 200 (. The =and in the DOS to the =and The can be in the Hastings: "AKA Nick Haflinger... Zopy me I want to travel" "I can now in assembler" was written in the town of Hastings hehehehe!" The Hastings Nnot do $replicating and destroying those See: Possum PZPAPN : Hell Year-6545, Hell-892, Pixel-897, Pixel-899, Pixel-899B, Pixel-905 G: May, R: 936 4: PNCK - \, IBM , NAV, VET, The Hell Vin May, . Hell is a vof . Hell is X, the search the Eand xall . +is present in the E, it s. A portion of the remain in , hooking the clock. Hell by 936 (, the at the . The =and in the DOS to the =and Hell 8the "WBO" "Fucking Hell:What a smelly ass hole!!Do you want to fuck!!! HaHaHa... What a Good Friday!!" Hell is actually shorter in (, the by the fa previous is a of the Amstrad es, and may detect it as such. Hell and its can be destructive activate, formatting the btrack of the of Hell are: Hell-892: gequivalent to the adds 892 Pixel-897: Pixel-897 is an 897 of the Hell wall . +in the of 897 (, and =and in the DOS `are: "WBO" "Fucking Hell: What a smelly ass hole!!" "Do you want to fuck it!!!" Pixel-897 , it Ms the last two as a , and s the btrack of the O, formatting it. Pixel-899: gequivalent to Pixel-897, adds 897 Pixel-899B: Pixel-899B is to Pixel-899, exception , it Ms its but Nnot format the btrack of the Pixel-905: Pixel-905 is an 905 of Pixel-897 gequivalent, the exception qd in by 905 See: Amstrad Pixel Silly Silly-365 PZPAPN Hellraiser : Hellraiser G: May, fail to Canada R: 1,580 4: ONE - .1.4+, 25.10+, 1.53S+ The Hellraiser in May, . It is fCanada. is a of . the Hellraiser X, the check the Oto determine if more Fories exist. If more two sub Fories exist, the start in the third sub Eand check for two Hellraiser mthe b1,580 of the host the Hellraiser 4, permanently damaging them. be no 2to the unless the awas smaller 1,580 . In the case of the host smaller 1,580 , it 1,580 . The =and in the DOS smaller the Hellraiser to the DOS prompt Ythem. are larger receive too big to fit in Ythem. PZPAPN Hellween : Hellween 1376 H: R: 1,376 4: PRhA - D: IBM , VET, NAV 2.1+, The Hellween . Its . Hellween is a vof . ,and . , but Nnot The Hellween is X, the Hellween at the top of #the |12's moved. , as rby the DOS by 1,904 nby the the Hellween , it qof 1,376 (. The at the end of the a. The =and the DOS not be The in the Hellween 4, and are not "HELLWEEN???!!" It is what Hellween of Hellween are: Hellween-1182: on the Hellween is 1,696 (. It hooks {08, 13, and 21. Like Hellween, ,and . qof 1,182 at the end of the a. The and in the DOS . It Nnot 8the "HELLWEEN" PZPAPN : Hero Hero-506 G: May, Italy R: 506 4: PRA - , VET, , IBM NAV 2.1+, The Hero in May, . Its is believed to be Italy. Hero is a generic vof . and . bHero X, Hero it is , it X. The usually be hung Hero qof 506 (. . by 506 to 509 (. The marker of all is 24 hex FF (h'FF') 3at the !of the the (of the , permanently damaging the host Hero is not a viable due to the bugs in its 4, and is a very poor replicator since s in a hang. of Hero are: Hero-506B: on the Hero has had of the ming Tin the corrected. It no longer kthe are qd in by 509 at the end of the a. The =and in the DOS to the =and See: Hero-394 PZPAPN Hero-394 : Hero-394 Hero-B Mof random R: 394 4: PRfE - }, VET, , NAV 2.1+, The Hero-394 . Its is a vof . `, and on the Hero The Hero-394 is X, the Hero-394 . Hero-394 hooks many {in the |area, Hero-394 is , it qof 394 at the end of the a. The =and in the DOS to the =and of a Hero-394 random may be X, as well as the ing to be hung. Usually, if the presses "enter", the continue processing. See: Hero PZPAPN : HH&H Gomb, GMB R: 4,091 4: PRhCK - o, NAV 2.1+, 1.53S+ The HH&H . Its . HH&H is a vof . bHH&H X, the HH&H at the top of but #the , as rby the DOS by 6,144 {1C and 21 nby HH&H in the HH&H , it over 8K in X, it the HH&H 4,091 (. The at the end of the . The =and in the DOS to the =and The in the HH&H 4, and hence are not "HARD HIT & HEAVY HATE the HUMANS!!" "[ H.H.& H.H. ]" It is what HH&H PZPAPN : Hi Eastern R: 460 4: PRtE - , VET, 6.0+, 3.93+, 25.10+, NAV 2.1.4+, V99+, The Hi . It is fEastern V. Hi is a vof . X, the Hi at the top of #the &, moving |12's , as by the DOS ?by 1,024 nby the the Hi , it qof 460 at the end of the a. The =and in the DOS to the =and . The can be dnear the end of all "Hi" PZPAPN HiDos : HiDos BSC; Jroot England R: N/A 4: BRtX - 6.00+, o, NAV 2.1.4+ The HiDos . It is England. HiDos is a and the ). It is roughly on the The the HiDos , the HiDos xthe , as rby the DOS ?by 2,048 (. On the K, the moved to Side 0, Cylinder 0, 7, and a copy of the 4written to the location. the HiDos , it xthe of non-write protected accessed on the . The ualways fthe Kto the hang ing. Any attempt to Fly access the or the in a hang. The s360K 5.25" copied to 11. On 1.2M 5.25" I, it be at 17. As both of are part of the root 9may 8ed entries. PZPAPN Highlander : Highlander j; TSR R: 477 4: PRsC - 1.15a+, .1.4+, 2.43a+, V99+, 6.04+, \2.07+, V99+, 1.53S+ The Highlander . It is fthe , and is by the same author as the Geek . Highlander is a vof . , but not bHighlander X, the Highlander as a low TSR of 1,280 (. It hooks {21 and 22. , the Highlander qof 477 at the !of the a. The =and in the DOS not be The in the all Highlander "Highlander 1 RULES!" "v05" Highlander on the 29th day of any month, at Mthe "Highlander 1 RULES!" s and hang the PZPAPN Hitchcock : Hitchcock j; TSR; I/O ; music; R: 1,247 4: PRsCK - , IBM }, VET, NAV 2.1+, The Hitchcock . Its . Hitchcock is a vof . The Hitchcock is Hitchcock as a low TSR of 4,196 mapping utilities not show the TSR, but instead the in- 5interpretor is 4,196 (larger expected. nby the becoming , Hitchcock over 3K in X. If X, it be 1,247 (larger The at the end of the fwrite-protected in a DOS "Write protect Uwriting Hitchcock Nnot trap X, later fthe in Hitchcock becoming at the top of #the DOS ?by 4,096 {1C and 21 now be on the may now get the , "I/O UF0, PC=3FAB", and the be aborted. five to ten minutes %ing the a Hitchcock +, the play music on the speaker. The music is the theme song fthe Alfred Hitchcock television , and continue to play at intervals until the is re PZPAPN Holocaust : Holocaust , Holo Barcelona, Spain R: 3,784 4: PRhCK - , IBM , VET, NAV 2.1+, The Holocaust by David Llamas of Barcelona, Spain. Holocaust is a self-encrypting vof . qualifies as a as it hides the `as well as aopen and The the Holocaust X, the . It reserve 4,080 (of high #the be marked as 5Data, and mapping utilities show the 5interpreter to mgrown by the 4,080 it is actually in high instead of low Holocaust is , it for any reason. , however, xvery small . `of less 1K in by 3,784 not be seen in a the . The the end of If the Holocaust and the DOS ras having a Zof the the /F parameter on in the `becoming damaged. The Tdo not the is not in since at match the in the FAT. The Holocaust is a self-encrypting , and occasionally produce an Sdifferently fits encryption mechanism. 8the at the end of the , while samples Anti - C.T.N.E. v2.10a. (c) Grupo Holokausto. Kampanya Anti-Telefonica. Menos tarifas y mas servicio. med in Barcelona (Spain). 23-8-90. - 666 -" Holocaust is reported by David Llamas to be widespread in Barcelona as of . It is not , and what it See: Telecom PZPAPN Hominy : Hominy Australia R: 1,589 4: PNCK - , VET, , NAV 2.1+, 1.53S+ The Hominy . It is Australia. Hominy is a vof . the Hominy xone . in the 1,589 at the end of the The =and in the DOS not be can be identified manually by checking to determine if the bthree (of the match the last three (of the The in the 4in Hominy "GAMES "RASTAN RJ" "WORLDALC.DN1" "ZEPFIGHT.MS3" "*.*" "\ S S\DR SS" It is what Hominy of Hominy are: Hominy-B: gequivalent to the Hominy the "CINACT.LOG P" "CARTOONS.000" "\ TRIP ARK" : Australia May, See: P PZPAPN Horror : Horror R: 2,319 4: PRsAK - , NAV 2.1+, , VET, The Horror . Its . Horror is a ,and . The the Horror the Horror at the top of #the , as rby the DOS ?by 3,744 |12's not be moved. {13 and 21 nby the Horror , the Horror the copy of ed to by the ,SPEC en mental variable if it was not the Horror , it qof 2,319 at the end of the a. The =and in the DOS not be . The Horror unable to determine if it has the , adding an 2,319 Horror is an . While it 7the in its cannot be viewed in is HORROR !" ,SPECS" It is what Horror [frequent are of Horror are: Horror-1112: on the Horror adds 1,112 (to the . ,and . the end of the a. It Nnot re . Its is 1,792 (, hooking {13 and 21. The locked out . The in the Horror-1137: on the Horror adds 1,137 (to the . ,and . the end of the a. It Nnot re . Its is 1,856 (, hooking |21. The locked out . The in the Horror-1137B: gequivalent to Horror-1137, very minor PZPAPN Horse : Horse Horse %Dropper G: May, BSC; ; high density R: N/A 4: BRhX - , NAV, 25.10+, K/P, or DOS SYS on The Horse in May, in the form of a "dropper" zs the on a 360K Horse "dropped" by the , is a and the ). It is on the sby the Horse , the at the top , but #the |12's not be moved. @by 2,048 (as measured by the DOS . The access the K, and xthe a copy of the %has completed, the find OC:, and not Horse , it xnon-write protected are exposed to the 360K low density 5.25" Horse moved to the last on the mthe moved to cylinder 0, side 0, Horse %treats high density Ias low density If a high density Horse %, data on the be damaged. of Horse %are: Horse %Dropper: A small . drops the Horse See: PZPAPN House : House fail to unexpected access to A: and B: R: 11,636 4: ONE - 6.00+, 2.43a+, The House . Its . House is a on the A: and B: the House X, the House xall . in the Fories on the A: and B: are larger 11,636 mthe b11,636 (over- written by the House , permanently corrupting them. The =and in the DOS not be , and the not be 0. The can be din the House 4in all "*.exe" "*HOUSEVIRUS*" "*.exe rb rb rb+" the House not function and either to the DOS prompt, or unexpected s may PZPAPN Hungarian : Hungarian Hungary R: 695 4: PRhAK - , IBM }, VET, , NAV 2.1+, .1.4+, 1.53S+ The Hungarian ~in Hungary in is a vof . ,and . bHungarian Xon a the Hungarian at the top #the |12's moved. , as rby the DOS by 1,024 (. The is actually 1,008 , and can be easily seen mapping utilities. the Hungarian , it and . qof 695 at the end of the a. The =and in the DOS It is if the Hungarian of Hungarian are: Gyorgyi: A 749 of the Hungarian , Gyorgyi ,and . qof 749 at the end of the a. The =and in the DOS not be . The dnear the end of all Gyorgyi "I LOVE GY RGYI" : Hungary May, Hungarian-B: gequivalent to the Hungarian has three differ. : Hungary PZPAPN Hungarian 482 : Hungarian 482 j; TSR; no Hungary R: 482 4: PRsCK - , IBM VET, NAV 2.1+, .1.4+, The Hungarian 482 ~in Hungary in Dr. Szegedi Imre. is a The Hungarian 482 is the as a low TSR, hooking |21. Unlike most use TSRs for residency, the DOS report no . However, |12's moved. The TSR is in low , and the prevent its TSR Hungarian 482 is , it very small ones, as X. If X, it by 482 at the end of the be no in the =and in the Due to a bug in the Hungarian 482 4, it is possible happen very Hungarian 482 Nnot do See: Zu1 PZPAPN Hybryd : Hybryd Hybrid Poland R: 1,306 4: PNCK - \, NAV, , IBM , VET, The Hybryd , and is fPoland. is a vof . Hybryd is X, the for an in the E. If an d, the xit. qof 1,306 (, the at the end of the alters the the seconds field in the is 62, the indicator s. Just viewing the , it =and not The in the Hybryd cannot be viewed in "(C) Hybryd Soft Specjalne podziekowania dla Andrzeja Kadlofa i Mariusza Deca za artykuly w Komputerze 11/88" In the sample, the one is not is the d samples: "Copyright IBM Corp 1981,1987 Licensed Material - Property of IBM" should not be taken to indicate IBM necessarily had to do the creation of On Friday the 13th starting in It may corrupt PZPAPN Hydra : Hydra Hydra, Hydra-0, Hydra-1, Hydra-2, Hydra-3, Hydra-4, Hydra-5, Hydra-6, Hydra-7, Hydra-8, Hydra-8 Trojan unexpected Zfailure; truncated R: 340 - 736 (, depending on present 4: PNCK - }, VET, , NAV 2.1+, The Hydra es was . Its . The Hydra 7nine closely related es, and one trojan dropped by one of the es. All of the es are vs of . . The earliest Hydra-0, is eight later and the trojan included in " Hydra-0 is X, the Hydra-0 search the Efor one non- x. If one is d, Hydra-0 Hydra-0 736 (, the at the !of the a. The =and in the DOS to the =and If Hydra-0 Nnot find an ain the E, it activate. At , it , and to the DOS prompt: "HYDRA" "Watch for the many heads. The beight are easy to find and kill. replacements be more sophisticated." "(c) - C. A. V. E." The , along #can be din all Hydra-0 "HyDra" "Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E." "Coalition of American Engineers" " -=-=- " "Dedicated to supporting the anti- industry out recognition or reward." Hydra-0 Nnot do members of the Hydra $Hydra-0, are: Hydra-1: Hydra-1 is to the Hydra-0 . It adds 403 (to the . all the . `in the s, it Mthe , and the hung: "HYDRA" "Copyright (c) by C.A.V.E." The din all Hydra-1 along "YD HyDra-1 Beta - Not For Release. *.CO?" Hydra-2: on Hydra-1, Hydra-2 is a 343 . It adds 343 (to the . all the `in the s, it Many , and no hang . It 7the "YD HyDra-2 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E" Hydra-3: on Hydra-2, Hydra-3 is one )smaller. It adds 342 (to the . all the . `in the s, the not be able to successfully Yany in the ed to the DOS prompt. in unexpected . For example, Zof the DOS typically in a indicating the is bad, even it is actually undamaged. Hydra-3 are: "YD HyDra-3 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E." Unlike members of the Hydra ], Hydra-3 xalready , adding (to the Hydra-4: on Hydra-3, Hydra-2 is two (smaller. It adds 340 (to the . all the . `in the Zof any in the DOS : "General Failur Ureading O". The is receiving the Uis actually ok, and accessible %ing the and dis in Hydra-4 are: "YD HyDra-4 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E." Hydra-4 Nnot re `as Hydra-3 Hydra-5: The Hydra-5 on the Hydra-4 . It adds 391 (to the . all the `in the Zof the next in all in the in Hydra-5 "YD HyDra-5 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E." Hydra-6: The Hydra-6 on the Hydra-5 . It adds 372 (to the . all the `in the Zof the next any ain the the base ,MAND (ie ,MAND.*) "truncated to zero in Hydra-6 "YD HyDra-6 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E. ,MAND.*" Hydra-7: The Hydra-7 on the Hydra-6 . It adds 368 (to the . all the `in the Zof the next in all in the truncated to zero in Hydra-7 `are: "YD HyDra-7 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E. *. Hydra-8: The Hydra-8 on the Hydra-7 . It adds 495 (to the . all the `in the Zof the next four . `in the "replaced by a 90 )trojan (see #as Hydra-8 Trojan). in Hydra-8 "YD HyDra-8 Beta - Not For Release. *.CO?" "Copyright (c) by C.A.V.E. *. Hydra-8 Trojan: The Hydra-8 Trojan is a 90 the Hydra-8 replace four . the Hydra-8 are later X, it in the middle of the and to the DOS prompt: "Who is John Gait?" is not in the trojan PZPAPN : Hymn R: 1,865 - 1,883 4: PRhAK - \, NAV, , IBM , VET, The Hymn , and ated in the is a vof . ,and . `, and The the Hymn the at the top of #the &. The DOS show ?by 3,712 Nnot move the Hymn is , it ,and . are over 2K in for any reason. by 1,865 qof 1,869 to 1,883 (. In both cases the at the end of the 8two in the 4: "ibm@SNS" "@ussr@" It is not what Hymn , but it is assumed fthe under conditions it may play music. PZPAPN : I-B BadGuy, BadGuy 2, Crackpot, Demon, Exterminator G: May, Italy R: 265, 272, or 451 4: ONCK - ., IBM , VET, C, NAV 2.1+, The I-B is actually a group of three Vin May, ated in Italy, and are very closely related. All of them are an I-B X, it xall . the mthe !of the The number of vary, depending on is present. and in the to the =and . See #for specifics of I-B es activate on the day of the week. If all of the in the Eare s, and the day of the week is the day "checked for by the activate. Two of the b160 of the C: O, the third just hang the of I-B are: BadGuy: BadGuy is a 265 of I-B. It s the b265 =and in the to the =and BadGuy on Mondays, hang the the BadGuy of I-B are: "BadGuy (c) by Cracker Jack (IVRL)" "Italian Research Laboratory (C) "IVRL Head Quarter, Milan Italy" BadGuy 2: BadGuy 2, or Crackpot 208, is a 208 of I-B. Basically, it is a bug-fix of BadGuy, having had the bug fixed s in a BadGuy . BadGuy 2 wall . the b208 (. The and in the to the =and u. On Mondays, BadGuy 2 Mthe "New BadGuy - (c) by Cracker Jack IVRL Head Quarter Milan Italy" cannot be as it : Italy, Demon: Demon is a 272 of I-B, and is the most advanced of the ]. It the b272 =and in the DOS E. Demon on Tuesday, at Mthe the b160 of the Ueating can be Demon are: "Demonhyak Viri X.X (c) by Cracker Jack (IVRL) Demon-B: Demon-B is a minor of the Demon I-B. It has five differ fthe Demon Demon-C: Demon is a 263 of I-B, and is on the Demon . It s the b263 (of all . in the X. Demon-C 7the in its Ureading "BillMeTuesday!" WC failure" ,MAND.C0M" Exterminator: Exterminator is a 451 of I-B, and s to be the earliest Exterminator s the b451 =and to the =and . Exterminator on Mondays, Mthe b160 of the "Exterminator 1.0 (c) by Cracker Jack (IVRL) No panic... is a Harmless can be Exterminator "Exterminator 1.0 - (c) by Cracker Jack (IVRL)" "Italian Research Laboratory (C) Researchers: Non rompetemi le palle o mi arrabbio... non so se sono stato abbastanza chiaro PZPAPN Ice 9 : Ice 9 ARCV93 j; TSR; hidden `are no longer hidden England R: 639 4: PRsC - 6.00+, 2.43a+, \2.07+, V99+, The Ice 9 ~in England in . Ice 9 is a vof . , but not The the Ice 9 the Ice 9 as a low TSR of 1,136 nby the , Ice 9 for any reason. qof 639 at the end of the a. The =and in the DOS not be The can be dat the very end of Ice 9: "r51xP" A symptom of an Ice 9 hidden no longer be hidden, and in the DOS of Ice 9: Ice 9B: to the one differs. : England PZPAPN Icelandic : Icelandic 656, One In Ten, KCrunching , Saratoga 2, Iceland Extinct , 1989 -TOM; bad ; FAT Iceland R: 656 4: PRfE - , NAV, IBM , VET, \, NAV, or The Icelandic, or KCrunching , was Iceland in 1989. Icelandic is a `, and xevery tenth . The Icelandic is X, the at the top of #the , as rby the DOS by 2,048 nby the `growing in between 656 and 671 always be a multiple of 16. The attaches to the end of the w, and always end hex '4418,5F19'. The Icelandic to avoid detection by utilities by checking to see if has " |13. If |13 was nbefore the bIcelandic X, the not proceed . If |13 has not attempt to xevery 10th floppy Os, or 10 MB Ks, the not cause any damage. However, on larger 10 MB, the select one unused FAT entry and mark the entry as a bad of Icelandic are: Icelandic-IB: gequivalent to Icelandic, differs by one by fthe Icelandic-IC: gequivalent to Icelandic, differs by one by fthe and Icelandic-IB. Icelandic-II: Icelandic-II is a modified of the Icelandic . Its is 632 the Icelandic-II , it modify the =and the DOS E. It removes the read- attribute fread- `. On Ks larger 10MB, are no bad marked in the FAT as the Icelandic ~: Iceland , 1989. Icelandic-III: Icelandic-III is a modified of the Icelandic . Before Icelandic-III , it checks to see if the Icelandic or Icelandic-II, if it has, it Nnot xthe the Icelandic-III qd by 848 to 863 (. If an is run on >24th of any year, subsequently run be stopped, later Ming the "Gledileg jol" ("Merry Christmas" in Icelandic) instead. The 's id in the last two words of the hex '1844,195F', the Qword reversed fthe id ending the Icelandic and Icelandic-II ~: Iceland >, 1989. Saratoga: on the Icelandic , the Saratoga main difference is it copies , it modifies the block so to belong to the operating , thus avoiding reusing the block. It is 642 ~: Saratoga, California, USA , 1989. See: Mix1 PZPAPN : Idle k; unexpected R: 2,332 or 2,859 4: PRhA - VET, NAV 2.1+, .1.4+, The Idle . Its . Idle is a ,and . . It Nnot The the Idle at the top of #the |12's moved. rby the DOS 3K. {08, 21, and 28 nby Idle in the Idle , it ,and . for any reason. . by 2,332 at the !of the a. . by 2,859 at the end of the a. In both cases, be no to the =and in the DOS The can be in the all "PATH= ,MAND W*.*" the Idle [unexpected kand warm re PZPAPN Ieronim : Ieronim Ieronim-570 R: 570 4: PRtC - 1.15a+, V99+, 6.00+, \2.07+, V99+, The Ieronim, or Ieronim-570, It is fthe . Ieronim is a vof . , but not The the Ieronim the Ieronim at the top of #the &, moving |12's , as rby the DOS ?by 576 08 and 21 nby Ieronim in , the Ieronim qof 570 at the end of the a. The =and in the DOS to the =and . The the 4in all Ieronim "com "Mulier pulchra est janua diaboli" "via iniquitatis,scorpionis percussio." "St. Ieronim" The Ieronim Mthe follwoing it is , usually accompanied by a hang: "Mulier pulchra est janua diaboli via iniquitatis,scorpionis percussio. "St. Ieronim" of Ieronim are: Ieronim-512: A 512 of the Ieronim 1K. It hooks {08, 20, and 21. Ieronim-512 , but not qof 512 to 1,023 at the !of the 512 (of the qis the actual 4, the remainder of the is padding at the end of the a portion of the host ahas initially Ieronim-512, its multiple of 1,024 (. The =and the DOS the =and . Ieronim-512 is not able to determine sby the , so may be re adding an The in the 4in Ieronim-512 "Mulier pulchra est janua diaboli," "via inquitatis,scorpionis percussio." "St. Ieronim" The Mthe last three as a , accompanied by beeping, Ieronim-560: A 560 of the Ieronim 1K. It hooks {08, 20, and 21. Ieronim-560 , but not qof 560 to 1,119 at the !of the 560 (of the qis the actual 4, the remainder of the is padding at the end of the a portion of the host ahas initially Ieronim-560, its multiple of 560 (. The =and the DOS not be Ieronim-560 is not able to determine sby the , so be re s, adding an u. The in the 4in Ieronim-560 "Mulier pulchra est janua diaboli," "via inquitatis,scorpionis percussio." "St. Ieronim" The Mthe last three as a , accompanied by beeping, Ieronim-600: on the Ieronim is 608 (, hooking {08 and 21. It X, adding 600 . The the end of the a. The =and the DOS not be 7the same as the , and like the Mthe Ieronim-1581: on the Ieronim is 1,584 (, hooking {08 and 21. It X, adding 1,581 . The the end of the a. The =and the DOS to the =and . The can be in the 4in all Ieronim-1581 "Le voyage de condom" Ieronim-1581 has for awhile, scroll the Mand emit an occassional beep until the is reset. No PZPAPN IKV 528 : IKV 528 IKV-512, R: 528 4: PNCK - , IBM , VET, NAV 2.1+, The IKV 528 , its is a of . `. It IKV 528 is X, the xtwo . in the E. . are smaller not be by 528 (. The at the end of . The =and in the not be by the Nnot do PZPAPN : Ill & beeping R: 1,016 4: PNCK - , VET, NAV 2.1+, The Ill . Its . Ill is a vof . the Ill X, the search the Eto find the has not d, it s, and the usually continue Z. If an is not d, the usually continue the Ill qof 1,016 (. The at the end of the a. The =and in the DOS . No in the X, the Lalong a series of beeps emitted fthe speaker: "WARNING : USE ONLY ORIGINAL PROGRAMS DON'T COPY IT and now .. I AM ILL !!" in the PZPAPN Incom : Incom G: May, R: 648 4: PNC - , IBM , VET, C, NAV 2.1+, The Incom in May, V. Incom is vof . . It Incom is X, the Incom xall , except in the by 648 at the end of the a. The =and the DOS to the and Incom 8one : "IN derives its Incom is on the unlike , it not damage any See: PZPAPN R: 822 - 837 4: PNCK - 6.00+, 2.43a+, \2.07+, V100+, V100+ The . It is fthe vis a X, the xone . in the 822 - 837 at the end of the The =and in the DOS to the =and . The can be din all [frequent PZPAPN Infinity : Infinity Canada R: 732 4: PNCK - VET, NAV 2.1+, The Infinity . It is Canada. Infinity is a Infinity is X, the Infinity search the Efor the a. If an d, the Infinity 732 (. The at the end of the a. The =and in the DOS not be The can be in the Infinity "SKISM ReplicatoR" "FiRe is a LAMER... destroy InFiniTy!" "PATH=*. It is if Infinity PZPAPN Interceptor : Interceptor 1014 Italy R: 1,014 4: PNCK - , IBM , NAV 2.1+, The Interceptor , and is fMilan, Italy. Interceptor is on the , and like , is a vof . Interceptor is X, Interceptor search the Eto locate the btwo s. If an das one of the `, it Interceptor by 1,014 (. Interceptor at the end of the . The can be dnear the end of all "Interceptor - by Cracker Jack IVRL Milan, Italy" "*.com" It is if Interceptor s to be a research at the of its submission. See: PZPAPN Internal : Internal 1381 H: j; cascade of contents; R: 1,381 - 1,395 4: PNE - , NAV, IBM , VET, The Internal, or 1381, . It is a generic . the Internal the attempt to xone aon the Nnot always qd in by between 1,381 and 1,395 The can be dat the end of 8the "INTERNAL ERROR 02CH. PLEASE CONTACT YOUR HARDWARE MANUFACTURER IMMEDIATELY ! DO NOT FORGET TO REPORT THE ERROR CODE !" The Internal days =. At , the produce a cascade of the contents of the Mto the bottom of the , and Mthe . The remove fthe of 1381 are: 1381-B: (Internal-B) to the Internal is a minor Internal-1459: on the Internal adds 1,459 to 1,473 (to the . w. The in the 4, and not "INTERNAL ERROR 02EH. PLEASE CONTACT YOUR HARDWARE MANUFACTURER IMMEDIATELY ! DO NOT FORGET TO REPORT THE ERROR CODE !" in the same manner as the the cascading effect of the contents, , and uof the was executing. PZPAPN Intruder : Intruder G: March, R: 1,319 - 1,333 4: PNE - , VET, , NAV 2.1+, .1.4+, 6.04+, The Intruder source 4was published in "The Little Black Book of Computer es" by Ludwig in the . It is a vof . the Intruder xone . in the E. The qof 1,319 to 1,333 the Intruder to the end of the host . The =and in the DOS not be . The can be din the "\*. W\*.*" the Intruder of Intruder are: Intruder-1326: A 1,326 of Intruder, wone . ain the qof 1,326 to 1,340 at the end of the The =and in the DOS not be . The can be in the 4in all Intruder-1326 "\*. W\*.* \" Intruder-1326 corrupt instead of tthem. Intruder-1440: A 1,440 of Intruder, wone . ain the qof 1,440 to 1,456 at the end of the The =and in the DOS not be . The can be in the 4in all Intruder-1440 "\*. W\*.* \" Intruder-1440 bthree or four in the Zof the next in either a hang, or the playing of a warbling sound on the speaker accompanied by a hang. Intruder-1967: A 1,967 of Intruder, wone . ain the qof 1,967 to 1,981 at the end of the The =and in the DOS not be . The can be in the 4in all Intruder-1967 "\*. W\*.* \" Intruder-1988: A 1,988 of Intruder, wone . ain the qof 1,988 to 2,002 at the end of the The =and in the DOS not be . The can be in the 4in all Intruder-1988 "\*. W\*.* \" Intruder-1988 bfour . in the Zof the next either a hang, or the playing of a melody on the speaker accompanied by a hang. Intruder-2336: A 2,336 of Intruder, wone . ain the qof 2,336 to 2,350 at the end of the The =and in the DOS not be . The can be in the 4in all Intruder-2336 Intruder-B: gequivalent to the has six differ. As kmay PZPAPN Invader : Invader Plastique %, Anticad 4 TSR; . j; BSC; music; track 1 of may be Taiwan/China R: 4,096 4: PRsAB - W, & , IBM \, NAV, , VET, : CleanUp, or The Invader in China. is a later of the Plastique-B or Plastique 5.21 . It is a vof . ,and . `, but not +. It . In many reports of us of s to mspread very rapidly. The the Invader X, the as a low TSR. The TSR is 5,120 (and {08, 09, 13, and 21 , the xthe of the Owhere the X. The new is an MS-DOS 3.30 , and can be easily identified because the normal DOS din the are now at the !of the instead of the end. , any . ,or . the exception of sby the by 4,096 at the !of the a. . between 4,096 and 4,110 at the end of the ly, any non-write protected are exposed to the The Invader for 30 minutes. At , a melody may be played on the speaker. On play the melody, it continue until the is re %ed. If the presses CTL-ALT-DEL to re the , the btrack of the an un Scopy of the . The melody isn't played on all as it is configuration dependent. The melody was composed by Mozart. of Invader are: Chinese Invader: A of the Invader fChina. It 7the "PC Tools" in the 4. It is what music, if any plays. : China Danube: A of the Invader addes 4,096 (to the . w, and 4,096 - 5,111 (to . at the end of the a. Like members of the Invader . It the in the "ACAD. "by Invader, Feng Chia U., Warning: Don't run ACAD. Mozart: Playing the same melody as the Invader Nnot continue to play the melody until the is re %ed, but continues for a few minutes. Sledge Hammer: to the Invader ~in Morgan Hill, California . Its major fthe it plays a different melody for 30 minutes. The tune is the theme song to the television Sledge Hammer. See: Plastique Plastique-B PZPAPN Invol : Invol W& .SYS write protect executing . fwrite- protected R: 1,409 - 1,421 W); 2,832 ((.SYS) 4: PRsE - W& .SYS \, NAV 2.1+, 25.10+ The Invol . Its was in the . Invol is a vof . Wand .SYS The Invol sby the Invol may be a .SYS has a device entry in the CONFIG.SYS a, or an . %has completed. In either case, if the DOS X, it indicate has 2,832 (less is expected. nby the mapping utilities most likely indicate 's config.sys has qd in by 2,832 Invol is , it attempt to xthe .SYS rin the 's CONFIG.SYS a. The .SYS qof 2,832 at the !of the a. The and in the DOS to the =and . The can be s.SYS "You mhelped spread is a fyour friendly neighborhood uservice. k you for your involuntary cooperation." "c:\config.sys EVICE C:\vansi.sys device=vansi.sys" sby the Invol it is . In the case of . qof 1,409 to 1,421 at the end of the a. The to the =and . The not be It is what Invol Invol-B: Gin the in May, , Invol-B is a smaller of the Invol Its encryption has to avoid detection. It adds 2,720 (to the .SYS w, and 1,348 to 1,365 (to . `. The last in the "c:\config.sys EVICE C:\vansi.sys vansi" May, PZPAPN Ionkin : Ionkin Ionkin-231 R: 231 4: PNCK - 2.43a+, 6.04+, \2.07+, V100+, V100+ The Ionkin, or Ionkin-231, It is fthe . Ionkin-231 is a vof . Nn't smaller the Ionkin X, the Ionkin xup to two . in the qof 231 at the end of the a. The =and in the DOS to the =and The in all Ionkin of Ionkin are: Ionkin-2372: , Ionkin-2372 is a 2,372 of the Ionkin . It may xone . larger 2,372 at the end of the a. The =and in the DOS to the =and . The in the "IONKIN. PZPAPN : Iper R: 1,062 4: PNCK - V100+, 6.04+, \2.07+, V100+ The Iper . Its . Iper is a vof . the Iper X, the Iper xone amay be in the C: ODOS E, the C: root O, or on the O. Iper Nn't xmore five . `in any given Eon the K, and no more three . qof 1,062 at the end of the a. The =and in the DOS not be . Two are in the "IPER" The "IPER" s very close to the end of the It is what Iper PZPAPN Iranian : Iranian , 1993 R: 1,320 4: PRhAK - V102+, V102+ The Iranian , 1993. Its . Iranian is a of . ,and . bIranian X, the Iranian at the top of #the &, hooking {09 and 21. , as rby the DOS ?by 1,328 12's not be moved. the Iranian , it qof 1,320 at the end of the a. The =and in the DOS not be The in the Iranian 4and are thus not "IRANIAN VIRUS W.by ABBAS KUHKAN ALIABADI" ANTI VIRUS Writen By ABBAS KUKAN" It is what Iranian PZPAPN Iraqui Warrior : Iraqui Warrior Iraqui, -Iraqui j; closely spaced beeps speaker; %failures R: 777 4: PNCK - \, IBM , VET, C, NAV 2.1+, The Iraqui Warrior in the is a non- vof . +. It is on the the Iraqui Warrior the xone of the bfour . the Oand qof 777 at the end of the The can be `, the two ring near the !of the , and the last very near the end of the "I come to you fThe Ayatollah!" "(c) "An Iraqui Warrior is in your computer..." None of Lby the the Iraqui Warrior may occasionally [the speaker issuing a series of closely spaced beeps s, the hang and mto be re %ed. The beeps continue until the re %ing Kwhere +has in a " U, Cannot start ,MAND, exiting" The Iraqui Warrior Nnot to do else See: PZPAPN : It Coahuila Mexico R: 454 4: PNCK - The It ~in Mexico in is a vof . the It xone in the it has completed tall . in the E, it start on the path. qof 454 the end of the . The =and in the DOS not be . The can be in the 4in all It "(C) ITV85020203 PATH=*. Nn't to do of It are: It-457: fMexico in , It-457 is a 457 of the It gvery to the , the major difference It-457 adds 457 (to the . w. The same as the : Mexico Viva Mexico: Gin Morelia City, Mexico, in , Viva Mexico is a 449 of the It wone . ain the qof 449 the at the end of the a. The =and in the DOS to be , but the seconds field set to "60". The the 4in all Viva Mexico "ITV85020203 "Viva M xico!" "PATH=*. Viva Mexico 16th, Mexico's Independence Day. At the Lon the monitor and the Viva M xico!" : Mexico PZPAPN Italian 803 : Italian 803 Italian a, V817, Sept 18 G: March, Italy R: 803 4: PNAK - \, IBM , VET, NAV 2.1+, The Italian 803 in March, vof . ,and . `. It Italian 803 is X, the look for an ain the If one is d, it s. If an Nnot exist in the E, the look for an ain the E. If an d, it Italian 803 of 803 to 817 at the end of the Nnot alter the =and the The Italian 803 may re already . The re copied, and X. Re of Italian 803 in an the Italian 803 Nnot do of Italian 803 are: Italian 803-B: to Italian 803, differs by PZPAPN Itavir : Itavir 3880 Endangered G: March, Italy R: 3,880 4: PNE - , IBM \, NAV, , VET, The Itavir ~in March by a group of students at the Milan Politechnic in Milan, Italy. The Itavir generic . by 3,880 $having qd in usually where on the K. The bcharacter of is an unprin character. The pure 4and is used for appending to The Itavir period running for more 24 hours. , the is corrupted, rendering the %able. The Ms a in Italian and writes ANSI values through 255 to all I/O ports, thus confusing any attached peripheral devices. monitors may show a flickering effect s, while VGA monitors may actually "hiss". PZPAPN : Itti Itti-A %failures; " WC failure" R: 161 4: ONCK - , VET, 1.53S+ The Itti . Its Itti is a Itti is X, the Itti xone . in the Eby over- writing the host b161 be no 2to the unless it was smaller 161 (. In the case of . `smaller be no 2to the =and in the DOS the Itti has completed a, it the to the DOS prompt: WC failure" The , plus the ,", can be the b161 the Itti %failures if the copy of in the root Eof the %able of the if the Itti cannot find an of Itti are: Itti-B: A 99 of Itti, Mthe " WC failure" , and the is not in the =and in the DOS to the =and PZPAPN : IVP Bubbles R: 684 4: PNA - 6.04+, \2.07+ The IVP generation along the Bubbles was generated by the IVP is not a , but a generator of ,and/or . `, as well as possibly +. While the was intended to able to generate function produce working 4. The IVP can produce a random number of NOP instructions placed in two areas of the decryption routine in an attempt to elude simple search ning techniques. The NOPs aren't a real problem, and it is very simple to generate a generic detection es created IVP. The #is for the Bubbles the IVP . It may not match copies of the Bubbles are regenerated The Bubbles is a of . ,and . , but not +. It of the . ,and . in the X. It to move up one Ein the Estructure. the Bubbles 684 at the end of the a. The =and in the DOS Estructure not be . The the "Bubbles "Admiral Bailey" "[IVP]" "*.com *.exe .." The bthree of Lby the X. Bubbles Nn't do Mits (es) created IVP are: Swank: ^, 1993, Swank is a 789 s to created the IVP Swank is a vof . +. It wall of the ,and . in the qof 789 at the end of the a. The =and in the DOS not be . The Swank attempt to Mthe followed by a hang, "Slut3Death Dealer" "Enjoy The Most Advanced To Man "[IVP]" The in the 4, as is the "*.com *.exe .." ^1993. PZPAPN Japanese Christmas : Japanese Christmas Christmas In Japan, Japan H: , 1989 Japan R: 600 4: PNCK - , IBM \, NAV, , VET, The Japanese Christmas breported in Japan in , 1989. It was later ~in Japan in late . As of , it was reported to be widespread in Japan. is a 600 generic vof . `. It the Japanese Christmas X, the xzero to one ain the E. If a s, it by 600 at the end of the >25th, if an X, the Lin the center of the "A merry christmas to you" The flash and be underlined for the it is L. If left alone, the go away a little while and the Ynormally, but the Nnot to do any malicious damage. of Japanese Christmas are: Japanese-709: , Japanese-709 or DAPDM-13 is a 709 of the Japanese Christmas . It wone . qof 709 at the end of the a. The =and not be . Two can be the "*.*" "PATH=*. : Japan Japanese Christmas-B: to the Japanese Christmas-B is a minor modifications. : Japan Japanese Christmas-C: to the Japanese Christmas-C is a minor modifications. : Japan Japanese Christmas-D: to the Japanese Christmas-D is a minor modifications. : Japan Japanese Cookie: one . in the ever an qof 653 at the end of the a. The =and in the DOS . The in the is "*.com". : Japan PZPAPN : JD JD-158, JD-276, JD-356, JD-392 R: 158 - 392 ((depending on 4: PRaCK - NAV 2.1+, The JD ]was . Its ]is a group of four closely related es, the larger of hide the The entry #describes ]in general, specific runder a JD X, the in a "hole" in al . As such, be no as well as possibly {13 or 1E, depending on the present. a JD , it X. If X, it s. The at the end of the of 158 to 392 The JD es don't do member(s) of the JD es are: JD-158: The smallest member of the JD 158 (to the . w. The =and in the DOS . It hooks |13 in addition to |21 in JD-276: member of the JD ]adds 276 (to the . be no 2to the =and in the DOS hooks |21 in JD-356: JD-356 adds 356 (to the . however the not be if the . It hooks |1E in addition |21. be no 2to the =and in the DOS JD-392: in behavior to JD-356, adds 392 (to the . PZPAPN : Jeff R: 814 4: PNCK - , IBM The Jeff ~in the is a vof . the Jeff X, the attempt to xone . aon the C: O, starting in the root 814 to 828 at the end of the The Jeff fthe Sin the "Jeff is visiting your While Jeff is visiting your K, it occasionally write of random contents to the K. If are written to the , or FAT, the contents of the Kmay inaccessible or produce unexpected PZPAPN : Jerk Talentless Jerk, SuperHacker, 1077, Jerk-B G: March, ; unexpected access to C: R: 1,077 4: PNAK - D: IBM NAV 2.1+, , VET, The Jerk, Talentless Jerk, or SuperHacker March, . Its is a vof . ,and . , and it the Jerk search the Estructure of the C: Oto find a x. If the Xthe J, an unexpected access to the has selected a . ,or . x, it alter the bnine (of the candi a, and append the to the end of the newly . The Lon the monitor, Nnot always "Craig Murphy calls himself SUPERHACKER but he's just a talentless jerk!" cannot be seen as it is in the the Jerk qof 1,077 (. The "MURPHY" dstarting at the fourth )of the a. The can be WBad The Jerk Nnot do of Jerk include: Jerk-B: gequivalent to Jerk, differs by three PZPAPN PLO, Israeli, Friday 13th, Russian, 1813( ,), 1808( Arab Star, Black Box, Black Window, Hebrew University , 1987 Israel TSR; . slowdown; on Friday 13th; "black window" Italy R: 1,808 - 1,822 4: PRsA - Generic \, IBM , NAV, , VET, : CleanUp, , NAV, or The ~at Hebrew University in Israel in the Fall of 1987. As of , it is mnow ated in Italy. is a generic .SYS, .BIN, .PIF, and overlay `may be re sby the to a bug in the 4. The many s, and many on its 4. The description #is for a standard , or members of ], are The X, the as a low TSR of 1,792 {08 and 21 nby the , it X. . by 1,813 at the !of the a. . by 1,808 to 1,822 at the end of the a. Later, sby the are again add an 1,808 (to the in the DOS |8, and 1/2 hour Zof the slow down by a factor of 10. ma "black window" or "black box" on the lower left side of the scroll up the as the scrolls. The Friday the 13ths. At , it Aany The identifier for most strains is "sUMsDos", however, identifier may not be din the newer The t to on the Suriv 3.00 the Suriv 3.00 members(s) of the ]are: A-204: the sUMsDos 0to *A-204*, and a couple of instructions 0in order to avoid detection. slow down the for 30 minutes, as well as having a black box : Delft, The Anarkia: r delay set to slow down the to a greater degree, effect Nn't show until a much longer has elapsed. No Black Box is ever L. The sUMsDos id- 0to ANARKIA. Lastly, the =has 0to Tuesday the 13th, instead of Friday the 13th. : Spain Anarkia-B: to Anarkia, the exception now on any 12th instead of on Tuesday the 13ths. Antiviru: B, the Antiviru differs in 7two +" and "ANTIVIRU". Like , it Ma "black box" accompanied by a slowdown 30 minutes becoming Friday the 13ths, any Apocalypse: The Apocalypse Vin May, . It ated in Italy. X. . by 1,813 (. . by 1,808 to 1,822 u, and 1,808 (on later re us. The MsDos umarker in the to "C.J**". can be din Apocalypse are: "Apocalypse!!!" "**C.J**" The last is what has replaced the sUMsDos in the . Apocalypse mthe characteristic "black box" on the lower left hand side of the has for 30 minutes. It Nnot, however, on Friday the 13ths. : Italy May, Bogota: The Bogota Gin Bogota, Columbia in May, . Its low TSR is 2,048+ hooking {16 and 21. It adds 1,813 (to the . s. . by 1,808 to 1,822 u, and 1,808 u. Bogota truncate . to zero Captain Trips: The Captain Trips in March, , and is fthe . Its comes "Captain Trips X." in the 4. Unlike most Ma black window for 30 minutes, nor Nit slow down the . On Friday the 13th, it Nnot . The "MsDos" Nnot by 1,813 (. . by 1,808 to 1,822 the a, and by 1,808 subsequent March, Captain Trips 2: Captain Trips 2 was It is a of the Captain Trips to avoid detection. The major difference is us of . qof 1,813 Czech: The Czech the Czech zs a 1,984 )TSR in {08, 21, and F8 it is , it X. . 1,735 at the of the a. . by 1,735 to 1,749 at the end of the Nnot re the Czech for 30 minutes, it Ma reverse video box in the upper left hand corner of the 7the "Ha!Ha!". It Nnot on Friday The 13ths. may detect as the Sunday Dragon: The Dragon to the . It "BDH B T". The MsDos identifier has 0to a hex character . It on Friday The 13ths. Get Password 1: Get Password 1 is a Gin the bhalf of 's TSR is 1,840 . Get Password 1 is a Novell network specific , it won't unless the Novell Netware Ors are present in . The intended to capture the logon logs onto the network, however Nnot function and so is no threat. Get Password 1 is 1,914 25TH: B, the major difference activate on 25TH, at Aany 25TH Nn't re for 30 minutes, it mthe "black box" effect 6to many . The "sUMsDos" replaced hex 00 25TH-B: gequivalent to the 25TH, slight 4modifications. to the Nnot re : Israel , 1988. out the r delay to slow down the processor. destroy both copies of the FAT on any Friday the 13th has the sUMsDos 0to 00h for 30 minutes, the slow down by 30% and the 6"black window" on the lower left side of the . Like , it `multiple Nnot carry an `, it s for all intents to be "defanged". : Washington, DC, D but the is in -Polish: on the slightly so the "black box" effect Nnot : Poland -PLO: on the Xduring the secondd half of the year. It during the half of the year. for 30 minutes, a slowdown , but the characteristic black box . The "sUMsDos" in the "sU?sDos". by 1,813 by 1,808 - 1,822 u, and 1,808 17TH: on the 17TH is a 1,530 . Its TSR is 1,792 (, hooking |21. . by 1,535 while . by 1,530 to 1,544 , the at the of the , the at the end of the a. . are not re is between 17TH and >31st of any year, at Aany JVT1: to the , the JVT1 major differences are 30 minutes, a vertical black box consisting of two in the very upper left hand corner of the M. An difference is instead of deleting on Friday the 13ths, it As them on Tuesday the 1st. The "sUMsDos" in the 0to "sUMsDns". Like , it JVT1-B: gequivalent to JVT1, slightly modified Mendoza: on the `. It is missing the black box effect. Mendoza in the second half of the year ( >), at any day ma 10% chance of having all : Argentina Messina: to the , Messina's major difference is the "sUMsDos" 0to "Messina". by 1,813 by 1,808 to 1,822 u, and 1,808 Nemesis: to the major difference is in the area of in the . The characteristic "sUMsDos" "UM Do ". Two can be `: "NEMESIS. ," and "NOKEY". New : The New is a was uploaded to several BBSes in The 14, 1989. It was modified to be undetec utilities were widely distributed at : The , 1989. Oscar: The Oscar equivalent to the . It 7three : "sUMsDos", " +, and "OSCAR NU". be re On Friday the 13ths, it Payday: The Payday ~in The Jan Terpstra in , 1989. A major behavioral Payday activate on all Fridays except Friday the 13th. Upon , it As all : The , 1989. Park ESS: in Happy Camp, California, is very by 1,813 (, and by 1,808 to 1,822 u, and 1,808 on later subsequent us. +. The major difference fthe "normal" "sUMsDos" replaced. The "PARK ESS" can din the in all slows down the 20 percent and a "black window" for 30 minutes. Phenome: The Phenome B was at the same as the Apocalypse in behavior to Apocalypse, the exception X. The "MsDos" "PHENOME. "*-*-*-*" Phenome becoming on Saturdays. On Saturdays, Y, but simply to the DOS prompt. : Italy May, Puerto: in Puerto Rico, very to the Mendoza , the sUMsDos id- `may be smultiple : Puerto Rico Skism: to the Skism-1 , the Skism 's major difference is the "SKISM-1" 0to " SKISM ". g, it is equivalent to Skism-1. : Canada Skism-1: in New York State, to many s except regards to and what it Nupon . Rather activate on Friday the 13ths and in the years and later on any Friday the 15th of the month. On , it truncates any is attempted to be Xto zero (. . upon 1,808 qby 1,808 to 1,822 be re sby the . The "sUMsDos" in the is now "SKISM-1". Like produces a "black window" 30 minutes becoming , and slows down the : Canada Soy Un: on the , Soy Un is a 2,064 fPeru. Its TSR is 2,336 and hooks |21. Soy Un adds 2,069 (to the . at the !of the a. It adds 2,064 to 2,078 (to . at the end of the are not re s. Most of the usually not be the as it attempt to hide all by 1 to 16 (of the q. The in the "HACK1" "CHKLIST.CPS" "Soy un y mi nombre es - THE HACKER - Lima - Per : Peru Spanish JB: ( , it re `. The `is always 1,808 (. On . `, the may be either 1,808 or 1,813, ualways adding 1,808 (to the already a. No "Black Box" The characteristic "sUMsDos" id- Nnot in the s identified as : Spain Sub-Zero: , Sub-Zero is a modified Nnot Mthe characteristic "black box" for 30 minutes, nor slowdown . Sub-Zero : "LORD SKISM", "Sub-Zero NYHC", and "ED EL". : Canada Sub-Zero B: in May, , Sub-Zero B is a slightly modified of the Sub-Zero . On the last Friday of any month truncate X, and attempt to format the minutes becoming May, Swiss 1813: fSwitzerland, Nnot exhibit the "black window" for 30 minutes, nor Nit slow down the . It Nnot on Friday the 13th, or any Friday. The "sUMsDos" 0to binary zeros. : Switzerland Triple: , Triple is a to avoid detection by ning g, it is to the . One can be din the ,MAND". Ucender: in March, to avoid detection by The "sUMsDos" 0to "UCNDER". The characteristic "black box" has for 30 minutes, and a slow- down . Ucender `, like the on Friday The 13ths, at : Argentina March, See: 1605 Discom Freddy Frere Jacques Fu Manchu Groen Links Growing Block 11-30 1663 Mule RAM Slow Sunday Sunday-2 Suriv 3.00 Westwood Barcelona Moctezumas Revenge 1244 Timor Totoro PZPAPN 11-30 11-30 1130 j; TSR; R: 2,000 - 2,014 4: PRsA - , IBM , NAV 2.1+, , VET, .1.4+, The 11-30, or 1130, Its 11-30 is a of . W, and overlay `. It , as the implies, is a of the it is "documented separately due to its different behaviour. The 11-30 is the 11-30 low TSR of 2,288 (. On 30th, the hook {20, 21, and 27. On 30th, it hook 11-30 is , it qof 2,000 at the !of the qof 2,000 to 2,014 at the end of the a. Unlike several not re `. All mhad =and in the DOS to the =and . The can be in the 4of all 11-30 11-30 it has 30th of any year. It intermittently flash a reverse video block in the upper right hand corner of the says "1130" while the is at a DOS prompt. See: PZPAPN j; TSR R: 1,663 4: PRsAK - D: VET, V99+, .1.4+, 6.00+, 2.43a+, \2.07+, V99+, The 1663 . Its 1663 is a vof . ,and . The 1663 X, the Jersalem 1663 as a low TSR of 2,432 {13 and 21 , Jersalem 1663 X. Both . ,and . by 1,663 at the end of the a. The cannot recognize a previous uon a a. Both . ,and . s, adding 1,663 u. The =and in the DOS not be . No in the It is what 1663 See: PZPAPN Research TSR; . New Zealand R: 1,767 - 1,779 4: PRsAK - , IBM , VET, The 1767 Henry Wolfe of New Zealand whom he has had on a Jfor over one year. The source of the 1767 is a of the characteristic 1in its behavior. The 1767 is as a low TSR of 2,048 (, hooking {08 and 21. 1767 is , it ,and . X. If X, it by 1,767 at the !of the a. The exception "at the end of the by 1,767 to 1,779 the at the end of the a. . not be re related In both cases, be no 2to the =and in the DOS E. Two can be in the 4, the "the umarker for "** INFECTED BY FRIDAY 13th **" 1767 Nnot exhibit the typical "black box" for 30 minutes. A slowdown Nnot See: PZPAPN Joanna : Joanna England R: 986 4: PRhCK - 6.04+, \2.07+, The Joanna Gin Lancs, England, in . Joanna is a vof . bJoanna X, the Joanna at the top of #the , as rby the DOS ?by 3,008 nby the , the Joanna +if it was not the Joanna , it for any reason. qof 986 at the end of the a. The and in the DOS not be Hidden `, however, mhad the hidden attribute removed. The in the Joanna and are not is Dedicated To the Girl I Love, Joanna Dicks." "Made in England by Apache Warrior, ARCV Pres." "Jo Ver. 1.01 (c) Apache Warrior 92" "I Love You Joanna, Apache.." "[JO] By Apache Warrior, ARCV Pres." of the lines of by the while it is in of Joanna are: Joanna 1.11: fManchester, England in Joanna 1.11 is a 916 of the Joanna Its , and use of {, is the same as the . Joanna 1.11 qof 916 the end of the be no 2to the =and in the DOS The in the "Looking Good Slimline Joanna." "Made in England by Apache Warrior, ARCV Pres." "Jo Ver. 1.11 (c) Apache Warrior 92." "I Love You Joanna, Apache..." "[JO] By Apache Warrior, ARCV Pres." : Manchester, England Joanna-911: A 911 of Joanna, is very to Joanna 1.11. Its is 3,018 (, hooking |21. , Joanna-911 qof 911 at the end of the a. The =and in the DOS not be . The in the Joanna-911 "Looking Good Slimline Joanna" "Made in England by Apache Warrior, ARCV Pres." "Jo Ver. 1.11 (c) Apache Warrior 92" "I Love You Joanna, Apache." "[JO]" "Apache Warrior, ARCV Pres" Joanna-911 7destructive Eand : England , 1993. fEngland in , Jo Wis a 916 of Joanna `. Its , and use of {, is the same as the . Jo are for any reason. qof 916 be hidden . The Jo at the end of the a. The =and in the DOS not be . The in the "Jo Exersiser . Apache Warrior, ARCV Pres. [JO The DOS , as well as data the Jo : England PZPAPN : JoJo G: May, k; graphic Israel R: 1,701 4: PRaC - \, NAV, , IBM , VET, \, or The JoJo Gin Israel in May, . The comes in the "Welcome to the JOJO One in the , indicating it was written in is: "Fuck the (c) - Both in the 4are never the JoJo Xon a , the . The method used is to alter the 5interpreter in , expanding its . As an example, on my test , the 5interpreter in qd in f3,536 (to 5,504 (. One block of 48 reserved in . The be a net @of 2,048 The JoJo |13 is in use by any . Instead the clear the , and the be hung. If the performs a warm re (CTRL-ALT-DEL), the remain in is able to n, any . sby the by 1,701 JoJo is on the Cascade Nnot make use of the encryption mechanism in Cascade. JoJo produces a Mof multicolored diamonds on graphic JoJo is of JoJo are: JoJo-B: A minor of the JoJo , JoJo-B's encryption has slightly modified. See: Cascade Cascade-B JoJo 2 PZPAPN JoJo 2 : JoJo 2 ; "Not enough k; cursor position off 1 character R: 1,703 4: PRaCK - \, IBM , VET, NAV 2.1+, The JoJo 2 , by David Grant of the on the JoJo as well as 8ing part of the decryption for the Cascade . It is a vof . The the JoJo 2 the by altering the 5interpreter in . The 5interpreter in qof 1,904 is an is reserved by the as well, to JoJo. , it are X. If Xfor any reason, it qof 1,703 at the end of the can be the JoJo 2 "The JOJO strikes again. x zzz" "Fuck the - (c)" "141$FLu" the JoJo 2 Mthe "Fuck the - (c)" , or a garbage may fail due to "Not enough T. Lastly, for awhile, the may notice cursor on the monitor is off by one position to the right fwhere it should be. JoJo 2 may be detected by utilities as an of JoJo and Cascade/1701/1704. See: JoJo PZPAPN Joker : Joker Jocker Extinct >, 1989 Wand .DBF Poland R: ??? 4: PNE - , IBM , VET, NAV 2.1+, The Joker ~in Poland in >, 1989. is a generic . v, and is a poor replicator (i.e., it Nnot quickly the Joker Mbogus and comments. and comments can be din the `at the !of the Here are of the and comments may be "Incorrect DOS "Invalid Volume ID Format failure" "Please put a new Kinto "End of input "END OF WORKTIME. TURN SYSTEM OFF!" "Divide Overflow" "Water detect in Co-processor" "I am hungry! Insert HAMBURGER into "NO SMOKING, PLEASE!" "Don't beat me !!" "Don't drink and cup of cofee ?" " OH, YES!" Khead has destroyed. Can you borow me your one?" "Missing light magenta ribbon in printer!" "In case mistake, call GHOST BUSTERS" "Insert tractor toilet paper into printer." alter .DBF `, adding to them. The sample in the author of possession on an 8088 entry has included since the sample may damaged before its receipt by the author. At best, is a serious bug in the replication portion prevents it freplicating. PZPAPN Joker 2 : Joker 2 Joker-01 G: May, j; TSR; R: 29,233 4: PRsA - IBM , NAV 2.1+, , VET, The Joker 2, or Joker-01, in May, , by the PCVRF. Its is a vof . ,and . , and The Joker 2 is X, Joker 2 as a low TSR of 29, 568 nby the include 09, 1C, and 21. becoming , Joker 2 ,and . `whose was less larger 9K are never always by 29,233 by 29,233 to 29,372 (. In both cases the at the end of the The "JOKER-01" can be din all Joker 2 may [the "cleared, followed by a hang ring. happens, a few spurious 3may on the well. If ANSI.SYS is loaded before Joker 2 effect be produced. Joker 2 may be an incomplete is a large area of 00h in the 4, implying thing else may later. PZPAPN : Jos j; TSR Romania R: 1,000 4: PRsC - 6.04+, \2.07+, V100+, V100+ The Jos . It is fRomania. Jos is a vof . but not bJos X, the Jos as a low TSR of 1,312 {09 and 21 nby Jos in the Jos , it qof 1,000 at the of the a. The =and in the DOS not be . The in the 4in all Jos "JABBERWOCKY , the bRomanian Political sian" "DhoE1" "Dhohoho" "Release =12-22- Jos is not related to the JW2 or Jabberwocky It is what Jos PZPAPN Joshi : Joshi Happy Birthday Joshi, BSC; machine kand India R: N/A 4: BRX - , NAV, IBM ., VET, : CleanUp, NAV, or M- The Joshi ~in India in . At the was ~, it was reported to be widespread in India as well as portions of the continent of Africa. Joshi is a Iand the fa Joshi- J, the . Joshi takes up , and show is 6K less zed if the DOS run. Joshi has ities to two Like the , it wthe to the Brain 's method of re Fing all to read the to the , Joshi 5th of any year, the Joshi . At , the hang the while Ming the Happy Birthday Joshi" If the s "Happy Birthday Joshi", the again be usable. may be recognized on by powering off the %ing -clean, write-protected DOS J. Using a editor or viewer to look at the of suspect I, if the btwo (of the are hex EB 1F, s. The EB 1F is a jump instruction to the rest of the 4. The remainder of the is stored on track 40, 1 through 5 on 360K 5.25 inch I. For 1.2M 5.25 inch I, the at track 80, 1 through 5. It on the last track of 3.5" To determine if a s, you must look at the . If the btwo (of the are EB 1F hex, The remainder of the can be dat cylinder 0, side 0, 2 through 6. The at cylinder 0, side 0, The Joshi can be manually removed bpowering off the , and %ing -clean, write-protected J. If the has a K, the Kshould mdata and `backed up, and the copied back to cylinder 0, side Iare easier to remove Joshi f, the DOS SYS 5can be used. several Joshi may [problems to access or data `on write protected of Joshi are: Joshi-B: to behavior to the Joshi , the major %ed on 5, the hang L. If the s "Happy Birthday Joshi", the proceed. May, PZPAPN Joshua : Joshua R: 965 4: PNA - V99+, 6.04+, \2.07+, The Joshua . Its . Joshua is a vof . ,and . , but not the Joshua xtwo in the E. It prefers . . If it could not two in the E, it move upwards in the Estructure looking for the Joshua qof 965 at the end of the a. The =and in the DOS not be , the Joshua Mthe Guess what ??? You victimized by a !!! Do not try to re %your computer or even turn it off. You might as well read and weep! The in the 4, as is the "*.com *.exe .." See: PS-MPC PZPAPN Endangered effects on Madrid, Spain R: 1,201 4: PNE - \, NAV, IBM , VET, \, or The 13TH ~in Madrid, Spain, in Guillermo Gonzalez Garcia. is a generic . v, and is not 13TH X, the attempt to `are are greater in 1,201 by 1,201 to 1,209 The 13TH 13TH of any year. At , a bouncing ball effect s on the monitor's to the bouncing ball effect of the Ping Pong . While is disruptive, it Nnot cause any overt damage to tthem. The bouncing ball effect created occasionally leave dots on the where it was passing if the scrolled for any reason. PZPAPN Italy R: 205 4: PNCK - The 26TH submission, it s to ~in Italy. is a vof . +. It is destructive 26th of any year. 26TH xall of the . in the E. If E, it 26TH qof 205 at the end of the a. The =and the DOS to the =and . One in the The 26TH 26th of any year. At , the the O, rendering it inaccessible. PZPAPN Pretoria, Endangered j; long Kaccesses; 16th FAT alteration Republic of South Africa R: 879 4: PNCK - \, NAV, IBM , VET, : NAV, or The 16TH, or Pretoria, is a generic . v, and is S. The X, the search the O(all Fories) and xall . d. The search period can be quite long, and it is very obvious on is taking too long to load. 16TH of any year, the Xthe activate. On , the 2all entries in the root Eand the to "ZAPPED". The 16TH t to ated in South Africa. PZPAPN Junior : Junior R: 234 4: PRaCK - 6.00+, 2.43a+, 25.10+, V100+, V100+ The Junior . It is '. Junior is a vof . bJunior X, the Junior in a "hole" in al 0:0500. , as rby the DOS not be . No {are nby the the Junior , it qof 234 at the end of the a. The in the DOS not be . One in the 4in Junior "Jr" s at or very near the end of the PZPAPN : JW2 812, Jabberwocky j; TSR R: 812 4: PRsAK - , NAV, ., IBM , VET, The JW2, or 812, . Its , or , is . JW2 is a vof . ,and . The JW2 is X, JW2 as a low TSR of 1,136 nby JW2 in JW2 is , it ,and . by 812 at the end of the be no 2in the =and in the DOS 8the "JW2" in the fourth through sixth 3of the is the umarker. It is if JW2 of JW2 are: Jabberwocky: A of JW2, it has six differ fthe occasionally Mthe X: "BEWARE THE JABBERWOCK!". The cannot be seen in `as it is Jabberwocky-B: to Jabberwocky, Jabberwocky-B is an minor differ. PZPAPN Kalah : Kalah Hamburg, Germany R: 390 4: PRCK - ., NAV 2.1+, The Kalah ~in Hamburg, Germany, in is a vof . The Kalah is X, the Kalah in a "hole" in very low , hooking |21. be no the Kalah , it the exception of those of less by 390 (. If the was less (, the be 780 (. The at the !of the a, and the b390 3of the moved to the end of the be no 2to the =and in the DOS in the Kalah s Kalah Nn't do of Kalah are: Kalah-499: , Kalah-499 is a of the . It wtwo . qof 499 at the !of the a. In the case of . were smaller of 998 u. The in the DOS not be . The can be din all Kalah-499 "I don't like mondays ..." Kalah-499 4to low-level format the Xon any Monday. PZPAPN Kamikazi : Kamikazi Kamikaze R: 4,031 4: ONE - D: IBM , NAV, , VET, The Kamikazi by Vesselin Bontchev of is a , and the Kamikazi X, the ain the the . is greater 4,031 (. Kamikazi simply s the b4,031 (of the candi 4, thus permanently damaging the candi s. The 4,031 4is not stored at any location. `do not , the the (of the "kamikazi", thus the . At , one of several : the may be re %ed by the of the contents of may get Lon the , or the may complete Zhaving ed to mdone nothing at all. In any event, the never run successfully, doing what the expects. If the Xa second , it hang the since it is no longer an execu . The . header has permanently damaged due to the having 0to "kamikazi" by the it was PZPAPN Karin : Karin RedStar Germany R: 1,090 or 1,134 4: PNCK - ., IBM , VET, NAV 2.1+, The Karin, or RedStar, fGermany. Karin is a vof . a Karin X, the Karin search the Efor an . If one d, the xit. If in the E, it may sas a the Karin qof either 1,090 or 1,134 (. In either case, the at the !of the be no 2to the =and in a DOS The can be in the "REDSTAR" "!Bad copy" The Karin 23rd. On is run the Mthe repeatedly: "Karin hat GEBURTSTAG" roughly translates to "Karin's Birthday". The be stuck in a loop during the M, and the need to be re %ed to end the %ing scopy of in the and the %failing to proceed. PZPAPN Kemerovo : Kemerovo 257, Kemerovo-B, Keme, -257, Kemerovo-C, V257, Kemerov ,Path not R: 257 4: PNCK - \, NAV, IBM , VET, The Kemerovo and is is a vof . the Kemerovo X, the search the Oand Efor a . x. If an d, the xit, adding its 4to the end of the . The newly =and the to the =and by 257 If an awas not din the the ,Path not d" may be Land the be terminated. Kemerovo Nnot do of Kemerovo are: Kemerovo-B: to Kemerovo, fthe United States and has to avoid detection by . Its major distinction xfive . in the Kemerovo-C: Very to Kemerovo-B, differs by a couple of PZPAPN Bug-1596, Kbug interference R: 1,598 - 1,620 4: PRhA - The Bug, or Bug-1596, . Its Bug is a vof . ,and . , but Nnot The Bug is the at the top of #the 12's moved. , as rby the DOS ?by 1,616 {01, 03, 1C, and AC nby the , it ,and . X. . qof 1,620 (. . qof 1,598 to 1,612 . In both cases, the at the end of the . The =and the DOS intermittent interference input due to the adding bursts of random 3to the buffer. kmay , in particular if the to copy using the DOS COPY Bug are: Bug-1720: A larger of the in 1,728 at the top of #the &, as well as ma 448 )TSR. 01, 03, 1C, and AC nin high , and nby the TSR. qof 1,744 (. . 1,722 to 1,734 Bug-1724: An of the what Bug-1720. ,and . adding 1,724 to 1,759 . The at the end of PZPAPN Keydrop : Keydrop Keydrop Dropper G: May, BSC; 3dropped buffer; ; possible adamage R: N/A 4: BRtX - , NAV, : M- K/P, DOS SYS on The Keydrop in May, V. Keydrop is a and the ). The Keydrop sample 8ed in a . "dropped" the . The . ,dropper is not its behavior is not to the , and the naturally the Keydrop , the at the top of #the @by 5,120 |12's moved. At , the xthe . The m6K in bad Keydrop is , it x360K are accessed on an . High density not be 3,072 (in bad , and the . The , and the Nnot fit in the din the bad m6K in bad . The bad 8the and the remainder of the Keydrop's comes fthe copyright notice din the in the bad "(c) Copyright Keydrop inc." Keydrop on a random basis, at occasionally drop a character fthe buffer, making the think missed a keystroke on the may damage Iand the K. It Nnot check to see if the it is going to mark as bad are in use, so may be in the middle of or data of Keydrop are: Keydrop Dropper: A small X, drops the Keydrop PZPAPN Keypress : Keypress Q, SamSoft, St. Leos, Turku, Keypress-Viring, Viring keystrokes repeated unexpectedly; R: 1,232 4: PRhAK - , IBM \, NAV, , VET, : CleanUp, or The Keypress was reported and ~in many locations in the in late is a vof . ,and . The the Keypress X, the at the top of , but #the {1C and 21 nby the on the ?by 1,232 , any Xmay sby the . In the case of . was greater 1,232 `of any s, as it is 0to the =and between 1,234 and 1,248 (upon u. . qby 1,472 to 1,486 (upon u. In either case, the at the end of the The Keypress for 30 minutes. Upon , the may interfere input by repeating keystrokes. For example, if "a" is entered on the , it may be 0to " a" by the `can be identified by 8ing the near the end of the : 4333C98E1E2901CD21. of Keypress are: Keypress-1238: Keypress-1238 is a modified of the Keypress at the of its submission was undetec ning . Its is 1,328 (, hooking {1C and 21. It adds 1,238 to 1,252 (to the . w, and 1,492 to 1,506 (to . . In both cases, the at the end of the a, and the =and in the DOS to the =and Keypress-1238B: gequivalent to Keypress-1238, is a minor Keypress-1238C: to Keypress-1238, is 1,328 (, hooking {1C and 21. It adds 1,238 to 1,251 (to the . w, and 1,492 to 1,507 (to . `. The at the end of the a. The =and in the DOS to the =and Keypress-1268: (MuBark) on the Keypress is 1,744 (, hooking 09, 1C, and 21. It ,and . are qof 1,268 to 1,282 (. . by 1,506 to 1,520 (. The at the end of the a. The =and in the DOS to the =and . The in the 4in all "M u b a r k i s c a w" Lon the monitor Keypress-B: Keypress-B is very to the Keypress it is four (shorter in @by 1,216 Keypress-B. by between 1,228 and 1,243 (. . by 1,468 to 1,482 (. Keypress-B on a random basis, at interfere input by repeating keystrokes. Keypress-Chaos: on the Keypress is 1,328 (, hooking {1C and 21. It ,and . 1,238 to 1,251 (. . 1,492 to 1,506 (. The at the end of the a. The =and in the DOS to the =and . The the "SADDAM - the inferiority of the chaos" Lon the monitor : Malaysia Keypress-E: Keypress-E is very to the Keypress . Its major differences are is 1,232 (. It adds 1,234 to 1,247 (to the . w, and 1,472 to 1,486 (to the . w. The =and the DOS to the =and Keypress-UFO: on the Keypress is 3,968 (, hooking {13, 1C and 21. ,and . 2,725 to 2,738 (. . 2,979 to 2,994 (. The at the end of the a. The =and in the DOS not be Keypress-Viring: on the Turku of Keypress, 's major difference fTurku is the beeping, , and kdo not : Italy on the Keypress Singapore is much smaller in , it by 896 889 to 902 qof 1,143 to 1,157 (. The can be in the 4in all "Roy CuatroNo" "2 P QGargenMeyer Rd. Spore 1543" "chklist.cps" Nnot to interfer input of the Keypress group do. It is targetted at Central Anti- , looking for the CHKLIST.CPS created by the Central package. : Singapore SamSoft: to the Keypress, 1,232 - 1,248 (to the . w, and 1,472 - 1,487 (to . `. The =and in the DOS to the =and . Unlike the , it Nnot repeat 3entered on the . It 7one May, SamSoft-B: to the SamSoft is has minor alterations. St Leos: to the Keypress, gequivalent. It has slightly Turku: to the Keypress , Turku adds 1,234 to 1,247 (to the . w. . by 1,472 to 1,486 (. The din the 4of all `: ". W". The sticky key or repeated keystroke effect in the replaced by a series of beeps "emitted on speaker, the halted, and the "Internal stack overflow halted" s, the must be powered off to be re PZPAPN Kiev 483 : Kiev 483 483, Kiev G: May, R: 483 4: PNCK - , NAV, , IBM , VET, The Kiev 483 in May, . It is fthe . Kiev 483 is a of . Kiev 483 is X, the search the Oand E, and xthe it locates. Kiev 483 by 483 (, the at the end of `. The =and in the DOS not be 8three "Kiev Kiev 483 Nnot do PZPAPN Kiev 2049 : Kiev 2049 ; C: ; lost cluster or '.SYS ain C:\ R: 2,049 4: PRsEB - 6.00+, 2.43a+ `& DOS SYS on C: The Kiev 2049 . It is . Kiev 2049 is a vof the C: and . bKiev 2049 X, the Kiev 2049 on the C: , and create d '.SYS in the C: Oroot not usually in the E, but be a lost cluster on the O. The aor lost cluster 8a pure copy of the Kiev 2049 4. The not be , and not start The next fthe K, the Kiev 2049 as a device Or in low . The device Or is 3,152 (, hooking |21, and be labelled "NUL". the Kiev 2049 , it may it is what sporatic about qof 2,051 to 2,064 at the end of the a. The =and in the DOS not be . The in the 4in all Kiev 2049 "KIEV" "c:\'.sys" "SYS CONFIG SYS" "IBM 3.2" "CONFIG SYS3" "Non- K. Replace and press key" The last three 8ed in the imbedded in the It is what Kiev 2049 PZPAPN : Kit R: 2,383 - 2,446 4: PRhAK - , NAV 2.1+, The Kit . Its It is a vof . ,and . The a Kit X, the Kit at the top of but #the , as rby the DOS ?by 2,400 {1C and 21 the Kit , it X. If the Kit qof 2,383 to 2,384 (on initial u. Kit `, adding an 2,384 u. The at the !of the the Kit qof 2,416 to 2,446 the initial u. As `, Kit re adding 2,416 u. Kit at the end of the Nnot alter the =and in the DOS are no in the It is what Kit may do PZPAPN Kiwi-550 : Kiwi-550 Kiwi ^, 1993 R: 550 - 566 4: PRhE - The Kiwi-550, or Kiwi, ^, 1993, and fthe . Kiwi-550 is a of . bKiwi-550 X, the Kiwi-550 at the top of #the &, hooking |21. , as rby the DOS ?by 608 |12's moved. the Kiwi-550 , it qof 550 to 566 at the end of the a. The =and in the DOS not be . The can be in the 4in all Kiwi-550 "I'm KIWI-586.(C) Vege -Soft, .DOS AIDSTESTP" It is what Kiwi-550 may do PZPAPN Klaeren : Klaeren Hate j; TSR; slowdown Italy R: 978 4: PRA - \, IBM , NAV, ., VET, The Klaeren , by the PCVRF. It is reported to be fItaly. Klaeren is a of . ,and . . It Nnot bKlaeren X, Klaeren as a low TSR of 1,312 nby the Klaeren is , it ,and . over 1K in by 978 to 996 the at the end of the be no 2in the =and in the Klaeren respond sluggishly due to a slight slowdown Klaeren is a fully . It is what it PZPAPN KLF-356 : KLF-356 R: 356 4: PRaCK - 6.00+, 2.43a+, \2.07+, V100+, V100+ The KLF-356 and is fthe . KLF-356 is a vof . bKLF-356 X, the KLF-356 in a "hole" in al 0:025E. nby the rby the DOS not be the KLF-356 , it qof 356 at the end of the a. The and in the DOS not be The in the KLF-356 "KLF" "The KLF3" The s very near the the a, and the last s in the 4at the end of the KLF-356 Nn't to do PZPAPN Kode4 : Kode4 fail to North America R: 399 4: PNCK - 6.04+, \2.07+, 2.45+, The Kode4 , and s to be fNorth America. Kode4 is a of . the Kode4 X, the Kode4 xall of the . in the it completes tthe , it the s the to the DOS prompt: "-=+ Kode4 +=-, The one and ONLY!" the Kode4 qof 399 at the end of the a. Kode4 cannot tell by the , so it `adding increments of 399 (. The =and in the DOS not be $the , one can be din all "*.com" Kode4 Nn't to do not function of Kode4 are: Kode4-129: , Kode4-129 s to be an earlier of the Kode4 is a wall . in the mthe b129 (of the by the 4. The "-=+ Kode4 +=-, The one and ONLY!" In addition to , the can be in the "*.c*" Kode4-129 may even is an s, the 8the the !of the a, and the remainder of the 8data PZPAPN Korea : Korea LBC 6- Korea G: March, BSC - 360k Seoul, Korea R: N/A 4: RF - Floppy \, IBM , NAV, , VET, : CleanUp, M- K, or DOS SYS The Korea, or LBC ~in March in Seoul, Korea. is a 5.25" 360K The Korea is not intentionally destructive, it Nnothing in its :form except for replicating. In instances, Korea damage the root it moves the 11, the last the root E. If entries, be lost. PZPAPN Krivmous : Krivmous R: 972 - 993 4: PNA - D: IBM \, VET, 1.15a+, 3.93+, o, NAV 2.1.2+, 25.10+, The Krivmous was . It is '. Krivmous is a ,and . , but not +. It mthe to be hung the Krivmous search the Eto determine if x. If an d, the xit and run. If was not d, the check the Eto determine if an d, and sby the Krivmous qof 979 at the !of the a. . qof 972 to 993 at the end of the a. The =and in the DOS not be The Krivmous Mthe cpoem Ys an . The to be hung, pressing CTL-C usually to the DOS prompt: was a crooked man, and he went a crooked mile, da crooked sixpence against a crooked stile, He bought a crooked cat, caught a crooked mouse, And all lived together in a little crooked house." The is not as it in the of Krivmous are: Krivmous-B: gequivalent to the Krivmous has five differ. PZPAPN Kthulhu : Kthulhu write protect Poland R: 512 4: PNCK - V99+, 6.04+, \2.07+, The Kthulhu . It is fPoland. Kthulhu is a the Kthulhu X, the Kthulhu xall of the . in the qof 512 at the of the a. The =and in the DOS not be . The can be in the 4in all Kthulhu "KTHULHU Today is my birthday." "IT $is coming." "$has gone." The Kthulhu during the month of May of any year, Ming a hang s. The of the depends on what the day of the month is set to in the fthe 1st of May thru May 19th, the "IT is coming." On May 20th, it Ms the "Today is my birthday." fMay 21st thru May 31st, it Ms the "IT has gone. symptom of a Kthulhu on write protected write protect PZPAPN Kuku-448 : Kuku-448 Ku-448 R: 448 4: PNCK - \, IBM , VET, NAV 2.1+, The Kuku-448 . Its , is . Kuku-448 is a non- vof . +. Kuku-448 can be a destructive , overwritting in advanced ucases. Kuku-448 is X, the Kuku-448 search the Efor one x. If it may s. Kuku-448 qof 448 at the !of the be no 2to the =and in a DOS If Kuku-448 Nnot find one x, it one . ain the a small trojan . Later, X, the write the word "Kuku!" in small colored boxes all over the PZPAPN Label : Label Int13 ; sluggish response on DIR R: 512 4: ORCK - , NAV, , IBM , VET, The Label, or Int13, . Label is a vof . The Label is X, Label , it one . in the a DOS DIR mthe by the . The b512 the are not saved by the be no 2in the `, nor be a in the =and in the DOS , as well as be corrupted by the Label , but not actually s. Like permanently damaged. Label may on the same aif the is not PZPAPN Lancs : Lancs Lancspoly, Lancs-5476 `created; long Kaccesses England R: 5,476 4: SNCE - Spawning , VET, 1.15a+, 3.93+, Acompanion . The Lancs, Lancspoly, or Lancs-5476, . It is fEngland. Lancs is one of a group of three closely related spawning or companion All three of the in an LZ Wpacked format. the Lancs the Lancs search the Eto determine if exists the same base ain the E. If the companion exist, the create one. The newly created companion . of 5,476 (. The in the DOS is the same as the and for the corresponding . a. The The Lancs always is packed using LZ Win the companion . `. The in the but is not in the `due to the compressed format: 'HAVE A "HAPPY MONDAY" LANCSPOLY SUCKERS.' 'POP WILL EAT ITSELF' the Lancs Tand mthe halted L: "Cannot load ,MAND, halted". of Lancs are: Lancs-5882: to Lancs, companion . `are 5,882 Lancs-7376: to Lancs, companion . `are 7,376 PZPAPN Larry : Larry R: 491 - 507 4: PRsAK - V99+, 2.43a+, 6.04+, \2.07+, V99+, 1.53S+ The Larry . Its . Larry is a vof . ,and . . It on the monitor. The the Larry in a "hole" in low , hooking |21. be no rby the DOS the Larry , it qd in by 491 qof 507 (. In both cases, the at the end of the a. The =and in the DOS not be . One in the 4in all Larry "Larry on a Lon the monitor the Larry and a PZPAPN : Lazy slowdown; slow writes; R: 720 4: PRxCK - , IBM , VET, , NAV 2.1+, : CleanUp, or The Lazy , and its is a vof . The the Lazy on a , the unreserved low hooking {10 and 21. The processor be significantly slowed down, ing in very slow writes ring. Lazy is , it are by 720 at the end of the The =and in the to the =and can be identified by the "lazy" near the end of all the Lazy [unexpected allocate and where the Lazy resides in . For example, hang it checks if Lazy is of Lazy are: Lazy-2: has 16 differ fthe Lazy . It Nnot hook |10 nor slow down writes. PZPAPN Leech : Leech Leech2, Topler G: May, =s may dis R: 1,024 4: PRhCK - , NAV, , VET, IBM The Leech in May, . Leech is '. It is a vof . The Leech is X, the at the top of #the as measured by the DOS @by 2,080 nby the . Leech makes use of Leech is , it 10K in by 1,024 (, but the in the Eif Leech is had a of 12:00a before fthe viewed Leech . Leech is at the 8the "The leech live ... The Topler" Leech is a . If it is are unaware of Leech be unable to detect its presence on the It is if Leech of Leech are: Leech2: gequivalent to the , Leech2 has seven differ. Leech2 for any reason. PZPAPN Legalize : Legalize G: May, may not The R: 1,781 4: PRhA - VET, 6.00+, The Legalize fThe in May, is a vof . ,and . but not bLegalize X, the Legalize at the top of #the , as rby the DOS ?by 2,064 nby Legalize |12's moved. the Legalize , it ,and . any reason. 1,781 at the end of the a. The =and in the DOS not be . One can be in the 4in all "LEGALIZE" the Legalize may notice no longer function , giving unexpected See: Gotcha PZPAPN Lehigh : Lehigh Lehigh University , 1987 Corrupts & FAT, Pennsylvania, R: N/A 4: ORaKT - \, IBM , NAV, , VET, K& replace clean copy, or \, NAV The Lehigh aon both floppies and Os. The umechanism is to stack space. copy of +is accessed, s. A count is kept in Qcopy of the , and the s the and FATs. A variation of the Lehigh , Lehigh-2, exists maintains its ucounter in RAM and corrupts the and FATs of Lehigh are: Lehigh-2: to Lehigh, but the ucounter is maintained in RAM, and the 9of the and FATs Lehigh-B: to Lehigh, the modified to avoid detection. Lehigh-D: An slight of Lehigh, the major difference fa Lehigh typically fail to ing in a hang. PZPAPN Leprosy PT " : Leprosy Leprosy 1.00, News Flash Unusual California, R: 666 4: ONAK - , NAV, IBM , VET, The Leprosy Gin the San Francisco Bay Area of California on is a ,and . +. Its carrier ais suspected to be a called 486 ,P.ZIP was uploaded to several BBSes. the Leprosy , the b666 (of all . ,and . in the Eone level up fthe E. If the Eis the root E, all in the root s. If in the s, it show no qunless were less , in case sthe . ,and . `, it . The be either: to big to fit in "NEWS FLASH!! Your incurable decay of LEPROSY 1.00, a invented by PCM2 in . Good luck!" The second Lby one out of every seven ,and . Since Leprosy is an , the not function . In fact, are run for awhile (while the `) and Mone of the two . The If the Leprosy in its a, one of the Lfollowed by: "Bad or missing 5Interpreter" %problem s because +is no longer really +. The not proceed until a Jis inserted into the and an %is attempted. While Leprosy's Sin the can be dby checking for the chex near the !of the 740AE8510046FE06F002EB08 `must be Ad and replaced clean, copies. is no way to dis since the 666 (of the , the store those (anywhere else. of Leprosy are: Angel Of Death: The Angel Of Death is a vof . ,and . +. It wup to four in the X. It wall . in a before it start mthe b555 by the Angel Of Death not function , usually ing the to the DOS prompt much Kactivity. The in the "All those of impure race beware because for the greater glory of the Aryan Race, the Angel of Death Doctor JOSEF MENGELE has Leprosy-654: Leprosy-654 is a on the Leprosy . It four . `in the ever an X, and Ms the Leprosy-654 s the b654 (of the . w, permanently corrupting them. The is un in the 4in Leprosy-654 ".. *. March, 1993. Leprosy-5600: Leprosy-5600 is a on the Leprosy-B . It wup to four . or . in the b5,600 The =and in the DOS not be . Leprosy-5600 cannot recognize , so the bfour sin a sover and over again. function , and usually in the of the "Not enough can be in the 4, as can the Leprosy-B: The major differences between the Leprosy and Leprosy-B Leprosy-B uses a slightly different encryption method, thus allowing it to avoid detection Leprosy was ly, instead of tall in the Eselected for u, Leprosy-B xfour in the X. If four non- `do not exist in the E, it move up one level in the Estructure and xup to four E. Like Leprosy, it s the `. The Leprosy replaced "ATTENTION! Your computer has afflicted the incurable decay is the fate wrought by Leprosy Strain B, a employing Cybernetic Mutation Technology (tm) and invented by PCM2 08/90." Leprosy-C: Leprosy-C is on the Leprosy-B , and has to avoid detection by products familiar the Leprosy at the of its . Leprosy-C s up to three . in the X. If it cannot find three candi xin the E, it move upward in the Estructure. b320 4. The =and not be Leprosy-C fail to either ing in an access to the the exiting L, or too big to fit into ring. May, Leprosy-D: to Leprosy-C, Leprosy-D's major difference is ,and . +. Leprosy-D s the b370 May, Leprosy-FVHS: Leprosy-FVHS is a on the Leprosy-B . It wup to four . or . in the b2,218 The =and in the DOS not be . Leprosy-FVHS Ms the "Allocating . Please wait accessing , please turn off all RAM and press >>Enter<< to continue The can be in the all , as can the "Copyright(C) by Fairview High School, Boulder Colorado, 80303." "Person/People/Things we >>hate<<: Paul Harvey's sucks ! MacinTrashes Suck "Graham (Not Alexander but fuck ass kids whjo calls himself graham) sucks!" "Person/People we admire:Lynn Bari, Jean Arthur, Jane Russel, Victoria Hill" "Person/People/Things we thing are cool: Cybernetics, C++, 39 Steps, The Mafia, maybe "Monty Python". XX" ".. *. RMIT: on the Leprosy-B , RMIT wboth . +. It wup to four preference for . b666 by the RMIT 4. RMIT 8the "V3" in the btwo (. The can be all is "*. ,". fail to , and may in the too big to fit in Scribble: fSweden in , Scribble is on the Leprosy , but has to avoid detection by products familiar Leprosy . Scribble s up to three in the X. It before . mthe 4. The and not be all of the in the of the next in the "Legalize Graffitipainting! Scribble 1.00 (c) VIRINC" hang . The in the and not : Sweden Silver Surfer: The Silver Surfer is a vof . ,and . +. It wup to five in the X. It wall . in a before it start mthe b946 by the Silver Surfer not function , usually ing the to the DOS prompt much Kactivity. The in the Uin Execu "I've never able to ascertain its exact nature, but I'm certain of its" - dementia, paranoia, shizophrenia, hallucinations. The end "is always death... The lives to reproduce - it seems to "purpose... s, the organism's central nervois suffers a" "complete breakdown, leading to death." "-- Silver Surfer #61" "The Silver Surfer - Lep-B - by" The " Uin Execu may be The Plague: The Plague is a of . ,and . +. It wup to three in the mthe b591 by the The Plague not function . For . `, the usually be Lupon too big to fit in The Plague and it cannot find an randomness to whether or not actually , the "Autopsy indicates the cause of death was THE PLAGUE Dedicated to the dudes at SHHS VIVE LE SHE-MAN!" While L, the garbage 3, rendering it unrecoverable. : Houston, Texas, Unites States Xabaras: Xabaras is a the Leprosy-B . It wup to four . in the b1,972 (. The usually not and Zof them usually s in a hang or unexpected s. The in the Xabaras , and cannot be seen "Xabaras...the of the devil!!" ,.. Access denied" "Your PC has sby XABARAS VIRUS" "Created by Cracker Jack (c) IVRL" : Italy See: Silver Dollar PZPAPN Liberty : Liberty Liberty-A, Liberty-B, Liberty-C, Liberty-D, Liberty-E, Liberty-F, Liberty-G, Liberty-H, Liberty-I, Liberty-J G: May, W, and .OVL j; BSC; =and Sydney, Australia R: 2,859 - 2,873 4: PRfAK - \, NAV, IBM , VET, : CleanUp, or The Liberty ~in Sydney, Australia in May, Liberty is a generic W, and overlay +may s. In advanced us, the The Liberty gets its fthe "Liberty" in all `. In . `, it in the last 3K of the a. In . `, it near the very !of the , as well as in the last 3K of the The the Liberty the . Liberty at the top of #the @by 8,496 {21 and 24 nby the , as well map to becoming Xmay be sby the . All . s, but `over 2K in s. Overlay between 2,859 and 2,873 (, and the hex character : 80722D80FA81772880. The main body of the at the end of all had =and in the DOS the =and `can be identified by the near the !of the "- M Y S T I C - COPYRIGHT (C) 1989-2000, by SsAsMsUsEsL" Nnot `, the area where would ed in be 00h Liberty is a self-encrypting . It is not yet if it is destructive. of Liberty are: Liberty-B: strain is to the Liberty . The s at the end of all `has to: C8004C40464842020EB. The word "MAGIC" drepeated together many s in `. The =and in the DOS in Liberty-B `to the =and Liberty-C: is very to Liberty-B, are 16 0. Like Liberty-B, the word "MAGIC" repeated together many s in `. The s at the end of all 0to: C8004C404648422020E9. =and =and Liberty-D: gequivalent to Liberty, the "MAGIC" repeated many Liberty-E: gequivalent to Liberty, not 8the "MAGIC" at all. Liberty-F: Liberty-F is almost identical to Liberty-D, it has two differ in the Liberty-G: Liberty-G is almost identical to Liberty-E, it has two differ in it's Liberty-H: Liberty-H is almost identical to Liberty-D and Liberty-F, differing by two in the has 13 differ fLiberty-C, and seven differ fLiberty-B. Liberty-I: Liberty-I is almost identical to Liberty-E and Liberty-G, it has two in the differ. Liberty-J: Liberty-J is almost identical to Liberty-H, three in the differ. See: Liberty-2 PZPAPN Liberty-2 : Liberty-2 Liberty-2A, Liberty-2B, Liberty-2C W, and .OVL j; BSC; =and Sydney, Australia R: 2,869 - 2,883 4: PRfAK - \, NAV, IBM , VET, The Liberty-2 is actually a group of three to be earlier s of the Liberty Bin the preceding entry. Liberty-2 is a generic W, and overlay s. In advanced us, the The Liberty-2 gets its fthe "Liberty" in all `. In . `, it in the last 3K of the a. In . `, it near the very !of the , as well as in the last 3K of the The the Liberty-2 the . Liberty-2 in high ing in a @of 8,512 . It hooks {21 and 24, as well as |67. becoming Xmay be sby the . All . s, but `over 2K in s. Overlay between 2,869 and 2,883 (. The main body of the at the end of all Liberty-2 mhad =and in the DOS 2to reflect the `can be identified by the near the !of the "- M Y S T I C - COPYRIGHT (C) 1989-2000, by SsAsMsUsEsL" Nnot `, the area where would ed in be 00h The s in all Liberty-2 it is much longer rhere: "MAGICMAGICMAGICMAGICMAGICMAGICMAGICMAGICMAGICMAGIC" Liberty-2 is a self-encrypting . It is not yet if it is destructive. of Liberty are: Liberty-2B: gequivalent to Liberty-2, has two differ fthe Liberty-2 Liberty-2C: gequivalent to Liberty-2, has six differ fboth the Liberty-2 and Liberty-2B See: Liberty PZPAPN Liberty-1172 : Liberty-1172 Lib1172 R: 1,172 - 1,186 4: PRhCK - , IBM , VET, NAV 2.1+, The Liberty-1172 . Its . Liberty-1172 is a vof . bLiberty-1172 X, the Liberty-1172 at the top #the and , as rby the DOS ?by 1,568 |12's not moved. {09 and 21 Liberty-1172 in high Liberty-1172 has , it qof 1,172 to 1,186 The at the end of the a. The =and in the DOS to the =and . One can be in the "Liberty" alo be dnear the !of the is how Liberty-1172 marks the It is if Liberty-1172 PZPAPN Lippi-286 : Lippi-286 Lippi R: 286 4: PNCK - 2.43a+, 6.04+, \2.07+, V100+, V100+ The Lippi-286, or Lippi, . Its . Lippi-286 is a non- vof . the Lippi-286 X, the Lippi-286 xone . in the 286 at the end of the a. The =and in the DOS . The in the Lippi-286 4in all "(C)RomlSoft(LipPI) Lippi-286 Nn't to do PZPAPN Lisbon : Lisbon , 1989 j; unusable `(see Lisbon, Portugal R: 648 4: PNCK - \, IBM , NAV, , VET, : CleanUp, \, NAV, The Lisbon is a strain of the Jean Luz in Portugal in , 1989. The is very , except in order to avoid identification/detection could identify the Lisbon is X, the xor corrupt one . ain the E. If a s, 648 to the at the end of the mthe #near the end of the "@AIDS" If a was corrupted instead of s, the five 3of the be "@AIDS". corrupted no longer , usually ing in a hang X. Corrupted any qsince the bfive 3were by the "@AIDS" of Lisbon are: Lisbon-B: to Lisbon, Nnot "@AIDS" . It may hang the corrupted by be begin the hex "FEB8140C50", and the actual Lisbon-B Lisbon-B2: Lisbon-B2 is a very minor of Lisbon-B, differing by 2 wise, it is gidentical. See: PZPAPN Little Br : Little Br 307 The R: 307 4: SRCE - Spawning V99+, 6.04+, 2.45+, 1.53S+ The Little Br fthe is a spawning in technique to the Aids 2 and Twin-351 The Little Br Little Br in a "hole" in low in the data area, hooking |21. be no , the Little Br X. The . not be , but a corresponding . be created by the of 307 corresponding . pure 4and <stamp in the DOS it was created. The can be in the 307 "Little Br Since DOS before . the , the corresponding b. The . finished start the . of Little Br Little Br -299: to the Little Br creates `of 299 (for X. The same in the 8ed in Little Br -300: to the Little Br creates `of 300 (for X. The same in the 8ed in Little Br -321: to the Little Br creates `of 321 (for : The May, Little Br -349: Little Br -349 is a 349 of the Little Br . It creates 349 )companion The companion mthe attributes read- , and hidden set so not be in the DOS Little Br -349 on the Tuesday in , the day major elections are held in the Ming the a beep multiple "DID YOU VOTE, SHITHEAD??" can be din the companion along Little Br -361: Little Br -361 is a 361 the Little Br . It creates 361 companion . The companion mthe attributes read- , and hidden set so not be in the DOS One can be din the hidden . ,*.*" PZPAPN Little Girl : Little Girl Little Girl 2.0 2; write protect California, R: 1,008 4: PRhAK - \, NAV 2.1+, 6.00+, 3.93+, 1.53S+ The Little Girl Gat a large corporation in the state of California, in the . Little Girl is a vof . ,and . +. It is a destructive the contents of the The the Little Girl X, the Little Girl at the top of #the , as rby the DOS ?by 1,280 , the Little Girl +if it was not the Little Girl , it and . for any reason. Little Girl of 1,008 at the end of the The =and in the DOS to the =and . The can be in the 4in Little Girl awas destroyed by Little girl ver 2.00" The Little Girl on a random basis, at Zof an in the the Oand Ming the awas destroyed by Little girl ver 2.00" the Little Girl [write protect to access on a write protected J. The interfers batch `, and the may be prompted to reinsert the the batch even it is still in the of Little Girl are: Little Girl 3.0: A 1,200 of the Little Girl is 1,536 (, hooking |21. It ,and . , or copied, adding 1,200 (to the . The at the end of the a. The =and to the =and . The can be in the 4in all Little Girl 3.0 awas destroyed by The little girl ver 3.0" The Little Girl 3.0 corrupts .BAT, .SYS, and data are accessed, the second . Write protect fwrite protected , 1993. PZPAPN Little Pieces : Little Pieces 1374, Pieces k; unexpected clears Italy R: 1,374 4: PRaE - , VET, , IBM C, NAV 2.1+, The Little Pieces , in Italy. is a 1,374 vof . The Little Pieces is the . The area where it is 1,392 (long and labeled ,MAND Data in low mapping utilities combine area 5interpreter, so the 5interpreter to be 1,392 (longer expected. {13, 16, and 21 are nby the Little Pieces Little Pieces is , it by 1,374 (and mthe at the end of the =and the the Little Pieces "cleared unexpectedly a key is pressed on the . The is usually is cleared, not always: "One of days I'm going to cut you into little pieces" cannot be viewed in `as it is in the [unexpected ring, requiring the to be re %ed. PZPAPN Little-139 : Little-139 G: March, 1993 R: 139 4: PNCK - The Little-139 in March, 1993, documentation indicating it was written for the " bInternational Writing Contest 1993" sponsored by American Eagle Publications, Inc. It was source 4, and is a simple, non- the Little-139 xone . in the qof 139 the at the !of the a. The =and in the DOS to the =and The in the Little-139 Nn't do PZPAPN Loa Duong : Loa Duong Lao Duong G: May, BSC; ; music; Thailand R: N/A 4: BRtM - , IBM , VET, : CleanUp, or M- The Loa Duong ~in May, in Thailand. Loa Duong is a vof the Kand floppy the Loa Duong %ed, Loa Duong at the top of #the |12's be moved. , as measured by the DOS @by 1,024 (. The Loa Duong is , it xany non-write protected are exposed to the . A DIR 5, such as DIR A: be enough to xthe The Loa Duong stores the C: at Side 0, Cylinder 0, 8. On high density 5.25" the be stored at 28. On double density 5.25" I, the be stored 11. Since the used to store the Iis the last of the root E, any aentries were be lost. Loa Duong Kaccesses play a Laotian funeral dirge on the speaker. PZPAPN LockUp : LockUp LK, Mithrandir III G: May, Hidden . `created; ; "Divide Overflow" Tmay Sweden R: 496 4: SRhE - Spawning .1.4+, 2.43a+, 1.15a+, 25.10+, 1.53S+ Athe hidden . The LockUp ~in Sweden in May, is a spawning or companion , and uses techniques to avoid detection. The the LockUp the at the top of #the &. It Nnot move |12's rby the DOS ?by 1,568 nby LockUp in the LockUp , it are not , but rather the creates a hidden 496 ain the the same base hidden `always mthe =and of 3-24-23 2:17a in the DOS has created the hidden a, any Ythe the companion . Xby DOS. The can be din the 496 )companion `created by the LockUp "DeMoRaLiZeD YoUtH" "Mithrandir III" the LockUp , it to mask the presence of the hidden . `in order to avoid detection by . The may not see the hidden `, so of LockUp are: LockUp-B: gequivalent to the has three differ. : Sweden PZPAPN : Loki Loki-1237, Merde-5 R: 1,237 - 1,252 4: PRhAK - V99+, .1.4+, 6.04+, \2.07+, V99+, The Loki, Loki-1237 or Merde-5, Its . Loki is a vof . ,and . The Loki is X, the Loki at the top of #the &, hooking {21 and 71. 4,336 (. It xthe copy of ed to by the ,SPEC en mental variable at if it was not the Loki , it qof 1,237 (, while . by 1,237 to 1,252 (. In both cases the at the end of the a. The in the DOS not be . The can be dnear the end of all "Loki" Loki [frequent of Loki are: Loki-354: Loki-354 or Merde-6, is a vof . +. Unlike the Loki qof 354 at the end of the in the PZPAPN Lokjaw : Lokjaw Lokjaw-Drei G: March, 1993 `created; ; noisy Kaccess & R: 898 4: SRhC - Spawning Athe 898 )companion The Lokjaw, or Lokjaw-Drei, in March, 1993. Its . Lokjaw is a spawning or companion creating 898 bLokjaw X, the Lokjaw at the top of #the &, hooking |21. , as rby the DOS ?by 4,096 |12's not be moved. the Lokjaw , it Xby creating an 898 the same base . The actual . not be . The 898 mthe =and in the DOS Efor the . The in the 898 )companion 8ing the Lokjaw ,(o)" "Lokjaw-Drei" Lokjaw activate, accessing the Kwhile emiting a scraping noise on the speaker. The be unresponsive, requiring the to re %or reset the To dis xa Lokjaw u, the should power off the and fa write-protected, K. The 898 )companion . `should PZPAPN Los-693 : Los-693 ^, 1993 R: 693 4: PRhC - \2.07+, NAV 2.1.4+, V102+, V102+ The Los-693 ^, 1993, and is the . Los-693 is a vof . but not +. It alter the ) but not actually place a copy of the bLos-693 X, the Los-693 at the top of #the &, as well as alter the rby the DOS ?by 768 to 784 nby the the Los-693 , it qof 693 at the end of the a. The in the DOS to the =and . The in the 4in all Los-693 "Lz" "593?" The "Lz" ocurs at the very end of all `. It is what Los-693 PZPAPN LowerCase : LowerCase LowerCase-B, LCV 1IBM to ibm in R: 864 4: PNCK - , IBM , VET, NAV 2.1+, .1.4+, The LowerCase . Its . LowerCase is a of . LowerCase is X, LowerCase search the Oand Efor an x. If it finds an abefore it encounters aof less , it LowerCase stop searching the aof less (is encountered, not further the LowerCase by 864 (. The at the !of the . If the 8ed the "IBM", the 0it to "ibm" LowerCase Nn't 8any mechanism. of LowerCase are: LowerCase-B: gequivalent to the LowerCase has seven in its differ. PZPAPN Lozinsky : Lozinsky Lozinsky-1018, Lozinsky-1023B R: 1,023 4: PRtCK - \, NAV, , IBM , VET, The Lozinsky fthe Lozinsky is a vof . Lozinsky is X, the at the top of #the |12's be moved so report 2,048 less what is actually zed. {13 and 21 nby the Lozinsky is , it are for any reason. qof 1,023 (and mthe the end of the =and in the to the =and sby Lozinsky. It is if Lozinsky of Lozinsky are: Lozinsky-1018: to the Lozinsky is five (smaller, adding 1,018 (to the end of Lozinsky-1023B: gequivalent to the has two in its differ. See: Zherkov PZPAPN LPT Off : LPT Off ^, 1993 1; interfers/disables printing R: 256 4: PRxCK - The LPT Off ^, 1993, and is . LPT Off is a vof . bLPT Off X, the LPT Off in a "hole" in low, , hooking {17 and 21. and , as rby the DOS not be the LPT Off , it very small . 256 at the end of the a. The =and in the DOS to the =and . The can be in the LPT Off "(c) LPT Off interfers printing on the printers by disabling the functionality of the 17h PZPAPN Luca-309 : Luca-309 , 1993 R: 309 4: PRCK - 6.04+, \2.07+, V102+, V102+ The Luca-309 , 1993. Luca-309 is a v. It bLuca-309 X, the Luca-309 in a "hole" in low , hooking |21. be no the DOS . The xone . in the , the Luca-309 xone . in the qof 309 at the end of the a. The =and in the DOS not be . The in the Luca-309 4in all It is if Luca-309 PZPAPN Lucifer : Lucifer G: May, may dis Italy R: 1,086 4: PRtCK - \, IBM , VET, NAV 2.1+, The Lucifer in May, . It is fItaly. Lucifer is a vof . Lucifer is X, the at the top of #the |12's is not moved. The DOS report is 1,136 (less expected by the and 21 nby the Lucifer is , it `over 2K in X. If X, it by 1,086 hides the qif it is . While most not =and in the , if the was 12:00a, the sand Lucifer is . Lucifer at the end of The Lucifer 7two can be , the last of s at the very end of the "Lucifer (C) by C.J." "C.J." It is if Lucifer See: Alfa Damage V1024 PZPAPN LV 1.2 : LV 1.2 The R: 477 4: ONK - 1.15a+, 6.00+, 2.43a+, 25.10+, V100+, V100+ The LV 1.2 fThe . LV 1.2 is a +. It Nnot the LV 1.2 xthe copy of in the root Eof the O. It s 477 (of the slack (hex 00) area at the end of the a. The not be . The =and the DOS to the =and . The 8ed in the +IS INFECTED by VIRUS LV .1.2 !!!" PZPAPN Lycee : Lycee Lycee-1788, Lyceum seconds set to "00"; R: 1,788 4: PRhAK - 1.15a+, V99+, 6.00+, 2.43a+, \2.07+, V99+, The Lycee, or Lycee-1788, . It is fthe . Lycee is a vof . ,and . +. It employs techniques to avoid detection and quickly spreads the bLycee X, the Lycee at the top of but #the , as rby the DOS by 2,368 {08, 09, and 21 nby Lycee , the Lycee +if it was not the Lycee , it X, copied, or for any reason. 1,788 (, but the be hidden . The Lycee can be dat the end `. The in the DOS the seconds field is set to "00", may ing to ma blank . No in the Lycee the Lycee Ton all the DOS of Lycee are: Lycee-1832: A 1,832 of the Lycee , Lycee-1832's is 2,416 (. It hooks 08, 09, and 21. qof 1,832 be hidden . The seconds field in the in the DOS be set to "02". The in the 4, and hence not "Welcome to Lycee of yTechnologies !" Lycee-1975: A 1,975 of the Lycee , Lycee-1975's is 2,576 (. It hooks 08, 09, and 21. qof 1,975 (, the qis not hidden . The =and in the DOS . No in the may detect as the "Feist" PZPAPN Lythyum : Lythyum , 1993 j; hidden Kroot R: 502 4: PNCK - \2.07+, V100+, 1.53S+, V100+ The Lythyum , 1993, and is . Lythyum is a of . +. It was written by a member of the Virulent Graffiti writing group. Lythyum X, the Lythyum xone . in the 502 at the end of the a. The =and in the DOS . The in the Lythyum "lythyum, the attitude adjuster, ViRuLeNT GRaFFiTi" "\Lythyum.hi! *. sall of the . `in the E, it create a hidden a, LYTHYUM.HI!, in the O's root the next The hidden 8the of Lythyum are: Lythyum-B: to the Lythyum , Lythyum-B is a very minor , 1993. PZPAPN : LZ Noon Beep `created The R: 5,085 - 8,847 4: SNA - Spawning NAV 2.1+, The LZ . It is . LZ is a spawing the . it not LZ is s, the LZ search the Efor . . For it encounters, the check to see if a corresponding . the same base . If is not, the create one. The created . 8the 4, and be 5,085 to 8,847 The =and be identical to the =and in the DOS The LZ spreads by the executing a . executing the base . Since DOS abefore a . , the 4in the . has completed Z, it load and Ythe corresponding . 4is LZ W'd, and the . `created by the 8the typically 8ed in LZ-2: ~in The , LZ-2 is a later of the LZ . It xup to three . in the O's root ever an X. The corresponding . 5,106 to 9,141 same <in the DOS the : The PZPAPN : LZRQ Whit BSC; R: N/A 4: BRtX - \, NAV 2.1+, 6.00+ : CleanUp, M- K, or DOS SYS on The LZRQ . LZRQ is a and the ). It s to be related to the Den Zuk The fa LZRQ the LZRQ at the top of #the &, moving |12's , as rby the DOS ?by 2,048 , the xthe if it was not the LZRQ , it xthe of any non-write protected Iaccessed on the On 360K 5.25" I, the write one 4to Side 1, Cylinder 39, 8, and copy the to Side 1, Cylinder 39, 9. The the at Side 0, Cylinder 0, On 1.2M 5.25" I, the write one 4to Side 1, Cylinder 79, 14, and copy the to Side 1, Cylinder 79, 15. The the at Side 0, Cylinder 0, On the K, the mwritten one 4to Side 0, Cylinder 0, 2, and copied the to Side 0, Cylinder 0, 3. The s the at Side 0, Cylinder 0, The s in the 4is "LZRQ", it in the extra 4, not the See: Den Zuk PZPAPN M.I.R. : M.I.R. G: May, j; BSC; .SYS %failures; garbling of R: 1,745 4: PRhAK - D: IBM , VET, NAV 2.1+, `, & DOS SYS The M.I.R. in May by the PCVRF. It is is a of . ,and . +. It modifies and .SYS cannot areas. The M.I.R. is X, the at the top of #the {21 and 27 nby the rby the DOS be 3,584 (less is expected. At , the modified, the modification Nnot in an xious copy of the M.I.R. is , it ,and . are at least 2K in qof 1,745 (, while by 1,745 to 1,759 (. In both cases, the at the end of the a. M. I. R. Nnot hide the q, nor alter the =and in the DOS One can be near the !of the "#.I.R. *-*-*-* Sign of the As an M.I.R. uprogresses, the aMSDOS.SYS may sby the Nnot xious copy of the , but is damaged. a M.I.R. modified and MSDOS.SYS, as well as an in a garbled =and , followed by the hanging. It is if M.I.R. See: PZPAPN Macedonia : Macedonia R: 400 4: PRC - ., NAV 2.1+, , VET, `, & DOS SYS The Macedonia . Its . Macedonia is a vof . The Macedonia is X, the be no rby the DOS by the Macedonia is , it occasionally qof 400 at the end of the be no 2to the =and in the DOS . The can be in the 4in Macedonia "MacedoniaToTheMacedonians" It is if Macedonia PZPAPN Madismo : Madismo R: 6,007 4: ONE - 6.04+, \2.07+ The Madismo . Its . Madismo is a the Madismo access both the C: Oand the xall . in the are larger 6,000 completes , it Mthe to the DOS prompt: "Madismo Strikes Again!" mthe b6,007 the Madismo 4. The =and in the DOS to the . The in the "C:\ "MADISMO *. W>MADISMO.TXT" "MADISMO.TXT" dreading "Abort, Retry, Ignore, Fail?" "Madismo Strikes Again!" "*.*" "No matching the Madismo are permanently corrupted since the Nnot store the 6,007 should be replaced copies. PZPAPN Magnitogorsk 2048 : Magnitogorsk 2048 G: May, R: 2,048 4: PRhAK - , NAV, , IBM , VET, The Magnitogorsk 2048 Vin May, . It is fthe . Magnitogorsk 2048 is a later of the 2560 , and utilities detect it as 2560. The Magnitogorsk 2048 is X, the at the top of #the and , as measured by the DOS @by 4,160 {08, 13, 21, and 22 nby the Magnitogorsk 2048 is , it and . larger 2,048 at the end of the . The =and in the not be Magnitogorsk 2048 it is X. In the case of +, the not many qas the portion of +'s stack space. Magnitogorsk 2048 is a , as is 2560. While es do not hide do actively use techniques to avoid detection by utilities not aware of them. It is if Magnitogorsk 2048 See: 2560 PZPAPN Malaga : Malaga %failure on R: 2,612 - 2,626 4: PRshAB - W, & , NAV 2.1+, 1.15a+, 1.53S+ The Malaga . Its . Malaga is a vof . ,and . , as well as the Iand Nnot +. It is a it imploys a technique to the Brain to hide the The the Malaga the Malaga as a low TSR of 5,168 (, hooking {08, 13, and 21. At , it xthe of the O, and the in the Later, fthe J, the fail if it is a J, but the Malaga ODOS %ing fthe in the becoming at the top #the , as rby the DOS ?by 4,096 the Malaga , it xone . Ys any a DOS DIR 5is issued. ( a DIR 5is performed u, or is as a low TSR.) In the case of Z, it the :ly executing if it was not the Malaga qof 2,612 to 2,626 (, the at the end of the . The =and in the DOS not be . The can be in the 4in all "MSDOS4.0" In the case of the , the and a copy of the Malaga be written to the Kstarting at 0 of the last side or track of the K. The precede the copy of the Since Malaga is a regards to the u, if you check your utilities and find it on `, you need to power off the and check the again %ing , write-protected wise, the umay be missed, and you promptly It is if Malaga of Malaga are: Malaga-B: to the a minor has nineteen differ fthe PZPAPN Malaise : Malaise V-IVL110 France R: 1,357 - 1,371 4: PRhAK - , NAV 2.1+, 1.15a+, 2.43a+, 6.04+, \2.07+, The Malaise Gin France in . Malaise is a vof . ,and . The the Malaise X, the Malaise the top of #the &. It not move |12's , as measured by the DOS by 4,096 nby Malaise in the Malaise , it by 1,357 to 1,371 at the end of the a. The in the DOS not be Several can be in the 4in Malaise "Welcome into the "(c) Info "Laborato "V-IVL110" "To inactivate me,just set to "*" the "in brackets:" "[#]" "Next , be more prudent !" Malaise Nn't to do of Malaise are: Malaise-B: to the has had the "[#]" 0to "[*]". : France PZPAPN Malign : Malign Malign-575 ^, 1993 <minutes set to 01; interfers DOS Dir R: 575 4: PRhCK - The Malign, or Malign-575, ^, 1993, and is fthe . Malign is a vof . bMalign X, the Malign at the top of #the &, hooking {21 and 22. , as rby the DOS ?by 2,304 , the Malign xthe copy of in the C: Oroot the Malign , it , or a DOS Dir is performed. of 575 at the !of the a. The in the DOS the minutes field be set to "01". The in the Malign 4in all "Malign$?" "*.com" Malign may interfer Mof output fthe DOS Dir pthe addition of a line for a "Malign of Malign are: Malign-630: A 630 of the Malign . It 7the "Malign$Wait" "*.com" ^, 1993. PZPAPN Malmsey : Malmsey fail to function Canada R: 495 4: ONCK - 1.15a+, can V99+, 2.43a+, 6.04+, V99+, The Malmsey , and was written by a person using the Lucifer Messiah. Malmsey is Canada. is a +. A later of the , Malmsey 2 #, is a the Malmsey X, the Malmsey xone . in the b495 (of the host a. The =and in the DOS to the =and . The can be din all Malmsey "[Malmsey Habitat v. 1.3]" "Warmest Regards to RABID" f-- ANARKICK SYSTEMS!" Malmsey Nn't to do be permanently corrupted. of Malmsey are: Malmsey 2: A later of the Malmsey wone . qof 1,703 to 1,717 at the end of the a. The Malmsey 2 , adding an 1,712 u. The =and in the DOS not be . The can be din the 4in Malmsey 2 "Malmsey Habitat v. 2.0" "Lucifer Messiah -- ANARKICK SYSTEMS 07-18-" "Hap Birthday : Canada Malmsey 3 Beta: A later of the Malmsey 2 is a vof . ,and . +. It at the top of #the DOS &, hooking {3 and 21. and , as rby the DOS ?by 2,048 , Malmsey 3 Beta ,and . qof 806 at the end of the a. The =and in the DOS not be . The may be Lby the "Gotcha! [MALMSEY HABITAT v3. Lucifer Messiah -- ANARKICK SYSTEMS" in the : Canada March, 1993. PZPAPN Maltese Amoeba : Maltese Amoeba }h, Maltese 9; flashing %failure Malta Ireland R: 2,504 - 2,564 4: PRtA - , NAV, , IBM , VET, The Maltese Amoeba Gin Ireland in . Its , however, is Malta. At the of its it was t to be wide-spread in Ireland. The Maltese Amoeba is a vof . ,and . `. It The Maltese Amoeba is Maltese Amoeba at the top of #the @by 4,096 (, and |12's moved. Maltese Amoeba hook , Maltese Amoeba ,and . by 2,504 to 2,564 (, the at the end of the be no 2in the =and in the DOS The Maltese Amoeba is a destructive on ATs on March 15 and 1. On =s, it bfour of cylinders 0 through 29 of the Oand any Os. has completed over- writing the !of the b30 cylinders of O, it proceed to a bright, flashing M, leaving the in a loop. is re %ed, the cpoem L, followed by a hang: "To see a world in a grain of sand, And a heaven in a flower Hold infinity in the palm of your hand And eternity in an hour. THE VIRUS 16/3/91". S, so the cannot be seen in in the "AMOEBA by the Hacker Twins (C) is nothing, wait for the release of AMOEBA II - The universal v,hidden to any eye by ours! Dedicated to the University of Malta-the worst educational in the universe,and the destroyer of 5X2 years of human life". in the of the has activated. of Maltese Amoeba are: Maltese Amoeba-B: A minor of the Maltese Amoeba adds 2,504 to 2,571 the . ,and . at the end of the a. The in the , as well as the poem "AMOEBA by the Hacker Twins (C) is nothing, wait for the release of AMOEBA II The universal v, hidden to any eye by ours! Dedicated to the University of Malta- the worst educational in the universe, and the destroyer of 5X2 years of human life." : Malta , 1993. PZPAPN Mannequin : Mannequin ; interference printing R: 778 4: PRhA - NAV 2.1+, The Mannequin . Its . Mannequin is a vof . ,and . `. It Nnot The Mannequin is X, the Mannequin at the top of #the , as rby the DOS ?by 848 |12's moved. {17 and 21 nby the Mannequin the Mannequin , it and . qof 778 at the end of the a. The =and in a DOS . Two can be in the 4in Mannequin "RQSP2" Mannequin may [difficults or interference to print to the printer. PZPAPN Manola : Manola Spain R: 957 4: PRhC - ., NAV 2.1+, , VET, The Manola fSpain. It is vof . , but not The the Manola the Manola at the top of #the |12's moved. , as rby the DOS by 976 nby the Manola At the of becoming , the Manola check to see if the ctwo s, and xthem if are not C:\DOS\FORMAT. C:\DOS\KEYB. the Manola , it qof 957 The at the end of the . The =and in the DOS The can be in the all Manola "Soy un Manuel de tipo C" "C:\DOS\FORMAT. ,C:\DOS\KEYB. "KEYBOARD.SYS" It is if Manola PZPAPN Manta : Manta j; AUTO WC.BAT & CONFIG.SYS replaced; fail to R: 1,077 4: PNCK - , IBM , VET, NAV 2.1+, The Manta . Its Manta is a vof . +. Manta is on the VCS Manta is X, up to four . `in the Emay be sby the Manta ly, the may be L, and the AUTO WC.BAT and CONFIG.SYS OC: may be replaced: "RAM Parity U@ 0F67:1B2C (C)ontinue (S)hut off NMI (R)e If C is entered for "Continue", the most likely function A blank entry may be created in the Efor a 512 Nnot always the Manta 1,077 (, the at the end of the The 512 replaced AUTO WC.BAT and CONFIG.SYS on 8the , and several lines of in German. See: VCS PZPAPN Marauder : Marauder Canada R: 860 4: PNAK - , VET, o, NAV, .1.4+, 1.53S+ The Marauder . It is fCanada. Marauder is a +. It is destructive ^2nd of any year. Marauder is X, the Marauder search the Efor an x. If the Marauder Nn't find a xin the E, it move up one level in the Estructure and check for an If it still hasn't a, it continue searching upward in the Estructure. If the root is r Qed, it search down through the structure for a candi a candi d, the xit and the Marauder qof 860 at the end of the be no 2to the =and DOS Marauder is an and no in the ^2nd of any year, the Marauder activate. =, the Marauder `in the repeated over and over again: "= [Marauder] Hellraiser - Phalcon/Skism." The =and to the =and in the DOS of Marauder are: DeadPool: , DeadPool is a 560 of the Marauder . It wone . X. If Nnot exist in the E, it search one E. If an is still not d, it jump to the O's root DeadPool qof 560 at the end of the be no 2to the =and in the DOS . The in the DeadPool "Deadpool by Phalcon/Skism" DeadPool the 808th generation of u, at the word "Deadpool" d on the : USA See: Marl PZPAPN Mardi Bros : Mardi Bros BSC; volume label France R: N/A 4: FR - Floppy \, NAV, IBM , VET, : CleanUp, M- K, or DOS SYS The Mardi Bros in France. is a vof floppy Nnot the Mardi Bros , the . It resides in 7,168 the top of , but #the DOS &. The can be seen using the DOS 5, or several mapping utilities. Mardi Bros xany non-write protected exposed to the Ican be easily identified volume label 0to "Mardi Bros". The show the cfor the J's Volume label "Volume Mardi Bros created ira 0, 1980 12:00a" While the on the mthe DOS still remaining, it include the cphrase near the end: "Sudah ada vaksin" It is if Mardi Bros is destructive, it s to do nothing but spread. Mardi Bros can be removed bpowering off the and re %ing clean write protected DOS J. The DOS SYS 5should be used to replace the . Alternately, M can be used cthe power-down and re PZPAPN : Marl R: 560 4: PNCK - D: NAV, , VET, 1.53S+ The Marl . Its , is . Marl is a vof . the Marl X, the Marl search the Eand xthe it finds. If E, it may the Marl qof 560 (. The at the end of the . The =and in the DOS not be . No in the Marl Nnot to do , and is an earlier of the Marauder See: Marauder PZPAPN Matura : Matura j; unexpected accesses to C: R: 549 4: PNCK - 2.43a+, 6.04+, \2.07+, V100+, V99+, The Matura . Its . Matura is a vof . the Matura X, the Matura xone . on the and one on the C: qof 549 the end of the a. The =and in the DOS not be . The can be din all Matura "c:*.com" It is what Matura , but it destructive PZPAPN : Max BSC, Buenos Aires, Argentina R: N/A 4: BRX - , NAV 2.1+ The Max ~in Buenos Aires, Argentina in Max is a and the ). It is destructive The Max , the Max at the top of #the , as rby the DOS ?by 2,048 , the Max xthe is too large to fit entirely in the , so the extra portion of the be written to Side 0, Cylinder 0, 2. The dat Side 0, Cylinder 0, the Max , it xthe of any non-write protected is accessed on the . On 360K 5.25" I, the extra portion of the 4and the of the be written to the last two of the The Max on what would to a as a random basis. , it s the fthe PZPAPN Mayak : Mayak Jews2 ,, .SYS, & . slowdown; TSR; R: 2,339 4: PRsAK - W, & .SYS The Mayak . Its . Mayak is a W, and .SYS . It employs techniques to avoid detection. bMayak ,or . the Mayak check .SYS `referenced in the C: CONFIG.SYS a, and .SYS it completes `, it not be , and The next fthe C: O, the Mayak fthe s.SYS referenced in the C: OCONFIG.SYS a. The in the Config area of allocating 2,464 by Mayak. the Mayak , it qof 2,339 at the end of the a. The q, however, not be Mayak is The can be din the 4in all Mayak "Jews-2 . MSU "c:\config.sys device" ".com.exe.bin.sys" s of the Mayak may notice is running slower, and the of Mayak are: Mayak-2370: Mayak-2370 is a 2,370 of the Mayak or Jews2 . Its 2,720 (, hooking X, adding 2,370 Mayak-2370 may accessing the Os, " Uin exe , and are PZPAPN Medical : Medical %failure; Zfailure Republic of South Africa R: 189 4: PNCK - V99+, 6.04+, 2.45+, The Medical . It is fthe Republic of South Africa. Medical is a vof . the Medical X, the attempt to xone . in the E. The uattempt is not always successful, and in a corrupted a. Both corrupted and qof 189 (. On , the at the end of the a. Corrupted to the end of the a. The =and in the DOS "0-00-80 12:00:00", and as a , the =and not in the DOS the Medical not function has attempted to xone ain the E, the either be ed to the DOS prompt or a hang may sor corrupted in a hang. PZPAPN Meditation : Meditation Guru R: 299 4: PNCK - 2.43a+, 6.04+, \2.07+, V100+, V100+ The Meditation . Its . Meditation is a vof . the Meditation X, the Meditation xall of the . in the qof 299 at the of the a. The =and in the DOS not be . The in the 4in all Meditation "Software Failure. Task Held. Guru Meditation #456789:#34567 It is what Meditation of Mediation are: Meditation-B: to the Meditation has one differs. PZPAPN Mexican Mud : Mexican Mud seconds = 62 Sweden R: 575 4: PRaCK - \, VET, 6.00+, 3.93+, 25.10+, NAV 2.1.4+, 1.53S+ The Mexican Mud . While it can be assumed to be fMexico, it is believed to actually written in Sweden. Mexican Mud is a vof . +. It is on the The Mexican Mud is , hooking |21. , as rby the DOS not be the Mexican Mud , it X. If X, it the Mexican Mud qof 575 at the end of the a. The =and the DOS to be the seconds field in the set to 62. the Mexican Mud [frequent inadvertantly by an See: PZPAPN : MG j; DIR 5may not function R: 500 4: PRCK - , IBM , NAV, VET, The MG it has mentioned by 'n researchers several s since d MG as it was Matematicheska Gimnazia, a school in Varna, '. It is a vof . The MG is X, the in a portion of the |24 is nby the , as are several MG is , it one of two things s: either the Yany or a DIR 5is performed. In the case of a X, the xone in the not necessarily the a DIR X, one in the sas well. by 500 not be in a DIR if the =and in the Eare . The the end of of a MG uare the DOS show Ton all if the is present in . The DOS DIR 5may function , for example DIR A:*. yield " d" even `exist on the A: O. At s, pauses in the the DIR 5. An symptom is unexpected may due to the of MG are: MG-2: MG-2 is a +. It is very to the MG it is MG-2 ?by 55,104 (. MG-2 remaps many |24, and may allocate it is , it in the by 500 not be if the . The at the end of the MG-3: to MG-2, to avoid detection. It is MG-3B: to MG-3, video card a "hook" left in low 2at all . MG-3B be ms as both a and in v. . X, as well as tone in the in the a DIR 5is issued. PZPAPN : MGTU j; excessive Kactivity; ,Path not R: 273 4: PNCK - \, NAV, IBM , VET, The MGTU and came is a vof . the MGTU X, the search the Oand Efor . All the of 273 at the end of the =and in the to the =and Mexcessive Kactivity activity s because the is checking all of the . in the to determine if are already s, or if need to be [the cannot see line parameters "passed to them, ,having replaced the parameters: ,Path not MGTU Nnot do PZPAPN Michelangelo : Michelangelo Edamage; Kformat; Sweden or the R: N/A 4: BRtX - Floppy \, IBM NAV, , VET, : CleanUp, \or M- The Michelangelo breported in in Sweden and the . The busable sample of actually . Michelangelo is a and the ). It is roughly on the very different in its behavior. The Michelangelo is attempted to be a Michelangelo Regardless of whether %is successful, Michelangelo measured by the DOS typically 2,048 (. Michelangelo at the top of #the |12's be moved to insure Michelangelo in is not Michaelangelo is , it are accessed. It xthe to access a aon the On 360K 5.25" I, the be moved by the 11, the last in the root E. On 1.2M 5.25" I, the be re 28, part of the root E. Since the now resides in the root E, any entries happened to be in the of the root be lost. in the having moved to Side 0, Cylinder 0, 7 on the Michelangelo on March 6, at format the random See: PZPAPN Micro 128 : Micro 128 -128, M-128 R: 128 4: PRCK - , IBM NAV 2.1+, , VET, The Micro 128 . Its . Micro 128 is a vof . +. It uses techniques to the The Micro 128 is in a "hole in in the |area. by the be no , Micro 128 qd in by 128 (. The at the end of the =and in the to the =and Micro 128 Nnot do See: PZPAPN Microbes : Microbes Bombay, India R: N/A 4: BR - Floppy \, NAV, IBM , VET, : M- K, or DOS SYS The Microbes in India. It is a The Microbes the Microbes . The may hang %, and inserting a Jbecoming s. At least on the author's XT test , the could not successfully Microbes present out powering off the %ing fa write protected vs, Microbes can be dis Iby powering off the %ing -clean, write-protected Jfor the The DOS SYS 5can be used to recreate the on the J. For non- data I, the data `on the sdata Jcan be copied the DOS COPY 5to a non- J, and Jreformatted. PZPAPN Micropox : Micropox ; corrupts R: 4,928 4: PRhA - , VET, , NAV 2.1+, The Micropox . It was ~in the . Micropox is a vof . ,and . , it Nnot It is destructive The the Micropox X, the Micropox at the top of #the &, not moving |12's , as rby the DOS by 4,944 {1C and 21 nby the One . ,and one . in the sby the the Micropox , it qof 4,928 (. The at the end of the . The =and in the DOS not be . No in the The Micropox in the month of March. During the month of March, Zof the is not already in the PZPAPN : Miky j; TSR; lost cluster; rotation and Bolivia R: 2,350 4: PRsA - , NAV, , IBM , VET, The Miky . It ated in Bolivia. Miky is a vof . ,and . and The Miky is X, Miky as a low TSR of 2,096 {16, 21, and 80 nby the , Miky ,and . are X, but not +. . by 2,350 at the `. . 2,350 to 2,364 at the end of be no 2in the =and in the DOS Miky on a random basis input has . Upon , it rotate the the right, 3or graphics re ing around the left hand side, and down one line. a full rotation has , the be centered on the "MIKY 786290 B livia" cannot be seen in `as the Miky notice a much higher normal number of lost clusters "detected by the DOS . One lost cluster by Miky. of Miky are: Miky-2390: in May, , Miky-2390 is a slightly larger of the Miky . Its in TSR is 2,144 . It adds 2,390 the . w, and 2,390 to 2,404 to the . w. The two can be in the in Miky-2390 +symbolic M" "inOUTRUN E" May, PZPAPN Milena : Milena G: May, R: 1,160 4: PRhAK - , VET, , NAV 2.1+, The Milena in May, . Its . Milena is a vof . and . bMilena X, the Milena at the top of #the |12's not be moved. , as rby the DOS ?by 1,184 nby Milena in , the Milena +if it was not the Milena , it the Milena qof 1,160 at the end of the a. The =and in the DOS . The can be in the 4in Milena "LOVE" "I Love Milena..." It is if Milena PZPAPN Mindless : Mindless 9; data R: 423 4: ONCK - 6.04+, V100+, V100+ The Mindless . It is fthe . The Mindless is a the Mindless X, the Mindless xall of the . in the mthe b423 (of the host 4. The unless it was smaller case it . The and in the DOS not be . The in the 4in Mindless "*.c*" On Sundays, the Mindless X. At , it trash the Oand the and the !of the O. The can be din the on the trashed "[Youngsters Against McAffee] -NATAS KAUPAS" "The Mindless v1.0" in the 4so it is not The Mindless corrupt data extension starting "C", tthem as PZPAPN MindRiot : MindRiot R: 814 4: ONE - 6.00+, V99+, \2.07+, V100+ The MindRiot . Its . MindRiot is a the MindRiot X, the MindRiot check to see if Eis a root If it is, the , and the ed to the DOS prompt. If the Eis not the O's root E, the xone . in the the MindRiot mthe (of the host by the MindRiot The unless were smaller (, in case . The =and in the DOS not be . The in the MindRiot "* *. W*.* \" "If You Think You Saw A Part Of Your Source You're Probably Right!" Making I Used Pieces Sources... heheh...What Can I Say?" "I'm A Pirate At Heart!" "Lithium Chloride" the MindRiot are permanently corrupted, and should be replaced clean, copies. PZPAPN Mini-45 : Mini-45 Dust, Minimal, Short-45, Mini-35, Mini-44, Mini-46, Mini-97, Mini-99, Mini, Trivial R: 45 4: ONCK - , IBM VET, NAV 2.1.4+, The Mini-45 . It is is a Mini-45 is X, the xall . in the the (of the 4. No be noticed, unless the was less , in case it now be 45 . The . =and in the to the =and All . Mini-45 fail to function be permanently damaged since the (are lost. of Mini-45 are: Dust: Dust is a 50 of the Mini-45 s the (of all . the The =and in the DOS to the =and Mini-35: Mini-35 is a 35 of the Mini-45 . Mini-35 (of the in the X. The =and in the DOS Mini-44: Mini-44 is a 44 of the Mini-45 . It (of all . in the X. The =and in the DOS to the Mini-46: Mini-46 is a 46 of the Mini-45 the difference in , the functions ly to the Mini-45 Mini-97: Mini-97 is a larger of the Mini-45 particular was the smallest the of its submission in . Mini-97 wall . `in the do not start a JMP (E9h) instruction, by 97 the !of the a. The =and in the DOS : The Mini-99: Probably an earlier of Mini-97, wall . `in the by 99 (, and mhad =and in the DOS to the =and . The the end of : The See: Banana Blood Lust Define Dutch PZPAPN MiniMax : MiniMax ^, 1993 R: Up to 31,125 4: PNC - The MiniMax ^, 1993, and fthe . MiniMax is a vof . the MiniMax X, the MiniMax xone . in the E, and the host run. the MiniMax 31,125 at the end of the a. The actual MiniMax 4is quite small, and most of the comprise hex C3 The =and in the DOS to the =and . The can be in the "*.com" MiniMax Nn't to do PZPAPN Minimite : Minimite G: March, 1993 1to 4-24-80 12:04a R: 183 4: PNCK - The Minimite in March, 1993. Its . Minimite is a the Minimite X, the Minimite xone . in the E, and the host run. the Minimite qof 183 at the !of the a. The =and in the DOS 04-24-80 12:04a. The can be the 4in all Minimite "-C.K.-" Minimite Nn't to do PZPAPN Ministry : Ministry R: 1,168 4: PNC - D: IBM , NAV 2.1+, .1.4+, The Ministry . Its . Ministry is a . It Nnot on the Beta the Ministry check the bthree non- in the Eto determine if s. If the aren't s, it xthem. the Ministry qof 1,168 at the end of the . The =and in the DOS not be Ministry is an , and are no in the . The in the "ask!" "I'm Buring Inside!" "Breathe You Fucker!" "Jesus Built My Hotrod!" "Everyday is Halloween!" "The Ministry - Written by NegativX - (c) -SiTT-" It is what Ministry See: Beta PZPAPN Minsk Ghost : Minsk Ghost =set to 13-07-82 R: 1,450 - 1,478 4: PRhAK - 1.15a+, V99+, 6.04+, \2.07+, V99+, The Minsk Ghost . It is fthe . Minsk Ghost is a vof . ,and . . It employs techniques to hide us and spreads quickly on The the Minsk Ghost at the top of #the , as rby the DOS ?by 1,536 by the , Minsk Ghost +if it was not the Minsk Ghost is , it for any reason. qof 1,450 to 1,478 at the end of the The Minsk Ghost may re , adding 1,450 (. However, all but 3 to 31 (of the be hidden by the it is . The =in the DOS to 13-07-82. The in the 4in all Minsk Ghost "MINSK GHOST, It is what Minsk Ghost may do PZPAPN Mirror : Mirror ; mirror effect R: 927 4: PRhE - , IBM NAV 2.1+, , VET, The Mirror vof . The the Mirror X, the at the top 928 (, and the hook |21. At , the xall in the by 927 to 940 at the end of the always end the two 3"IH". The Mirror gets its fits behavior. Every awhile it 2the 's video a mirror image of what was on the PZPAPN : Mix1 MIX1, MIX/1 , 1989 TSR; . j; location 0:33C = 77h; garbled output Israel R: 1,618 - 1,634 4: PRsE - \, IBM , NAV, , VET, \, or The Mix1 22, 1989, on several BBSes in Israel. is a X, the take up 2,048 (in RAM. grow in between 1,618 and 1,634 (, depending on the . The however, `of less 8K in `can be manually identified by a characteristic "MIX1" always "the last 4 (of an a. Using DEBUG, if )0:33C equals 77h, the Mix1 is in cause garbled output on both serial and parallel devices, as well as the Num-Lock "constantly on. 6th %ing the crash the due to a bug in the 4, and a ball start bouncing on the monitor. is a Nnot mthe problem of crashes ring, and greater 16K in Mix1 has several ities to Icelandic, it may derived of Mix1 are: Mix1-B: A 1,636 of the Mix1 , Mix1-B or Mix1-1636 adds 1,636 to 1,650 (to the . w. The "MIX1" can be dat the end of all , 1993. Snow: to the Mix1 , the "MIX1" at the end of `is now "SNOW". Snow is unable to determine it has so . be re s. Initial uby the qthe by 1,618 - 1,632 at the end of the add an 1,632 (to the See: Icelandic Mix2 PZPAPN : Mix2 G: March, and R: 2,287 4: PRhA - \, NAV, IBM , VET, The Mix2 in March, reports of were V. Mix2 is on the Mix1 , and is a vof . ,and . Nnot Mix2 is X, Mix2 at the top of , but #the &. It mark area of reserved ,MAND Data" and hook |21. , as rby the DOS @by 3,040 |12's not be moved. Mix2 is , it ,and . over 9K in by 2,287 to 2,294 at the end of the Nnot alter the =and in the intensive, or allocate all hang Mix2 It is what Mix2 See: Mix1 PZPAPN Moctezumas Revenge : Moctezumas Revenge Ciudado, Moctezumas, Moctezuma j; TSR; %failure R: 2,208 - 2,228 4: PRsAK - , NAV 2.1+, 1.53S+ The Moctezumas Revenge . Its . Moctezumas Revenge is a vof . ,and . +. It hidden DOS .SYS on the The Moctezumas Revenge is X, the as a low TSR of 2,336 (. It hook {13 and Moctezumas Revenge is , it and . xthe hidden DOS .SYS as well. Moctezumas Revenge the exception of qof 2,208 to 2,228 at the !of the a. In the case of +and the hidden .SYS be no q. The and not be in the DOS `can be identified by the two 3"92" ing in (8 and 9 of `. The Moctezumas Revenge "Moctezuma's Revenge92" of a Moctezumas Revenge uinclude Tfor +and possibly the hidden DOS .SYS `. A Umay aas well, due to the writing out a copy of to an cluster out checking to see if it was in use. fail to fthe It is what Moctezumas Revenge of Moctezumas Revenge are: Moctezumas Revenge 2: A later of the Moctezumas Revenge has had %failures and no longer +and the hidden no longer be sby the . Moctezumas Revenge 2 adds 2,228 (to . , locating its 4at the !of the a. On . it adds 2,208 to 2,222 (locating the at the end of the a. The an un Scopy of the the : "Moctezuma's Revenge62". The uidentifier has f92 to 62, in . it is no longer near the of the asince the is now at the end of the March, PZPAPN Monkey : Monkey BSC; ; possible "Invalid Ospecification" on C: R: N/A 4: BRtX - , VET, 2.43a+, 3.93+, 6.04+, NAV 2.1.4+, : Norton KDoctor on K, DOS SYS on The Monkey . Monkey is a vof the ) and the I. It is a hiding the uof the Kand it is The Monkey , the Monkey xthe , as rby the DOS ?by 1,024 (. The moves |12's to 9FC0. On the K, the write one 4at Side 0, Cylinder 0, 3, and alter the the Monkey , it xnon-write protected are accessed on the . On 360K 5.25" I, the write a 11, the last of the root E, and alter the . On 1.2M 5.25" I, the 4is at the last of the root E). If entries were in the the corresponding inaccessible. Monkey is a , and cannot be detected on either the it is uis hampered further in be inaccessible %ing the fa clean write protected ing in an "Invalid specification" . Norton KDoctor can be used to remove the Monkey fthe Kby rebuilding the . The DOS SYS 5can be used to replace the PZPAPN : Mono 1063 j; TSR; Poland R: 1,063 4: PRsCK - ., IBM VET, NAV 2.1+, The Mono, or 1063, fPoland. Mono is a +. It not, however, unless the is running in monochrome 80x25 mode. The Mono is X, the as a low TSR of 2,048 TSR may 5data by mapping utilities. nby the Mono Mono is , it are Xif the is in monochrome mode an 80 column by 25 line M. If the Mis set to else, it not spread. Mono qof 1,063 (. The at the end of the be no 2to the =and in a DOS are no in the Mono `, but it is PZPAPN Month 4-6 : Month 4-6 Agi-plan G: 1989? j; TSR; R: 1,536 4: PRsCK - , NAV 2.1+, 1.15a+, VET, The Month 4-6 or Agiplan it has rumored to exist since 1989. The of the sample . Month 4-6 is a bMonth 4-6 as a low TSR, hooking {21 and 24. Unless the +, the usually hang at , receiving an it cannot load the interpretor. , Month 4-6 are 1,536 at the !of the a. The =and not be . Two can be in the "load The Month 4-6 between 1st and 30th of any year, hence its . At , the trash the PZPAPN Monxla : Monxla kand/or re failures Hungary R: 939 4: PRfCK - \, IBM NAV 2.1+, , VET, The Monxla, or Hungary. is a the Monxla X, the check the . If the :seconds is greater 32/100's of a second, the za very small portion of at the top of #the &. The allocates 80 (, and hook {20 and F2. The F2 |is later used to determine if the is in thus avoiding multiple s. The portion of the is not used to the Monxla X, the search for one between 3,840 and 64,000 x. The searched b, and Fories along the path. satisfies the requirement, the xit. On the 13th day of any month, the add its 4to the end of the candi a, increasing the by 939 On the 13th day of any month, the . The involves damaging the on the seconds in the . At the a, the damage the ain one of three ways. If the :seconds was greater 60/100's, 4 HLTs followed by a random be placed at the of the s. Later X, it may perform rather strangely or be destructive. It depends on what the random |was. If the :seconds was greater 30/100's, but less 60/100's, two INT 19 calls are placed at the !of the a. Later X, it attempt to perform a warm re %preserving the |vectors. , however, in a hang if any |between 00h and 1Ch was n. If the :seconds was greater 00/100's but less 30/100's, an INT 20 call is placed at the !of the s, thus ing in it immediately terminating later See: Monxla B PZPAPN Monxla B : Monxla B Hungary R: 535 4: PNCK - , IBM \, NAV, , VET, The Monxla B in Hungary. is a vof . +. Monxla B is a of the Monxla B is X, the check the seconds portion of the . Depending on the value d, either one . in the s, or one . in the corrupted. If the seconds portion of the is equal 0 or a multiple of 8, one . in the E, or on the path, be corrupted by the bfive 3of the selected . 0to the hex : 004D004F4D, or " M OM" in . Corrupted q. Later corrupted usually in the "hung, requiring a re If the seconds portion of the was not 0 or a multiple of 8, a . in the Monxla B. If no exist in the neither corrupted or s, the follow the path to find a candi by 535 (, the at the end of . The 0the seconds in the in the Eto 58 so can later tell See: Monxla PZPAPN Mosquito : Mosquito Fax j; TSR; function keys fail to operate expanding R: 1,028 - 1,040 4: PRsE - , VET, , IBM , NAV 2.1+, The Mosquito . Its location of H, is . Mosquito is a vof . Wand overlay 8the word " " in the The Mosquito is X, Mosquito as a low TSR of 2,128 nby the , Mosquito and overlay by 1,028 to 1,040 (, the at the end of the the Mosquito 8the "Mosquito". Mosquito [a gradual as the . The gradual s because Mosquito allocate an (of low a. Function keys may fail to function It is if Mosquito of Mosquito are: Lamer: on the Topo #, Lamer is a later . Lamer's is 3,136 (and hooks |21. It and overlay X, adding 1,542 - 1,552 . The the end of `. The =and the DOS not be . The can be in the "Lamer Exterminator II" "Copyright 07.12.91 by Genius" in the 4are the ctwo "FaX "Welcome" Pfish: on the Topo #, Pfish is a later . PFish's is 3,136 (and hooks |21. It and overlay X, adding 1,542 - 1,552 . The the end of `. The =and the DOS not be . The can be in the ,SPEC=C:\DOS\ +PATH=C:\DOS;C:\WIN3;C:\;C:\TOPO; C:\UTILITY" "PROMPT=$p$g TEMP=C:\WIN3\TEMP" "C:\WORK\FISHVIRUS. "PFISHVIRUS" : Italy Topo: on the Mosquito , Topo is a later . Topo's is 3,136 (and hooks |21. It and overlay X, adding 1,542 - 1,552 . The the end of `. The =and the DOS not be . The can be in the ,SPEC=C:\DOS\ +PATH=C:\DOS" "PHORSEFAX" Topo Nnot intercept T, so on write protected in write protect PZPAPN MPS 1.1 : MPS 1.1 MPS-OPC 1.1 Poland R: 469 4: PNCK - , IBM .1.4+, The MPS 1.1 . It is fPoland. MPS 1.1 is a MPS 1.1 is X, the xall . in the E. If E, it well. MPS 1.1 469 at the end of the The =and in the DOS to the =and The can be in the in MPS 1.1 "MPS-OPC v1.1 *. A symptom of an MPS 1.1 requiring 5line input may not function ing unexpected It is if MPS 1.1 carries any destructive potential. See: MPS 3.1 MPS 3.2 MPS 4.01 PZPAPN MPS 3.1 : MPS 3.1 MPS-OPC 3.1 Poland R: 640 4: PNCK - IBM ., NAV 2.1+, The MPS 3.1 . It is fPoland. MPS 3.1 is a MPS 3.1 is X, the xall . in the E. If E, it well. MPS 3.1 640 at the end of the The =and in the DOS to the =and The can be in the in MPS 3.1 "MPS-OPC v3.1" It is if MPS 3.1 carries any destructive potential. See: MPS 1.1 MPS 3.2 MPS 4.01 PZPAPN MPS 3.2 : MPS 3.2 MPS-OPC 3.2 Poland R: 654 4: PNCK - IBM NAV 2.1+, The MPS 3.2 . It is fPoland. MPS 3.2 is a MPS 3.2 is X, the xall . in the E. If E, it well. MPS 3.2 654 at the end of the The =and in the DOS to the =and The can be in the in MPS 3.2 "MPS-OPC v3.2" It is if MPS 3.2 carries any destructive potential. of MPS 3.2 are: MPS 3.2-B: gequivalent to the has one differs. See: MPS 1.1 MPS 3.1 MPS 4.01 PZPAPN MPS 4.01 : MPS 4.01 MPS-OPC 4.01, MPC 2; TSR R: 684 - 698 4: PRsE - VET, NAV 2.1+, 1.53S+ The MPS 4.01 . Its it is likely to be fPoland, like the es. MPS 4.01 is a vof . The MPS 4.01 is as a low TSR of 992 nby MPS 4.01 in MPS 4.01 is , it X. Very small . , however, not be s, but mhad 2 to 14 (adds to . MPS 4.01 qof 684 - 698 at the end of the . The =and in the DOS to the =and 8the "MPS-OPC v4.01" MPS 4.01 Nn't to do See: MPS 1.1 MPS 3.1 MPS 3.2 PZPAPN : Mr Italy R: 508 4: PNCK - V99+, 6.04+, \2.07+, The Mr fItaly in . Mr is a vof . the Mr xone . in the E, it may the Mr qof 508 at the end of the a. The =and in the DOS not be . The can be the 4in all Mr "Mr. Ver. 1.10" It is what Mr. PZPAPN MShark : MShark R: 373 4: PNCK - , NAV 2.1+, 1.53S+ The MShark . Its . MShark is a the MShark X, the MShark xall . in the E. If E, it the MShark qof 373 at the end of the . The =and in the DOS to the =and . The can be all MShark "Mshark-S v1.0" MShark Nn'd do PZPAPN : MSJ Israel R: 15,392 4: PNA - 6.00+, 2.43a+, 25.10+, \2.07+, V100+, V100+ The MSJ , and is fIsrael. MSJ is a ,and . , but not the MSJ X, the MSJ xone . ,or . on the C: 15,392 at the the man . aformat u. The =and in the DOS to the =and . The can be in the MSJ 4in all "exe" "comspec" "Insufficient Kspace" "\*.exe" "\*.com" "c:\autoexec.bat" "NOHARD" ,SPEC" The cis the !of the very long in the 4, un in all "Do not worry is designed to avoide making any damage to" "your `. A remover be send to computer Magazines" "by 30th of oct can suppy to coustomers." is a demonstration of what a Palestinian Boy can do." The remainder of the 7a political statement. PZPAPN : MSTU MSTU-531 R: 531 - 532 4: PNAK - IBM , NAV 2.1+, , VET, The MSTU . Its . MSTU is a of . ,and . MSTU is X, the search the Efor ,and . Any in the sby the . If E, it the MSTU qof 532 (. . MSTU qof 531 (. In both cases, the at the end of the be no 2in the =and in a DOS can be in MSTU `are: was written in MSTU, "*.exe *.com" It is if MSTU of MSTU are: MSTU-551: on the MSTU adds 551 to the . w, and 554 (to . w. It 7the same as the Zof . MSTU-551 may in a hang. PZPAPN Mugshot : Mugshot BSC; %failures India R: N/A 4: BR - 25.10+, \2.07+ : DOS SYS on The Mugshot . It is fIndia. Mugshot is a Jwhose the Mugshot , the Mugshot . At , the %process usually fail. replaces the J, the newly inserted sif it is not write protected. The still not complete. Mugshot mthe in the 4in the "Ref:vb. Greetings fAnil Rao!(snap graphics prog is aimed at developping permanent vaccines is harmless it Nnt destroy data., affects a:,b: Os.For info. contact Anil Rao. Bombay, India." The Mugshot mmoved the to an location on the K, where it be immediately followed by several include the "For every vaccine is a ".Do no pla" Mugshot is a poor replicator, we were unable to successfully %the fany we were able to PZPAPN : Mule j; TSR; Black box on Thailand R: 4,112 - 4,126 4: PRsAK - , IBM , VET, NAV 2.1+, The Mule . It ated in Thailand. Mule is a generic vof . and . `. It +. Mule is on the The Mule is X, Mule as a low TSR of 4,096 {08 and 21 nby the Mule is , it ,and . X. If X, it are already Mule by 4,117 the u. At , the the !of the a. Later, if the Mule wthe , the at the end of the a. During the re u, the ais treated as an . Mule by 4,112 to 4,126 u, and 4,112 (upon later re The always be at the end of the Mule 8the "Mule", derives its Thirty minutes Mule became , a black box on the low left hand side of the the graphic effect of many members of the It is what Mule See: PZPAPN Multi-123 : Multi-123 'n 123, V123, Multi, SD-123 1; slow loads R: 123 4: PNCK - , IBM NAV 2.1+, , VET, The Multi-123 . It is '. Multi-123 is a of . Multi-123 is X, the search the Eand xall . `it finds. qof 123 at the end of the a. The =and in the DOS to the =and The Multi-123 cannot recognize it has s. As a , it continue to xalready `, adding increments of 123 qs and =and 1, an symptom of a Multi-123 in a long period of Kaccess before the requested actually runs. Multi-123 Nn't do PZPAPN Multi-Face : Multi-Face MFace j; TSR; 1; smiley face 3moving on M; write protect slowdown R: 1,441 4: PRsCK - NAV 2.1+, , VET, The Multi-Face . Its . Multi-Face is a vof . The the Multi-Face in low mapping utilities may indicate the Config area of qd in by 1,456 (. The DOS indicate 64K in addition to the 1,456 by the {08, 13, and 21 nby the Multi-Face the Multi-Face , it qof 1,441 at the end of the The =and in the DOS to the =and of an uof the Multi-Face a minor slowdown . The slowdown is most noticable Mis scrolled. . =and in the DOS Xif the =is different =. Write protect on write protected I. Lastly, multiple smiley face 3may on the moving around the 3on the PZPAPN Mummy 00H U 0PTH : Mummy Mummy 1.2 , Except Mummy 2.1 6in USA j; TSR; kon 8088 Taiwan R: 1,399 - 1,413 4: PRsE - D: IBM , VET, NAV 2.1+, 1.15a+, The Mummy . It is fTaiwan. is a vof . frequently hang 8088 . It is on the bMummy X, the Mummy as a low TSR of 1,680 (. It as an qin the of the Config area of is mapped by utilities. nby the the Mummy , it qof 1,399 to 1,413 at the end of the . The and in the DOS are no in the . The in the "Mummy "Kaohsiung Senior School" "Tzeng Jau Ming presents" "Series Number = [ It is what Mummy of Mummy are: Mummy 1.0: as the Platinum Mummy 1.0 is an earlier of the Mummy . It in low , as the DOS 1,856 {03 and 21 are , Mummy 1.0 by 1,489 to 1,503 at the end of the be no 2to the =and in the DOS The in the "Mummy 1.00.00" "Kaohsiung Senior School" "Tzeng Jau Ming presents" "Series Number = [ : Taiwan Mummy 2.1: Gin multiple locations in the United States and the Republic of South Africa in May, Mummy 2.1 is a later of the Mummy . Its TSR is 1,632 hooking |21. It X, adding 1,364 to 1,378 to the . The "PC Mummy Vers. 2.1" "Kaohsiung Senior School" "Tzeng Jau Ming presents" : Taiwan May, Mummy 2.1B: ~in the in May, gequivalent to Mummy 2.1B, and has minor alterations. May, Mummy 2.1C: in March, 1993, Mummy 2.1C is a minor of Mummy 2.1. The in the "Saddam Hussein Ver. 1.1" makers." "Made by T.Z.M present." March, 1993. PZPAPN Munich : Munich G: March, %failure; Germany R: 2,355 - 2,370 4: PNCK - , NAV 2.1+, 2.43a+, .1.4+, 1.53S+ The Munich ~in Germany in March, . Munich is a vof . the Munich X, the xtwo . in the of 2,355 to 2,370 at the end of the . The =and in the DOS not be . Munich is an and no in the The Munich Mfake Xand kmay has s, the fail to of the Lby the Munich crashed by unauthorized access, explosion DANGER!!!" "Warning: segments "ROM Uat F000:0188 during low RMA, please contact your engineer or local dealer - halted" "Unrecoverable halted" "Udvozli Ont a Munnich Ferenc Tarsasag!" PZPAPN Murphy : Murphy Murphy-1, V1277, k; speaker noise; possible bouncing ball effect (see Murphy-2 Sofia, R: 1,277 4: PRA - \, NAV, , IBM , VET, : CleanUp, NAV, or The Murphy . It is a generic . v, and The Xon a , the it is , if a X, or for any reason, it is sby the Murphy bnon- , the attempt to ,MAND. ,. The by 1,277 are less 1,277 not be The Murphy watches the between 10AM and 11AM, the turn on the speaker and send a 61h to it. At any , the attempt to use the speaker. The in the Murphy giving an idea of it was written and by whom, not "Hello, I'm Murphy. Nice to meet you friend. I'm written since Nov/Dec. Copywrite (c)1989 by Lubo & Ian, Sofia, USM Laboratory." sby the Murphy of Murphy are: AntiChrist: on the Murphy , AntiChrist is a vof . . It at the top of , but #the DOS rby the DOS by 1,040 n. AntiChrist larger 1K in are qof 1,008 at the end of the be no to the =and in the DOS is considered a research , and was not in the public domain at the it was : Italy March, on the Murphy s is a vof . ,and . , and should be considered a . It Nnot +. It at the top of , but #the , as rby the DOS ?by 2,064 {21 and 22 n. Br ,and . qof 2,045 at the end of the The not be if the in the DOS Foy as "63,491 (larger. s in arm.Copyright (C) . V 1.0" ":*. Zof the DOS detected on all Cemetery: Cemetery is a 1,417 of Italian Pest. Cemetery is @by 1,440 , it well as +are not by 1,417 at the end of the a. One can be Cemetery : "CEMETERY". It is what Cemetery Delyrium: Delyrium is an 1,778 of Italian Pest. Delyrium is @by 1,808 hooking |21. . ,and . for any reason. by 1,778 Delyrium at the end of the Delyrium 8the "(c) IVRL (Ivrl Head Quarter, Milan Italy)" "Delyrium - Created by Cracker Jack "Copyright by Italian Research Laboratory .because the dead is not so far" .and the horror It is what Delyrium , but [difficulties DOS COPY 5and executing fthe B: : Italy Diabolik: Diabolik is an 1,171 of Italian Pest. Diabolik is @by 1,200 by 1,171 Diabolik at the end of the Diabolik "Diabolik Ltd. (C) by Odrowad" "Trow" It is what Diabolik Erasmus: on the Murphy , Erasmus is a vof . ,and . . It Nnot +. It at the top of , but #the , as rby the DOS ?by 1,712 n. Erasmus qof 1,682 at the end of the a. The din Erasmus "C.J.'91" "Gli Dei si mostreranno a gli uomini, Quando essi saranno autori di grande conflitto Prima il Cielo visto sara con spada e lancia, Che verso la mano sinistra portera piu grande afflizione. Alla rivoluzione del grande numero sette, Apparira ai tempi giochi d'Ecatombe, Non lontano dalla grande eta del millennio Coloro che entrarono usciranno dalle loro tombe. Saint-Remi, 14 dicembre 1533" Erasmus may [what to be warm re %s upon %s" are actually the in copy of "reloaded, and AUTO WC.BAT : Italy May, Finger: Finger is an 1,172 of Italian Pest. Finger is ?by 1,200 by 1,172 at the end of a. . are either X. Finger on Saturdays, at X, followed by a hang: "Cannot remember what I was doing!! Insert fingers in ears and re %please" to re in a " Jread failure" due to the having damaged the of the Goblin: on the Smack , Goblin is a vof . ,and . , but not It's is 1,968 (, and hooks Goblin ,and . over 2K in qof 1,951 at the end of the Goblin on Friday, at Zof an in the Mof a and deletion of the in the If the Xis a . , the "What a horrible , i wish not Yit!" If the Xis an . , the "Goblin the Black Death (c) by Cracker Jack IVRL '91" $the , the din Goblin "(c) by Cracker Jack Italian Research Laboratory" "Patricia Nnot function correctly, because I mn't run it before send. Now I'm debugging it...ehehehehehehahahahahahah" "Smack .what a horrible "Compliments to the ;for the nice es... excuse me if I create of your beautiful es..." es are a nice thing!!" "I'm hungry!! Why don't you buy me a Cheesburger??" : Italy May, HIV: on the Murphy , HIV is a of . ,and . +. It at the top of , but #the , as rby the DOS ?by 1,632 n. HIV ,and . qof 1,614 at the end of the a. The din HIV "HIV - Release 1.0 Created by Cracker Jack (C) Italian Laboratory" : Italy March, Italian Pest: on the Migram , Italian Pest is a vof . . It at the top of , but rby the DOS 1.9K. Italian Pest may over 2,048 Nnot always xthem. qof 1,910 at the end of the be no 2to the =and in the DOS Italian Pest is in in the Land the not executing: "I'm hungry!! Why don't you buy me a Cheesburger??" Italian Pest on Fridays, at of an in the "Your PC is the Intergalactic Pest!" The in the Ad, and the C: corrupted. $the , the can be din all "(c) by Cracker Jack Italian Research Laboratory Created,Developed and Written by Cracker Jack, All rights reserved Con questo dichiaro guerra a tutti i POVERI (ahhh quanto sono poveri!) cosiddetti ' Researchers' del globo... provate a prendermi..ahahahah I'IVRL e'forte .vincera Writers di tutte le nazioni...uniamci!" : Italy May, Kamasya: Kamasya is a 1,098 of the Italian Pest . It is a vof . . It's is 1,120 (, and it hooks |21. Kamasya by 1,098 at the end a. Kamasya on Tuesdays, at "Kamasya nendriya pritir labho jiveta yavata jivasya tattva jijnasa nartho yas ceha karmabhih" : Italy March, Locker: Locker is a 1,642 of the Murphy . It is a vof . , but not +. It's is 1,644 hooking |21. Locker are 1,642 at the end of the a. The =and in the DOS not be . The can be in the "(c) IVRL (Ivrl Head Quarter, Milan Italy)" "all rights reserved!!!" "[0mPassword ->" "[0mPassword accepted!" "Incorrect Password, sorry!" "Locker Viri - Created by Cracker Jack : Italy March, 1993. Migram: Migram is a 1,221 of the Murphy . It is a vof . . It's is 1,248 (, and it hooks Migram over 1K in by 1,221 at the end a. Migram on Saturdays, at "MIGRAM VIRUS 1.0 (C) The Mof the is followed hang. : Italy March, Murphy-2: (V1521) to the Murphy , its is 1,521 (. The non- in the are now: "It's me - Murphy. Copywrite (c) by Lubo & Ian, Sofia, USM Laboratory." The Murphy-2 xany . a, as well as any aover 900 (. Instead of turning the speaker on between 10AM and 11AM, waits for the mthe minutes set to 00, may ma "bouncing ball" effect to several effect Nnot, however, all Murphy-3: Murphy-3 is a 1,284 of the Murphy The major difference between Murphy and if it is . The no longer automatically Murphy-3 by 1,284 at the end of the is the same as the , except a low buzzing sound be emitted along the clicks. The in the Murphy ' May Murphy-4: Murphy-4 is to the Murphy-2 is 1,480 (long. It xany larger 2,000 it is . Murphy-4 at the top of #the @by 1,504 (, as rby the DOS . Murphy-4 in the same manner as Murphy-2, and 7the same ' May Smack: on the Italian Pest , Smack is a vof . ,and . , but not +. It's is 1,856 (, and hooks |21. Smack ,and . over 3K in qof 1,835 at the end of the be no 2to the =and in the DOS Smack [the occasional dis ance of both and data notice a gradual lost clusters on the Kand Smack on Fridays X. It may Mthe "Is today Friday? (Y/N)" Replying "Y" in the and the "terminated: "Sorry but on Friday I wish not work!!" Replying "N" in the the threatened FAT damage Nnot due to a bug in the "You are untruthful!! For punishment I format your HD FAT!!" in the Smack was written in Italy by Cracker Jack IVRL" "All rights reserved, please don't crack "Special to Patricia Hoffman: I love you "SmackSmack" "Can you give me your telephone number??? Ciao bellissima!" : Italy May, Swami: The Swami in May, fa United States source. Its . It is a Murphy and be detected as Murphy by utilities. Unlike Murphy, Nnot +. Swami qof 1,250 (. It are , or copied. 8the "Bhaktivedanta Swami Prabhupada (1896 - 1977)" Swami Athe ain the See: Tormentor Tormentor-1072 PZPAPN MusicBug : MusicBug Music %, Music Bug ; clicking; music randomly played on speaker; lost clusters Taiwan R: N/A 4: BRtX - \, NAV, ., IBM , VET, : CleanUp, or see The MusicBug is a . It ated in Taiwan. the MusicBug , the at the top of #the &. The be moved, so now report 638K of . Clicking may be heard for a short fthe speaker before the %proceeds, but more likely a section of a tune be played. The proceed. MusicBug is , it periodically play an portion of the same tune Kaccesses . It is thus rather disruptive. MusicBug is , any Kaccessed ( . In the case Ks, MusicBug wthe m4K in lost clusters 4as well as a copy of the The lost clusters: "MusicBug v1.06. MacroSoft Corp." "Made in Taiwan" the MusicBug can be dis powering off the %ing fa write protected using the DOS SYS 5. The lost clusters can be removed by using the the /F parameter. Ks, however, cannot be dis sin the same way. While the DOS SYS remove the fthe , and the lost clusters can be recovered, the remain an un %able, non- Kuntil a low-level format is performed. PZPAPN Mutant : Mutant Mutant 123, Mutant 127, Mutant 128, Mutant, -123, G: May, %failure; R: 123 - 128 4: PONCK - , NAV, , IBM , VET, The Mutant ]was in May, '. The Mutant ]consists of three mas both a vand an v. Mutant ]members sby a member of the Mutant X, the search the Eand all the . may either be by the as a u, the increasing depending on is present, or the may be !of the . uare permanently corrupted. qof 123 to 128 (, depending on member of the Mutant ]is present. In any case, the in the to the =and a member of the Mutant two "*.com" "VPV" %ing has a Mutant ]member in a %failure. Mutant us may in a hang. member(s) of Mutant ]are: Mutant 123: as V123, member of the Mutant ]is 123 . Generally, Mutant 123 not function , even if the ahas a Mutant 127: as V127, member of the Mutant ]is one )shorter Mutant 128. It ms as Mutant 128: The Mutant submission, its 128 (. It be ms as PZPAPN Mutation : Mutation H: ^, 1993 <seconds set to 02; "Divide overflow" T; "Cannot load ,MAND, halted" too big to fit in R: 688 4: PRhCK - The Mutation ^, 1993. It s to be fNorth America. Mutation |is a vof . X, the Mutation at the top of #the &, hooking |21. , it may the Mutation qof 688 at the end of the a. The =and in the DOS to be un , or may ed. Actually, the seconds field in the to 02. The can be in the 4in all Mutation "The Mutation RABID'S Back and Kicking in `93" "-Soltan Griss" the Mutation the , as well as possible "Divide overflow" "Cannot load ,MAND, halted" too big to fit in PZPAPN : MVF Arka, Arkanoid H: j; TSR; R: 1,898 - 1,909 4: PRsCK - 6.00+, The MVF, or Arkanoid, . It is reported to be fthe . MVF is a polymorphic, vof . bMVF X, the MVF as a low TSR of 2.1K. nby MVF in the MVF , it X. If X, it the MVF qof 1,898 to 1,909 at the end of the a. The =and in the DOS not be . The are in the MVF 4, and are not "THE MVF-FILEVIRUS" by the MVF" "MAD Factory" "No. 0001" frequently %copy of of the MVF MVF-1954: on the MVF 2.2K. It adds 1,954 to 1,969 (to the . for any reason. The at the end of the a. The =and in the DOS not be . The in the "THE MVF-FILEVIRUS" by the MVF" "MAD Factory" "28/9/91 - V1.6" kmay MVF-1954B: to the MVF-1954 is a very minor . It Nn't always PZPAPN ], Horse T; buzzing speaker & clicking Sofia, R: 1,154 or 1,160 4: PRhAK - , NAV, , IBM , VET, The is a group of four . Several were in May, . The es in ]are all es, and gare very one of the es is X, the at the top #the and 21 nby the , as measured the DOS by 1,280 (. At , the +if it hasn't , it ,and . `over 1K in qby either 1,154 or 1,160 (, depending on is present, at the end of the . The not be able to be seen if the . The =and in the not be one of the es may find Ythe DOS the adjusted not match the . Executing the a /F option may in corrupted symptom may be noticed on is an annoying "buzz" "emitted fthe speaker for awhile. s, scrolling of the Mor pressing keys on the clicking noise. sound effects members of ], but not the later It is what the es do es are: Horse: Very -B, Horse is a minor variation. Like -B, it is 1,154 produces the sound effects . The is: "Sofia, Horse 2: Horse 2 is very -A. It is 1,160 , and produces no sound effects. The is: "Sofia,Feb '91 Horse 5: Horse 5 is very #, it is a 1,776 has three Horse-8: , Horse-8 is a 2,248 member of the ]. It in the DOS Data area of , hooking |21. rby the DOS not be , Horse-8 ,and . larger for a reason Z. The hides the 2,248 q, and the DOS Horse-8 is Horse-8B: , Horse-8B is a minor of the Horse-8 . Its is 4,864 (and hooks |21. mthe seconds field in the <set to "60". an effective of 1,160 Nnot produce the sound effects of -B. The "Sofia, Feb '91 " can be dat the end of an effective of 1,154 produces the sound effects . It 7the "Sofia,Jan " and "(c) ." It s to be an earlier an effective of 1,610 and by 2,048 (. It is , or what it 8the an effective of 1,776 -C. It not 8any {01, 1C, and 21 an effective of 1,576 (, the to the Naughty Hacker-D Nnot hook |1C. Like -D, it 8any -F is a 1,594 -C. The is "N.Hacker". -G is an 1,154 ]. It is 4modifications. The "Sofia,Jan/Feb PZPAPN Nazgul : Nazgul fail to function %failure The R: 266 4: PNCK - 6.00+, 2.43a+, 25.10+, \2.07+, V100+, V100+ The Nazgul . It is fThe . Nazgul is a vof . the Nazgul X, the Nazgul xall of the . in the E. If the Nazgul qof 266 the Nazgul at the !of the a. The =and in the DOS not be . The can be in the 4in all Nazgul ,Nazg the Nazgul fail to function ing to the DOS prompt has accessed the . If the %copy of s, the PZPAPN NaziPhobia : NaziPhobia , 1993 fail to R: 4,240 4: ONE - V100+, V100+ The NaziPhobia , 1993, and fthe . NaziPhobia is a vof . . It permanently corrupts the the NaziPhobia X, the NaziPhobia xone . ain the but not the ain the mthe b4,240 (of the host by the NaziPhobia 4. The unless were smaller 4,240 , in case 4,240 . The in the DOS to the =and The NaziPhobia on any Friday. On Fridays, of an in the Land the ed to the DOS prompt. 'ON THE SABBATH.. THE GHOST OF HITLER SPEAKS : "MY FELLOW NAZI'S.. I WAS WRONG.." "I NOW ,MAND YOU TO ,MIT SUICIDE.. NOT GENOCIDE.." "DO IT.. SO THE WORLD WILL BE RID OF THE NAZIPEST.. "AND ALL AUSLANDER CAN TRUELY BE FREE OF NAZIPHOBIA.. NaZiPhobia (c) [VooDoo].. We support the The fthe in the 4in all NaziPhobia PZPAPN NCU LI : NCU LI ; Parity hang R: 1,694 - 1,704 4: PRhE - V99+, 6.04+, \2.07+, The NCU LI . Its it may be fthe NCU LI is a vof . The the NCU LI at the top of #the , as rby the DOS ?by 1,888 nby the , the NCU LI qof 1,694 to 1,704 at the end of the a. The =and in the DOS to the and . The can be din the 4in all "NCU LI" the NCU LI [the video mode "switched to 40 column mode, and the "PARITY ERROR ADDR (HEX) = ( 02C14H) SYSTEM HALTED" s, the be hung. The not as it is PZPAPN Necro Fear : Necro Fear R: 1,823 4: PRaCK - V100+, V100+ The Necro Fear . It is the . Necro Fear is a bNecro Fear X, the Necro Fear in low , hooking {21 and 2F. , as rby the DOS not be the Necro Fear , it qof 1,823 at the end of the a. The in the DOS not be . The in the "I am afraid bitten by the FEAR" "bug. Just think, you may mpassed in on to all of" "your friends! What fun it goes off" "all of "FEAR Copyright (c) NecroSoft Technologies" "Developed in:" "The Metropolis of Sodium Chloride in Hydrogeon Dioxide" kfrequently on Necro Fear PZPAPN Necro Shadow : Necro Shadow k; disruption of contents, "blue snow" R: 1,200 4: PRhAK - V100+, 6.04+, \2.07+, V100+ The Necro Shadow . It is the . Necro Shadow is a ,and . bNecro Shadow X, the Necro Shadow at the top of #the &, hooking |21. the Necro Shadow , it and . qof 1,200 at the end of the a. The =and in the DOS not be The in the "[Shadow] NecroSoft Enterprises-a division of BCA" "Greets to SKISM" [frequent %failures the %copy of disruptions frequently . On monochrome as a couple of on the . On VGA , a bunch of blue squares or blue snow . In both cases, a hang accompany the disruption. of Necro Shadow are: Necro Shadow-B: on the Necro Shadow employs techniques to avoid detection and quickly spread on . Its is 3,504 (, hooking |21. It , or a DOS DIR 5is performed. qof 1,700 be hidden Necro Shadow-B is . The at the end of the a. The =and in the DOS not be . The in the "[Shadow-B] NecroSoft Enterprises - a division of BCA" "Greets to SKISM" Necro Shadow-B failures %copy of on write protected in a write protect U. The DOS Ton all PZPAPN Newcom : Newcom R: 3,045 - 3,060 4: PRhAK - , IBM , NAV 2.1+, 1.53S+ The Newcom . Its . Newcom is a vof . ,and . Newcom is X, the at the top of but #the , as measured by the DOS 3,312 {1C and 21 are nby the |12's is not moved. becoming , Newcom ,and . X. If X, it by 3,045 to 3,060 at the end of the a. The =and in the DOS not be by the It is what Newcom See: Alfa PZPAPN : Nina R: 256 4: PRhCK - \, NAV, , IBM , VET, The Nina , and is is a vof . the Nina Nina at the top of #the @by 1,024 (as shown by the DOS nby the Nina is , it are greater X. If X, it by 256 (, and mthe at the !of the The Nina d Nina because the 7the "Nina" in the Nnot do PZPAPN Nines : Nines j; TSR; printer interference R: 705 4: PRsCK - , VET, The Nines . Its . Nines is a of . The the Nines as a low TSR of 800 {17 and 21 nby the Nines the Nines , it X. If the Nines qof 705 (. The at the end of the . The =and the DOS not be . No are in the 4in Nines the Nines [interference fthe to print to the printer. of Nines are: Nines-706: One )longer Nines adds 706 (to the . May, Nines-776: Nines-776 is a 776 of the Nines May, PZPAPN Ninja : Ninja R: 1,546 - 1,634 4: PRhA - 1.15a+, V99+, 2.43a+, 6.04+, V99+, The Ninja . It is fthe . Ninja is a vof . , but not +. It spreads quickly, for any reason. The the Ninja the Ninja at the top of #the , as rby the DOS ?by 1,408 Ninja in , the Ninja ,and . for any reason. qof 1,634 (. . by 1,548 (. In both cases, the at the end of the a. The and in the DOS not be . The in the 4, and thus not +AIDSTEST. "Mutant Ninja 2.0 (C) &Worm Software" It is what Ninja may do PZPAPN No Frills : No Frills Australia R: 813 4: PRhAK - 3.93+, 6.04+, \2.07+, NAV 2.1.4+, The No Frills . Its was Australia. No Frills is a vof . ,and . bNo Frills X, the No Frills at the top of #the |12's not be moved. , as measured by the DOS ?by 2,048 nby No Frills in , the No Frills +if it was not the No Frills , it and . X, or copied. qof 813 at the end of the a. The =and in the DOS The can be in the 4in all No Frills "-No Frills by Harry McBungus-" No Frills may the of No Frills are: No Frills 1.01: A later of the No Frills by 1,536 hooking of 815 at the end of the a. The in the has "-No Frills 1.01 by Harry McBungus-" No Frills 1.01 Nnot hang the the : Australia No Frills 2.0: A later of the No Frills 1.01 of 843 at the end of the a. The in the has "+-No Frills 2.0 by Harry McBungus-+" : Australia No Frills 3.0: A later of the No Frills 2.0 of 835 at the end of the a. The in the has "+-NF3.0-H.McB- [PuKE] -+" "=EXt.=COt-" No Frills 3.0 may : Queensland, Australia PZPAPN NoBock : NoBock R: 440 4: PNC - , IBM , VET, NAV 2.1+, The NoBock . NoBock is a vof . NoBock is X, the check the =. If the between 1, 1980 and 30, 1980, it Mthe and halt the , not tany "No Bock today halted!" The be left spinning. If the clock is set to a =between 1, 1980 and 30, 1980, NoBock may xone ain the Oand The , however, Nnot Xduring period of NoBock qof 440 the at the end of the NoBock is an , and the cannot be viewed PZPAPN NoInt : NoInt Bloomington, LastDirSect, BSC; Canada R: N/A 4: BRtX - , NAV, IBM , VET, : CleanUp, or M- The NoInt ~in Canada in . NoInt is a of the . Like , it as well as the The the NoInt , NoInt at the top of #the 12's be moved by the , as measured by the DOS by 2,048 (. NoInt xthe . The to Side 0, Cylinder 0, NoInt is , it are accessed on the . On double density 5.25" I, the 11. On high density 5.25" I, the 17. In both cases, are part of the root Eof the J, so any `whose Eentries were in be lost. NoInt Nnot 8any take longer normal to perform accesses or %s. High density often get a " %failure" are later attempted to The reason NoInt is considered a while it can be detected on actively keep software "able to read the on the K. Instead ing the , the may unreadable to the ing in an . If you mreason to believe NoInt , power off the and re fa clean write- protected Jand check the Kfor the See: PZPAPN Nomenklatura : Nomenklatura Nomenclature, 1024-B, Nomen not R: 1,024 4: PRhAK - , NAV, IBM , VET, : CleanUp, or The Nomenklatura in the is a vof . +. It is not related to the V1024 it is the same The the Nomenklatura Xon a , the the top of , but #the @by 1,024 (, and nby the , any . ,or . greater 1,023 for any reason sby the Nomenklatura qd by 1,024 (. The Nnot hide the the fa write-protected in a " L, and the The Nomenklatura is destructive to the contents of exposed to randomly the frequency increasing as the more filled data. The Tmay on data `as well s due to the occasionally swapping a pair of words in the buffer. It may to critical areas such as the FAT, Fories since it may to any clusters on the K. If a aor critical area was residing in a corrupted cluster, be corrupted. As such, exposed to the Nomenklatura must be carefully checked as the integrity of non- and any data `should be considered suspect. The d Nomenklatura as in all PZPAPN Not-586 : Not-586 ^, 1993 R: 586 4: PRtCK - The Not-586 ^, 1993, and is fthe . Not-586 is a vof . bNot-586 at the top of the &, moving |12's and , as rby the DOS ?by 1,024 the , the Not-586 qof 586 at the end of the a. The =and in the DOS not be . No in the 4in Not-586 It is what Not-586 may do PZPAPN 855, Nov 17 Italy R: 855 4: PRhAK - , IBM ., NAV 2.1+, The 17th . Its , but it has since reported as "widespread in Rome, Italy, in 17th is a vof . ,and . The 17th is at the top of #the , as rby the DOS ?by 896 |12's moved. {09 and 21 17th , it ,and . qof 855 at the end of the be no 2to the =and in a DOS . One in the 4of all 17th "SCAN.CLEAN. The 17th s the 17th of any year. 17th are: Nov 17-768: A 768 of the 17th by 800 it is . It Nnot hook |09. qof 768 at the end of the May, Nov 17-880: An 880 of the 17th by 928 it is . It hooks {09 and 21. qof 880 at the end of the a. The in the "SCAN.CLEAN. WAMZ" Nov 17-880 17th thru 31st of any year, at trash the Oand the C: 17th-B: on the 17th adds 855 (to the . ,and . usually hang the function PZPAPN Nowhere Man : Nowhere Man , VMessiah ; long followed by not executing; truncated R: 6,286 4: ONAK - 6.00+, \2.07+, The Nowhere Man , complete source 4in C. Its . Nowhere Man is a non- vof . ,and . over 6,300 Nowhere Man is X, the search the Efor a . ,or . 6,300 a candi ahas d, the b6,286 (of the 4. The remainder of the binary 00 be no 2to the , or =and , in the DOS E. The can be "NMAN" "BMAN" the Nowhere Man has successfully a, it Mthe , and the to the DOS prompt: "Out of If the did not find a x, it to the DOS prompt: "All s. Mission complete." Both are not The Nowhere Man truncate is zero of Nowhere Man are: gvery to the Nowhere Man completely the . ,and . all . and . in the Eof over 4.5K s, it trash the Oof the , and root The "NMAN" and "J-VIRUS!" can be seen in all : Canada Montreal, Canada Nowhere Man 1.9: to the Nowhere Man 6,286 . It Ms the : "Out of Nowhere Man 2.0: to the Nowhere Man is 4,828 mhad =and the =and . While Nowhere Man 2.0 `, it may truncate both . ,and . in the VMessiah: A 702 of the Nowhere Man wall . ,and . whose is at least 702 in the mthe b702 (of the host the VMessiah 4. The =and in the DOS . The d samples so it is not "I am your VIRAL MESSIAH Follow me and be redeemed Your data doth exist no more The FAT holds ashes of your dreams" "[VCL] [ Messiah] Nowhere Man, [NuKE] '92" The bquote , comprising four lines, is See: 4Zero PZPAPN : NPox Evil Genius seconds = 58; K; trashes Kon 18th of month Canada R: 963 4: PRhAK - 6.00+, The NPox, or Evil Genius, was simultaneously ~in the Eastern and Montreal, Canada in late is a +. It is extremely destructive. bNPox at the top of #the rby the DOS ?by 1,024 |12's not be moved. {09 and nby NPox in . The copy of in the C: Oroot if it was not , NPox ,and . qof 963 at the end of the a. The q, however, not be in the DOS mthe seconds field of the in the DOS Eset to '58'. is the umarker for the The can be in the all NPox "Evil Genius V2.0 - R.S/NuKE" "C:\ NPox the DOS may, however, find random on the , or Kis corrupted on the 18th of any month. of NPox are: Evil Genius 2B: gequivalent to the has two differ. : Montreal, Canada Evil Genius 2C: gequivalent to the has seven differ. : Eastern NPox 2.0: , NPox 2.0 is on the NPox . It's is 1,856 (, hooking {21 and 22. NPox 2.0 ,and . are closed, and dis them as are read into many NPox 2.0 is qd in by 2,048 (. The at the end of . The seconds in the =in the DOS be set to 60 on all Two can be din all "NuKE PoX V2.0 - Rock Steady" "C:\ : Montreal, Canada NPox 2.1: , NPox 2.1 is on the NPox 2.0 . It's is 1,744 (, hooking {21 and 22. NPox 2.1 ,and . are closed, and wthem as are read into many NPox 2.1 is qd in by 1,686 (. The the end of . The seconds in the in the DOS be set to 60 on all . Three can be din all "Death to Separatist" "C:\ "NuKE PoX V2.1 - Rock Steady" NPox 2.1 on the 13th day of any month, at K, rendering it inaccessible. It hang the : Montreal, Canada PZPAPN : NTKC C-23963 j; graphic picture R: 23,963 4: PNCK - , NAV, IBM , VET, The NTKC in May, . It is the . NTKC is on the Father Christmas . It is a vof . NTKC is X, the search the Efor a . x. If one is d, it , the full graphic of a personal computer, the cleared, and the host NTKC 23,963 (. The at the end of the din NTKC are: "regional engeneering centre" "LENINFORMATIKA N T K C Computer-Service" See: Father Christmas PZPAPN Null Set : Null Set Null R: 733 4: PNCK - ., NAV 2.1+, 2.43a+, 1.53S+ The Null Set . It is . Null Set is a the Null Set X, the search the Eto locate the over . If an , the the Null Set qof 733 (. The at the end of the . The =and in the DOS not be Null Set Nn't to do PZPAPN Null-178 : Null-178 to write to PRN device; R: 178 4: PNCK - , NAV 2.1+, .1.4+, 2.43a+, 1.53S+ The Null-178 . Its is a of . the Null-178 X, the check the bfive . `in the and xthem if were not bfive . `are s, it further down in the the Null-178 qof 178 at the end of the . The =and in the DOS to the and . One can be in the 4of the Null-178 "*.com" Null-178 may notice attempt to write to device PRN. If the Nnot man attached printer, and in DOS. PZPAPN Number One : Number One Number 1, #1, Number One-B, Number One-Argentina G: 1987 (see `fail to function; displayed West Germany R: 12,032 4: ONC - D: IBM NAV 2.1+, 6.00+, The Number One for inclusion in , however, is not a new but is an extinct rather "old" . The Number One was written in , 1987, by M. Vallen using Turbo Pascal 3.01A. It is documented, complete source, in a book by Ralf Burger. is an the Number One X, the xthe ait finds in the E. If the . awas less 12,032 , it ma 12,032 <stamps in the reflect the Number One has finished a, it Mthe aHas sby Number One! The X is the of the . has just sby the are no more . Number One to xin the E, it aHas sby Number One! Number One xany mthe Read Attribute set. Since Number One is an , it is not possible to remove the `and repair the damage. `should be erased and replaced clean copies. of Number One are: Number One-Argentina: to the Number One Gin Argentina in s the b12,032 (of the . w. The has ahas sby Number One". It may 2the Mvideo attributes : Argentina Number One-B: to the Number One Ms the "<Smile>" in place of the ASCII character all . sand an See: AIDS PZPAPN Nygus : Nygus Poland R: 757 4: PRhA - 1.15a+, 2.43a+, 6.04+, \2.07+, V99+, The Nygus fPoland in is a vof . ,and . , but not bNygus X, the Nygus at the top of #the , as rby the DOS by 1,024 nby the the Nygus , it by 757 at the end of the a. The =and in the DOS to the =and It is what Nygus of Nygus are: Nygus-Klaw: , Nygus-Klaw is fPoland. Its is 1,024 (, hooking |21. it is , Nygus-Klaw ,and . 752 at the end of the a. The =and in the DOS to the . No in the Nygus-Klaw may X, or the may be ed to the DOS prompt unexpectedly. : Poland PZPAPN : Ohio , 1988 BSC; Indonesia R: N/A 4: RtF - Floppy \, IBM , NAV, , VET, , or DOS SYS The Ohio is a t360K floppy Ks. The Ohio in many respects to the Den Zuk , and is believed to possibly be the earlier of Den Zuk. A Ohio immune to uby the Pakistani Brain The in the Ohio "V I R U S The Hackers Y C 1 E R P D E N Z U K 0 Bandung 40254 Indonesia (C) 1988, The Hackers Team See: Den Zuk PZPAPN Oi Dudley : Oi Dudley Dudley ^, 1993 Australia R: 1,218 - 1,245 4: PRhAK - The Oi Dudley, or Dudley, Gin Australia in ^, 1993. Oi Dudley is a vof . and . +. It is a polymorphic employing an encryption mechanism on the encryption used in the V2P6 , thus requiring an algorithmic approach to detection. It a fast v, spreading for any reason. It has reported by several sources as "prominent in Australia. bOi Dudley X, the Oi Dudley at the top of #the &, hooking |21. , as rby the DOS ?by 4,608 |12's moved. the Oi Dudley , it for any reason. qof 1,218 to 1,245 at the end of the a. The =and in the DOS not be . The indicating the , is in the "[Oi Dudley!][PuKE]" the Oi Dudley Fories. PZPAPN : OMT 413, One More Thing G: May, j; long Kaccesses; Australia R: 413 4: PNCK - , NAV 2.1+, 1.15a+, 2.43a+, The OMT, One More Thing or 417, Gin Australia in May, by Peter Ferrie. The OMT is a vof . It is destructive in years the OMT X, the OMT xall of the . in the it has completed tall of the . hang usually s. The xthe C: Oroot E, however it 4isn't functional. the OMT qof 413 at the end of the a. The =and in the DOS not be OMT is an , so no the `. The are included in the "c:\*.com" "And one more thing... fuck you!" The OMT the year of the . At , the starting at side 0, cylinder 0, PZPAPN Ondra : Ondra 4915 G: May, 9; access to unexpected R: 5,000 4: ONE - 1.15a+, \2.07+, 2.45+, The Ondra in May, . Its Ondra is a the Ondra X, the Ondra xall . larger 5,000 in the completed tthe in the E, it start on the B: O. If the B: a write-protected J, it retry writing to the indefinitely. has completed the ed to the DOS prompt. the Ondra q, but rather be completely 4and of the contents of . The and in the DOS not be The can be in the all Ondra "ondra.dat" "Invalid en ment" "Run the Ondra , and kmay frequently of Ondra are: Ondra-B: is a of Ondra . It wone . be completely 8ed in the b4,915 the a. It 7the same as the PZPAPN Ontario : Ontario Tin the case of extreme Ontario, Canada R: 512 4: PRtAK - , NAV, \, IBM , VET, The Ontario ~by Mike Shields in Ontario, Canada . The Ontario is a W, and overlay `. It The the Ontario X, it the top of #the and ?by 2,048 (. At the +on the C: O, increasing its by 512 Xon the , the at the end of the a. For . qby 512 (in all cases. For . Wand overlay `, the be 512 - 1023 (. The difference in for . Wand overlay `is because the fill out the unused space at the end of the last of the random data (usually a portion of the E) and append to the end of the aat the next using a of more may notice larger qs for always is a multiple of the on the In the case of extreme us of the Ontario Tmay be noticed. See: 1024 SBC Ontario 730 Ontario III PZPAPN Ontario 730 : Ontario 730 Ont-730 j; TSR; FAT & Damage Ontario, Canada R: 730 - 744 4: PRsA - W, & Overlay , NAV 2.1+, The Ontario 730, or 730, Gin Ontario, Canada, . Ontario 730 is a W, and overlay The Ontario 730 is as a low TSR of 1,024 (. It Ontario 730 is , it W, and Nnot always . It not Ontario 730 of 730 to 744 (. The at the end of the a. The =and in the DOS not be . One can be the 4of the Ontario 730 "!=TVu" In advanced us of the Ontario 730 , the ) may be damaged by the See: Ontario PZPAPN Ontario III : Ontario III Ontario, Canada R: 2,048 4: PRhAK - The Ontario III Ontario, Canada. The Ontario III on the 1024 SBC or Ontario II , and is a polymorphic wof . W, overlay and .SYS `. It The the Ontario III X, it the top of #the and ?by 5,120 nby the . At , the xthe copy of ed to by the ,SPEC mental variable. as the the slack space at the end of the Ontario III , it W, overlay (.OVL), and .SYS for any reason. 2,048 not be the . The at the end of the The Ontario III uses a very complex form of encryption no more (remaining constant in d samples. While the in the not `due to the encryption: ,SPEC=\ WOVLSYS" "MSDOS5.0" "YAM" "Your PC has a %ache! - Get medicine!" "Ontario-3 by Death Angel" The Ontario III 7an embedded it is never actually written out to K. It employs techniques to avoid its "disassembled using the DOS DEBUG . If it detects the use of the DOS DEBUG fthe See: 1024 SBC Ontario PZPAPN Oropax : Oropax Music , Musician >, 1989 j; tunes R: 2,756 - 2,806 (, but usually 2,773 4: PRC - \, IBM , NAV, , VET, , or The Oropax has had several reports, but wasn't until >1989. It `, increasing by between 2,756 (and 2,806 always by 51. The active (on a random basis) five minutes uof a a, playing three different tunes a seven minute interval in between. One recently reported in Vplays six different tunes at seven minute intervals. of Oropax are: Oropax-B: in May, 2,755 to 2,800 at the end of the a. It as a low TSR of 3,072 (, hooking {21, CC, and F8. May, PZPAPN Otto6 : Otto6 ; host R: 640 4: PNCK - 6.00+, 25.10+, V99+, 1.53S+ The Otto6 . It is . Otto6 is a of . +. It za small portion of its it is not a complete copy of the , and the is not xive bOtto6 X, the Otto6 za small portion of its 4at the top of #the , as rby the DOS ?by 2,048 nby the portion of Otto6 , providing it was not , the Otto6 xone . in the the Otto6 X, the Otto6 xone in the qof 640 the end of the a. The =and in the DOS not be . The are in the "OTTO6 VIRUS, << S>>, YAM, COPYRIGHT MICROSHAFT INDUSTRIES S>> YAM, MICROSHAFT INDUSTRIES (tm.) The Otto6 is an . It not encrypts the 4, but the host as well. It is what Otto6 of Otto6 are: Otto-415: on the Otto6 , Otto-415 is a 415 . It wone . ain the qof 415 at the end of the a. The =and in the DOS not be . The Otto-415 encrypts the 4and the , so the are not "OTTO VIRUS written by: OTTO SCHTUCK" "COPYRIGHT MICROSHAFT INDUSTRIES (tm.)" PZPAPN Outland : Outland 2136, Oliver R: 2,136 - 2,150 4: PRhAK - .1.4+, 6.00+, V99+, NAV 2.1.2+, 2.43a+, V99+, The Outland, Oliver or 2,136, Its . Outland is the , and like ;, is a vof . W, and overlay `. It alters the of the J, maintaining a counter bOutland X, the Outland at the top of #the &, hooking {21 and 27. , as rby the DOS ?by 4,368 12's moved. the Outland , it and overlay qof 2,136 qof 2,136 to 2,150 The at the end of the a. The =and in the DOS not be The in the Outland 4in all "Bill the Cat Lives!" "Oliver Wendell Jones" "Politically Incorrect Personal Computers Presents:" "the OLIVER VIRUS!" "Nya Ha Ha! Men Rule! America Kicks Butt! Rap Sucks!" "Eat Fatty Food! Dames Melt Like Jell-O for Naughty Men!" "Ted Kennedy Sucks Barney Frank`s Fag Cock!" "Banana 6000 P.I.P.C. (C) I spell -Lightening- wrong!" The Outland maintains a counter in the of the O. It is what it See: PZPAPN OW-Trident, OW-64 to function R: 64 4: ONCK - V99+, 6.00+, \2.07+, 2.45+, The , OW-Trident, or OW-64, . The submission was actually of four related The OW-Trident three Bunder at the end of entry. the OW-Trident xall . in the (of the host 2in the , unless the . smaller (. In the event the host smaller , it of 64 (. The =and in the DOS 0to the and . The in all ,Trident" are permanently damaged, and no longer function of the OW-37: A 37 of the OW-Trident . It s the bfive . in the The can be din all OW-42: A 42 of the OW-Trident s the (of all . in the X. It 7the OW-42B: to OW-42, it is a minor Small-46: A 46 , Small-46 wone . ain the mthe (of the host ovewritten by the , and the =and to the =and . It 7the , 1993. Small-72: A 72 , Small-72 wall of the . `in the mthe (of the host by the , and the =and the DOS to the =and . It , 1993. PZPAPN Oxana : Oxana ^, 1993 <seconds set to 62; R: 1,670 4: PRhE - The Oxana ^, 1993, and is fthe . Oxana is a vof . in its 4a long in Russian. bOxana X, the Oxana at the top of #the &, hooking |21. , as rby the DOS ?by 4,112 |12's not be moved. the Oxana , it for any reason. qof 1,670 at the end of the a. The =and in the DOS to be seconds field set to 62. $the mentioned in Russian, the in the "MSDOS3" It is what Oxana may do PZPAPN : Pa 5792 H: R: 5,792 4: PNE - , VET, o, NAV 2.1.4+, The Pa, or 5792, . Its it is probably fEastern V. Pa is a vof . the Pa X, the Pa may xup to three . on the C: O. The start looking for xin the root moving down through the Estructure. the Pa qof 5,792 at the !of the a. The =in the DOS not be , but the minutes in the set to 57. sthree . , the Land the ed to the DOS prompt: Uin *. a Pa X, the Lby the and the to the DOS prompt: "Pa,pa slodki bobasku ..." is not PZPAPN H: March, R: 1,589 4: PNCK - , VET, NAV 2.1+, 1.53S+ The P in March, . Its is a the P X, the xone . in the E, it may the P qof 1,589 at the end of the a. The =and the DOS not be are several can be seen in the 4in P "\ ENU \TENNIS" "CHECKIT.LOG" "WHISTLE.SPL" "ETABLE1.GIF" "*.*" It is what P may do to the . The "\ ODS \ STRIP R" "DOS" "GODS" "VOCEAN.LHZ" "MRA.V2E CAR" "*.*" See: Generic Hominy PZPAPN Parasite : Parasite H: & buzzing; warm re Canada R: 1,132 4: PNCK - , VET, NAV 2.1+, The Parasite fCanada. Parasite is a vof . +. It is on the Sicilian Mob , and in Fly on the Parasite is X, the Parasite search the Efor the it finds a, it the Parasite qof 1,132 (. The at the end of the be no 2to the =and in a DOS The in the Parasite "(C) by [NUKE] InterNat`nl Software Development" "Parasite , Released , Montreal, Canada" "--> [NukE] H/A/P/C/T/V at its Best! <---" "RABiT,RABiT,RABiT...EAT THIS!" "To John McAfee [I'll be BACK!]" "PATH=" one out of every four the Parasite Mthe accompanied by a loud buzzing on the speaker: "Parasite ! by Rock Steady [NukE] HP" is not as it is L, the Parasite cause a warm re %of the of Parasite are: Parasite 2: Parasite 2 was , and is fMontreal, Canada. It is a modified of the Parasite many of the having removed. The remain are: "ParaSite II - By: Rock Steady" "PATH=" Parasite 2 is the xone . ain the E, plus +if it was not Parasite 2 qof 901 at the end of the 2to the =and in the DOS Parasite 2 may [a "machine gun" noise "emitted on the speaker kand intermittent %failures may . The the C: E, and FAT on Mondays, however Nnot function : Montreal, Canada Parasite 2B: to Parasite 2, the Parasite 2B two (larger Parasite 2. It adds 903 the . w. The can be din all "ParaSite IIB - By: Rock Steady" "PATH=" 7the same bug as Parasite 2, preventing it factivating on Mondays and Vengeance: on the Parasite , the Vengeance Gin the in late May, . It wone . qof 723 at the end of the a. The seconds in the in the DOS set to 56, the umarker. Vengeance 8the "*** Vengeance is ours! ***" "SKISM/Phalcon '92" "PATH=*. May, Vengeance-B: , Vengeance-B is to Vengeance . The seconds in the in the DOS be set to 00 on all Vengeance-B 8the "PATH=*. : Canada Vengeance-C: , Vengeance-C is to Vengeance , it has eight differ. : Canada See: Sicilian Mob PZPAPN Paris : Paris H: j; slow loads upon Paris, France R: 4,909 4: PNAK - , NAV, , IBM , VET, The Paris ~in Paris, France, in early is a generic vof . Wand overlay `, and +. It is not the Paris X, the xall . Wand overlay `on the and the exception of very small . check to see if +on the C: , if it has not by between 4,909 - 4,925 at the end of the The Paris can be destructive in instances, ing in Ibecoming corrupted if the a Paris PZPAPN Parity : Parity j; long . loads; possibly intermittent parity R: 441 4: PNCK - \, NAV, i, VET, , IBM The Parity , and ated in is a non- vof . `, and the Parity X, the xall . `in the E. If +is in the E, it by 441 (, the at the end of the . The =and in the not be by the The major symptom of a Parity significantly longer to load and `. The is due to the searching the for . "PARITY CHECK 2" at and halt the PZPAPN Parity : Parity BSC; ; "PARITY CHECK" hang; possible root Germany Australia R: N/A 4: BRtX - 1.15a+, , NAV 2.1.4+, 6.04+ : CleanUp, \, M- K/P and DOS SYS The Parity ~in Australia. is believed to in Germany. Parity %is a vof the ) and . It is a Fing to read the to the The the Parity xthe , as rby the DOS ?by 1,024 (, and |12's moved to 9FC0. The mcopied the to Side 0, Cylinder 0, 14 before tthe at Side 0, Cylinder 0, the Parity , it xnon- write protected are accessed. On 360K 5.25" I, the On 1.2M 5.25" I, the 28. In both cases, are the last the root E, and any Eentries be lost. the Parity keys are pressed on the "PARITY CHECK" s, the be hung, requiring the to reset the Parity %is a , it re to read the to the copies it stores. PZPAPN Particle Man : Particle Man s C:\AUTO WC.BAT & C:\CONFIG.SYS New Mexico, R: 690 4: PNCK - The Particle Man Gin the State of New Mexico in the . Particle Man is a non- vof . the Particle Man the Particle Man xall . in the E, as well as the AUTO WC.BAT and CONFIG.SYS the Particle Man qof 690 at the end of the a. The =and in the DOS not be 0. The in the , and are not "Particle man, particle man Doing the things a particle can What's he like? It's not important Particle man Is he a dot, or is he a speck? he's underwater Nhe get wet? Nthe water get him instead? Nobody knows, Particle man (c) Copyright Drizzt Do'Urden '92" ,*.* .. Particle Man Nn't to do the AUTO WC.BAT and CONFIG.SYS %problems. of Particle Man are: Particle Man 2: gequivalent to the is a minor : New Mexico, PZPAPN Pascal-4260 : Pascal-4260 }, Wirus `corrupted/ "Abort, Retry, Warsaw, Poland R: 4,260 4: ONA - 2.43a+, NAV 2.1.2+, \2.07+, V99+, 1.53S+ The Pascal-4260 . It is Warsaw, Poland. Pascal-4260 is a ,and . . It is written in Borland's Turbo Pascal language. the Pascal-4260 access the C: Oand xone . It Ms the #, substituting X for the "General Ureading Abort, Retry, Regardless of what the responds, the a second aon the C: O, and Mthe again. responds the second ed to the DOS prompt. The Pascal-4260 wboth . ,and . on the C: O, and it can read down through the structure. mthe b4,260 (over- written the Pascal-4260 4. The =and in the DOS not be . Several can be in the "(C) by OSCAR" "6'89" Plus fBorland's compiler. The in the thus not "To dopiero pierwaze pozdrowienia dla S.Fischera i M.Sella" "General Ureading "Abort, Retry, should be replaced copies. PZPAPN Pascal-5220 : Pascal-5220 Pas-5220, Re %Patcher `corrupted/ unexpected %s; seconds in = "00" R: 5,220 4: ONAK - 1.15a+, 3.93+, NAV 2.1.2+, V99+, The Pascal-5220 or Re %Patcher is a wor trojanizes . ,and . Pascal-5220 is access the B: and C: Os, trojanizing all . !of the 4to re the X. The xseveral in the b5,220 (of the 2to the . The seconds field of the in the DOS be set to "00". The can be in the "*.com" "*.exe" "*.zip" "*.arc" "05520" "CJu" Pascal-5220 [frequent %s, and may notice has dis DOS PZPAPN : Path VHP-547, k; random 3written to R: 547 - 562 4: PNCK - ., IBM , VET, NAV 2.1+, The Path, or VHP-547, . Its . Path is a of . the Path X, the search the Efor one x. If it finds one, it may or may not sby the Path qof 547 to 562 (. The at the end of the be no 2to the =and in a DOS . The "IBM" "PATH=" of an uof the Path hang the s may in random "written to the PZPAPN Pathhunt : Pathhunt j; .DBF 9; "Path not Republic of South Africa R: 1,231 4: PNA - , NAV 2.1+, The Pathhunt Gin the Republic of South Africa by Oliver Steudler. Pathhunt is a vof . ,and . `. It may corrupt .DBF advanced Pathhunt is X, Pathhunt search the Estructure for three . do not start a JMP instruction (E9h or EBh). If the three . are not d, it search the path looking for x. If three candi still mnot d, it up to three . all of the . s, it x.DBF `, permanently corrupting data ly, Pathhunt Nnot always correctly, corrupted and no longer function , both . ,and . Pathhunt by 1,231 at the end of the be no 2in the and in the DOS The Pathhunt comes fthe behavior of the a candi , the s the to PATHHUNT, wit, and it back to its PZPAPN Patient : Patient j; TSR; R: 1,504 - 1,519 4: PRsA - , NAV, , IBM , VET, The Patient, or PK, Gin the . It was by John McAfee. Patient is a ,and . v. It Nnot +. Patient is d for its unusual behavior regarding start to The Patient is X, Patient as a low TSR of 1,920 {08, 21, 24, and 67 nby the Patient is , it not start to spread or for 20 minutes. for a minimum of 20 minutes, it ,and . over 2K in ,and . by 1,504 to 1,519 at the end of the be no 2in the =and in the DOS Patient s hang the Later, hang the Patient is an , and are no in the PZPAPN PC Flu : PC Flu R: 802 4: PRfCK - , IBM , NAV 2.1+, The PC Flu . Its . PC Flu is a vof . The PC Flu is X, PC Flu in low hooking |21. not be PC Flu is , it for any reason. PC Flu qd in by 802 (. The at the end of the a. The dnear the end of all "PC-FLU by WIZARD It is what PC Flu See: PC Flu-2 PZPAPN PC Flu-2 : PC Flu-2 Flu-2 j; TSR; possible input omissions Poland R: 2,112 - 2,126 4: PRsAK - , IBM , NAV 2.1+, The PC Flu-2 . Its Poland. PC Flu-2 is a vof . ,and . Nnot function on 386 computers, and `on those in a hang. The PC Flu-2 is X, the PC Flu-2 as a low TSR of 6,192 {21 and 27 the PC Flu-2 the PC Flu-2 , it for any reason. qof 2,112 at the !of the qof 2,112 to 2,126 at the end of the a. In either case, the =and in the DOS by the PC Flu-2 PC Flu-2 is an and no in the It is what PC Flu-2 of PC Flu-2 are: PC Flu-2B: A 2,141 of the PC Flu-2 adds 2,141 to 2,157 (to the . w. In addition to the 6,192 )TSR by the is a small portion of the placed in high hooks and 09. interfers input so d on the may not . The the "PC-FLU Mk II by Wizard : Poland PC Flu-2D: A later of PC Flu-2B, 2,134 to 2,148 (to the . 7the same as PC Flu-2B, and interfers input. : Poland PC Flu-2E: to PC Flu-2D, adds 2,134 to 2,148 (to the . w. It is different in are X. It 7three in the "PC-FLU Mk II by Wizard "-FLU Mk II by Wizard "Incorrect DOS : Poland PC Flu-2F: A 2,156 of PC Flu-2, ,and . qof 2,156 at the !of the 2,156 to 2,170 at the end of the Nnot interfer input. : Poland See: PC Flu PZPAPN : PCBB 1677, PC )Bandit H: March, %failure; Sweden R: 1,677 4: PRK - , NAV 2.1+, The PCBB, or PC )Bandit, in March, . It ated in Sweden. is a it is very buggy and not really viable in its present state. It is on the 1720 the PCBB immediately +. At , the be hung. If the +, the hang. the PCBB qof 1,675 - 1,677 (. The the end of the a. The =and in the DOS to the =and . The can be dat the end of all "PCBB" of PCBB are: PCBB-3: in March, , the PCBB-3, or 1720-C, is a 1,719 of the PCBB . It wthe copy ed to by the ,SPEC en ment X, as well as becoming at the top of #the &, hooking {09, 1C, and 21. ?by 4,096 Nnot to hide the . The "PCBB" can be dat the end of all `, and the its "<> Demoralized Youth <>" "PCBB, "Written by <: Charlie! :>". : Sweden March, PCBB-3B: , the PCBB-3B 1,722 of the PCBB-3 . It wthe copy ed to by the ,SPEC en ment X, as well as becoming at the top of #the &, hooking {09, 1C, and 21. ?by 62,176 it is difficult to get it to do to hide the . The "PCBB" can be dat the end of all `, and the in its "<> Demoralized Youth <>" "PCBB, "Written by <: Charlie! :>". : Sweden PCBB-5: PCBB-5 is a 1,680 of the PCBB . It in a manner to PCBB-3. The major difference is on open or Z, adding 1,680 The qis not hidden, and the in the DOS to the =and . Like the members of group, the "PCBB" can be at the very end of `. It in the "Pc )Bandit ver5". PCBB-5 is a polymorphic , employing a complex encryption mechanism. : Sweden PCBB-5B: to PCBB-5, is a minor and is gequivalent. : Sweden PCBB-1141: PCBB-1141 is a 1,141 of the PCBB X. Its 4,096 at the top of #the DOS {09, 1C, and 21 of PCBB +, not and . qd in by 1,141 at the end of the be hidden PCBB-1141 is . The =and in the DOS not be . The "PCBB" can be dat the end of all : Sweden PCBB-3072: on the PCBB , PCBB-3072 or PCBB-11 is a 3,072 of the . It and X. Its is 6,176 at the top of #the 09, 1C, 21, and 24 PCBB-3072 ,and . qof 3,072 at the end of the hidden if PCBB-3072 is PCBB-3072 is , the DOS indicate Ton all . The and in the DOS not be . The in the 4and are not "PCBBCSX.?." W.BATVBAPW" The "PCBB" can be dat the end of all : Sweden See: Sistor PZPAPN : PCV PCVRSDS TSR; . `may be Italy R: 1,904 4: PRsA - , IBM , VET, NAV 2.1+, The PCV fItaly. PCV is a vof . ,and . . It The PCV is X, PCV as a low TSR of 1,904 (. The hook PCV is , it ,and . X. . by 1,904 at the !of the a. . by 1,910 to 1,918 at the end of `. The q, however, mostly be hidden by the if it is . The =and in the not be notice or are Ad randomly fthe `may be , .BAT `, or data `may to view them, such as aeditor. Ymay Ad by the If the DOS indicate PZPAPN Pegg-833 : Pegg-833 Pegg G: March, 1993 ; write protect R: 833 - 847 4: PRhEK - \2.07+, V102+, V102+ The Pegg-833 in March, 1993. Pegg-833 is a +and . . It not bPegg-833 X, the Pegg-833 at the top of #the &, hooking {21 and 6C. , as rby the DOS ?by 1,120 12's not be moved. , the Pegg-833 +, if it was not , the Pegg-833 qof 833 to 847 at the end of the a. The =and in the DOS not be . No are in the 4in Pegg-833 the Pegg-833 [repeated write protect fwrite-protected I. The write-protect scroll down the response. PZPAPN Pentagon : Pentagon Extinct , 1988 TSR; BSC 360k floppies; a(see R: N/A 4: RF - Floppy , NAV, , IBM 1.15a+, \2.07+ K, CleanUp, or DOS SYS The Pentagon consists of a normal MS-DOS 3.20 where the 'IBM' has replaced by 'HAL', along `. The ahas a of the hex character 0F9H, and 7the portion of the would not fit into the , as well as the of the K. The second d PENTAGON.TXT and Nnot be used or 8any data. The 0F9H ais accessed by its absolute storage address. Portions of The Pentagon w360K floppies, and look for and remove the Brain fany w. It is , occupying 5K of RAM, and can survive a warm re (CTL-ALT-DEL). PZPAPN Penza : Penza R: 700 4: PRhAK - 3.93+, 6.00+, 25.10+, The Penza . Its . Penza is on the Vacsina es. It is a vof . ,and . The the Penza at the top of #the &. It Nnot move 12's , as by the DOS ?by 2,288 nby Penza in the Penza , it qof 700 at the end of the a. The =and in the DOS not be . No The Penza Mthe accompanied by a beep "Welcome to Penza!" Penza Nn't to do Mits and of Penza are: Penza-1210: A 1,210 of the Penza , Penza-1210's is 1,328 (, hooking , it ,and . X, increasing by 1,210 to 1,225 (. The at the end of the a. The =and in the DOS not be on the monitor: "Best wished fPenza!" See: Vacsina PZPAPN Perfume : Perfume 765, 4711, G- >, 1989 Germany R: 765 4: PRhCK - \, IBM , NAV, , VET, \, NAV, or The Perfume is of German , and has in Poland in >, 1989. The the Perfume the Perfume at the top of #the , as rby the DOS ?by 1,024 nby the , the Perfume +if it was not the Perfume , it qof 765 the end of the a. The =and in the DOS not be . One in all The s ask the a question, and not run the unless the responds by typing 4711, the of a German perfume. In the most , however, the questions miscellaneous See: Sorry PZPAPN Phantom : Phantom ; shift of Hungary R: 2,274 4: PRhC - , VET, , IBM , NAV 2.1+, The Phantom ~in Hungary in , by Dr. Szegedi Imre. is a vof . `, but not The the Phantom X, the Phantom the top of #the {20 and 21 nby the , and the DOS report 2,704 (less expected. becoming , the Phantom if the is greater 2K. 2,274 at the end of the Phantom Lintermittently "HI ROOKIE! I`m a THESEASE! I live in YOUR computer - sorry... ks to Brains in the Computer Siences!" , as in the 4, cannot be seen in are S. The Sin the 4are: "The PHANTOM Was HERE - SORRY" "(c) PHANTOM - was designed in the HUNGARIAN VIRUS DEVELOPING LABORATORY. (H.V.D.L.) v1.0" symptom of the Phantom occasionally alter the what should start on the left side of the starts in the middle (it is shifted 50% around on the same line). PZPAPN Phoenix : Phoenix failure; +header R: 1,704 4: PRhCK - , NAV, , VET, The Phoenix is of , and was to the author of document in by Vesselin Bontchev. is one of a ]of three (3) may be referred to as the P1 or Phoenix es is documented separately due to varying characteristics. The Phoenix is a , generic vof . and The the Phoenix X, the high , reserving 8,192 the 8,192 (. If the fa floppy O, and +was not present on the J, the request +present be inserted in the O. Phoenix immediately part of the binary zero portion of the , and changing the header . The +residing in the C: Oroot becoming , the attempt to any . X. Most of its , however, in a s. Phoenix is a fairly poor replicator. If the is successful in tthe a, it append its 4to the end of the a, increasing the by 1,704 Phoenix is not able to recognize it has a, so it may re `several in an 1,704 "appended to the the Phoenix [problems executing Phoenix in a warm re %of the ring, however the of Phoenix survive the re %. If an autoexec.bat ais not present on the f, the prompt for the enter =and The Phoenix employs a complex encryption mechanism, and ners able to look for simple hex not be able to detect it. is no simple hex 6to all ssamples. is not related to the Cascade (1701/1704) See: Evil Phoenix 2000 PhoenixD Proud V82 PZPAPN Phoenix 2000 : Phoenix 2000 ; TSR; R: 2,000 4: PRshAK - The Phoenix 2000 fThe , where it was uploaded to several BBSes by a person identifying themself as " ;". ated in ', and is closely related to the earlier V82 . Phoenix 2000 is a vof . ,and . `, as well as The Phoenix 2000 is X, the Phoenix 2000 at the top of #the &. It small TSR in low of 112 (. The at the top is 8,192 is the amount rby the DOS by. The be slightly more. The Phoenix 2000 hooks |2A. |12's moved. Phoenix 2000 is , it ,and . copied, or accessed in any way. While it always `are successfully 2,000 (of binary 00 3in a continuous block. If the 2,000 (of binary 00 3do not exist, the amay be partially s, but not be replicating copy of the qof 2,000 in the middle or end of the a. Phoenix 2000 is unable to identify previous us of `, so may sby Phoenix 2000, adding an 2,000 (to the afor be no to the =and in the DOS +and . the Phoenix 2000 . In two cases, the 2,000 (of binary 00 the 4. For . less 2,000 (of binary 00 3, the be partially and may not function as a See: Phoenix V82 PZPAPN PhoenixD : PhoenixD failure; +header R: 1,704 4: PRhCK - , NAV, VET, The PhoenixD is of , and was to the author of document in by Vesselin Bontchev. is one of a ]of three may be referred to as the P1 or Phoenix es is documented separately due to varying characteristics. The PhoenixD is a , generic vof . `, and The PhoenixD is a "bug fixed" of the Phoenix The the PhoenixD X, the high , reserving 8,192 the 8,192 (. PhoenixD check to see if the root 7a copy of +. If a copy of d, it sby PhoenixD by part of the binary zero portion of the , and changing the header . The +residing in the C: Oroot becoming , the attempt to any . X. PhoenixD is a much better replicator the Phoenix , and is usually able to by 1,704 PhoenixD is not able to recognize it has a, so it may re `several in an 1,704 "appended to the A characteristic present in the PhoenixD is not in the Phoenix in addition to it for any reason. The simple act of copying a . PhoenixD present in in both the source and target the PhoenixD [problems executing Phoenix in a warm re %of the ring. If an autoexec.bat ais not present on the f, the prompt for the to enter =and The PhoenixD employs a complex encryption mechanism, and ners able to look for simple hex not be able to detect it. is no simple hex 6to all ssamples. is not related to the Cascade (1701/1704) See: Evil Phoenix Proud PZPAPN : Pi j; TSR; R: 1,552 - 1,568 4: PRsE - o, NAV 2.1.4+, V99+, 1.53S+ The Pi . Its . It is a vof . X, the Pi as a low TSR of 2,048 (. It hooks {1C and 21. the Pi , it qof 1,552 to 1,568 the end of the a. The =and in the DOS to the =and . One in the "P I _ P I" Pi has 10 minutes, Mthe in the upper right hand corner of the PZPAPN Piazzolla : Piazzolla j; TSR Argentina R: 874 4: PRsC - 1.53S+ The Piazzolla fArgentina in is a vof . , but not bPiazzolla X, the Piazzolla as a low of 1,200 nby the Piazzolla is , it X. Piazzolla qof 874 (. The at the !of the . The =and in the DOS . The can be in the 4in all Piazzolla "Piazzolla" ,MAND "PIAZZOLL.$$$" Piazzolla Nn't do PZPAPN : Pif Pif Paf B v1.0 G: May, Hungary R: 760 - 774 4: PRhAK - , IBM , VET, 1.15a+, 3.93+, 25.10+, NAV 2.1.2+, The Pif, or Pif Paf B v1.0, in May, Hungary. Pif is a vof . ,and . The the Pif at the top of #the , as rby the DOS ?by 800 12's not be moved. Pif in the Pif , it ,and . X. If X, it qof 760 (. . qd in by 760 to 774 (. In both cases, the at the end of the The can be in the Pif "PIF-PAF B v1.0" "Nincs kegyelem !" the Pif notice and continue to @the longer the is in X, Pif copy of , decreasing by an PZPAPN : Pila Unknwon R: 1,731 - 1,746 4: PRhA - 25.10+, The Pila . Its . Pila is a vof . and . , but not The the Pila at the top of #the |12's not be moved. rby the DOS ?by 2,016 nby Pila in the Pila , it ,and . qof 1,731 to 1,746 at the end of the a. The in the DOS not be The in the 4, and is not "pilapilapilapilapilapilapilapilapilapilapilapilapilapilapila" It is if Pila bears ity to the Year- PZPAPN Ping Pong : Ping Pong Bouncing Ball, %, Bouncing Dot, Italian, Italian-A, Vera Cruz G: March, 1988 Graphic M(see ); TSR; BSC R: N/A 4: BRsF - \, IBM , NAV, , VET, K, CleanUp, , NAV, or DOS SYS The Ping Pong is a breported in March 1988. The Ping Pong wFloppy Ks. Later xthe as well. is on a random basis, a bouncing ball or dot s on the Mcan stopped through a %. No damage is apparently done. The Ping Pong is extinct, , Ping Pong-B listed #, is a 6MS-DOS of Ping Pong are: Ping Pong-B: A later of the Ping Pong May, 1988. Ping Pong-C: to Ping Pong-B, Nnot the bouncing ball effect. : Argentina PZPAPN Pirate : Pirate Lima Lisbon, Portugal R: 609 4: ONCK - IBM , NAV 2.1+, The Pirate Gin Lisbon, Portugal in , by Pedro Lima. Pirate is a Pirate is search the currect Efor an it finds an a, it xit, b609 (of the Pirate was less 609 (. If the was less the be no in the =and in the DOS If Pirate Nnot find an . x, it continue searching the Euntil the %s the %the a Pirate in a hang. The can be din all Pirate: "1989 / Software Pirates - Fast Serial - Portugal" PZPAPN Pisello : Pisello 1030 H: j; TSR Italy R: 1,030 - 1,040 4: PRsE - , VET, NAV 2.1+, The Pisello . It is fItaly. The Pisello is a vof . bPisello X, the Pisello as a low TSR of 2,112 nby the TSR, nby the mapping utilities. the Pisello , it qof 1,030 to 1,040 (. The at the end of the . The =and the DOS not be in the 4in Pisello . The in the "My is PISello BYE 31-1-92" It is what Pisello of Pisello are: Pisello-B: gequivalent to Pisello, Pisello-B is a minor May, PZPAPN Pitch : Pitch H: j; TSR; high pitched noise emitted speaker France R: 593 4: PRsCK - 1.15a+, 2.43a+, The Pitch Gin France in . Pitch is vof . It can be a very noisy bPitch X, the Pitch as a low TSR of 1,568 (. It hook {1C, 21, 25, 26, 2F, and 47. In addition to the TSR, it allocate an 64K of , so actually @by 65,680 , the xthe on both the :and C: the Pitch , it X, along on the Oand OC:. qof 593 at the !of the a. The can be in all "*.com .. *.*" "DOS the Pitch for 15 to 30 minutes, emit a high pitched noise fthe speaker. of Pitch are: Pitch-B: gequivalent to the has five differ. : France PZPAPN Pixel : Pixel V-345 Endangered H: 1988 Greece R: 345 4: PNC - \, IBM , NAV, C, VET, \, or The Pixel distributed in Greece in 1988 by Pixel magazine. It is a +. Since its release, many of the Pixel are listed #under , or under the entries the Pixel X, the Pixel xall . `in the 345 at the !of the a. The =and in the DOS to the =and The can be the Pixel "=!= sick U:Call doctor or buy Pixel for cure description" "WB" "WB" is the umarker for the Pixel , and is din the third and fourth (of all The Pixel Nn't do of Amstrad are: MS-748: on the Pixel , MS-748 wall of the . in the qof 748 at the !of the a. The =and the DOS to the =and . The dnear the !of all MS-748 "MS*. Pixel-257: to the Pixel adds 257 (to the All mhad 0to "4-24-80 12:04a". "Fucking hell:You wet pussy" The two character ASCII "WB" the third and fourth (of all is the umarker for the . Pixel-257 Mthe second all of the . the s. At , the Y, but the ed to the DOS prompt Pixel-275: to the Pixel-257 275 (to the w. It Nn't the , and are the same as for Pixel-277. Pixel-277: to the Pixel , except is now 277 , and 8any . The replaced 4to produce a parity 50% of the : V-277 Pixel-283: to Pixel, adds 283 (to the =and in the DOS to "4-24-80 12:04a". are: "=!What a stupid you are Pixel-283 Nn't do Pixel-295: to Pixel, adds 295 (to the =and in the DOS to "4-24-80 12:04a". din Pixel-295 are: "=!= sick U:Call doctor or buy PIXEL for cure description" Pixel-295 Nn't do Pixel-297: on the Pixel in the qof 297 at the !of the a. The =and in the DOS not be The can be in the 4of all Pixel-297 "Happy Birthday,Cheef" Pixel-299: to Pixel, except of the is 299 : V-299 Pixel-342: to Pixel, except of the is 342 (. The "WB" umarker in the 0to "IV". Pixel-779: to Pixel, except the of the now 779 mhad =and set to the =and . The in the are: "IV" (the marker) and "*. ,". Pixel-779 is actually much smaller , the remainder of the Pixel-837: to Pixel, the of the is now 837 mhad =and set to the =and are: "=!= I love you so much !!!" "-- Francis" Pixel-847: to Pixel, except of the is 847 : V-847 Pixel-847B: to Pixel-847, except in the is now in Spanish and is: "=!= En tu PC hay un RV1, y esta es su quinta generacion". distributed by a magazine in Spain in aNOCARGAR. : Spain : V-847B Pixel-850: members of was in March by 850 at the !of the 7the same as the Pixel. V, March : Pixel 2 Pixel-850 Dropper: The Pixel-850 Dropper is the "dropper" aof the Pixel-850 is 384 , and xall . the Pixel-850. V, March : S-847 Pixel-852: to the Pixel-847 not 8any . The sample of by the author did not 8any however, replicating on a test , all fthe video buffer, implies the sample was the distribution of the checks (4-5 of . to determine if the awas s. If (4-5 are "SS", the assumes the ais already : V-852 Pixel-854: to the Pixel-852 , Pixel-854 differs primarily in it adds 854 (to the . Portugal-500: on the Pixel fPortugal in May, . It is a xall the . `in the qof 500 at the !of the . The =and in the DOS to the . Portugal-500 8any , and : Portugal, May See: Amstrad Hell Pixie Silly Silly-365 PZPAPN Pixie : Pixie Pixie 1.0 Kread R: 812 ((and multiples 4: PNCK - D: NAV, , IBM , VET, 2.43a+, The Pixie, or Pixie 1.0, a source in the . Pixie is a vof . +. It is very buggy. Pixie is X, the Pixie xall of the . `in the E. A bug in Nnot recognize it has completed tall of the . `, so it promptly starts re them. continue until the %s the Pixie qof 812 usually the be a multiple of 812 due to the re us. The at the !of the a. The =and in the DOS to the the last u/ re The can be din all Pixie "The Pixie v1.0 - Written by NegativX" "- Copyright (c) , -SiTT-" The Pixie is actually much smaller (, around 306 . The be filled binary 00 3, or random data Zof . the Pixie in a Kread ring. Uis on the adue to the %ing while the was writing to the of Pixie are: Pixie 1.0B: A minor of the Pixie May, See: Pixel PZPAPN Plastique 00M I PTM : Plastique Plastic Bomb, Plastique 3012, Plastique 1, Anticad 3 TSR; . j; possible slowdown or bomb noises Taiwan R: 3,012 4: PRsA - , IBM \, NAV, , VET, : CleanUp, or The Plastique, or Plastic Bomb, it comes to us fTaiwan. Plastique is a generic vof . ,and . Nnot +. Unlike the Plastique-B listed Nnot xfloppy The Plastique is X, the as a TSR in low . The TSR is 3,264 , and hooks , it attempt to ,or . is rather "buggy", and it is not always successful in it is successful tthe a, the q. For `, the qby 3,012 (. For qbetween 3, 012 and 3,020 Plastique attempt to for any reason, again, it is not always successful. 20th of any year, the Plastique , it do either of two things. It either progressively slowdown the , or it intermittently emit "bomb" noises fthe speaker. of Plastique are: HM2: The earliest , it . Executing an s in the hanging requiring a re : Taiwan, May Plastique 4.21: A of the Plastique the real difference is the encryption of the is slightly different. wise it ms exactly the same as Plastique. : Taiwan, Plastique COBOL: A of the Plastique is 3,004 , and its TSR is 3,248 . The character can be is "COBOL". of the Plastique related es. by 3,004 3,004 to 3,019 of the . Between 1st and 21st, the progressively slowdown the 20 minutes, the 50% of its speed. 30 minutes, the may lockout the , as well as corrupt the 's CMOS configuration. Between 22nd and >31st, the Nnot activate, and no slowdown or CMOS See: Invader Plastique-B Tobacco PZPAPN Plastique-B : Plastique-B Plastic Bomb, Plastique 5.21, Plastique 2, Anticad 1 TSR; . j; BSC; Taiwan R: 4,096 4: PRsAB - W, & , IBM \, NAV, , VET, : CleanUp, or The Plastique-B, or Plastique 5.21, is a later of the Plastique . Like Plastique, it is a generic vof . ,and . . It Nnot If the =is before 20th, the Plastique-B is X, the as a TSR in low . The TSR is 5,120 {08, 09, 13, 21, and ED are nby the If the 20th, the in high #the &. The same nby the , it attempt to ,or . for any reason. It has had many of the "bugs" fixed were in Plastique, and is usually successful in ,and . by 4,096 Plastique-B xthe of any accessed on an 20th, , the Plastique-B either progressively slowdown the or cause "bomb" noises to be emitted periodically fthe speaker. It may the contents of all depending on if a predetermined limit in the See: Invader Plastique PZPAPN Play Tetris : Play Tetris R: 552 4: PRhCK - 2.43a+, 6.04+, \2.07+, V100+, V100+ The Play Tetris . Its . Play Tetris is a vof . no relationship to the Tetris game or the Tetris game's author. bPlay Tetris X, the Play Tetris at the top of #the &, hooking , as rby the DOS ?by 768 |12's not be moved. the Play Tetris , it qof 552 at the end of the a. The in the DOS not be . The can be in the 4in all Play Tetris "PLAY TETRIS,HI-HI-HI..." PZPAPN Plovdiv 1.1 : Plovdiv 1.1 Poland R: 800 4: PRCK - , IBM ., NAV 2.1+, , VET, The Plovdiv 1.1 . It is fPoland. Plovdiv 1.1 is a of . The Plovdiv 1.1 is Plovdiv 1.1 in the DOS Data area in . It hook {1E, 21, and 22. be no rby the DOS the Plovdiv 1.1 , it xone . ain the X, a DIR 5is performed, or a .BAT X. It for any reason. Plovdiv 1.1 of 800 be hidden the . The at the be no 2to the =and in a DOS . The in the "*.com" "(C)Damage inc.Ver 1.1,Plovdiv, of a Plovdiv 1.1 uare the DOS indicate Ton all `if it expect 5line input may and fail to function It is if Plovdiv 1.1 See: Plovdiv 1.3 PZPAPN Plovdiv 1.3 : Plovdiv 1.3 Plov Poland R: 1,000 4: PRhAK - \, IBM , NAV 2.1+, The Plovdiv 1.3 . It is fPoland. Plovdiv 1.3 is a of . ,and . The Plovdiv 1.3 is Plovdiv 1.3 at the top of #the {21 and 22 , as by the DOS ?by 1,344 |12's moved. Plovdiv 1.3 , if it was not the Plovdiv 1.3 , it xone . ,or . ain the any or .BAT X, a DIR 5is performed, as well as `are for any reason. Plovdiv 1.3 of 1,000 be hidden the . The at the end of be no 2to the and in a DOS . The in the "*.*" "(C)Damage inc. Ver 1.3 Plovdiv S.A." of a Plovdiv 1.3 uare the DOS indicate Ton all `if it expect 5line input may and fail to function It is if Plovdiv 1.3 of Plovdiv 1.3 are: Plovdiv 1.3B: on Plovdiv 1.3, uses 1,840 , hooking {21 and 22. Like Plovdiv 1.3, it ,and . X, DOS DIR 5issued, or a .BAT it completes tall of the in the E, it start tthe C: O. The in the "(c)Damage inc. S.A. Ver 1.3B IX.91 Plovdiv". : Poland May, See: Plovdiv 1.1 PZPAPN Plumbum : Plumbum Plumbum-A =month Poland R: 534 4: PNCK - D: VET, 3.93+, 2.43a+, 6.04+, V100+, V100+ The Plumbum, or Plumbum-A, along seven of the . The Plumbum es is fPoland, and are on the W13 one of the Plumbum es is the Plumbum xone . in the qof 534 at the end of the a. The =in the DOS , the month in the =having set to "13". The can be in the 4in all Plumbum "osoftyright Microsoftyright Microsoftyright" "Microsoftyright Microsoftyright Microsoft 1988" Plumbum Nn't to do of the Plumbum Plumbum-B: A 534 , Plumbum-B 1the month in the `to "14". The in the 4are: "Plumbum Plumbum Plumbum Plumbum Plumbum Plumbum" "Plumbum Plumbum Plumbum Plumbum Plumbum !!" : Poland Plumbum-C: A 543 , Plumbum-C wone . 543 at the end of the a. The =in the DOS , the month field having set to "15". The can be in the "osoftyright Microsoftyright Microsoftyright" "Microsoftyright Microsoftyright Microsoft 1988" : Poland Plumbum-D: A 450 , Plumbum-D wone . is executing, adding 450 (to the the ='s month in the DOS Eset to "15". The can be in the : Poland Plumbum-E: to the Plumbum-D adds 450 (to the w. The =in the DOS the month is "15", and the day field may 7the same as Plumbum-D. : Poland Plumbum-F: to the Plumbum adds 534 (to the . wand sets the month in the DOS =to "13". The can be in the "osoftyright Microsoftyright Microsoftyright" "Microsoftyright 141$FLuofyright Microsoft 1988" : Poland Plumbum-M1: A 679 of Plumbum, Plumbum-M1 sets the ='s month in the DOS "15". The can be in the "BE CAREFULL!!!" "IN YOUR ,PUTER IS ONE POWERFULL CREEPER!!!" "Hey you! You are lucky! YOU HAVE ME!!!" "written in WARSAW (c) Plumbum" : Poland Plumbum-M2: A 518 of Plumbum, Plumbum-M2 sets the ='s month in the DOS "15". The can be in the "BE CAREFULL!!!" "Hey you! You are lucky! YOU HAVE ME!!!" "written in WARSAW (c) Plumbum" : Poland See: W13 PZPAPN Plutto : Plutto R: 602 4: PNCK - \, VET, 1.15a+, 6.00+, 3.93+, 25.10+, NAV 2.1.4+, The Plutto , and is fthe Plutto is a vof . the Plutto xone . in the E, it may the Plutto qof 602 the end of the a. The =and in the DOS not be . One can be in all the Plutto "pLuTto_B" Plutto Nn't to do PZPAPN : Poem ACDC Republic of South Africa R: 1,825 - 1,888 4: PRfCK - , IBM , NAV 2.1+, 1.53S+ The Poem ~in the Republic of South Africa in , by Oliver Steudler. Poem is a vof . The Poem is X, the in low {01, 03, 21, and 7C nby the Poem Poem is , it very small . X. If X, it sas well. Poem 1,825 to 1,888 at the end of the be no 2to the in the DOS The copy of Poem keeps track of how many |21 has called. |21 has called 2,112 , the Mthe cpoem on the M, and the be prompted to press Escape to continue: "Void - Composed by Marvin Giskard for T In a field a million buds stood,Over them a million days came - a day a bud - opening up one by one Fed light.But one didn't do as s did,It waited for your loving rays to shine upon it to open its pedals revealing the pure beauty of its sincere love. Never " unfaithful to its dream of the day of your light, Forced to resist any light but yours - because of it - until the day the brilliance of your life sustaining light shines it : wanting, wishing, waiting. Many were the buds you rather shined upon opening them - revealing phony colours. I ed your light onto me but s you tried instead, No subtle motion r Qed you, still I refused light - holding out for you - Even your light fade, Not having d one to do your light justice, mine still be : wanting, wishing, waiting. 22 Nov - 21 Dec" >21 of any year, Poem activate. At , the Mthe poem, as well as b1,221 of the OC:, Scopy of the PZPAPN Pogue : Pogue ; music R: 2,973 - 3,850 4: PRhC - , VET, o, NAV 2.1+, 2.43a+, The Pogue . It is '. Pogue is a vof . , but not those ma base starts the three ,". Pogue 7portions of ffour es: 512, ;, Seventh Son, and Yankee Doodle. It employs a complex encryption mechanism, and detection of require an algorithmic approach. an un Scopy of , and as a to the as an one of the four es on it is The the Pogue the Pogue at the top of #the , as rby the DOS ?by 9,728 |12's moved. {1C and 21 nby the the Pogue , it X, or copied. In the case of copying, both the source and the target s. The exception is Pogue aif the base starts the three ,". is the mechanism used by the to avoid Pogue qof 2,973 to 3,850 (. The at the end of the . The =and in the DOS by the uprocess. Usually the Pogue encrypt using its garbling encryption mechanism on `. In `, no in the an un Scopy of the 4. In cases, the "Pogue Mahone!" - or - "Pgoue Mahone!" "TNX2DAV" The un us of Pogue on `as well the Pogue may be detected by ners as any of the four es on Pogue is The Pogue play music on the speaker and the is between 08:00 and 09:00. See: DAME Groove PZPAPN Pojer : Pojer Prague, Czechoslovakia R: 1,919 4: PRhAK - 6.04+, \2.07+, The Pojer Gin Prague, Czechoslovakia, in . Pojer is a vof . bPojer X, the Pojer at the top of but #the &, not moving |12's , as rby the DOS ?by 2,160 nby Pojer in , the Pojer ,and . qof 1,919 (. The Pojer at the end of . The =and in the DOS It is what Pojer PZPAPN Polimer : Polimer Polimer Tapeworm Hungary R: 512 4: PNCK - , IBM NAV, , VET, The Polimer Gin Hungary in is a vof . the Polimer X, the "A le' jobb kazetta a POLIMER kazetta ! Vegye ezt !" can be dnear the !of all L, the attempt to one . aon the Oand E, and one . on the C: are between 512 and 64,758 . If the . xhas the Read- attribute, it not be s, and the $ERROR is actually 456 by 512 at the !of the Nnot to do $replicating. PZPAPN Polish 217 : Polish 217 217, Polish Stupid, V217 Koszalin, Poland R: 217 4: PNCK - \, NAV, IBM , VET, The Polish 217, or Polish Stupid, Gin Koszalin, Poland, in is a the Polish Stupid the xthe din the 217 at the end of the the hex 5757h. The =and in the Eis not A side note on the copy of ed to by the ,SPEC en mental variable is sby the , the [a warm re Nnothing $replicating in its of Polish 217 are: Polish 217 B: The Polish 217 B 's major difference is s, a warm re in the "Specified ,MAND search Ebad". in the Land the terminated: Path not can detect Polish 217 may not be able to detect Polish 217 B as it has V72 and not detect it. Polish 217 C: The Polish 217 C is very to the Polish 217 B . It has had 14 order to avoid detection by products. PZPAPN Polish 529 : Polish 529 529, P529, Piter, Piter2 j; TSR Poland R: 529 4: PRsCK - , NAV, , IBM , VET, The Polish 529 in Poland. is a vof . `. It +if it is The the Polish 529 X, the as a low TSR of 1,664 the , any . aover 1600 sby the show a qof 529 (and at the !of the Nnot to do of Polish 529 are: Polish 529B: on the Polish 529 , the major difference TSR is 1,648 PZPAPN Polish 583 : Polish 583 Polish-583, Poland R: 583 4: PNCK - \, NAV, IBM , VET, The Polish 583 ated in Poland and was is a vof . Polish 583 is X, the xone aon the Oand E. The newly by 583 the at the end of the The =and in the Eis not Nnot do PZPAPN Polish : Polish Polish do not Poland R: 150 4: PNCK - V99+, 2.43a+, 6.04+, \2.07+, V99+, The Polish . It is Poland, and is a vof . the Polish the xone . in the E, and to the DOS prompt. qof 150 at the end of the a. The and in the DOS to the =and . One in the "*.com" Nnot do not function of Polish Polish -158: to the Polish adds 158 the . : Poland Polish -226: to the Polish adds 226 the . : Poland PZPAPN Polish-45 : Polish-45 P-45 Poland R: 45 4: ONCK - , IBM , VET, NAV 2.1+, The Polish-45 corrupts the Polish-45 is X, the xall . in the Eby over- writing the (of the a copy of the Since the (are , the permanently damaged and no function be a qif the . awas smaller (. In case, the mhad =and in the DOS to the =and Polish-45 should be Ad and replaced clean copies. It is not possible to dis as the (of the lost. PZPAPN Polish-376 : Polish-376 V376 Poland R: 376 4: PNCK - , IBM , NAV 2.1+, .1.4+, The Polish-376 ated in Poland and was is a vof . Polish-376 is X, the xall . in the E. If +resides in E, it well. Polish-376 376 at the end of the The =and in the DOS to the =and Polish-376 Nnot to do PZPAPN Possessed : Possessed Possessed-2443, Possessed 1.03A, Possessed 1.03B, Possessed 1.07, Possessed 1.07B, Possessed 1.08 j; TSR; ; write fault Australia R: 2,446 - 2,460 4: PRsAK - , NAV, , IBM , VET, 25.10+, 1.53S+ The Possessed , in Australia. Possessed is a vof . ,and . bPossessed X, Possessed as a low TSR of 3,008 {08, 21, and 24 nby the , if it was not Possessed is , it ,and . X. Possessed at the end of all the exception by 2,446 (. . by 2,446 to 2,460 (. In the case of be no it is s. All =and in the Possessed 8the "POSSESSED! Bwa! ha! ha! ha! ha! Author: JonJon Gumba of AdU" Possessed has 15 to 20 minutes, it occasionally erase a Yit. to copy in the receiving a "Write fault writing device ,1", the source and target of the operation was a of Possessed are: Possessed 1.03A: Possessed 1.03A is a of the Possessed 's TSR 2,912 , hooking {08, 21, and 24. It becoming , and ,and . X. . by 2,367 (. . by 2,367 to 2,381 not . In all cases, the at the end of the the for the , the in the Possessed 1.03B: to Possessed 1.03A, Possessed 1.03B's major characteristic its TSR is now 2,928 Possessed 1.07: to the Possessessed adds 2,446 (to . +, and 2,446 to 2,460 (to . . Its in TSR is 2,992 (, hooking {08, 21, and 24. $the din the the , two d: "*. ," and "*. Possessed 1.07B: to Possessed-2443 and Possessed 1.07, TSR is 3,008 by 2,443 by 2,443 to 2,457 Nnot has 17 differ fPossessed-2443. May, Possessed 1.08: to Possessed 1.07, 's major difference is 7one : "Fucker". Possessed-2443: Three (smaller the Possessed Possessed-2443 was . Its TSR is 2,992 {08, 21, and 24 2,443 by 2,443 to 2,457 Nnot s. Possessed-2443 7the din the Possessed PZPAPN Possum : Possum /corrupted; R: 202 4: ONCK - 2.43a+, .1.4+, 6.04+, \2.07+, The Possum . Its . Possum is a the Possum xthe in encounters in the 202 (of the host . Since the 202 (of the host are , the permanently corrupted and no longer function Possum q, unless was less (, in the . The in the DOS not be The can be din all the Possum "IN HASTINGS addr UD9EB, 02" , WOLVERINE v1.01" "by Nick(ie) Haflinger" the Possum sall of the . the Zof an in a "I AM ' x' IN HASTINGS addr UD9EB,02" The ' 8a group of garbled Possum Nn't do See: Hastings PZPAPN Pregnant : Pregnant d to "PREGNANT" R: 1,199 4: PRhCK - , NAV 2.1+, The Pregnant Gand Pregnant is a vof . The Pregnant is X, Pregnant at the top of #the rby the DOS 2,048 nby the , Pregnant are hides the it is , so the not see a is performed. The actually by 1,199 at the !of the had a of 12:00a in the ma blank Pregnant future =or event, at 2the s in Fories to "PREGNANT". The triggering factor has not yet determined. PZPAPN Press : Press R: 1,024 4: PNE - 6.00+, 2.43a+, \2.07+, V100+, V100+ The Press . It is fthe . Press is a a Press X, the Press xone . in the qof 1,024 at the end of the a. The in the DOS not be . The in the 4in all Press "Press any key" "\ IRUS S" The Press Mthe "Press any key" PZPAPN Prime : Prime Prime Evil j; unexpected Sweden R: 580 4: PNCK - \, VET, 6.00+, 3.93+, NAV 2.1.2+, 25.10+, The Prime, or Prime Evil, . It is fStockholm, Sweden. Prime is a vof . the Prime X, the Prime locate and xone in the qof 580 at the !of the a. The in the DOS not be The in the Prime 4, and as such cannot be seen in "*.C*" "Prime Evil! (C) Spellbound, Line Noise 4d in Stockholm, Sweden." "Please spell my right!" the Prime sall of the . in the Zof an in a warm re ring. PZPAPN Print : Print EB 21, 8290, PRTSC , 1989 BSC; Kaccess slowdown Bombay, India R: N/A 4: BR - \, NAV, IBM , VET, : CleanUp, M- K, NAV, or DOS SYS The Print ~in Bombay, India in 1989 by Neville Bulsara. It is the in India. are two s of Print , the later having had bugs fixed. fa Print O, the in the top of . The adjusts the amount of thinks is zed. show is 2K less zed. On floppy Ks, the of the be copied to becoming , the xany or floppy is accessed by the notice Kaccesses done for any reason be much slower expected. In cases, the root show apparently garbage entries in it. entries are actually part of the The of the Print is buggy, and as such Nn't actually accomplish having to do printing s to on the Ping Pong , and identify it as such. of Print Print -2: Print -2 is the later, bug fixed the Print attempt to perform a print or dump to the printer every 255 KI/Os PZPAPN Problem : Problem Problem-856 H: R: 856 4: PRhAK - 1.15a+, 6.00+, V99+, 2.43a+, \2.07+, V99+, The Problem . It is . Problem is a vof . ,and . bProblem X, the Problem at the top of #the , as rby the DOS ?by 1,008 by the sif it was not sby the , the Problem ,and . X, copied, or for any reason. qof 856 at the end of the a. The =and in the DOS not be . The can be in the 4in all Problem "THIS IS YOUR PROBLEM !" hang the Problem of Problem are: Problem-734: An earlier of the Problem is 896 hooking |21. It adds 734 (to the . w, and Nnot 8any Unlike the Problem , it Nnot The at the end of the a, and the =and in the DOS not be Problem-863: A 863 of the Problem is 1,024 hooking |21. It adds 863 (to the . w, and 7the same . The executing the do not PZPAPN Protecto : Protecto Protect, Protecto-1157 H: fail to R: 1,157 4: PRtAK - , VET, 6.00+, 1.15a+, 3.93+, NAV 2.1.2+, The Protecto, or Protecto-1157, It is reported to be fthe . Protecto is a vof . ,and . bProtecto X, Protecto at the top of but #the &, moving |12's , as rby the DOS ?by 2,064 1C and 21 nby Protecto in the Protecto , it and . qof 1,157 at the end of the a. The =and in the DOS not be . The can be din all Protecto aprotection" anot "masm.exe" Protecto may larger 64K are of Protecto are: Protecto-1196: to the Protecto . The major differences are {1C, 21, and 24 are nby the and 1,196 (. The can be din all Protecto-1196 "sl.exe" aprotection" anot Protecto-1355: to the Protecto . The major differences are {1C, 21, and 24 are nby the and 1,355 (. The can be din all Protecto-1355 "c.exe" aprotection" anot See: CPSU-2535 PZPAPN Proud : Proud V1302, P1 Related H: FAT entry R: 1,302 4: PRtCK - \, NAV, , VET, The Proud, or V1302, 'by Vesselin Bontchev. Proud is a of . The Proud is X, the checks to determine if |13 is in use by an and if it is, the hang the . If |13 is not in use by an , Proud at the top of , but #the @by 8,192 be replaced by the , it certain candi ranges for any reason. The candi ranges are: 2,048 - 14,335 16,384 - 30,719 32,768 - 47,103 49,152 - 63,487 Proud is an , and is unusual in it "splits" the sinto two parts, placing the between the two sections. Proud is unable to distinguish ahas s, so . `can smultiple the exception of add 1,302 (to the `generally don't on the uas the part of the 00h area of Proud can be a damaging a probability of 1 out of 256, it may swap entries in the PZPAPN PS-MPC 00IC= PTIC : PS-MPC see es listed H: Varies depending on present R: Varies depending on present 4: PONAK - 6.00+, V100+, 2.45+ PS-MPC is a 4generation developed by Phalcon/Skism during the summer of . It s to be response to the VCL generator fNowhere Man of Nuke. The es listed #are were generated, at least in part, the PS-MPC generator. The 644 and Walkabout din the wild in the and Canada. were created PS-MPC are: 203: The 203 . Its . The 203 is a vof . the 203 xone . in the qof 203 at the end of the a. The and in the DOS not be One in the "*.com" The 203 Nn't do 644: The 644 . It is vof . ,and . `, but not Zof an in all . ,and . in the Ebecoming the 644 644 at the end of the The =and in the DOS not be . The the 4: "*.exe *.com" 696: The 696 . It is vof . ,and . Zof an in three . Wor . in the Ebecoming preference to . the 696 qof 696 at the end of the a. The =and in the DOS not be . The in the "c:\autoexec.com" "*.exe *.com" Abraxas: , Abraxas is a 546 vof . ,and . +. It wone in the a preference for . qof 546 the at the end of the a. Abraxas not always recognize a and re xthe s, it adds an (. The =and in the DOS not be . The "*.exe *.com" "[Z10] Abraxas" not function the to the DOS prompt %failures +has Alien-1: ^, 1993, Alien-1 is a 571 vof . ,and . +. It at the top of #the the X, hooking 21. , as by the DOS ?by 1,216 , it ,and . qof 571 at the end of the a. The in the "ALiEN 1 Levia ^, 1993. Alien-3: ^, 1993, Alien-3 is a 625 vof . ,and . +. It at the top of #the the X, hooking 21. , as by the DOS ?by 1,328 , it ,and . qof 625 at the end of the a. The in the "ALiEN 3 - Demon Spawn Levia ^, 1993. Anathema: , Anathema is a 588 vof . ,and . +. It at the top of #the the X, moving 12's rby the DOS 2,048 nby Anathema in , it ,and . qof 588 at the end of the a. The in the "[ANATHEMA] THE STRANGER" cross-linking of and data %failures %copy of Cheesy: , 1993, Cheesy is a 381 vof . . It wone . ain the qof 381 at the end of the a. The and in the DOS not be . The in the 4in all Cheesy "[MPC] Dark Angel of PHALCON/SKISM" "[Demo W] for 40Hex" "*.exe" , 1993. Chuang Tzu: , 1993, Chuang Tzu is a 970 vof . ,and . , but not +. It wtwo . Wor . in the qof 970 at the end of the a. The =and in the DOS not be . The in the Chuang Tzu "No one has lived longer a dead child, and Methusula died young." "Heaven and Earth are as old as I, and ten thousand things are one." "-- Chuang Tzu, 300 B.C." "[MPC] , 1993. Cinco de Mayo: ^1993, Cinco de Mayo is an 885 vof . , but not +. It wthree . in the qof 885 at the end of the a. The =and in the DOS not be . The in the Cinco de Mayo "** Cinco de Mayo **" "No trabajas hoy." "[MPC] [VCL] [Cinco de Mayo]" "Danzig Tanks to Dark Angel and Nowhere Man for excellent creation ! more to follow" "*.exe *.com .. US" ^, 1993. Clint: , Clint is a 1,076 vof . ,and . +. It at the top of #the the X, moving 12's rby the DOS 3,072 nby Clint in , it ,and . qof 1,076 at the end of the a. The in the "[CLINT] (c) Copyright THE STRANGER" "THIS VIRUS PROUDLY MADE IN THE USA!" Crumble: , Crumble is a 778 vof . ,and . +. It wtwo in the qof 778 the end of the a. The =and in the DOS not be . The "*.exe *.com" "[MPC]" "[CrumblKouch] Kouch" Death 2: , Death 2 is a 671 vof . ,and . , but not +. It wone in the preference to . qof 671 the at the end of the a. The =and in the DOS not be . The "*.exe *.com" "[MPC] The Of Death 2" "The Happy Hacker" Eclypse: , Eclypse is a 641 vof . ,and . +. It wone in the preference to . qof 641 the at the end of the a. The =and in the DOS not be . The "[MPC] [Eclypse] Abraxas" "*.exe *.com" Hiccup: in March, 1993, Hiccup is a 533 vof . at the top of #the X, hooking |21. , as rby the DOS ?by 2,048 qof 533 the at the end of the a. The in the "[N.I.T is a waste of money!]" "[Created at the National Institute of Technology]" "[Hiccup]" ""May the world fear the hiccup! Created Feb.1993" March, 1993. Kersplat: , Kersplat is a 670 vof . ,and . +. It at the top of #the the , as rby the DOS ?by 2,048 nby Kersplat in ,and . qof 670 at the end of the The in the "[KERSPLAT] THE STRANGER" McWhale: , McWhale is a 1,125 vof . ,and . , but not +. It wtwo . Wor . preference for of 1,125 at the end of the a. The =and in the DOS not be of the X, the Lin the middle of the M, scrolling fright to left on one line: "Beware!!! Anti- .John .McAfee .wrote WHALE HONEST!!! , the follow "- (c) Abraxas Warez The in the as is the " ABRAXAS -" "[MPC] [McAfee' Whale] [pAgE]" "*.exe *.com .. US" Unexpected kmay Mimic-Den Zuk: , Mimic-Den Zuk is a 4,893 wtwo . qof 4,893 the at the end of the a. The =and in the DOS not be . Several in the 4, and are not "DENZ-SIM requires DOS 2.0 or later" "DOS 2.x -" is the wrong "check for On Fridays, Mimic-Den Zuk . At Zof an of the . in the by a trojan. trojan "Den Zuk" logo on the it is and to the DOS prompt. The s the b4,243 (of trojanized . Mimic- , Mimic- is a 2,832 vof . ,and . , but not +. It xeither all . Wor all in the qof 2,832 at the end of the a. . may be s, adding an 2,832 be no 2to the =and in the DOS . Mimic- is an Several in the trojanized . "JERU-SIM. ,V1.02" "Written by URN KOUCH" "Copyright (c) URN KOUCH requires DOS 2.0 or later" "DOS 2.x -" Mimic- on Fridays. Upon Zof an the . in the "trojanized. The !of the . a small mimics the behaviour of the Napolean Complex: , Napolean Complex is a 729 vof . +. It wthree in the preference for . qof 729 the at the end of the a. The =and in the DOS not be . The "LMluvsSI" "Dynamite cums in small packages!" "[NAPOLEAN ,PLEX v1.0] less One -- ANARKICK SYSTEMS" "*.exe *.com .." are X, as well as the s write a portion of its 4to the No Wednesday: , No Wednesday is a 520 vof . , but not +. It wone in the qof 520 the end of the a. The =and in the DOS not be . The "*.com" "[MPC] [No Wednesday]" "* by Goethe *" "for [AKL/4269]" anot No Wednesday on any Wednesday, at Zof an in the fake anot d." and the to the DOS prompt. The run normally on any day of the week. Page: , Page is a 570 vof . ,and . X, it xall of the . in the E. If the . were instead xall of the . in the qof 570 the end of the a. The =and in the DOS not be . The in the "C:\AUTO "*.exe *.com \ [pAgE]" Scarey: ^, 1993, Scarey is a 739 vof . ,and . +. It at the top of #the , as rby the DOS ?by 1,552 nby Scarey in ,and . qof 739 at the end of the Scarey 4to emit a buzzing noise on the speaker while performing a read of the ^, 1993. Schrunch: , Schrunch is a 458 vof . +. It wone in the qof 458 at the end of the The =and in the DOS not be . The are "[ZEB (C) ] [SCHRUNCH[ Abraxas 2]" "*.com" On VGA , executing an in the "placed in 50 line mode, and beeping may . On non-VGA , garbled may on the Skeleton: , Skeleton is a 556 vof . ,and . +. It wthree in the preference to . qof 556 the at the end of the a. The =and in the DOS not be . The "[MPC] [Skeleton] Deke" "*.exe *.com" kmay has run out of non- : Germany Sunday Death: , Sunday Death is a 644 vof . +. It wall . and . in the qof 644 the end of the a. The =and in the DOS not be . The "[BCA]" "Sunday Death -- (c)BCA" "Raven" "*.exe *.com" On Sundays, Zof an in a hang ring. Test 441: , Test 441 is a 441 vof . . It wthree . all of the . in the s, it move upward in the Estructure. qof 441 at the end of the a. The =and in the DOS not be . The can be in the in all as the is not "[MPC] [Test] Sam Hain" "*.exe .." Tongue: , Tongue is a 597 vof . ,and . +. It wthree in the preference to . qof 597 the at the end of the a. The =and in the DOS not be . The in the 4in all "*.exe *.com" Toys: , Toys is a 773 vof . ,and . +. It wtwo . ,or . in the preference given to . qof 773 at the end of the a. The =and in the DOS not be . The "All my toys are broken" "And so am I inside." "The carnival has closed" "Years ago..." "[VCL/MPC]" "*.exe *.com" Walkabout: , Walkabout is a 573 vof . ,and . +. It at the top of #the the , as rby the DOS ?by 2,048 nby Walkabout in ,and . qof 573 at the end of the The in the "[WALKABOUT TSR VER 1.0] THE STRANGER" Warez D00d: , Warez D00d is a 1,803 vof . and .OVR +. It candi in the qof 1,803 at the end of the a. The =and in the DOS not be . The "HEY!!! Blow ME, WaReZ FAGGOT" "You got sorta lucky!!!" "I am afraid I am going to mto smash your WaReZ, d00d!!!" "Go ahead! Call the police and tell them" "[NuKe]" "paid you a visit!" "*.exe *.ovr *.com" Mthe graphics, and corrupt in the "DONT'T YOU KNOW THAT PIRACY IS ILLEGAL I am afraid I am going to mto smash your Warez, d00d!!! Go ahead! Call the police and tell them [NuKe] paid you a visit!" Z10: , Z10 is a 704 vof . ,and . , but not +. It wtwo in the preference given to . qof 704 at the end of the a. The =and in the DOS not be . The "*.exe *.com" "[PF] [Z_10] Paul Ferguson" Zeppelin: , Zeppelin is a 1,508 vof . ,and . +. It wfive in the preference given to . qof 1,508 at the end of the a. . may be re sby the , adding an 1,508 u. The =and in the DOS not be . The "*.exe *.com" "Ripped fucker off" "SHIT!!! Wont work "[pAgE] [SwanSong] Gandolph" The Zeppelin activate tfive . , the be cleared and a color graphic of a zeppelin , accompanied by tones "emitted on the speaker. On mono , the graphic may series of s of various `, a hang usually follows. See: ARCV-n Joshua PZPAPN Psychogenius : Psychogenius Cover Girl, Psycho H: & data `corrupted; %failure R: 723 4: ONAK - & Data , VET, NAV 2.1+, .1.4+, 25.10+, The Psychogenius, or Cover Girl, source. Psychogenius is a wany execu or non- execu a. It permanently corrupts any Psychogenius is X, it all exist in the E. It Nnot care if the `are execu , or if are data sort. mhad the b723 by the 4, and =and to the be no if the was 723 (or larger. were smaller now be 723 The can be din the 4in all "Oh, oh, oh, She's my cover girl, Oh, oh, oh, oh, oh, oh, Cover Girl by The New Kids On The Block Hangin' Tough (c) 1988 CBS Records" "Written by" "(Psychogenius) 12/28/91" "NKOTB JORDON" It is not possible to dis `as the `should be Ad and restored fa clean backup copy. of Psychogenius are: Psychogenius-B: gequivalent to the has one differs fthe May, PZPAPN Puke-393 : Puke-393 Puke H: Australia R: 393 4: PRAK - V100, V100+ The Puke-393 fAustralia in Puke-393 is a vof . ,and . The the Puke-393 X, the Puke-393 a "hole" in low , hooking |21. and , as rby the DOS not be , the Puke-393 ,and . qof 393 at the end of the a. The in the DOS not be . One in the "[PuKE]" It is if Puke-393 PZPAPN : QMU QQ-1513 H: 1; TSR or R: 1,513 4: PRsCKX - ., IBM , VET, The QMU . QMU is a vof the ) as well as . +. Its bQMU Xon a , QMU as a low TSR of 2,080 (. The TSR {13 and 21. At , QMU xthe , moving the to the second side 0, cylinder 0, 2, and writing a full copy of the starting in If the is later fthe K, the at the top of the rby the DOS ?by 5,120 {13 and 21 |12's moved. QMU is , it qof 1,513 (. The at the end `. The =and in the DOS to the =and `include the normally din the , along "Bad It is what QMU PZPAPN : QP3 1028, ;1028 H: slowdown R: 1,028 - 1,042 4: PRhAK - , VET, , IBM , NAV 2.1+, The QP3 . Its . QP3 is a ,and . +. It is on the The QP3 is X, QP3 at the top of , but #the as measured by the DOS @by 1,104 {1C and 21 nby the , QP3 ,and . X. If X, it s. Unlike ;, it Nnot by 1,028 by 1,031 to 1,042 (. In both cases, be no 2to the <in the The at the end of the The QP3 7one can be viewed in : "QP3". It is what QP3 See: PZPAPN Quake : Quake H: May, j; shaking or "quaking" of The R: 518 - 532 4: PRfE - 1.15a+, 6.00+, 25.10+, The Quake ~in The in May, . It is a vof . a very noticeable effect. The the Quake the Quake in the DOS buffers. be no the Quake , it qof 518 to 532 at the end of the a. The =and in the DOS not be are no in the the Quake [shaking or "quaking" of all but the bottom line of the effect s every few minutes. PZPAPN Queens : Queens Micro Cop, Queensland H: Kinaccessible; Queensland, Australia R: N/A 4: BRX - , VET, \2.07+ : DOS SYS on The Queens, or Queensland, ~in Queensland, Australia in . Queens is a and the fthe bQueens the Queens at the top of #the &, moving |12's , as the DOS ?by 2,048 , the xthe the Queens , it xthe of any non-write protected is accessed on the . The Queens is too large to fit entirely in the , so a portion of the elsewhere on the J, along On double density 5.25 inch I, the in the location, along its continuation 10. The On high density 5.25 inch I, the the location, along its continuation in 27. The Since the s the last two of the root Eentries in inaccessible. On the K, Queens xthe . The s, but the inaccessible as a the Queens notice blank the M, reversing the video, and Mthe at the bottom of the "unauthorized software used --Micro Cops" s, the be hung. See: Generic PZPAPN Quiet : Quiet H: j; TSR Kansas, R: 2,048 - 2,063 4: PRsC - , VET, 1.15a+, NAV 2.1.2+, 6.04+, The Quiet Gin the State of Kansas in the . Quiet is a of . , but not +. It's was in a computer repair facility, so it is believed to be in the public domain. bQuiet X, the Quiet as a low TSR of 2,304 (. The {16, 21, and 64. the Quiet , it X. Quiet qof 2,048 to 2,063 at the end of the . The =and in the DOS . The can be din the last 2K of Quiet "DNAMMOC" "t=1024 /write=off /win /quiet" It is what the Quiet PZPAPN Quick : Quick Brasil BSC; Jroot R: N/A 4: BRtX - 1.15a+, 6.00+, \2.07+, NAV 2.1.4+ : CleanUp, M- K, or DOS SYS on The Quick . Quick is a and the ). Quick is a employing techniques to re to read the secotr and The fa Quick the Quick at the top of #the &, moving |12's , as rby the DOS ?by 1,024 , the xthe if it was not the Quick , it xthe of any non-write protected Iaccessed on the On 360K 5.25" I, the write one 10, and copy the The s the On 1.2M 5.25" I, the write one 27, and copy the The s the On the K, the mwritten one 4to Side 0, Cylinder 0, 2, and copied the to Side 0, Cylinder 0, 3. The s the at Side 0, Cylinder 0, The Nnot 8any in the and has d to due to its ability to quickly spread to "detected. Since the s the last two of the root entries were be lost. PZPAPN Quirk : Quirk H: `created R: 9,977 4: SNE - Spawning or Companion V99+, The Quirk . Its . Quirk is a spawning or companion the Quirk X, the Quirk xtwo or more . in the E. The . themselves are not rather the creates a 9,977 ain the same the same base . The newly created . `are not hidden, and mthe =and in the DOS set to the =and It is if Quirk PZPAPN : R-10 DataRape-10, Rape-10 H: Canada R: 500 4: PRhCK - , IBM NAV 2.1+, , VET, The R-10, DataRape-10, or Rape-10 , and ated in Canada. R-10 is a of . +. It is one of the the RABID group claims responsibility for writing. The R-10 is X, R-10 at the top of the {21 and 69 nby R-10 , as the DOS ?by 528 R-10 is , it by 500 (, the at the end of the be no 2in the in the DOS R-10 on a random basis, at the X. The of the Kstarts at the C: writing to the Kthe completes writing to the K, it continue formatting the O, writing full of x'FF' 3until the powers off the R-10 is probably an earlier of the R-11 See: R-11 PZPAPN : R-11 DataRape-11, Rape-11 H: Canada R: 747 4: PRhCK - , IBM NAV 2.1+, , VET, The R-11 fsources in both the V. At least in the case of the United States submission, the din the public domain. R-11 is a vof . The R-11 is X, R-11 at the top of #the remain 0, but @by 848 {21 and 69 nby the , R-11 X. If X, it R-11 by 747 at the end of the R-11 hides the . If the DOS R-11 , it indicate a a. The DOS may get an "Invalid Ospecification" R-11 R-11, on a random basis, may on the K. It s to be a later of the R-10 See: R-10 PZPAPN Radyum : Radyum H: R: 448 4: PNCK - 6.04+, \2.07+, V100+, The Radyum . It is . Radyum is a the Radyum xone in the qof 448 at the end of the a. The =and in the DOS not be . The fourth and fifth be "II". The the Radyum "radyum, the attitude adjuster, brought to you by ViRuLeNT GRaFFiTi" "\*. Radyum Nn't do of Radyum are: Radyum 2-707: A 707 of the Radyum wone . in the X. If an Nnot exist in the E, it move upward in the structure until it locates a Qes the root E, if it Nn't locate an x, it create a hidden a, HELLO.RAD, of 156 " radyum, 2, by the attitude adjuster" " brought to you by ViRuLeNT GRaFFiTi" " 07/31/92 Greets to Gary Watson!" " look for us again in the future." Radyum 2-707 adds 707 (to the . at the end of the a. The =and in the DOS not be . The in the Radyum 2-707 4, as is the "Hello.Rad .. *. may be identifed by the "QQ" starting in the fourth )of all March 1993. Radyum-B: A 698 of the Radyum wone . in the X. If an Nnot exist in the E, it move upward in the structure until it locates a Qes the root E, if it Nn't locate an x, it create a hidden a, HELLO.RAD, of 147 " radyum-b, by the attitude adjuster," " brought to you by ViRuLeNT GRaFFiTi" " 07/31/92 Greets to Gary Watson!" " look for us again in the future." Radyum-B adds 698 (to the . at the end of the a. The =and in the DOS not be . The the Radyum-B 4, as is the "Hello.Rad .. *. may be identifed by the "QQ" starting in the fourth )of all 1993. Radyum-C: A 860 of the Radyum wone . in the X. If an Nnot exist in the E, it move upward in the structure until it locates a Qes the root E, if it Nn't locate an x, it create a hidden a, HELLO.RAD, of 221 " radyum-c, by the attitude adjuster," " brought to you by ViRuLeNT GRaFFiTi" " 08/18/92 " 6 out of 16 keep the same" " position and value, not too bad in my" " book! greets to patti hoffman, i love you!" Radyum-C adds 860 (to the . at the end of the a. The =and in the DOS not be . The the Radyum-C 4, as is the "Hello.Rad .. *. may be identifed by the "QQ" starting in the fourth )of all 1993. PZPAPN : Rage H: Canada R: 575 4: PNCK - , IBM , NAV 2.1+, The Rage . Rage is Canada, and one of the RABID s to mwritten. is a vof . Rage is X, the check the Oand Efor an x. If one is very small . `, the Rage xit. by 575 at the end of the be no 2in the <in the DOS . The can be "Patricia Boon" Rage Mthe "Pray for death - RABID '91" cannot be `as it is in the It is if Rage PZPAPN : RAM H: May, j; black box; Ad on Fri 13th; TSR; slowdown R: 3,517 ,) & 1,808 - 1,822 4: PRsAK - , IBM The RAM Vin May, . The RAM on the . Like the es, it is vof . W, and overlay `. It The the RAM the as a low TSR of 4,008 {08 and 21 , the RAM are X. The is the same as for the , 1,808 to 1,822 at the end of the The RAM xalready , adding 1,808 (to the How the RAM is the major difference between es. The RAM , places a copy of the !of the . and an copy at the end. The qon . be 3,517 the end of the , and a qof 1,704 8two "sUMsDOS" the RAM for 30 minutes, a "black box" on the lower left hand side of the The slow the down by percent. The RAM on Friday the 13ths. If the on Friday the 13ths, it the Ythem. See: PZPAPN Random : Random H: , 1993 Australia R: 615 4: PRhCK - The Random in March, 1993, Hin Melbourne, Australia in , 1993. Random is a vof . The the Random the Random at the top of #the &, hooking , as rby the DOS @by 624 |12's not be moved. the Random , it X. If X, it the Random qof 615 at the end of the a. The =and in the DOS not be . The in the 4in all Random Kevin Mitnick" Lenny DiCcoco" Hans Hubner" 414's" Legion of Doom" Phiber Optik" Dr Popp" Robert Morris" Shooting Shark" Chesire Catalyst" Captain Crunch" Ron Austin" Kevin Poulsen" "are all to be congratulated" PZPAPN Rattle : Rattle Death Rattle H: seconds = 62 R: 615 4: PRaCK - 6.00+, 25.10+, NAV 2.1.4+, 1.53S+ The Rattle, or Death Rattle, . Its the submission was Van source. Rattle is on the vof . The the Rattle the Rattle , as by the DOS nby Rattle in the Rattle , it X. If X, it the Rattle qof 615 at the end of the a. The =and in the DOS to be the seconds field set to 62. the Rattle [frequent kdue to a See: PZPAPN RaubKopie : RaubKopie Raubkopi H: March, Germany R: 2,219 4: PNAK - \, IBM NAV, , VET, The RaubKopie in March, by Jan Terpstra of the . It is fGermany. Raubkopie is a vof . ,and . `. It RaubKopie is X, the xup to five . in the E. If less five existed in the E, it `until the number of it has s five. Raubkopie 2,219 at the !of the a. The =and in the not be Raubkopie 2,475 to 2,491 at the end of the a. The larger `is due to a different mechanism "used to xthe `, the badd up to 16 (to the candi is now di by 16. adding the (, it adds 256 (of hex 00's and appends the Raubkopie 4to the end of the . The =and in the not be The RaubKopie occasionally and require a response is invoked. The Lcannot be seen S. The A C H T U N G Die Benutzung einer RAUBKOPIE ist strafbar! Nur wer Jn, Handbucher, oder PD-Lizenzen besitzt, darf Kopien verwenden. mierung is muhevolle Detailarbeit: Wer Raubkopien verwendet, betrugt mierer un den Lohn ihrer Arbeit. A pause , and the cquestion "Bist Du sauber ? (J/N) " Entering "J" for yes in the Land the proceed to "Ich glauben, was Du sagst Entering "N" for no in the , the second of is garbled, and the be terminated: "CPU-ID wird gespeichert... * LO<garbled> The last garbled samples of * Losche dieses in the RaubKopie to format the of the Kif the =is greater the 12th of the month, or the hour is 17:00 (5:00 PM). 4, however, Nnot function due to a bug in the RaubKopie $the of the Fories 8ing RaubKopie sorted so at the !of the of RaubKopie are: Raubkopie-FRD: , Raubkopie-FRD is of the 1,888 at the !of the qof 2,150 to 2,160 at the end of the The in the "\ OSSI EN ST" "C:\ * NETWARE LMS MAUS MDB DOS BASE L" "*.exe *.com" "C:\ C:\CONFIG.SYS DEVICE = COUNTRY.SYS" "hgt42" "V1 FRD" of RaubKopie alter the C:\CONFIG.SYS 8the "DEVICE = COUNTRY.SYS" statement PZPAPN Reaper : Reaper Reaper Man H: England R: 1,072 4: PRhA - 6.00+, V99+, 2.43a+, V99+, The Reaper, or Reaper Man, It is fEngland. Reaper is a vof . ,and . , but not +, and not on the A: bReaper X, the Reaper at the top of #the &, hooking , as rby the DOS ?by 3,008 |12's not be moved. the Reaper , it are copied or reason location is on the A: the Reaper 1,072 at the end of the Reaper is not able to determine s, so it , adding an 1,072 (. The =and in the DOS be corrupted to an unusual value is not a normal, valid =and . The =and s in the DOS are not sby the The can be in the all Reaper "Reaper Man" "(c) 92, Apache Warrior, ARCV Pres." "[ReaperMan] Apache Warrior" PZPAPN : Re H: j; unexpected Eastern R: 715 4: PNCK - , VET, 6.00+, 3.93+, 25.10+, V99+, The Re . It is fEastern V. Re %is a vof . the Re xone . in the E, it may the Re qof 715 at the end of the a. One "891221" the Re [unexpected ring PZPAPN Red Diavolyata : Red Diavolyata 830, MLTI H: R: 830 4: PRhCK - \, NAV, IBM , VET, The Red Diavolyata is an 830 +. It was , and ated in the The Red Diavolyata is the at the top of #the &. The not moved. The DOS indicate ?by 960 nby the Red Diavolyata is , any . sby the . If X, it qd by 830 (, and =and in the to the =and . The at the end of the The can be dat the end of "Eddie die where in m was written in the city of Prostokwashino" "(C) RED DIAVOLYATA" "Hello! MLTI!" ly, the "MLTI! ,MAND" can be It is if Red Diavolyata of Red Diavolyata are: Red Diavolyata B: Very to Red Diavolyata B, the major difference fthe are two the differ fthe PZPAPN RefRef : RefRef H: R: 1,204 4: PRhE - \2.07+, V100+, 2.45+, V100+ The RefRef . Its . RefRef is a of . bRefRef X, the RefRef at the top of #the , as rby the DOS by 2,496 {21 and 22 nby RefRef in the RefRef , it very small ones, qof 1,204 at the end of the a. The =and in the DOS not be The in the RefRef "ReFReF" "TFReF" "4tsonpm" It is what RefRef PZPAPN Reklama : Reklama H: j; TSR Poland R: 2,723 4: PRsCK - 6.00+, 2.43a+, \2.07+, NAV 2.1.4+, V99+, The Reklama . It is fPoland. Reklama is a vof . bReklama X, the Reklama as a low TSR of 2,736 (. It hooks the Reklama , it qof 2,723 (. The at the end of the a. The and in the DOS not be The can be in the all Reklama "Przekaze tylko pewna informacje i juz mnie nie ma." "Wszystko jest OK." "A oto ta oczekiwana informacja:" "Ognisko Muzyczne F R A Z A we Wroclawiu uczy gry na :" "- pianinie," "- akordeonie," "- syntezatorach," "- gitarze," "- skrzypcach," "- uczy rowniez spiewu solowego." "Ognisko Muzyczne F R A Z A organizuje rowniez kursy" "CHWYTOW GITAROWYCH." "Juz po czterech miesiacach poznasz tajniki" "gry na gitarze badz syntezatorze." "I TY mozesz umiec grac na roznych instrumentach muzycznych." "Kontakt : Wroclaw, tel. 25-90-97" "Nacisnij dowolny klawisz abys mogl pracowac" "Jesli chcesz umiescic relame w ie samokopiujacym," "pisz do:" "Agencji Wydawniczej: skr. poczt. 1009, WROCLAW 3" "Wirusek reklamowy 1" It is what Reklama PZPAPN Relzfu : Relzfu 233, Fake VIRx H: j; "Specified ,MAND search Ebad" Finland R: 233 4: PNCK - , IBM NAV 2.1+, The Relzfu, or 233, Gin Finland in . Relzfu is a vof . Relzfu is X, the search the Efor an , the xit, was attempted to Relzfu 233 at the end of the be no 2in the =and in the DOS E. Two can be "ufzleR" "*.com" The used for the reversed. It is if Relzfu PZPAPN Repent : Repent H: fail to function %failures R: 350 4: ONCK - V100+, V100+ The Repent . Its . Repent is a the Repent X, the Repent xthe bfour . the E. If it may s. The Repent 4to move up one Ein the Estructure, not function in higher level Fories are not sby the the Repent mthe (of the host by the Repent be no 2to the unless it was smaller , in case it . The =and in the DOS not be . One in the Repent the Repent not function and are permanently corrupted. %failures %copy of sby the PZPAPN Reset : Reset Omega, Friday-13th-440 H: j; Very long Kaccesses R: 440 4: PNCK - ., IBM NAV 2.1+, , VET, The Reset . Its is a non- vof . the Reset X, the search the Estructure looking for . aencountered sby the has completed tthe O, it search the C: Oin the same manner. Since the searches the entire O, a long period of Kaccess any the Reset qd in by 440 (. The at the end of the a. One can be in the : "*. Reset Nnot to do PZPAPN H: R: 512 4: PRfE - 1.15a+, .1.4+, The Gin the s is a vof . and in on the video card if it is |21 is nby the in the |area. s is , it qof 512 at the end of the a. The =and in the DOS not be . No in the It is what PZPAPN Revenge Attacker : Revenge Attacker 777, Revenge H: j; DIR 5problems; hang; Kformat Philipines R: 1,127 4: PRsCK - , NAV, , IBM , VET, The Revenge Attacker, or 777, ated in the Philipines. Revenge Attacker is a generic vof . It is a very destructive The Revenge Attacker is the as a low TSR of 1,392 nby the sby the Revenge Attacker is , it xone . by 1,127 at the end of the =and in the the =and be marked by the "777" din the fourth through sixth are two "*** 777 - Revenge Attacker V1.01 ***" Revenge Attacker's low TSR is not used for u, but interfer operation internal 5s are issued. For example, issuing a DIR Revenge Attacker is in a Eentry repeated in place of actual Eentry. a DIR 5, the hang. all . in the Eare Revenge Attacker activate. At , followed by repeated 7's across the . While it is Ming the and writing the 7's to the , it Kstarting Side 0, Cylinder 1, 0. Fat 9, and aloss may even if the turns off the computer immediately PZPAPN RIP-699 : RIP-699 RIP, Patsy H: , 1993 j; TSR; Australia R: 699 4: PRsCK - .1.4+ The RIP-699, RIP, or Patsy, Gin Australia in , 1993. It is a vof . +. It on March 6th and it may bRIP-699 X, the RIP-699 as a low TSR of 1,792 (. It hooks interupts 10 and 21. It may as part of 5Data in under mapping utilities. , RIP-699 qof 699 at the end of the a. The =and in the DOS not be . The in the RIP-699 "RIP Patsy Cline 8th 1932 - 6th March 1963" RIP-699 on March 6th and 8th of any year. On those =s, if the Ys a to set the video mode to mode 80 by 25 the PZPAPN : RNA H: March, j; zero `created; R: 7,296 4: PNA - , VET, , NAV 2.1+, 1.53S+ The RNA in March, . Its . RNA is a vof . and . . It Nnot RNA is X, the RNA xup to four . ,and . in the of 7,296 at the the a. The =and in the DOS not be The can be din RNA "Run "uc253.rqz" the RNA [intermittent X. The notice zero- `may be created in the Oand Kaccesses to Omay , but the Nn't actually on the of RNA are: RNA-7408: RNA-7408, or RNA2, was It is in behavior to the are given preference for uover qof 7,408 at the !of the a. The can be in the "Run "Portions Copyright (c) 1983,90 Borland" PZPAPN Rocko : Rocko H: Canada R: 666 4: PRhAK - D: IBM , NAV 2.1+, VET, 1.53S+ The Rocko fCanada. Rocko is a ,and . +. It employs techniques to avoid detection. bRocko X, Rocko at the top of #the , as rby the DOS ?by 704 nby Rocko the Rocko , it ,and . to not many qas the hides the it is . The DOS the Rocko qof 666 at the end of the a. The in the DOS may dis . The seconds in the stamp set to 60. One can be in the "RocK STeaDY!" The Rocko on the 13th of any month, at the on the K. It 7two mechanisms to perform damage. of Rocko are: Mutating Rocko: on the Rocko , at the of its submission, is not detected by aware of the Rocko to an complex encryption mechanism. Its is 1,280 (, hooking {09 and 21. It adds 609 (to the . Z, the at the end of the Mutating Rocko is , the be hidden. One can be seen in all "(c) Rock Steady/NuKE]" Mutating Rocko on the 24th of any month, hits CTRL-ALT-DEL, the K. On the 24th of the month, a cold : Montreal, Canada Rocko-B: to the Rocko . It has 11 differ. The at the end of the : Montreal, Canada PZPAPN Rosen : Rosen H: R: 131 4: PNCK - ., NAV 2.1+, , VET, The Rosen . Its . Rosen is a vof . the Rosen xall . in the E. If E, it the Rosen qof 131 at the of the a. The =and in the DOS to the . The can be in the 4in all Rosen "R*. The Rosen is unable to recognize sby the , so it later re xthem, adding an Nnot do PZPAPN : RPVS 453, TUQ Endangered H: West Germany R: 453 4: PNCK - , IBM , NAV, VET, The RPVS, or 453, Gin West Germany in early is a vof . The RPVS is d for an unusual s in a adump of the - "TUQ.RPVS" - in not really a , but a series of PUSH instructions. The RPVS is a rather unsophisticated ever a . the RPVS or 453 X, the look for an ain the The determines if the . ahas by checking to see if the last two (of the aare 9090h. If the last two (are not 9090h, the appending 453 4to the end of the a. One . not normally be Nnot 8any logic to activate and cause damage in its :state. It 8many NOP instructions and odd jumps leave plenty of space for later additions. of RPVS are: RPVS-B: The RPVS the end of an s, the act differently. It not be able to determine it has already a, so it xthe ait finds in the Eover and over again. PZPAPN RSP-1876 : RSP-1876 1876 H: j; beeping; random 3written to R: 1,876 4: PRsAK - , IBM VET, NAV 2.1+, The RSP-1876 . Its . RSP-1876 is a vof . ,and . bRSP-1876 in low to a TSR. The area as a TSR, however, most mapping utilities. {21 and 22 nby the RSP-1876 is , it ,and . X. If X, it 1,876 at the end of the The =and in a DOS . The can be the "RSP" Zof RSP-1876 in beeping emitted fthe speaker, as well as randome "written to the may PZPAPN : RTL4 H: The R: 503 4: PNCK - V100+, V100+ The RTL4 , and is . RTL4 is a the RTL4 X, the RTL4 xone . in the along Ming the "RTL4" "Joop van den Ende Produkties BV Marco Daas (Casting Assistent) Postbus 397 1430 AJ AALSMEER van Cleeffkade 15 1413 BA AALSMEER The Wedden dat... je een hebt?" hang . The `, so it is not the RTL4 qof 503 at the end of the a. The =and in the DOS not be . In addition to the , the The individual and the addresses by the , but should not be construed to indicate individual wrote the PZPAPN Ryazan : Ryazan H: R: 512 4: PRaE - 6.00+, 2.43a+, \2.07+, V100+, V100+ The Ryazan and is fthe . Ryazan is a vof . bRyazan X, the Ryazan in a "hole" in al at 0010. It |21. , as rby the DOS not be the Ryazan , it very small ones, qof 512 the at the end of the a. The and in the DOS not be . The in the Ryazan "!!Ryazan" It is if Ryazan PZPAPN Rybka : Rybka H: j; TSR; Zfailures; %failures R: 123 Plus 4: PRAK - , NAV, The Rybka . Its . Rybka is a vof . ,and . The Rybka is X, the Rybka as a low TSR of 1.3K (, hooking |21. Since the Rybka cannot later recognize it has already its TSR, it zit again X. As a continue to @in 1.3K increments as the uprogresses. Rybka is , it ,and . over 132 X. If X, it sas well. Rybka by at least 132 many cases the qmay be over 13,000 (. In any event, the at the end of the a. The =and in a DOS . The can be "VACSINA" $the increasing loss of while the , Rybka failing to ing the to the DOS prompt. If s, the PZPAPN : Sad H: %failures; R: 301 4: PNCK - \, IBM , VET, 1.15a+, The Sad . Its . Sad is a vof . bSad X, the Sad xthe bfour . `in the were not qof 301 at the !of the a. The and in the DOS not be The can be in the all Sad "Sad - 24/8/91" "*?.com" the Sad [frequent k, as well as %failures %copy of in the month of in the "Sad - 24/8/91" of Sad are: Sad-307: A 307 of the Sad adds 307 (to the . w. Like the , Sad-307's at the end of the a, and the =and in the DOS not be The din the . The major distinction regards is the ' behavior in Upon Zof an during the month of , the Mits the O, effectively trashing the See: Bljec PZPAPN Saddam : Saddam Sadam, Profesor H: %failures; I/O "Insufficient to run .BAT `; DIR France (reported Israel R: 919 4: PRsCK - , IBM \, NAV, , VET, The Saddam breported in France in , the bsample of was actually , its was Israel. Saddam is a vof . +. It is on the Do-Nothing The the Saddam X, the in low not as a TSR. {21 and 22 nby the it has not Saddam is , it qof 919 (, the at the end =and upon are several may be [d on the Saddam . The most obvious symptom is the occasionally be "HEY SADAM LEAVE QUEIT BEFORE I cannot be seen in `, it is Y.BAT in an insufficient a Saddam fail, the hang. in an I/O Uand the aborting Z. The DOS 5may not function . Lastly, may [frequent krequiring the to re the of Saddam are: Profesor: on the Saddam , Profesor adds 919 (to the . w. Its usage and to Saddam, differs in s allocate very large amounts of fail to Y. Professor wup to two . the Zof an in a line of meaningless L. Professor 7the "??? "The Profesor is in town again !!!" See: Do-Nothing PZPAPN Sadist : Sadist H: j; unexpected warm re %s of R: 1,436 - 1,450 4: PNE - ., VET, , NAV 2.1+, The Sadist . Its . Sadist is a vof . the Sadist X, the Sadist search the Eand xup to three s, a warm re %may , or the host the Sadist qof 1,436 to 1,450 the end of the . The =and in the DOS . The can be in the 4in all Sadist "CopyRight by Vadim V.N.1989" PZPAPN Sandwich : Sandwich H: Manchester, England R: 1,172 4: PRhC - V99+, 6.04+, \2.07+, The Sandwich fManchester, England. Sandwich is a vof . requiring a response in a manner to the Ear . It Nnot The the Sandwich X, the Sandwich at the top of #the , as rby the DOS ?by 3,008 nby the Sandwich , the Sandwich for any reason. by 1,172 the initial not be if the . The at the end of the The =and in the DOS not be one out of every six in the Sandwich Ming a requiring a response. The ARCV Member Likes a <sandwich> Sandwich? Is it A. Apache Warrior B. ICE-9 C. Slartibartfast Select a Letter: " The "<sandwich>" be one of the "Cheese, Beef Spread, Cucumber and Crisp" "Corned Beef and Salad Cream" "Jaffa Cake and Hamster on Rye" If the answers the question correctly, the the , and the "Well you know you`re ARCV Members." If the answers the question incorrectly, the the , and a hang may "Bad Luck.. Better Luck Next All of the in the 4, and thus not . The answers for the questions, on the sandwich s in the order , are A, B, and the Sandwich notice "detected on all Sandwich PZPAPN Saturday The 14TH : Saturday The 14TH Durban, Saturday 14th G: March, TSR;. W, .OV? j; corrupts , FAT & on Saturday 14th Republic of South Africa R: 669 4: PRA - , NAV, IBM , VET, The breports of the Saturday The 14TH came fSouth Africa in March . The Saturday The 14TH, or Durban , is a generic W, and overlay `, but not by between 669 and 684 The Saturday The 14TH on any Saturday falls on the 14TH of any month, at 100 logical of the C: O, B: O, and A: O. In effect, on OC:, the destroys the , and (FAT). PZPAPN Scott's Valley : Scott's Valley 2131, Scott's, Slow-2131 TSR; . ,and . Scott's Valley, California, R: 2,131 4: PRsA - , IBM \, NAV, , VET, The Scott's Valley Scott's Valley, California. is a generic vof . ,and . `, and Nnot The the Scott's Valley X, the as a low TSR of 2,384 |21 is nby the , any . ,or . by 2,131 (. . between 2,131 and 2,140 8the chex in the 4: 5E8BDE909081C63200B912082E. It is is malicious. PZPAPN Scream : Scream Fist, Screaming Fist , Except Scream 2-696, 6in USA & Canada Canada R: 711 - 1,191 4: PRtAK - NAV 2.1+, 2.43a+, The Scream, or Screaming Fist, ~in Canada in . Scream is a vof . The the Scream at the top of #the &, moving |12's , as the DOS ?by 2,048 {21 and 24 nby Scream in , the check to see if C:\ +has sby the . If it is not s, the promptly xit. The copy of on the Omay the Scream , it for any reason. qof 711 qof 711 to 1,191 (. In both cases, the at the end of the . The =and in the DOS Two can be din the Scream 4in all "Screaming Fist" "C:\ It is if Scream of Scream are: Scream 1B: The Scream 1B gequivalent to the Scream . It has four differ fthe : Canada Scream 2: The Scream 2 on the Scream . It adds 838 (to the . w, and 838 to 1,318 (to . . Like Scream, the at the end of the S, and no its : Canada Scream 2B: The Scream 2B is a 692 of the Scream it is and , as measured by the DOS ?by 2,048 {21 and 24 nby Scream 2B. Scream 2B is , it ,and . , or copied. . by 692 (. . qof 898 to 1,172 (. In both cases, the at the end of the : Canada Scream 2C: The Scream 2C gidentical to Scream 2B. It is a minor : Canada Scream 2-696: The Scream 2-696 Gin the in May, it is , as measured by the DOS ?by 2,048 (, and it is , it ,and . , or copied. . qof 696 (. . qd in by 902 to 1,176 (. In both cases, the at the end of the a. Scream 2-696 is polymorphic, employing a complex encryption mechanism. As of May, , it was confirmed by several large us to be in the public domain, and is considered a in the as a : Canada May, Scream 2-732: The Scream 2-732 ~in the in May, . It is in many respects to the Scream 2-696 however, by 732 (. . qof 1,128 to 1,212 In both cases the at the end of the a. Like Scream 2-696, is polymorphic. May, Scream-650: The Scream-650 is a 650 of the Scream wthe C: Oroot Ecopy of X. It Nnot until the fthe Kand the scopy of as measured by the DOS by 2,048 nby Scream-650. it is , it are , or copied. qof 650 at the end of the a. The and in the DOS not be . The the "Screaming Fist (c)12/91" "C:\ : Canada See: Emf Enemy PZPAPN Scroll : Scroll seconds set to "62"; U; .BAT England R: 795 - 1,306 4: PRhCK - V99+, 6.04+, \2.07+, V99+, 1.53S+ The Scroll fManchester, England in . Scroll is a vof . +. It employs techniques to avoid the noticing the The sby the Scroll the Scroll at the top of #the , as rby the DOS ?by 3,008 Scroll in , the Scroll for any reason. 795 to 1,306 hide it is . The Scroll at the end of . The seconds field in the =and in the DOS set to "62", the umarker for the . The in the "[SCROLL] ICE-9 ARcV" the Scroll may notice the DOS detect the Scroll . It .BAT `, permanently corrupting them. PZPAPN Scythe : Scythe England R: 1,208 4: PRCK - V99+, 6.04+, \2.07+, The Scythe fManchester, England in . Scythe is a vof . +. It employs techniques to avoid the noticing the us, and is a fast The sby the Scythe the Scythe at the top of #the , as rby the DOS ?by 3,008 Scythe in , the Scythe for any reason. 1,208 usually hide it is (note: it Nn't always do ). The Scythe at the end of . The in the DOS . The be different, and the be set to 10:56.18. The in the is the Scythe for Reaper Man." "Beware I`m Sharp!" "Made in England by Apache Warrior, ARCV Pres." "Scythe Ver. 1.01 (c) Apache Warrior 92." "Reaper Man Swung The SCYTHE and the PC Died!" "[SCYTHE] Apache Warrior, ARCV Pres." the Scythe may notice the DOS detect the Scythe PZPAPN SeaCat : SeaCat Read- Attribute set on R: 160 4: PNCK - 6.00+, 2.43a+, \2.07+, V100+, V100+ The SeaCat . Its . SeaCat is a vof . the SeaCat X, the SeaCat xone . in the 160 at the !of the a. The =and in the DOS to the =and . The Read- attribute be set on in the DOS for the a. The can be in the 4in all SeaCat "SeaCat*.com" SeaCat corrupt . smaller are sby the PZPAPN : Self Polish-457, Polish-550, Self-457, Self-550 Poland R: 457 or 550 4: PNCK - , NAV, , IBM , VET, 1.15a+, The Self is actually two were ated in Poland. Both are vs of . one of the Self es is the search the Eto find all . All the Self . The either 457 or 550 (, depending on of the two es is present, at the !of the a. In either case, the =and the DOS to the and of Self are: Self-457: The 457 of the Self qd in by 457 (. The can be "MS *. ," and "RZRZ". Polish-457. Self-550: The 550 of the Self qd in by 550 (. The can be "CMS*. ,", "*. W", and "QYQY". as Polish-550. PZPAPN Semtex : Semtex Czechoslovakia R: 1,000 4: PRhCK - IBM NAV 2.1+, V100+, V100+ The Semtex . It is fCzechoslovakia. Semtex is a vof . bSemtex Xon a Semtex at the top of #the , as rby the DOS by 4,080 |12's not be moved. Semtex hook {8 and 21. , Semtex Semtex is , it for any reason. In the case of copying fone Eto an , both the source and target copy of the . Semtex by 1,000 The at the end of be no 2to the =and in the DOS . The can be the "S E M T E X by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)213-23" is not Lby the Semtex has for 60 minutes, it produce a Qcursor position on the 8a colored background and an ASCII character. The effect is a multi-color flashing of very small rectangles. The to normal by pressing a key on the of Semtex are: Semtex-B: A 1,000 of the Semtex is 4,080 (, hooking |21. It for any reason. qof 1,000 at the end of the a. The qis not hidden . The =and in the DOS not be . The in the 4in all Semtex-B "S E M T E X by Dusan Toman, CZECHOSLOVAKIA *** ma nice day ***" kmay : Czechoslovakia Semtex-C: A 619 of the Semtex is 4,080 (, hooking {08 and 21. It for any reason. qof 619 at the end of the a. The is not hidden . The =and in the DOS not be . The in the 4in all Semtex-C "S E M T E X by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)213-23" kmay : Czechoslovakia Semtex-D: A 1,000 of the Semtex is 4,080 (, hooking {08 and 21. It are for any reason. qof 1,000 at the end of the a. The qis not hidden . The =and in the DOS not be . The in the 4in all Semtex-D "S E M T E X by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)213-23" kmay : Czechoslovakia PZPAPN Seneca-B : Seneca-B , 1993 & data %failure; R: 493 4: ONAK - V100+, 2.45+, V100+ The Seneca-B , 1993. Seneca-B is and data `. It corrupts the the Seneca-B X, the Seneca-B xall of the in the b493 (of the host a. The Nnot differentiate between and data `, so 9, data and data the Seneca-B as the smaller . The =and in the DOS to the =and . The in the Seneca-B "*.* .." PZPAPN Sentinel : Sentinel Sentinel-3, Sentinel-5, BC stuck key failure" R: 4,625 4: PRHAK - , NAV, .1.4+, The Sentinel , and is is a vof . `, and +. Unlike most Turbo Pascal source 4. It may be purely a research Sentinel is X, the at the top of , but #the |12's not moved by the nby the +, if not sby Sentinel at as well. Sentinel is , it ,and . larger 1K as qof 4,625 (, the at the end of the makes no attempt to hide the =and the Eis not by the The can be dat the very end of Sentinel: "You won't hear me, but you'll feel me (c) by Sentinel. ks to Borland." Sentinel Nnot to do of Sentinel are: Sentinel-3: Sentinel-3 is a 5,173 of the Sentinel . Unlike Sentinel, , it hide the if it is . Sentinel-3's is 5,328 are no recognizable visable in Sentinel-3 notice executing the DOS Tdo not Sentinel since it didn't attempt to hide the ' May Sentinel-5: Sentinel-5 is a 5,402 of Sentinel-3. Sentinel-5 is , it hide the . Like Sentinel-3, executing the DOS uncover . Sentinel-5 smaller 2K in in the stuck key failure", always if the to view aeditor Sentinel-5 is . Sentinel-5's is 5,568 are no readable in the 4in Sentinel-5 ' May PZPAPN Serena : Serena j; TSR Italy R: 792 4: PRsCK - V100+, V100+ The Serena . It is fItaly. Serena is a vof . bSerena X, the Serena as a low TSR of 1,104 (. It hooks the Serena , it qof 792 at the end of the a. The in the DOS not be . No in the It is what Serena PZPAPN Seventh Son : Seventh Son 7th Son, Seventh Son-284, Seventh Son-350 The Eastern R: 284 or 350 (, depending on 4: PNCK - , IBM , VET, The Seventh Son is actually two behavior were ~in the are believed to mactually ated in Eastern The Seventh Son es are vs of . a Seventh Son X, the Seventh Son search the Oand encountered by either 284 or 350 (, depending of the Seventh Son es has sthe be no 2in the =and in the DOS E. The can be "Seventh son of a seventh son" Seventh Son Nnot to do of Seventh Son are: Seventh Son-284: Seventh Son-284 is a 284 Seventh Son-332: Seventh Son-332 is a 332 the Seventh Son . It wall . in the qof 332 at the end of the a. The =and in the DOS not be . The din the Seventh Son es are : The Seventh Son-350: Seventh Son-350 is a 350 Seventh Son-Kernel: Seventh Son-Kernel, or Kernel, is a 610 on the Seventh Son at the top of #the X, decreasing by 8,448 (. It hooks |21. qof 610 to 624 at the end of the be no 2to the =and in the DOS . One in the 4in all "KERNEL" PZPAPN Shadow : Shadow Shadow, Shadow-2 G: May, R: 713 4: PNCK - , VET, , IBM NAV 2.1+, The Shadow ), or Shadow, ~in May, . Its . Shadow )is a generic , it Shadow X, it one in the E. If +is in the E, it may 713 sby Shadow by 723 (if it s. In both cases, the at the end of the be no 2to the =and in the Shadow 8two "!seviL etybwodahS" The comes fthe reversed says "Shadow )Lives!". It is if Shadow of Shadow )are: Shadow-2: A smaller of the Shadow , Shadow-2 adds 635 `. The can be "!sevil etybwodahS*. "AWK" PZPAPN Shake : Shake Shake Dropper G: May, R: 476 4: PRCK - \, NAV, , IBM , VET, The Shake 'in May, Daniel Kalchev. It is a generic . v, and The X, the Shake , altering the image of The Shake tthem as accessed. by 476 qcannot be seen using a DIR (list if the While the is not destructive, it occasionally the : "Shake well before use !" attempted to be run. L, the terminates rather Ys. A second attempt to run the same in it running successfully. of Shake are: Shake Dropper: A small . drops the Shake ', May, PZPAPN Shaker : Shaker Prague Joker j; "shaky" effect may be produced; Prague, Czechoslovakia R: 512 4: PRhCK - , IBM NAV 2.1+, The Shaker reported to ated in Prague, Czechoslovakia. Shaker is a vof . It is on the Back , and identify it as such. The the Shaker Shaker at the top of #the , as rby the DOS ?by 528 {08 and 21 by Shaker in |12's moved. Shaker is , the xany . it is X. If X, it s. Shaker qof 512 (. The at the end of the be no 2to the =and in the DOS . One can be viewed in the "Shaker" Shaker may [a "shaky" effect effect, however, on all See: Back Blinker PZPAPN : Shhs R: 585 4: ONAK - , VET, .1.4+, NAV 2.1.2+, 1.53S+ The Shhs . Shhs is a vof . and . +. It corrupts the Shhs is X, the Shhs search the Efor three x. If were d, it xthem. If were d, the search the Efor three and xthem if were d. If all the . ,and . in the Ewere s, the activate (see #). If the Nn't activate, the L, and the ed to the DOS prompt: too big to fit in in the , and is a fake the Shhs mthe b585 of the host the Shhs 4. Unless the was smaller be no 2to the in the DOS were smaller 585 sby Shhs. be no to the =and in the DOS all of the . ,and . in the the Shhs , the activate the next X. At , the of the starting at 0. The "I'm sorry, Dave... but I'm afraid I can't do Dedicated to the dudes at SHHS The BOOT SECTOR v..." to access on the fDOS. Examination of the on the Norton Utilities in maintenance mode reveal the in the "Killed by: The " 8the of the activated f. For example, if the the activated, the thirteen periods be replaced by ,...". The Shhs S, so the cannot be seen `. Since Shhs s the !of the cannot be dis s, but must Ad and replaced fnon- scopies. has activated, the Kshould be reformatted. of Shhs are: Secret Service: on the Shhs , the Secret Service s the b600 the . w. It wthree . in the all of the . in the s, the next Zof the in the trashing the O. The in the too big to fit in "I'm sorry John McAfee (NOT!)..." "Secret Service has arrived..." "Dedicated to all makers!" "By: Agent #13/Nuke Member" "Killed by:" : Canada PZPAPN Shield : Shield G: March, j; hidden . `created; 2; TSR; R: 5,152 ((companion `), 127 4: PSRsA - Spawning , VET, , NAV 2.1+, The Shield in March, . Its is a spawning or companion by creating corresponding . `. It adds 127 (to . `do not carry an active The Shield is X, the Shield as a low TSR of 5,456 the Shield , it create a hidden companion . aof 5,152 (for . It add 127 . The 127 to the end of . , and the =and in the DOS The Shield is creates an active in the companion, hidden . kmay PZPAPN Shifter : Shifter ^, 1993 R: 6,672 4: PRtEX - 6.04+, 2.45+, 1.53S+, `& Replace The Shifter ^, 1993. Its . Shifter is a of the ) and bShifter X, the Shifter xthe , the 8ing the y. The Nnot , and not start The next fthe K, the Shifter at the top of #the &, moving |12's , as rby the DOS ?by 7,168 the Shifter , it qof 6,672 at the end of the a. The =and in the DOS not be . No in the Shifter It is what Shifter PZPAPN Shirley : Shirley j; TSR Germany R: 4,099 - 4,112 4: PRsE - .1.4+, 1.15a+, 6.00+, V99+, NAV 2.1.2+, 25.10+, 2.45+, V99+, The Shirley . It was ~in Germany in . Shirley is a of . bShirley X, the Shirley as a low TSR of 4,160 nby Shirley in the Shirley , it qof 4,099 to 4,112 at the end of the a. The =and the DOS not be . The in the 4in all Shirley "IWANTSHIRLEY" "Marty McFly lives where in (Doc Brown)" "Fuck for Eddie!!" one place to spend nice holidays... "CASAL BORSETTI" "in Italy... "Fuck for John McAfee and all the Vrs-Killers..." "We ma right to live "Greetings to the 1704... you were the "Greetings to -B...You were the Second!" "But now its my turn." "Hope You mfun the Shirley- The the "IWANTSHIRLEY" included in the 4in German. PZPAPN Sicilian Mob : Sicilian Mob warm re Canada R: 1,024 4: PNCK - ., NAV 2.1+, , VET, The Sicilian Mob . It is fCanada. is a vof . +. It is on the the Sicilian Mob the look for an The Eis searched b, and path. If no path has set, the search the Estructure. ahas , the the Sicilian Mob qof 1,024 (. The at the end of the a. The =and in the DOS Starting in , the Mthe "Sicilian Mob Ia - [NUKE]'91 - Rock MP" in all `, as are the "Copyright (C) by [NUKE] InterNat'nl Software Development" "Completed , Montreal, Canada" "--> [NUKE] H/A/P/V/T at its Best <--" the Sicilian Mob is a one in seven chance of the performing a warm See: Parasite VHP PZPAPN Signs : Signs Signs of Life j; TSR R: 720 4: PRsCK - 6.00+, 2.43a+, \2.07+, V100+, V100+ The Signs, or Signs of Life, Its . Signs is a vof . bSigns X, the Signs as a low TSR of 720 (. It hook |21. mapping utilities may show the TSR as qin the of the "config" area in the Signs , it qof 720 the end of the a. The =and in the DOS not be . The can be in the 4in all Signs "Signs Of Life." It is what Signs may do PZPAPN Silence : Silence R: 555 4: PRhCK - 6.00+, .1.4+, 3.93+, 25.10+, 2.45+, 1.53S+ The Silence . Silence is a vof . +. Its The the Silence the Silence at the top #the &. It Nnot move |12's rby the DOS ?by 1,568 nby Silence in the Silence , it X. If X, it sby the the Silence qof 555 at the !of the a. The =and in the DOS not be . The in the "The Silence Of The Lambs!" Silence Nn't to do See: Youth PZPAPN Silly : Silly 200, V200 G: May, R: 200 4: PNCK - , NAV, ., IBM , VET, The Silly Vin May, . It is a vof . Silly is X, the search the OC:, and xall . qof 200 the at the !of the a. The =and in the not be The Silly Nnot do See: Amstrad Hell Pixel Silly-365 PZPAPN Silly : Silly formatted R: 2,268 - 2,313 4: PNAK - The Silly . Its . Silly y is a vof . +. It trojanizes . the Silly X, it xor trojanize up to two on the C: O. The blook for the in the C: Oroot E, and move downward as necessarily in the structure. of 2,268 to 2,313 at the !of the a. Trojanized . q. The =and in the DOS not be Ys an . trojanized by the Silly , the be cleared, and an animated face in the upper left hand corner of the , accompanied by the "Hello, I'm Silly Now I'm formating Your HARDDISK! 's fine! - Isn't it (har,har)..." The C: be accessed, Kis not formatted by the a short period of , the cleared and the "ERROR: No SYSTEM Insert SYSTEM OA: and push any key!" The attempt to format the A: PZPAPN Silly-365 : Silly-365 Pixel, Pixel 877 G: May, j; slow to very slow loads; R: 877+ 4: PNCK - \, IBM NAV, , VET, The Silly-365 Vin May, . It is a very buggy of the Silly . Like Silly, it is a non- vof . +. It is "listed separately as its behavior and uare considerably different. Silly-365 is X, the search the E, and xall . d. If the . in the Ewere sby Silly-365, be re Silly-365 =and in the to the =and uand re The bugs in Silly-365 mto do the re us of uof a by Silly-365, the by 877 (. On the u, the by an 877 (. The second re in a qof 1,754 (. The third re uadds 3,508 The pattern is starting the second re u, the qis equal to two s the previous Needless to say, even starting a very small 42 , by the eighth u, the is too large to be The problem Silly-365 is it is very noticeable. As the uproceeds, the takes longer and longer to Yany . . By the seventh re uon the one of my test , the was literally working on re two . for 20 minutes. The Silly-365 was intended to Mthe an 8th generation U fucking defoult Please by me a new , in actual 8th generation us, is not as the 8th generation ais too large to be as a . Silly-365 fits base is 365 . The Silly Nnot do of Silly-365 are: Silly-740: to Silly-365, is actually 370 . Like Silly-365, it re multiple s, so multiple of 370 or 740 See: Amstrad Hell Pixel Silly PZPAPN Silver Dollar : Silver Dollar ; long Kaccesses; do not R: 2,071 4: ONAK - VET, 3.93+, NAV 2.1.2+, The Silver Dollar . Its a mention is made in the of Boulder, Colorado in the . Silver Dollar is a wboth . ,and . the Silver Dollar search the Efor up to four x. If the (s) are d, the xthem, b2,071 (of the host . The =and in the DOS not be . The can be in all Silver Dollar "Copyright(C) by CU, Boulder Colorado." too big to fit in "Person/People/Things we >>hate<<:" "Person/People we admire:" "Person/People/Things we think are cool: Irving Berlin's Music." sby the Silver Dollar may notice too big to fit in . Long Kaccesses of Silver Dollar are: Silver Dollar-8101: fa United States source, Silver Dollar-8101 is a 8,101 of the Silver Dollar . It one . ,or . in the the b8,101 (of the host . The =and in the DOS . The the 4in all "Copyright(C) by CU, Boulder Colorado." "Person/People/Things we >>hate<<:" "Person/People we admire:A Midgit, or maybe two :-)." "The Luna - moon. Ivy, Irene, "Person/People/Things we think are cool or find phus:" "Strip Poker," "Gambling." "PLO" "The Silver Dollar Strikes Again" is dedicated to a nice person AMY" "Everyone say Hi Amy!" See: Leprosy PZPAPN Simple : Simple ^, 1993 R: 424 4: PNCK - The Simple ^, 1993, and is fthe . Simple is a vof . the Simple X, the Simple xall of the . in the E, as well as the copy of in the Oroot qof 424 at the of the a. The =and in the DOS to the =and . The can be in the Simple 4in all "SIMPLE "C:\V.0 *. "C:\ Simple Nn't to do PZPAPN Simple Minds : Simple Minds do not R: 207 4: ONCK - V100+, V100+ The Simple Minds . Simple Minds is a the Simple Minds the Simple Minds xall of the . in the it has completed tall of the . `, it Mthe the to the DOS prompt: "A vir 4 da simple minded people of the earth Since ya didn't notice dis vir.. YAR LAME the Simple Minds mthe 207 (of the host by the Simple Minds 4. Since the b207 (of the host are not saved by the , host are permanently corrupted. The qunless the smaller (, in case 207 . The =and in the DOS to the and $the , the in the 4in Simple Minds Simple Minds fail to copy of PZPAPN Simulati : Simulati hang; R: 1,257 - 1,313 4: PNC - , NAV 2.1+, The Simulati . Its . Simulati is a . It Nnot Simulati is X, the search the Efor an . If one is d, the xit. by 1,257 to 1,313 at the end of the a. The in the to the =and On a random basis, the Simulati hang the . The be one of the three: "ALIVE... Your sby the SIMULATION ma nice day!" "FRODO LIVES!" "HA HA HA YOU HAVE A VIRUS" L, are centered vertically and horizontally on the PZPAPN Siskin : Siskin Sistkin-948 R: 948 - 956 4: PRhAK - \, VET, 6.00+, 1.15a+, 3.93+, NAV 2.1.2+, The Siskin, or Siskin-948, along of the es are fthe Siskin is a vof . ,and . +. On XT class machines, the es in destroy or corrupt the The the Siskin the Siskin at the top of #the &. It Nnot move |12's rby the DOS ?by 960 {1C and 21 nby Siskin in the Siskin , it usually qof 948 by up to 956 (. The at the end of the a. The =and in the DOS not be Frequent kmay be [d on especially %copy of of Siskin are: Siskin-1017: An earlier of the Siskin is 1,024 It adds 1,017 to 1,025 (to the . ,and . =and to the =and Siskin-Goodbye: An member of group of es, Siskin- Goodbye's is 848 (. It adds 839 to 847 (to the . ,and . =s the =and are PZPAPN Sistor : Sistor Sistor-2225, Plaice k; bouncing small diamond Sweden R: 2,225 4: PRtAK - , IBM VET, NAV 2.1+, 1.53S+ The Sistor, or Sistor-2225, location. It is believed to ated in Sweden. is a vof . ,and . The the Sistor at the top of #the |12's be moved. , as by the DOS ?by 4,096 {1C and 21 nby the Sistor At the of becoming , the Sistor check to see if the copy of +the s. If it is not s, the Sistor the Sistor , it qof 2,225 at the end of the be no 2to the =and in the DOS . The can be dnear the end of all "Sistor" the Sistor or .BAT , the be left spinning. The notice a "bouncing ball" on the s to actually be a very small diamond character. of Sistor are: Sistor-1129: A 1,129 of the Sistor is an earlier of the Sistor-J4J listed #. It qof 1,129 the end of the a. The in the DOS not be , and the qis not hidden. The 7one is the umarker at the very end of "J4J" : Sweden May, Sistor-2380: A 2,380 of the Sistor the exception q, and kdo not typically Sistor-2630: A 2,630 of the Sistor the exception q, and kdo not typically by 2,630 u. Sistor-2630 cannot distinguish s, so it , adding an 2,630 are no in the Sistor-J4J: A 1,273 of the Sistor by 1,273 be hidden if Sistor-J4J is . The at the end of . The in the DOS not be Sistor-J4J notice the DOS , and to be smaller actually are ras having T). The can be in the 4in Sistor-J4J "Elo , Elo , lam sabakt "Charlie says: Support ()DEMORALIZED YOUTH()" "J4J" : Sweden Sistor-J4J Alpha: , Sistor-J4J Alpha s to be an earlier of the Sistor-J4J . Its is 4,096 (, hooking |21. It were son open usually not function Sistor-J4J Alpha qof 833 at the end of the a. The =and in the DOS to the =and . The can be in the 4in all Sistor-J4J Alpha "Jump 4 Joy, alpha-release. Not to be distributed!" "J4J" : Sweden See: PCBB PZPAPN Skater : Skater Skater-1021, Tonya , 1993 j; TSR; Australia R: 1,021 4: PRsCK - .1.4+, The Skater, Skater-1021, or Tonya, Australia in , 1993. Skater is a of . bSkater X, the Skater as a low TSR of 2,416 (. It hook {10 and 21. mapping utilities may indicate the as an qin the of the in copy of the 5inter- pretor, showing a qof up to 2,500 , the Skater qof 1,021 at the end of the a. The in the DOS not be . The in the Skater "I love Tonya ling. The best womens Figure Skater in history." "Now Tonya, Do triple axle and kick Kristi Yamaguchi's arse" "- Australian Parasite -" The btwo may be Lby the ever a to set the video mode mode, 80 by 25. of Skater are: Skater-977: A smaller of the at the top of #the &, hooking {10 and 21. , as rby the DOS ?by 2,016 , Skater-977 qof 977 at the end of the a. Skater-977 in the same manner as the , and the same : Australia , 1993. PZPAPN Skew-469 : Skew-469 Skew ^, 1993 R: 469 - 485 4: PRxE - The Skew-469, or Skew, ^, 1993, and fthe . Skew-469 is a of . . It is a fast v, quickly spreading on bSkew-469 in a "hole" in al low , hooking {1C and 21. , as rby the DOS not be the Skew-469 , it for any reason. qof 469 to 485 the at the end of the a. The and in the DOS the =and . No in the It is if Skew-469 PZPAPN Skism : Skism R: 1,992 4: ONE - 1.15a+, 6.00+, 2.43a+, 25.10+, \2.07+, The Skism ~in the is a Skism look for an xin the second fthe O's root E. If an is not d, the continue reading down through the Estructure looking for , Skism xit, b1,992 (of the host be no 2to the unless it was smaller 1,992 (, in case it 1,992 . The =and not be Skism has completed a, it the to the DOS prompt. The not function. Skism 7the in the "The man who brought you" "622, Skism One, Captain" "Trips, and Sub-Zero now" "shanks you again, "his latest..." "Skism "Get a late pass!" "* *. It is if Skism corrupting the of Skism Skism gequivalent to the 's encryption has slightly modified. Skism-808: on the Skism one . ain the if more two sub Fories are present on the mthe b808 . The 7the not "Skism Rythem Stack -808." "Smart Kids Into Sick Methods" "Dont alter 4into your own strain, faggit." "HR/SSS NYCity, is the fifth of many, many more "You sissys "* *. W*.*" On the last Friday of any month, the attempt to destroy all `in the May, PZPAPN Skull : Skull Necro , 1993 9; graphic R: 666 4: PNCK - 6.00+, 2.43a+, V100+, V100+ The Skull, or Necro, , 1993, and is fthe State of Pennsylvania in the . Skull is a vof . +. It "drop" a second , the Skull #under . Since the Skull s, it is listed as a rather as part of the base Skull the Skull X, the Skull xone . in the If it cannot find a . x, it instead "drop" the Skull an . the Skull qof 666 at the end of the a. The =and in the DOS not be . The in the Skull "PATH=" The Skull Nn't do and drop the Skull #. The Skull it is of Skull are: Skull W: Skull Wis the is dropped by the Skull sby the Skull X, the Skull xone . in the b466 the host . The Skull Ma graphic "skull" on the "You cant Its already dead!" in the 4. The is un in the Skull : Pennsylvania, USA , 1993. PZPAPN Slayer : Slayer Brain Slayer, Slayer, Yankee Doodle Dropper, VBasic 2 G: March, j; long Kaccesses; Kaccesses to unexpected R: 5,120 4: PNA - \, NAV, , IBM , VET, The Slayer es was Gin March, group of :ly consists of five were fdifferent locations at the same . All of the of . ,and . do not #is a generic description of the es in Specifics for are listed under " " at the end of entry. In cases, the difference between the is a few a Slayer X, it xall . ,and . in the the ly, depending on the , it may Os as well. a Slayer between 5,120 and 5,135 at the end of the a. The =and in the not be of Slayer es include long Kaccesses , and possibly accesses to unexpected Os. The order of the bin the At least one member of ], Slayer-E or Yankee Doodle Dropper, carries the Yankee Doodle later release on Yankee Doodle is the TP45VIR Members of the Slayer ]are: Slayer-A: Slayer-A xup to nine in a the root E, on the addition to on the Slayer-B: to Slayer-A, in the C: Oroot Ein addition to those on the Oand Slayer-C: to Slayer-A and Slayer-B, Slayer-C all on the Oand all on the C: O. The can be din samples of Slayer-C: "KEYB*. ,KEYB*. WBASRUN BRUN COBRUN NET$OS *. "IBMBIO. "IBMDOS. +*.* .. \ .. *. "Access denied." Slayer-D: Slayer-D is to Slayer-C, the major difference while it accesses the C: X, it on the C: Ounless the fC:. The Slayer-C Slayer-E: Slayer-E is as the Yankee Doodle Dropper. X, it the on the Oand E, and xa few on the C: period has elapsed since the release the Yankee Doodle onto the ing in an active Yankee Doodle If the successfully removes Yankee Doodle, but Nn't remove the Slayer-E u, Yankee Doodle promptly re xthe fthe Slayer-E remain. be in the public domain. PZPAPN Slovak : Slovak Slovak 2.00, Slovakia G: May, Czechoslovakia R: 1,673 - 1,771 4: PNE - The Slovak, Slovak 2.00 or Slovakia, Czechoslovakia in May, . During May, of four different es were ~in the Slovak ]. Slovak 2.00 entry, initial listed #under . All of the es in group are polymorphic the Slovak 2.00 X, the may xone . in the Nnot always `. The always xan . Ewhere the Xis not the E, and is on the path. At , the xone . in the the Slovak 2.00 qof 1,673 to 1,771 at the end of the a. As all of the Slovak es, the Slovak 2.00 S, and no in the . The =and in the DOS not be a Slovak 2.00 X, the requiring the in the word "SLOVAK": "SLOVAKIA 2.00 (c) by ??. All Rights Reserved. Greetings fBratislava, SLOVAKIA. the word SLOVAKIA:" If the starts to a word SLOVAKIA, the Mthe cleared the presses escape as requested: the word SLOVAKIA, not CZECH, YUGOSLAVIA, or SLOVENIA!! Press Esc." s the word SLOVAKIA, the One in the "PATH=*. Slovak 2.00 Nn't to do Mits requiring a response. of Slovak are: Slovak 1.00: An earlier of Slovak, `instead of . , adding 1,352 to 1,603 (to the end of the w. The Lis much simplier, still requiring the word SLOVAKIA: "Greeting fBratislava, SLOVAKIA. the word SLOVAKIA:" : Czechoslovakia May, Slovak 2.02: A later of Slovak 2.00, , adding 1,969 to 2,091 (to the w. The Lby the to Slovak 2.00, the exception the number be 2.02. : Czechoslovakia May, Slovak 3.00: A later of Slovak 2.02, qof 2,051 to 2,177 at the end of the a. The to Slovak 2.02, the exception number is now 3.00. : Czechoslovakia May, Slovak-4: An earlier of Slovak, is very to the Slovak 1.00 Nnot Many qof 1,363 to 1,587 at the end of the a. It is slighly polymorphic. : Czechoslovakia PZPAPN : Slow Slowdown, Zero G: May, Australia R: 1,701 4: PRsA - , NAV, , IBM , VET, : CleanUp, NAV, or The Slow Gin Australia in May . It is a generic W, and overlay +is not The Xon a , the as a low TSR, taking up 1,984 nby the Later, as sby the Slow . While the Slow 4is actually 1,701 qby more amount. by 1,721 at the !of the by 1,716 to 1,728 at the end of the In the process of `, the may hang the , causing the mto re The Slow on the It is what else the Slow of Slow are: Slow II: A minor of the Slow adds 1,721 (to the . w, and 1,716 to 1,730 (to . . The at the !of . the end of . usually not function ing in frequent , 1993. Slow III: on the Slow II , Slow III is very no longer hang the March, 1993. See: PZPAPN Small ARCV : Small ARCV England R: 236 4: PNCK - 6.00+, \2.07+, NAV 2.1.4+, V100+, 2.45+, V100+ The Small ARCV fEngland in Small ARCV is a vof . +. It Nn't to do the Small ARCV xone . in the qof 236 the at the end of the a. The and not be . The can be in the 4in all Small ARCV "[SmallARCV] Apache Warrior. *.com" PZPAPN Small : Small England R: 349 4: PNE - 6.00+, \2.07+, V100+, 2.45+, V100+ The Small fEngland in Small Wis a vof . Nn't to do the Small xone . in the qof 349 the at the end of the a. The and not be . The can be in the 4in all Small "*.exe [Small W] Apache Warrior." PZPAPN Small-38 : Small-38 and data fail to Canada R: 38 4: ONAK - & Data .1.4+, 6.00+, 3.93+, The Small-38 fWallace Hale of Canada. Source fMr. Hale was , and indicates he wrote it in response to the Mini-45 in May, is not believed to be in the public domain, and is considered a research . It is a and data Small-38 is X, the xall in the E. The not care if the ais an execu or a data a. It xany ait encounters. the qunless the less (, in case the (. The =and in the DOS to the =and Small-38 has finished tall the `in the E, the be hung in a search loop on the E. The need to be re %ed to get out of the loop. and data Small-38 are permanently damaged, having had the should be replaced a clean backup copy. PZPAPN Small-178 : Small-178 ^, 1993 R: 178 4: PRxCK - The Small-178 ^, 1993, and is . Small-178 is a vof . bSmall-178 in a "hole" in low al , hooking |21. , as rby the DOS not be the Small-178 , it qof 178 at the end of the a. The in the DOS to the =and . No in the 4in Small-178 Small-178 Nn't do PZPAPN Smiley : Smiley Smiley face ASCII character bouncing around R: 1,987 - 1,994 4: PRfCK - , VET, , NAV 2.1+, The Smiley . Its . Smiley is a , but its umechanism is v. The portion is used for the effect. the Smiley X, the Smiley xone . ain the Nnot X. For example, if it encounters a very small . ain the Eas it searchs for an a, it typically not the Smiley qof 1,987 to 1,994 (. The the end of the a. The =and the DOS The can be in the Smiley "\*. W*.* \*. "yANKEE Doodle#and VACsin." "The red planet("InvasiOn" +in the Oroot the Smiley za portion of the next %s the , the Smiley |1C. a short period of has elasped, the Smiley produce effect of an ASCII smiley face character bounces around the It is if Smiley carries any damage potential. PZPAPN Socha : Socha R: 753 4: PRhCK - , IBM , VET, NAV 2.1+, The Socha . Its , or , are . Socha is a +. It should be noted Socha =has the year is 1981. The Socha is X, the Socha at the top of #the , as rby the DOS ?by 3,008 nby the if the year of the =is 1981. Socha is , it are if the ='s year is 1981. In years, the in its :form Socha 753 =and in the DOS to the =and . The Socha at the end of . The can be dnear the end of Socha "Socha" "C:\m_edit\me$.ovl com Socha Nnot to do PZPAPN Solano 2000 : Solano 2000 Dyslexia 2.01, Solano G: March, j; TSR; unusual California, R: 2,000 4: PRsC - \, NAV, IBM , VET, The Solano 2000 ~in Solano County, California in mid-March by Edward Winters. The by the Dyslexia V2.01, can be produced by negating null terminated in the 4. Using the same technique, what s to be the creation =of the , 08FEB90, can be produced. The yregarding the yproduced by negation of (was determined by Jay Parangalan of Solano County. The Solano 2000 is a generic v. The Xon the , the proceeds to xevery . can be manually identified by using a editor to view the (1168 through 1952 consist of '(' or 28h , such as DISKCOPY. is included on all DOS not run instead an "invalid Ospecification" is not in the 4, but is due to an Ucondition "induced due to the 's presence. The -induced ring KCopy was how the bspotted and eventually Solano is , it take up 3K of RAM The Solano 2000 Nno apparent damage, however it Ncheck the video buffer occasionally, and may transpose numbers din certain locations. effect, however, was not [d on the author's in researching reports instead of transposing numeric 3, the Solano 2color attributes on the it is active in of Solano 2000 are: Dyslexia 2.00: same as Solano 2000, except the 28h are now binary zeros. The attempted transposing of numeric 3in video slowed down. The creation s to be 22JAN90 instead of 08FEB90. Solano 2000-B: same as Solano 2000, except the 28h 0to DAh 3, and are (1168 through 1912 in Solano D: to the Solano, has had its encryption slightly in order to avoid detection. The 28h to 00h Subliminal 1.10: A very early of the Solano 2000 wany . 1,496 , the monitor to flicker. What is ring is to flash the "LOVE, REMEMBER?" in the lower left portion of the Mfor a subliminal duration. The actual amount of Ms on the varies due to CPU speed differences. PZPAPN thing thing thing-658 j; SOME. acreated; R: 658 4: PRhCK - , IBM NAV 2.1+, , VET, The thing Its , and , are thing is a vof . The thing X, the thing at the top of #the , as rby the DOS ?by 672 |12's moved. nby the thing . At be created in the d SOME. (the extension be blank). of zero thing , it qof 658 at the !of the a. The in the thing v1.1" It is if the thing PZPAPN Sorlec : Sorlec Sorlec 3 ^, 1993 R: 597 4: PRhAK - 6.04+ The Sorlec, or Sorlec 3, ^, 1993. Its . Sorlec is a vof . ,and . the Sorlec X, the Sorlec at the top of #the nby the the Sorlec , it qof 597 the at the end of the a. The and in the DOS not be . The can be in the 4in all Sorlec "CLtV" "Sorlec 3 - Detonaton!" kfrequently the Sorlec of Sorlec are: Sorlec 4: ^, 1993, Sorlec 4 is a later of the Sorlec is 10,240 (, hooking |21. It X, adding 553 (to the . The =and in the DOS not be . The in the "MSDOS.SYS" "Sorlec 4" ^, 1993. Sorlec 5: ^, 1993, Sorlec 5 is a non- of the Sorlec . It wall of the . `in the qof 535 at the end of the a. The =and the DOS not be . The in the "Sorlec 5 *. ^, 1993. PZPAPN Sorry : Sorry V1.3, Perfume-2 R: 731 4: PRhCK - \, NAV, , IBM , VET, : NAV, or The Sorry . Its comes German phrase in the : "Tut mir Leid !". on the Perfume fWest Germany, and identify it as Perfume or 4711. The the Sorry the in high both @by 1,024 nby the immediately sby the , thus insuring on later immediately. , it xany . X, increasing the by 731 (. The at the end of The Sorry 7the "G-VIRUS V1.3" "Bitte gebe den G- 4ein" "Tut mir Leid !" It is what the Sorry See: Perfume PZPAPN Soupy 003 O ;PT3 : Soupy , 1993 j; TSR; R: 1,072 4: PRC - 1.15a+, V102+, V102+ The Soupy , 1993, and is . Soupy is a of . , but not +. In the case of advanced us, it may za portion of order to facilitate the mechanism in the the Soupy X, the Soupy xone . in the E, as well as up =a counter in the the Soupy qof 1,072 at the end of the a. The =and in the DOS not be The Soupy the counter in the has r Qed 11, indicating the 11th generation of the Qed. At , the za portion of of 736 (, hooking |08. portion of the zed, it Mthe one at a every three minutes: "Unsuspecting , 12 o'clock!" "Get ready... 'cause... THERE'S A VIRUS IN YOUR SOUP!" fthe guys brought you Lythyum, Radyum, and VioLite comes:" "The Soupy , (k) VG Enterprises, 216/513/602/904/703" "By The Attitude Adjuster & AccuPunk!" "Hurry! Hire an Anti- Professional! qWallet Space!" "...hmmm, ya' know, I think I''ll halt now..." the last L, the halted or hung. The in the Soupy 4, as are the "[Soupy] The Attitude Adjuster & AccuPunk, VG 08/23/92 to 12/02/92" "Bad of Soupy are: Soupy-Death: on the Soupy adds 1,001 (to the . Like Soupy, it zs a 720 )portion of its an 11th generation uhas X. In the case of Soupy-Death, the hooks |9. , Soupy-Death waits for the to press CTRL-ALT-DEL, and clear the in color. The in the Soupy-Death "Your PC has lapsed into a higher state of "..." "D E A T H!!" "Please, feel eto cold "as nothing has damaged," "it was a near death" "Your PC should meditate more often," "cuz all the evil "flowing around neurospace" "we wouldn't want "to a real" "D E A T H" "[Death] The Attitude Adjuster, VG, 12/02/92" "Bad 1993. PZPAPN : Sov Sov-545, Sov-602 R: See 4: PNCK - ., IBM NAV 2.1+, }, VET, The Sov is actually two . Both es are vs of . +. Since characteristics are Bjointly as Sov, differences noted under a Sov X, the Sov one . in the E. If E, it may s. Sov depends on of the es is present (see #). The at the end of the be no 2to the =and in the DOS It is if the Sov es do es are: Sov-545: One of the two Sov adds 545 to 599 (to the w. The din the "PATH=" could be a crash, crash, crash" Sov-602: One of the two Sov adds 602 to 616 (to the w. The din the "PATH=" PZPAPN Spanish : Spanish j; TSR; slow loads; cascading letters graphic effect Spain R: 2,930 4: PRsAK - , IBM , NAV, ., VET, The Spanish Gin Spain in . Spanish is a generic is very to the Traceback II The Spanish is X, Spanish as a low TSR of 7,632 {1C, 20, 21, and 27 nby the X, the xthe Y, along in the E. Spanish by 2,930 (. The at the end of the be no in the =and in the DOS A symptom of a Spanish loads longer . The slowdown is due to the searching the Efor a candi Spanish is for one hour, it cascading effect to the Traceback II . The 3on the fall to the bottom of the , until encounter an character. Unlike Traceback II, the is not restored by the , and the end up "hung. See: Traceback II PZPAPN Spanish Fools : Spanish Fools >28th j; TSR; k; copy, A, and 5s may fail Spain R: 1,417 4: PRsE - , NAV 2.1+, .1.4+, The Spanish Fools, or >28th, , in the Zaragoza area of Spain. It is reported to be widespread in area. Spanish Fools is a vof . bSpanish Fools X, the as a low TSR of 1,808 {21 and 28 nby the Spanish Fools has for several minutes, it start by 1,417 to 1,431 (. The at the end of be no 2in the in the Spanish Fools if it the >28th of any year. Upon sporatically interfer DOS internal 5s, such as COPY, RENAME, and DELETE. 5s may not function involve . , either not executing the 5, or hanging the PZPAPN Spanz : Spanz <may dis R: 639 4: PNCK - , IBM , VET, The Spanz . It ated in V. Spanz is a vof . Spanz is X, Spanz search the Eto locate the , it by 639 (, the at the end of the a. If the in the Ewas 12:00a, it now blank a DIR 5is issued. can be identified by the s near the end of all "INFECTED! * SPANZ *" Spanz Nnot do PZPAPN Sparse : Sparse Sparse-B TSR; . j; gradual R: 3,840 4: PRsCK - \, IBM , VET, NAV 2.1+, The Sparse . Sparse is a vof . The Sparse is X, the as a low TSR of 3,872 {21, D1 and D3 the Sparse is , it by 3,840 at the !of the a. The =and in the to the =and Sparse mthe ASCII 3"UK" as the second and third (of the execu 8the SHELLC, and 8the of the ed in the becoming . (If the "sparse.com", "sparse.com" din all later as long as the Sparse slowly mless and less . The loss of Zof an in an 64K block of . If the Ys 10 , in effect be no of Sparse are: Sparse-B: gequivalent to the Sparse differ. PZPAPN Spyer : Spyer Faust, Spyer-B, Spyer-C TSR; . Taiwan R: 1,181 4: PRsA - , NAV, , IBM , VET, The Spyer in Taiwan. is a vof . ,and . `. It Nnot The the Spyer the Spyer as a 1,760 low TSR. {21 and 22 nby the , the attempt to the next X. If the is already the Spyer , the hung. If the was not already s, Spyer xit and hang the always by 1,181 Spyer between 1,181 and 1,195 (. In both cases, the at the end of the always mthe chex character sequence at the end of a: "CBDFD9DE848484". The Spyer , in its present form, is not expected to ever be a serious problem. Since it always kthe the next becoming , it is simply too obvious thing is wrong. of Spyer are: Spyer-B: to the Spyer, fthe NCSA collection . Its source is . Spyer-B is to Spyer, the exception hooks |21. hang the X, but usually not. the same hex character sequence at the end of the detect Spyer miss Spyer-C: Very to the Spyer, noteable differences. It was the NCSA collection and its or source is PZPAPN Squawk : Squawk G: March, R: 852 4: PRtAK - , VET, o, NAV 2.1.2+, The Squawk in March, . Its . Squawk is a vof . ,and . bSquawk X, the Squawk at the top of #the &, moving |12's , as measured by the DOS ?by 4,096 nby the Squawk is , it ,and . qof 852 at the end of the a. The =and in the DOS not be One can be din all Squawk "Nguyen Van Cuong - Siagon IBM comppany." It is what Squawk PZPAPN Squeaker : Squeaker .Exe Ad if R: 1,091 4: PRhAK - , IBM VET, NAV 2.1+, The Squeaker Squeaker is a vof . ,and . The Squeaker is X, the at the top of #the , as rby the DOS ?by 1,136 |12's moved. {1C and 21 nby the Squeaker is , it ,and . X. If X, it Squeaker qof 1,091 at the end of the a. The in the DOS to the =and A symptom of a Squeaker , if the .Exe, Ad. The ed to the DOS prompt. It is if Squeaker 7any damage potential. PZPAPN Squisher : Squisher Hunter R: 340 4: ORfCK - , VET, 3.93+, 25.10+, , NAV 2.1.4+, The Squisher or Hunter . It fthe . Squisher is a Unlike many Squisher function uses techniques to avoid detection, to the ZeroHunt bSquisher X, the Squisher in a hole in low , hooking |21. , as rby the DOS not be the Squisher , it at least 340 (of hex '00' are mthe inserted where the hex '00' 3were . In the case of a more (of hex '00' it may smultiple q, and the =and in the DOS not be . No are in the Squisher Nn't to do PZPAPN : Staf Staff may fail to R: 2,083 4: PNCK - , IBM \, NAV, ., VET, The Staf . Its but breports of it were out of v. It the Staf X, the Mthe Demo Ver.: 1.1 - Handle care! By STAF (Tel.: (819) 595-0787) Generation #n Press any key to The "n" cthe pound sign be replaced generation number of the . The " the of the . in the has just s. If no aexisted in the X, the t:" portion of the be replaced sall your `in the ma nice day!" Staf may fail to "VIRUS ERROR #nn - Aborting process." Staf qof 2,083 at the !of the a. The Nnot alter the =and in the Eat the Staf Nnot do PZPAPN Stahl : Stahl Stahlplatte Germany R: 750 4: PNCK - , VET, NAV 2.1+, .1.4+, 3.93+, 1.53S+ The Stahl, or Stahlplatte, . It fGermany. Stahl is a of . Stahl is X, the xone . in the E. If the encounters a very small . it is searching for a x, it stop the Stahl qof 750 (. The at the of the . The =and in the DOS not be . Two din all Stahl "STAHLPLA.TTE Ich bin da!" "*.com" It is what Stahl PZPAPN Stanco : Stanco j; unusual Eastern R: 7,529 4: PNCK - 6.00+, 2.43a+, The Stanco . It is fEastern V. Stanco is a vof . the Stanco xone . in the qof 7,529 at the !of the . The =and in the DOS not be . The 8ed in the 4, but are not as the s in a PKLited form: "Insufficient DOS ... must be 3.2x or greater!" "Write Protect KFull ..." "Abort" the Stanco may receive unusual such as the Write Protect PZPAPN StarDot 600 : StarDot 600 9; spurious I/O ports R: 604 4: PNE - , IBM NAV, , VET, The StarDot 600 . Its is a vof . StarDot 600 is X, StarDot 600 xone . in the StarDot 600 by 604 to 616 at the end of the newly a. The =and in the not be StarDot 600 write random data to the default s, as well as send random data to the ports (37F to 3DF). See: StarDot 789 StarDot 801 PZPAPN StarDot 789 : StarDot 789 R: 789 - 805 4: PNAK - , IBM , NAV 2.1+, The StarDot 789 . Its . StarDot 789 is a of . ,and . StarDot 789 is search the Efor an x. If one is d, it s. If an ais not d, the search the Efor an x, and it if StarDot 789 qof 789 to 805 at the end of the be no 2in the in the DOS StarDot 789 may It is what StarDot 789 See: StarDot 600 StarDot 801 PZPAPN StarDot 801 : StarDot 801 Italian R: 801 4: PNAK - \, IBM , NAV 2.1+, The StarDot 801 . Its it is very to the Italian 803 , so it may fItaly. StarDot 801 is a vof . ,and . . It StarDot 801 is X, the look for an in the x. If an Nnot exist in the E, it look for an is selected, the xit, adding the 4to the end of the StarDot 801 by 804 to 817 =and in the not be StarDot 801 ^13th is 1PM or later. At , it write random data to all Os on the in reverse order (it starts at OZ:). kmay See: StarDot 600 StarDot 789 PZPAPN Stasi : Stasi Stasi-1728 G: March, 1993 <seconds = 42; R: 1,728 - 1,742 4: PNE - The Stasi, or Stasi-1728, in March, 1993. Its . Stasi is a vof . . It ities to the Wit the Stasi X, the Stasi xone . in the qof 1,728 to 1,742 at the end of the The =and in the DOS not to be the seconds set to 42. in the 4in Stasi The Stasi Mthe "Stasi is watching you" destructive See: Wit PZPAPN Sticky : Sticky Multi-2, Nu Way G: May, R: 927 - 1,407 4: PRtAKX - W, Overlay, and .1.4+, NAV 2.1.4+, \2.07+, 1.53S+ The Sticky, or Multi-2, Gat several sites in the and Canada in May, . Sticky is a multi-partite wthe ) and all execu bSticky X, the Sticky xthe writes a copy of its 4to Side 0, Cylinder 0, 2 and 3, and alters the 4. The Sticky Nnot , and not Later, fthe Sticky K, the Sticky top of #the 12's be moved. rby the DOS 3,072 nby Sticky in the Sticky , it execu qof 927 (. . by 1,133 to 1,407 (. In both cases, the at the end of the a. The =and in the DOS . Sticky is an , and no in the It is what Sticky PZPAPN StinkFoot : StinkFoot Stink crashes on 8086/8088 machines Republic of South Africa R: 1,254 4: PNC - , IBM , VET, NAV 2.1+, The StinkFoot Gin the Republic of South Africa in . It is a `, and Nnot StinkFoot is X, the search the Oand Efor an xwhose is at least 1,000 (. If such d, the xit. StinkFoot qof 1,254 (. 259 of the at the !of the the remaining 995 "at the end of the be no 2in the =and in a DOS StinkFoot Nnot do . It function on XT (8088- ) machines. of StinkFoot are: StinkFoot-1273: s referred to as Stink 2, StinkFoot-1273 is an . It adds 1,273 (to the . w, splitting the 4between the !and the end of the : Republic of South Africa StinkFoot-2B: A minor of the StinkFoot adds 1,254 (to the u. It , adding an 1,273 (to the March, 1993. PZPAPN Stone`90 : Stone`90 Polish 961, Stone-90 Poland R: 961 4: PNCK - , IBM NAV 2.1+, , VET, The Stone`90 , or Polish 961, is a vof . +. It was , and is fPoland. the Stone`90 X, the look for one . on the Oand in the x. If one is d, the sit. The newly by 961 (, and mthe at the end of the The can be "Sorry, I`m INFECTED!" "I`m already NOT "(C) Stone`90" Stone`90 Nnot to do PZPAPN %, Donald Duck, Hawaii, Marijuana, New Zealand, Rostov, San Diego, Sex Revolution, Smithsonian, Deunis, -16, -AT Love, -Collor, -Mexican, Mutation ^, 1988 BSC; TSR; ; RLL controller New Zealand R: N/A 4: BRtX - , CleanUp, \, IBM , NAV, , VET, : CleanUp, M \, NAV The breported in Wellington, New Zealand in early 1988. The s360KB 5-1/4" I, doing no overt damage. The vis extinct, however, and all are capable of tthe ) as well as may damage Eor FAT y. Most minor modifications, usually in what the a computer at the top of . The be moved, and ChkDsk indicate the computer as 2K less zed. If the %was J, the attempt to xthe , if it was not During the %process, the The Lmore or less on a random basis. The most for the "Your computer is now "Your PC is now , it are accessed on the J, it moves the 0) to 11. The copies into 0. Since 11 is normally part of the Jroot Eon 360K 5.25" I, any Eentries be lost. s of DOS 11 as part of the in the K's FAT "corrupted. K, it copies the to side 0, cyl 0, 7. A copy of the placed at side 0, cyl 0, 1, the location of the . If the Kwas formatted software starts the , or Eon side 0, cyl 0 right the , the Kmay be corrupted as well. In order to dis , the must be powered off and , write- protected J. If is not done, the Ias soon as are dis are many can dis Iand Ks. To successfully use one of , follow the instructions To remove manually, the DOS SYS 5can be used on 5.25" 360K I. On the K, the must be copied back to side 0, cyl 0, can be performed Norton Utilities, or editors. Deunis : on the , Deunis is a fSpain in . The in the is now: s abras tu Cpu!" "(c) IMAN4" on the , PS- is a has to avoid detection. Unlike most members of the ], PS- Nnot , and Nnot Many xthe of both normal and high-density I, as well as the . In the case of the , the is moved to cylinder 0, side 0, 17. On low density I, the is moved to 11, while on high density Iit can be fNew Brunswick, Canada ~at a university. As of May, , no products detect can be just about in Rostov: Nnot . It 7the : "Non- K" and "Replace and strike". Sex Revolution V1.1: -B. the "EXPORT OF SEX REVOLUTION ver. 1.1" Sex Revolution V2.0: to Sex Revolution V1.1, the has "EXPORT OF SEX REVOLUTION ver. 2.0" -16: The Nnot as the in the replaced binary zeros. On 5.25 inch 360K the not be saved by the . On 5.25 inch 1.2M I, the is saved at 17, part of the root E. The Side 0, Cyl 0, May, in May, differs in wthe of the DOS of the . It to the , moving the on 360K 5.25" 11. It Nnot 8typical , but 8the " near the !of the May, -A: Same as , but Nnot xthe is the and is now extinct. The din the is: "Your computer is now . Legalize Marijuana". The "Legalize Marijuana" portion of the is not -AT Love: to the PS- moves the on 5.25 inch 360K 11, the last of the root E. On 1.2M 5.25 inch I, the be moved to 17, in the middle of the root E. The on the moved to Side 0, Cyl 0, 7the may be Your PC is now St NED in L May, -B: Same as controllers may [frequent typically is: "Your computer is now . Legalise Marijuana". The "Legalise Marijuana" may be in capital letters, or may be partially . It is not -C: same as , except removed. -Collor: to the fBrazil's main distinction is in the "Collor, um tiro basta!" "Call John" : Brazil -D: same as the exception can xhigh density 3.5" and 5.25" now emits a "beep" through the speaker L: "Your PC is now !" The "LEGALISE MARIJUANA!" can din the emits a "beep" through the speaker L. The is: "Twoj PC jest teraz be!" The "LEGALISE MARIJUANA?" can the modified to avoid detection by utilities. Since its , most utilities can now detect in the "Your PC is now 2" Or: "Donald Duck is a lie." The " 2" portion of the may be corrupted as well. -LM: on the Fly accessed read and write intent, usually ing in a hang. The location of the and the to the : Canada -Mexican: Gin Mexico in May, 7the "NO VOTES FOR EL PRI". : Mexico, May Mutation: Mutation is a minor of the . Its major destinction Nnot Iunless the is accessed write-intent. It the same as the -NSD: in the Eastern United States, -NSD is a minor of the . Its major difference is to: "Non SYStEM dISc" and "LEGALISE MARIJUANA", the second usually be corrupted to "LEGALISE4". second is corrupted, all later the corrupted -NSD can xhigh density, 1.2M 5.25" I, moving the -NZ: fNew Zealand in has one slight difference. It not always save the wthe K. The din the is: "YOUR PC IS NOW STONED!". See: Evil Empire Horse % Swedish Disaster NoInt WXYC PZPAPN Striker #1 : Striker #1 Striker, QD335 G: March, R: 461 4: PNC - , IBM , NAV 2.1+, , VET, : CleanUp, or The Striker #1 ~in the Eastern March, is a of . Striker #1 is X, the xone . bthirteen , and the body of the appended to the end of the show a qof 461 (in the and s are not can be easily identified as the "Striker #1" in the fourth through thirteenth all s near the end of Striker #1 Nnot to do PZPAPN Stupid-1355 : Stupid-1355 %failures R: 1,355 4: PNCK - , VET, NAV 2.1+, 1.53S+ The Stupid-1355 . Its . Stupid-1355 is a of . Stupid-1355 is X, the xone . in the E, and hang . If +is in the E, it may s, the fail to the Stupid-1355 qof 1,355 the end of the be no 2to the =and in the DOS . One can be in the "*.BNL" PZPAPN Sunday : Sunday , 1989 TSR; execu ; FAT Washington (state), R: 1,636 4: PRsAT - W. & .OV? \, IBM , NAV, , VET, : CleanUp, , NAV, or The Sunday Gby many s in the Seattle, Washington area in , 1989. on any Sunday, Ming the "Today is Sunday! Why do you work so All work and no play make you a dull boy! Come on! Let's go out and fun!" The Sunday s to derived fthe , the in many respects. Damage to the or FAT has reported number of of Sunday are: Sunday-B: to the Sunday activate on any day of the week due to an Uin the day of the week checking routine. The in the is never L, and no damage is done to the Sunday-C: to Sunday-B, never It has, however, modified so it differs both the Sunday and Sunday-B es. g, it is the same as Sunday-B. See: Carfield Sunday-2 PZPAPN Sunday-2 : Sunday-2 Datarape 2.2 Canada R: 2,877 4: PRhAK - , NAV 2.1+, .1.4+, 2.43a+, 25.10+, The Sunday-2 ~in Canada in . Sunday-2 is a generic v. It W, and overlay on the and Sunday The Sunday-2 is X, Sunday-2 at the top of , but the rby the DOS @by 5,888 {21, 22, and 27 nby Sunday-2. At Sunday-2 Sunday-2 is , it W, and overlay for any reason. Sunday-2 at the end of `. . qof 2,877 (. . qof 2,877 to 2,891 not see the `in the DOS Sunday-2 is as the adjusts the it is Sunday-2 on Sundays X. The L, and the be hung: "It's Sunday. Why are you working? Take the day off compliments of RABID" cannot be seen in `as the The Sunday-2 4to perform a format on Sunday, however 4has several bugs and is not functional. Sunday-2 notice "detected by the DOS Sunday-2 is as the Eand to match checked by the DOS of Sunday-2 are: Sunday-2B: gequivalent to the is a minor See: Basilisk Sunday PZPAPN Suriv 1.01 : Suriv 1.01 1st, Israeli, Suriv01, Suriv A Extinct , 1987 TSR; . lock on Israel R: 897 4: PRsC - \, IBM , NAV, , VET, \, or The Suriv 1.01 is a v. It activate on sby running an aand X. On , it Mthe "APRIL 1ST HA HA HA YOU HAVE A VIRUS". The lock up, requiring it to be powered off and back on. The "sURIV 1.01" can be din the See: Suriv 4.02 PZPAPN Suriv 2.01 : Suriv 2.01 1st-B, Israeli, Suriv02, Suriv A Extinct G: 1987 TSR; . lock on Israel R: 1,488 4: PRsE - \, IBM , NAV, , VET, \, or The Suriv 2.01 is a v. It activate on sby running an Ming the same as Suriv 1.01 and locking up the . The cause a lockup, , 1 hour on any day on default =of 01-01-80 is used. The xthe PZPAPN Suriv 3.00 : Suriv 3.00 Israeli, Suriv03, Suriv B Extinct G: 1988 TSR; . W, & .SYS j; black window; slowdown Israel R: 1,813 ( `) & 1,808 ( 4: PRsA - , NAV, IBM , VET, : CleanUp, \, or May be a of the . The "sUMsDos" has 0to "sURIV 3.00". The Suriv 3.00 Friday the 13th is run or if it is already present in , however `are not Ad due to a bug in the on Friday the 13th, for 30 seconds, an area of the is turned into a "black window" and a wasting loop is overlay, . SYS, and execu Wand . Nnot See: PZPAPN Suriv 4.02 : Suriv 4.02 j; TSR; to DOS prompt; %failures; Ireland R: 897 4: PRsC - , NAV, , VET, 25.10+, \2.07+, The Suriv 4.02 fIreland in Suriv 4.02 is a vof . `, but not +. It The Suriv 4.02 is X, the as a low TSR. Suriv 4.02 is , it X. If X, it by 897 at the !of the The can be din all "Suriv 4.02" ,MAND "$$TMP. ,APRIL 1ST" The , "Suriv 4.02", is the umarker the uses to determine if the ais already s. It in the fourth through thirteenth Suriv 4.02 . If the Ythem, or Ya non , the to the DOS prompt. in a %failure. Suriv 4.02 1st, at the "APRIL 1ST" followed by blanks the next goes . A , requiring the to re %the See: Suriv 1.01 PZPAPN Surrender : Surrender R: 513 4: PRaAK - NAV 2.1+, VET, 1.15a+, The Surrender , and has an . Surrender is a vof . and . . It +if it is The the Surrender in the DOS buffers and graphics card be no rby the DOS Fly by the Surrender is , it ,and . qof 513 at the end of the be no 2to the =and in the DOS The in the Surrender all "Jet" "Jews NEVER surrender!" Surrender Nn't to do PZPAPN SVC 3.1 : SVC 3.1 SVC V3.1 G: May, R: 1,064 4: PRhAK - \, NAV, , IBM , VET, The SVC 3.1 Vin May, . It is fthe . SVC 3.1 is a of . ,and . The SVC 3.1 is X, it at the top of but #the , as measured by the DOS 1,088 |12's not be moved. nby the SVC 3.1 is , it ,and . X. If X, it 1,064 at the end of the a. The =and in the DOS not be SVC 3.1 8the "(c) by SVC,Vers. 3.1" SVC 3.1 is an earlier of the 1689 . Unlike 1689, it Nnot hang the the next becoming . It Nnot hide the of SVC 3.1 are: SVC 3.1-CHR: , SVC 3.1-CHR is a modified of the SVC 3.1 Like the adds 1,064 to the . ,and . are X. The at the end of `. The can be in the 4in SVC 3.1-CHR "(C) by CHR,Sverdlovsk" is not detected by all can detect the SVC 3.1 See: SVC 4.0 SVC 5.0 SVC 6.0 PZPAPN SVC 4.0 : SVC 4.0 1689, Off , SVC V4.0, SVC 4.0-1740 R: 1,689 4: PRA - \, NAV, , IBM , VET, The SVC 4.0 . It is is not a very viable both . ,and . SVC 4.0 is in the in- interpreter. , the xthe next ,or . hang by 1,689 `larger 1,689 (, the hide the qif the is already in smaller 1,689 indicate a qin the DOS . In all cases, the at the end of hang , it is not a very viable , and should not be considered a threat in its :state. of SVC 4.0 are: SVC 4.0-1740: A 1,740 of SVC 4.0, the bug fixed in the k. It Nnot xvery small . `. The DOS Ton all . The "(c) by SVC,Vers. 4.0" See: SVC 3.1 SVC 5.0 SVC 6.0 PZPAPN SVC 5.0 : SVC 5.0 3103, SVC V5.0 Israel R: 3,103 4: PRhAK - , NAV, , IBM }, VET, 1.53S+ The SVC 5.0, or 3103, ~in Israel in . It is believed to ated in the 3103 is a vof . , as well as overlay `. It is a The SVC 5.0 is X, the at the top of #the , as rby the DOS @by 3,120 {01, 03, 08, and 21 nby the , SVC 5.0 ,and . X. SVC 5.0 is a , and , the of 3,103 not be . Likewise, to view SVC 5.0 in a "clean" copy of the "made . In reality, the by 3,103 at the end of the a. The can be in the "(c) by SVC, Vers. 5.0" SVC 5.0 checks see if the is "AIDSTEST.C". If the has add a copyright the reads: "-* -91 by SVC, Vers 6.0 *- SVC 5.0 may cause multiple open at the same of SVC 5.0 are: SVC 5.0B: gequivalent to the SVC 5.0, minor SVC 5.0C: gequivalent to the SVC 5.0, minor 1. It "(c) by SVC,Vers. 5.0" SVC 5.0D: on the SVC 5.0 are two major differences b, the hooks {13 and 21, instead of 01, 03, 08, and 21. Second, it Nn't 8the typical copyright notice din the SVC 5.0 See: SVC 3.1 SVC 4.0 SVC 6.0 PZPAPN SVC 6.0 : SVC 6.0 R: 4,644 4: PRhAX - , IBM , VET, , NAV 2.1+, The SVC 6.0 Gin the . It is fthe . SVC 6.0 is a ,and . . It Nnot The SVC 6.0 is X, the at the top of #the , as measured by the DOS by 4,672 {08 and 21 nby the and |12's moved. The SVC 6.0 has actually al 68K of uses the 4,672 If the bSVC 6.0 fthe K, the sthe by altering three (. The written to the Kstarting at side 0, cylinder 0, 2. The three (cause the to be fthe SVC 6.0 is , it ,and . qof 4,644 be hidden by the it is SVC 6.0 at the end of be no 2in the =and in the DOS SVC 6.0 is a true are read into , it "dis w" them, so a clean copy be in As such, if SVC 6.0 is utilities may not be able to detect the in the Three be able to be if the is not "(c) -91 by SVC, Vers. 6.0" "AIDSTEST.C" "SVC 6.0" It is what SVC 6.0 of SVC 6.0 are: SVC 6.0-4677: A later of SVC 6.0, is 4,704 (. Like the SVC 6.0, it hooks {08 and 21. , SVC 6.0-4677 ,and . for any reason. qof 4,677 at the end of the a. The qis not SVC 6.0-4677 is . The =and in the DOS not be . The in the SVC 6.0-4677 "/* (c) -91 by Moscow SVC, Vers. 6.0 */" "AIDSTEST.C" "SVC 6.0" Like SVC 6.0, SVC 6.0-4677 is a full SVC 6.01: A later of SVC 6.0, is 4,688 (. Like the SVC 6.0, it hooks {08 and 21. , SVC 6.01 ,and . for any reason. qof 4,661 at the end of the a. The qis not SVC 6.01 is The =and in the DOS not be . The in the SVC 6.01 "/* (c) -91 by Moscow SVC, Vers. 6.0 */" "AIDSTEST. "Moscow SVC 6.01" Like SVC 6.0, SVC 6.01 is a full SVC 6.01-B: to the SVC 6.01 is a minor . The "/* (c) -91 by Moscow SVC, Vers. 6.0 */" "AIDSTEST. "Moscow SVC 6.01" See: SVC 3.1 SVC 4.0 SVC 5.0 PZPAPN Sverdlov : Sverdlov Hymn-2 R: 1,962 4: PRhAK - \, NAV, , IBM , VET, The Sverdlov believed to ated in the . Sverdlov is a vof . ,and . `, and The the Sverdlov X, the at the top #the DOS &. 4,080 reserved, and the is not by the . The DOS indicate is 4,080 (less expected. if it was not already Sverdlov is , any . ,or . aover 2K in sif it is for any reason. qof 1,962 1,962 to 1,977 . In both cases, the at the end of It is if Sverdlov of Sverdlov are: Sverdlov-B: Very to the Sverdlov has one basic 2in behavior. It ,and . `over 3K in before wise, the 4is very to avoid detection, and may identify it as Hymn-2. PZPAPN : SVir Endangered Poland R: 512 4: PNE - , NAV, IBM , VET, The SVir ~in Poland early in The ~had a fatal flaw in its prevented it fexecuting. In , a sample was obtained fFridrik Skulason second sample, identified as SVir-B, is a `. A third the SVir-B X, the xone . between 516 and 526 4appended to the end of the a. If the could not find an . x, it leave the O"spinning" as it be in an endless loop looking for a Interestingly enough, the A: <in the 0to the =and SVir, at least in the three Nnot do malicious, it simply of SVir are: SVir-0: A is very to SVir-B. the xeither 1 or 2 `in the in a hang. SVir-A: The fPoland in early not SVir-B: A has the bug in SVir-A fixed so PZPAPN : Swap Falling Letters %, Israeli , 1989 Graphic M; BSC (floppy ); TSR; bad cluster Israel R: N/A 4: RsF - Floppy \, IBM K, CleanUp, \, or DOS SYS The Swap , or Israeli , was breported in 1989. is a wfloppies. The floppy's it is accessed. One bad cluster be written on track 39, 6 and 7 the head unspecified. If track 39, 6 and 7, are not empty, the , it uses 2K or RAM. The actual of the 4is 740 The Swap for 10 minutes. A cascading effect of letters and 3on the monitor is seen, to the cascading effect of the Cascade and Traceback The d the Swap because the ~case had the cphrase (00B7-00E4 on track 39, "The Swapping- . (C) , 1989 by the CIA" However, phrase is not freshly sby the Swap the Swap can be easily identified by looking at the editor, such as Norton Utilities. The normally at the end of the not be , instead the start of the 4is present. The remainder of the track 39, 6 and 7. PZPAPN Swedish Boys : Swedish Boys Data Molester, Headache, Swedish, Why Windows Sweden R: 457, 459, or 538 ((depending on present) 4: PNCK - , VET, NAV 2.1+, 1.15a+, Swedish Boys is a group of initially three Sweden in es are all vs of . +. Depending on the present, may be destructive. The Swedish Boys es are: Data Molester: The Data Molester is a vof . xall . in the qof 538 the at the end of the a. The =and in the DOS . The in the , and are not ":+:+ The Data Molester V1.00 +:+:" "The Vile One / The BetaBoys Development Corporation." Data Molester the C: root Eand : Sweden Headache: The Headache is a vof . +. It xone . in the qof 459 at the end of the a. The and to the . The can be in the 4in all "-+( Severe Head-Ache V2.oo )+-" "Created by The Vile One & MaZ" "Copyright (c) The BetaBoys Development Corp" "-Sweden 04/19/92" : Sweden Why Windows: The Why Windows is a vof . xone . in the 459 at the end of the . The =and in the DOS to the and . The can be din the 4in all Why Windows "*.com" "C:\ 5.Com C:\Autoexec.Bat C:\Config.Sys" "\windows\win.com" "Why Windows (c) MaZ / BetaBoys B.B" Why Windows is a destructive . It attempt to Athe a\windows\win.com. ly, on ^23rd of any year it attempt to C:\Autoexec.Bat. On ^24th of any year, it attempt to AC:\Config.Sys. Lastly, on ^25th of any year it attempt to the C: Oroot Eand : Sweden PZPAPN Swedish Disaster : Swedish Disaster BSC; Sweden R: N/A 4: BRhX - \, NAV, IBM , VET, The Swedish Disaster was s to be fSweden. It is a floppy and the Jwhose the Swedish Disaster , the moved to side 0, cylinder 0, 6. The at the top of but #the by 2,048 be 6,944 (less what is expected by the |12's moved by the Swedish Disaster is , the all non-write protected are accessed on the . On 360K 5.25" I, the moved to is normally a part of the root means if the entries in be lost. The can be dat the end of the I, as well as in the "The Swedish Disaster" the Swedish Disaster can be dis powering off the and re %ing fa write-protected, J. The DOS SYS 5can be used to replace the I. For Ks, the remove remain in the See: PZPAPN Swiss 143 : Swiss 143 Switzerland R: 143 4: PNCK - , IBM NAV 2.1+, , VET, The Swiss 143 , by Dany Schoch of Hagendern, Switzerland. is a non- vof . Swiss 143 is X, the xall . `in the by 143 (, the the end of the . The =and to the =and were Nnot do PZPAPN Swiss Phoenix : Swiss Phoenix Switzerland R: 927 4: PRhAK - 6.00+, V99+, 1.53S+ The Swiss Phoenix ~in Switzerland in is a vof . ,and . +. It exhibits techniques. The Swiss Phoenix fa low-level sub , it reside at the top of but #the , as rby the DOS by 976 nby Swiss Phoenix in the Swiss Phoenix , it ,and . , or copied, usually in sub Fories. the Swiss Phoenix qof 927 at the end of the a. The =and in the DOS not be . The the , and is not the Swiss Phoenix the DOS . Not all be flagged, but those were prior to the becoming It is what Swiss Phoenix may do PZPAPN Sylvia : Sylvia Holland Girl >, 1989 j; TSR R: 1,332 4: PRsC - \, IBM , NAV, , VET, \, or The Sylvia, or Holland Girl, breported by Jan Terpstra of the `, increasing by 1,332 (. The apparently damage, and Nnot The is due to the fact and phone number of a girl d Sylvia in Holland, along her address, requesting post cards be sent to her. The is believed to written by her ex-boyfriend. of Sylvia are: Sylvia 2: The Sylvia 2, or Holland Girl 2, is a modified of the Sylvia vof . Zof an in up to four becoming may be in the C: Oroot E, or the qof 1,332 at the !of the a. The can be in the 4, along Sylvia's last and full address is not "repeated here: sby a HARMLESS V2.1" "Send a FUNNY postcard to : Sylvia" "You might get an ANTIVIRUS : New Brunswick, Canada PZPAPN SysLock 00j G PTj : SysLock 3551, 3555 Endangered , 1988 j; data R: 3,551 4: PNA - Encrypting , NAV, IBM , VET, \, or The SysLock is a encrypting both . ,and . `, as well as damaging data Nnot , but instead searches through the . ,and . Fories on the K, picking one execu random to x. The mits 3,551 it may vary slightly depending on The SysLock damage `by searching for the word "Microsoft" in any combination of upper and lower case and dreplace the word "MACROSOFT". If the SysLock finds an en ment variable "SYSLOCK" exists in the and has set to "@" (hex 40), the xany or perform replacements, but instead pass control to its host immediately. of SysLock are: Advent: Reported to be a SysLock , the sample of by the author Nnot . All samples of researchers do not . Fridrik Skulason of Iceland has it is on an a, and t to be extinct. Advent-B: fthe NCSA is , Advent-B is a bug fixed of the Advent . Advent-B may xone . ,or . in the , however, xthe bfew `in the 2,768 to 2,783 at the end of the . The =and in the not be . Like Advent, Advent-B activate in >, at randomly activate, Ming four candles and playing "On Tannenbaum" on the speaker. Cookie: on the SysLock , Cookie is a considerably shorter in . It is a vof . ,and . +. It wone . ,or . the of 2,232 to 2,251 at the end of the a. The =and in the DOS Cookie may X. In cases, the functioning a number of Zs. reported to Mthe "I want a COOKIE!", the sample Nn't exhibit behavior. Macho-A: same as the SysLock , except "Microsoft" is replaced "MACHOSOFT". PZPAPN T-1000 : T-1000 %failure; R: 128 4: ONCK - V100+, V100+ The T-1000 . T-1000 is a +. It corrupts the the T-1000 X, the T-1000 xall of the . in the E, and Mthe "T-1000" hang the T-1000 mthe (of the host by the T-1000 unless were smaller (, in case . The =and in the DOS to the =and . The , along , is in the "*.Com" PZPAPN Tabulero : Tabulero 6- South America j; TSR Venezuela Argentina R: 2,048 - 2,062 4: PRsE - , NAV 2.1+, VET, 25.10+, V99+, The Tabulero . It is Venezuela, it was ~in Argentina. Tabulero is a vof . . It is on the bTabulero X, the Tabulero as a low TSR of 2,048 (. It hooks {09 and 21. the Tabulero , it X. Tabulero cannot recognize previous us on `, so it the Tabulero qof 2,048 to 2,062 of the a, and 2,048 u. The at the end of the a. The =and the DOS not be . The can be din all Tabulero "pTpApBpUpLpEpRpOp pI.U.P.L.C.M Wilmer C G" "exe" Tabulero may Mthe "TABULERO" on the it has period of of Tabulero are: Tabulero-B: A later of the Tabulero , it Nnot re . The "pTpApBpUpLpEpRpOp p" "ISRAEL" "ODALUBAT atse CP us, otreum ah LEMRAC" "--IUP LUIS CABALLERO MEJIAS--" Tabulero 2: An of the Tabulero Nnot re `. The in the 4are: "ODALUBAT atse CP us, otreum ah LEMRAC" "--IUP LUIS CABALLERO MEJIAS--" "Wilmer 86-Phonix (R) Rescue anti "Copyright (C) Phonix Corp 1987- All right reserved." "Immunizing" "No path especifed or no "Example RESCUE A:" "pTpApBpUpLpEpRpOp p" "ISRAEL" , 1993. PZPAPN : Tack G: May, R: 449 - 464 4: PNCK - 1.53S+ The Tack, or 4-A, in May, . Its . Tack is a the Tack X, the Tack xone . in the and Mthe - Hello, I am qof 449 to 464 at the end of the a. The =and in the DOS to the =and $the , the can be in the 4in Tack "TACK" the Tack Lon the monitor, and PZPAPN Taiwan : Taiwan Taiwan 2, Taiwan-B, Doom I, Doom I-B Endangered j; 8th day of any month corrupts %, FAT, Taiwan R: 743 4: PNCK - , NAV, , IBM , VET, \, NAV, or The Taiwan in Taiwan, R.O.C. +, and Nnot into the Taiwan X, the attempt to xup to three . `. The default Eis not s, instead the start its search for candi `in the C: Oroot , the wthe aby copying the 4to the b743 of the a, the b743 (of the ais re to the end of the . a. A bug exists in , if the ais less , the always be 1,486 effect is due to the not checking to see if it read less (of the abefore The Taiwan is destructive. On the 8th day of any month, is run the perform an absolute write for 160 starting at logical 0 on the C: and D: Os. In effect, logical write in the FATs and root of Taiwan are: Doom I: The of Taiwan is between Taiwan-B and Taiwan, Doom I adds 752 2in the =and in the DOS E. Doom I xfour . `on the C: X. It reset the Oand `, so if the was not :ly using the C: as the may notice the 2. Due to a bug in the Doom I smaller (, the 1,488 Doom I-B: Doom I-B is a later of the Taiwan , and qs the `by 677 (. It xthree . on the C: X. The and reset to the Ethe uprocess is complete. Unlike Taiwan, smaller Taiwan-B: Apparently an earlier of the Taiwan hang the X, but it has ausing the selection mechanism rfor the Taiwan PZPAPN Taiwan 3 : Taiwan 3 Anticad 2 Taiwan R: 2,900 4: PRA - , IBM \, NAV, , VET, : CleanUp, or The Taiwan 3 in Taiwan, R.O.C. It was dubbed the Taiwan 3 by John McAfee because it is the third fTaiwan, the two are Taiwan and KKiller. is not related to either of The the Taiwan 3 Xon a , the in low 3,152 (. The hooks becoming , Taiwan 3 xany X. . by 2,900 qby between 2,900 and 2,908 Overlay `may sas well. It is what the criteria is for what it $spreading. See: Fu Manchu PZPAPN Taiwan 4 : Taiwan 4 2576, Anticad 5 TSR; . slowdown and Thailand Taiwan R: 2,576 4: PRsA - , IBM \, NAV, , VET, 1.53S+ : CleanUp, or The Taiwan 4, or 2576, . While one copy of by a of Excalibur! who it had fa download of AutoCad BBS, a second copy was to John McAfee Thailand on the same s to ated in Taiwan, and is on the Taiwan 3 . It is a vof . ,and . `, but the Taiwan 4 X, the check to see if it is already . If the isn't already in , the as a low TSR of 2,832 and 21 nby the , the start to slow down the gradually. 30 minutes, it slowed the down by 30 percent. Any . ,or . Taiwan 4 active in qd by 2,576 (for . `, and 2,576 - 2,590 for . `. The at the !of . `, and the end of . `. The din all "To Whom see : Shit! As you can see document, you may know what is. But I must tell you: DO NOT TRY to WRITE ANY ANTI-PROGRAM to THIS VIRUS. is a test- , the real dangerous implement on . I use MASM to generate varius easily and you must use DEBUG against my lly, is foolish. Save your until next month. OK? Your Sincerely, ABT Group., Oct 13th, 1989 at FCU." can be din all "ACAD. PZPAPN Talentless : Talentless R: 1,077 4: PNAK - , VET, IBM C, NAV 2.1+, 3.93+, V99+, The Talentless . Its . Talentless is a ,and . v. It the Talentless the Talentless xone . ,or . on the C: O. The start looking for a xin the C: Oroot E, and move down through the Estructure. the Talentless qof 1,077 (. The at the end of the a. The =and in the DOS not be . The in all Talentless "Bad It is if Talentless PZPAPN TalkingHeads : TalkingHeads ^, 1993. fail to function; README. acreated R: 519 4: ONCK - .1.4+, NAV 2.1.4+, V102+, V102+ The TalkingHeads ^, 1993. Its . TalkingHeads is a vof . +. It permanently corrupts the . the TalkingHeads xtwo . in the , the create a 519 README. ,in the E, as create a 519 ain the C:\DOS Eif the Nn't already exist. the TalkingHeads mthe 519 (of the host by the be no unless the awas smaller , in case it . The =and in the DOS not be . The can be in the 4in all "C:\DOS\ "README. The TalkingHeads Mthe Xon Fridays between 11:00 and 11:59: ain't no disco..." The Nn't always behaviour. The in the PZPAPN Tao Cheng : Tao Cheng , 1993. k; video mode %failure; garbage 3written to unexpected R: 1,295 4: PRtAK - 6.00+, V100+ The Tao Cheng , 1993. Its . Tao Cheng is a vof . ,and . bTao Cheng X, the Tao Cheng at the top of #the &, moving |12's , as rby the DOS ?by 3,072 nby the Tao Cheng the Tao Cheng , it and . qof 1,295 at the end of the a. The =and the DOS not be . The in the Tao Cheng "TheDraw Save" "Unsupported Video Mode" "[Tao Cheng] Tommy Chong" The author of the "TheDraw" had nothing to do creation of . The btwo are in the due to use of TheDraw to create part of the the Tao Cheng [a number . Frequent kmay be accompanied colored squares 8ing random 3on the monitor. The video mode may be switched. Unexpected may , as well as %failures %copy of Tmay accompanied by a ,MAND cannot be loaded, and the halted. PZPAPN Tatou : Tatou j; TSR; seconds set to "62" Poland R: 1,153 4: PRsCK - .1.4+, \2.07+, V100+, V100+ The Tatou fPoland in . Tatou is a vof . bTatou X, the Tatou as a low TSR of 1,424 (. It hooks interrup 21. the Tatou , it qof 1,153 at the end of the a. The =and in the DOS to not be 's seconds field set to "62". The in all Tatou It is what Tatou PZPAPN : TB1 R: 124 - 448 4: PNE - The TB1 . Its . TB1 is a vof . the TB1 X, the TB1 xup to three . in the 124 to 448 at the end of the a. The =and in the DOS not be . No in the TB1 Nn't to do PZPAPN Telecom : Telecom Telefonica, Telecom a, Spanish Telecom-2 Kformatted Spain R: 3,700 4: PRhC - , IBM NAV, , VET, The Telecom, Telefonica, or Telecom breported , in Spain. several samples of Telecom were in early , the breplicable sample arrived sample is fSpain. Telecom is a vof . . It carries a of the Anti-Tel zon the ). Telecom was written by the same individual as the Anti-Tel and Holocaust es. All of es are Telecom is X, Telecom at the top of #the |12's not be moved. , as measured by the DOS ?by 3,984 nby the Telecom Telecom is , it larger 1K in by 3,700 the qcannot be seen in the as the hides it. The alters the in the Eby adding 100 to the year, readily apparent. The =alteration is how Telecom determines if the ais already Telecom , it xthe of the Anti-Tel accesses a on the K. See the description for Anti-Tel for yon the The Nnot 8a complete copy of the Telecom , so it by cannot The vportion of Telecom Nnot mechanism per say, the mechanism is in the K, the See: Anti-Tel Holocaust PZPAPN : Ten 1554, 9800: , V-Alert, 1559 H: j, TSR, linkage R: 1,554 4: PRfAK - D: IBM \, NAV, , VET, \, or The Ten (, or 1554, was accidentally sent out over the VALERT-L network on ^13, subscribers. , the . It proceed to `over 1000 and . `over 1024 +, increasing uby 1,554 to 1,569 The Ten >of any year. Upon , any are written be missing the bten (. At the end of `, ten (of miscellaneous . In effect, both and data be corrupted. If the Ten Xon a less , the hang the of Ten (are: 1415: The 1415 on the Ten . It elow hooking {21 and 49. The 1415 by 1,415 to 1,462 at the end of the be no 2in the =and in the DOS (-1514: The Ten (-1514 on the Ten . It , it and . by 1,518 to 1,569 at the end of the may notice `written to Kmay be missing the were in the a, thus corrupting the (-1514B: gequivalent to the Ten (-1514, differs in a few PZPAPN Tequila : Tequila modified; Switzerland R: 2,468 4: PRtEX - \, IBM , NAV, , VET, : CleanUp, \, or replace The Tequila . It is fSwitzerland, and at the of its V. Tequila is a ) and . uses a complex encryption method and garbling to avoid disassembly and detection by using a or search The Tequila is Xon a , the check to see if it has already . If the has not s, Tequila write an un Scopy of to the last six of the K, as well as modify the xious. Tequila , and it Later, is re fthe Tequila . It at the top #the |12's be moved, preventing the {13 and 21 nby the , as rby the DOS be 3,072 (less expected. Tequila is , it 2,468 (, but not be able to be seen in the DOS Eif the . The at the end of . The =and in the not be The be able to be don the last few of the "Welcome to T.TEQUILA's latest production. Contact T.TEQUILA/P.o.Box 543/6312 St'hausen Switzerland. Loving t to L.I.N.D.A. BEER and TEQUILA forever !" Tequila notice "detected the DOS . If the /F option, 9may perform CRC checking may not be able to detect Tequila on `, regardless of whether the Tequila four months the initial of the K. At , and every month on the anniversary =, the Ma graphic and the Y: mov ax, FE03 / int 21. Key to go on!" If the Ys a 8ing sequence of instructions, the don the last the PZPAPN Terminator : Terminator 1; TSR; write protect R: 526 4: PRsCK - , VET, , NAV 2.1+, The Terminator . Its . Terminator is a vof . The the Terminator X, the Terminator as a low TSR of 1,104 {21, 22, and the Terminator , it the Terminator of 526 at the end of the The =and in the DOS to the =and the Terminator may notice the fa write-protected J, a write-protect PZPAPN Terminator-2294 : Terminator-2294 R: 2,294 4: PRhAK - 6.04+, V100+, V100+ The Terminator-2294 . Its . Terminator-2294 is a vof . ,and . +. It employs techniques to avoid detection, and Nnot until the ring >31, >31, , and a Terminator-2294 X, the Terminator-2294 at the top of #the &, hooking {13, 21 and 24. , as the DOS ?by 2,448 , the Terminator-2294 +if it was not the Terminator-2294 , it ,and . qof 2,294 at the end of the a. The not be . The =and in the DOS not be . The in the Terminator-2294 "TERMINATOR" ".csc.eziarchomanxep" the Terminator-2294 notice Ton all . It is what effects the Terminator-2294 may PZPAPN Terminator-3549 : Terminator-3549 `corrupted; fail to function ; "Divide overflow" The R: 3,549 4: ONE - 6.00+, 2.43a+, \2.07+, V102+, V102+ The Terminator-3549 . It is fThe . Terminator-3549 is a . It permanently damages the the Terminator-3549 the Terminator-3549 xone . the C: O. The starting in the O's root E, and slowly work down the structure. the Terminator-3549 b3,549 (of the host by the 4. Unless the . awas smaller 3,549 be no smaller 3,549 before 3,549 u. The =and in the DOS to the and . The in the 4in Terminator-3549 "*.exe" "$456789:;<o>=>?u" in the Lon the monitor: "Divide overflow" PZPAPN Tester : Tester TestVir, Test B V1.4 R: 1,000 4: PNCK - \, NAV, , IBM , VET, The Tester, or TestVir, . Its is a vof . `. It Tester is X, the Mthe , requiring a response by the is TESTVIRUS B V1.4 ! 1 = E+ run orig. prog. 5 = run orig. 9 = abort" If a "1" is entered by the , the all of the . in the E, and the Tester , it Mone of the ctwo lines, indicating it is :ly processing. The bline is the if it was s, the second line it is tthe "Already "INFECTED: Entering a "5" in no s, and the X. Finally, entering a "9" in the terminating and the ed to a DOS prompt. Tester by 1,000 the at the !of the The =and in the DOS to the =and PZPAPN Thimble : Thimble j; TSR; R: 1,024 - 2,046 4: PRsCK - NAV 2.1+, , VET, The Thimble . Its , is . Thimble is a vof . bThimble X, the Thimble as a low TSR of 4,416 {21 and CC the the Thimble , it X. If the Thimble normally by 1,024 (. The exception is smaller 1,024 2,048 . The at the !of the . The =and in the DOS to the =and The can be din all Thimble "Greetings to Cracker Jack..." "Loving ts to Shirley" "Marty McFly lives where in "Kill Eddie. Kill Diana. Kill Fredo." It is if Thimble PZPAPN mark 1 H: Poland R: 1,062 - 1,076 4: PRhE - 1.15a+, 6.00+, \2.07+, V99+, The mark . It is fPoland. mark is a vof . mark X, the mark at the top of the rby the DOS ?by 1,072 {1C and 21 nby the mark mark , it very small ones) qof 1,062 to 1,076 "at the end of the a. The =and in the DOS . No in the mark It is what mark mark are: mark 2: Probably an earlier of the mark is 1,088 (, hooking {1C and 21. It adds 1,083 to 1,097 to the . w. Unlike mark, mark 2 adding an 1,083 to 1,097 (. The =and in the DOS not be : Poland PZPAPN Timid : Timid H: Zfailure Oregon, R: 306 4: PNCK - , VET, , NAV 2.1+, The Timid Gin the state of Oregon in the . Timid is a vof . +. Timid s to be an escaped research , and has din the public domain. It was by Wallace Hale of Canada. Timid is X, the Timid look for an in the x. The encountered sby the . If no exist in the E, a hang Timid qof 306 (. The at the end of the The =and in the DOS to the =and . Two can be din the "VI" The , "VI", in the fourth and fifth `. Together a jump (E9h) instruction at the !of the a, it forms the marker used by the to determine if the awas sby Timid. %the in a hang. yield unexpected s, such as beeping, or a of Timid are: Hehheh: , Hehheh is a 320 of the Timid . It wone ain the `may be of any pdata `, as the uses a search argument of *.*. qof 320 at the end of the a. The and in the DOS to the =and all of the `in the Zof the next in the "repeatedly Lon the monitor, accompanied by beeping: "*.* HEH!HEH!HEH!HEH!" can be in the 4in all Hehheh Timid-305: , Timid-305 is one )smaller Timid Zof an in the searching the Efor an x. If the , it Mthe newly . No beeping Timid-LM: , Timid-LM is a 305 of the Timid . It is fCanada, written by Lucifer Messiah. Timid-LM wone . ain the by 305 at the end of the a. The and in the DOS to the =and 8the "LM" starting in the fourth )of the a. The din the 4is "*. : Canada Timid-Orig: The Timid whose source published in "The Little Black Book of Computer by Mark Ludwig. the Timid- Orig X, the search the Efor an x, and xit. it has , it Mthe of the has just Timid-Orig qof 306 at the end of the . The =and in the DOS to the =and . The Timid-Orig Nnot cause beeping on the speaker. : Arizona, PZPAPN Timor : Timor H: j; TSR; R: 1,562 - 1,576 4: PRsA - \, IBM , VET, 6.00+, The Timor . Its . Timor is a vof . ,and . , and is on the bTimor X, the Timor as a low TSR of 2,816 (. It hook {21 and F8. Timor is , it ,and . X. . qof 1,562 at the !of the a. . qof 1,562 - 1,576 at the end of the a. Unlike , Timor many =and in the DOS The can be din all Timor "Timor" Cruz, Dili" "LxTimor" "sso, edom for East Timor !" Nov 12, Lusit ia Expres" Timor 12th of any year, at may Mthe : "St Cruz, Dili". See: PZPAPN Di-94, Di-101, Di-108, Di-110, Di-94, Di-101, Di-108, Di-110 H: %failure; R: 94 - 110 ((see 4: PNCK - ., NAV 2.1+, , VET, The Di, or Di, ]of four es was . Its . The es in ]are non- vs of . +. Since four es exhibit behavior, in general, differences #under X, the xall . in the E. If E, it well. one of the the at the !of the a. The q, and whether the later be re depends on is present. In any case, the mhad =and in the DOS to the =and One can be in the "*.com" The es do not intentionally do may fail to are s. The fail to %if the copy of members of the ]are: Di-94: adds 94 (to the . w. It is unable to distinquish has s, so it add 94 Di-101: A 101 )member of the wall . `in the not always in a manner. In cases, the b101 out saving the b101 fore, the initial uof a , the be either zero or 101 Like Di-94, it cannot recognize `, and later re xthem, adding an zero or 101 Di-108: Di-101, is 108 in a manner, and s by b108 Unlike Di-101, it can recognize `, and Nnot re xthem. Di-110: Di-108, is 110 PZPAPN -133, -134, -138, -143, -154, -156, -158, -159, -160, -167, H: R: 133 - 198 ((see 4: PRC - , IBM \, NAV, , VET, The es was by the author in fVesselin Bontchev of '. All the es in grouping share the same characteristics, difference is the effective of the five (5) es included in the " ]" as of -158, -159, -160, -167, and -198. In , five (5) es in ]were Vesselin Bontchev: -134, -138, -143, -154, and -156. In , an eleventh member was -133. The one of the Xon a , the segment 60h. area of is normally used by DOS %ed, it is never used or referenced. nby the , the xany . qof between 134 - 198 (, depending on is present on the . The =and in the to the =and The Nnot do The es in ]" are not related to the documented members of the ]are: -133: -134, 's effective 133 (. The bugs in -134 fixed, is an excellent replicator. it cannot be detected by utilities were aware of members of -134: 's effective is 134 is the member of is not a very viable , it usually hang the -138: Same as , effective is 138 -143: Same as , effective is 143 -154: Same as , effective is 154 -156: Same as , effective is 156 -158: Same as , effective is 158 -159: Same as , effective is 159 -160: Same as , effective is 160 -167: Same as , effective is 167 -198: Same as , effective is 198 See: Dutch Micro 128 Mini-97 PZPAPN 163 H: Denmark R: 163 4: PNCK - \, NAV, IBM , VET, \, or The 163 , or , was ~by Fridrik Skulason of Iceland in is a generic . v, and it The the 163 the attempt to xthe ain the E. On %able normally be attempt to be `are greater by 163 (, and <stamps in the 0to the always end hex : '2A2E434F4D00'. Nnothing but , and is the smallest MS-DOS as of its The may or may not be related to the documented elsewhere in of the 191: A 191 of the , the 191 xone . ain the qof 191 at the end of the a. The =and in the DOS not be . One s in the The 191 Nnot xvery small `, and it usually not xmore four `in the E. It Nnothing Brenda: A 256 of the , Brenda one . ain the of 256 at the end of the a. The =and in the DOS to the Brenda has bthree . `in the E, it the instead of "(C) '92, Stingray/VIPER Luv, Brenda" is not `as it is S. One in the Brenda 4: "*. May, Brenda-B: to Brenda, has one Kennedy: The Kennedy is a 333 of the . It wone . X, adding 333 (to the end of the has three 6 (Robert Kennedy's assassination in 1968), 18 (death of Joseph Kennedy in 1969), and 22 (John F. Kennedy's assassination in 1963) of any year. On , the "Kennedy is deal - long live 'The Dead Kennedys'" Two can be in the 5.com" "The Dead Kennedys" [cross-linking of `, lost clusters, and : Denmark Stigmata: Stigmata is a 1,000 of the wone . in the if it encounters a very small . the Stigmata qof 1,000 the end of the a. The =and in the DOS not be . No in the See: PZPAPN : TMTM Two Minutes To Midnight H: England R: 441 4: PNCK - V99+, 6.00+, \2.07+, The TMTM, or Two Minutes To Midnight, Manchester, England in . TMTM is a vof . the TMTM xone . in the hang may qof 441 at the end of the a. The in the DOS to 11:58p, or two minutes to midnight. One in the kfrequently PZPAPN Tobacco : Tobacco H: j; TSR R: 2,900 - 2,914 4: PRsAK - , IBM , VET, NAV 2.1+, 2.43a+, .1.4+, 1.53S+ The Tobacco . Its . Tobacco is a vof . ,and . on the Plastique bTobacco X, the Tobacco as a low TSR of 3,152 (. It hook the Tobacco , it and . the exception of qof 2,900 at the !of the a. . sby Tobacco by 2,900 to 2,914 at the end of the many sby Tobacco. The can be din all Tobacco "Tobacco v2" "AntiDacha. 21193We don't want" "gypsies in our" "world. We don't" "want DACHAs." 2nd Tabacalera gana siempre. Tobacco Ver. 2.0" It is what Tobacco of Tobacco are: Tobacco-B: to the Tobacco Nnot +. The the "Tobacco v2" "We don't want" "gypsies in our" "world. DHC 1997" "ENIGMA MCMXCV I@TTF" 2nd Tabacalera gana siempre. Tobacco Ver. 2.0" See: Plastique PZPAPN Todor : Todor 1993 H: R: 1,993 4: PNEK - \2.07+, The Todor . It is Todor is a vof . `and the Todor xup to four . in the ly, it +if it was not the Todor qof 1,993 at the end of the a. The in the DOS not be The in the Todor "*.exe *.com" ,SPEC=(C)Todor" It is what Todor of Todor are: Todor-B: gequivalent to the 7minor alterations. ~: The PZPAPN Tokyo : Tokyo H: may not function Japan R: 1,258 - 1,273 4: PNE - , VET, The Tokyo Gin Japan in . Tokyo is vof . Tokyo is X, the one . ain the by 1,258 to 1,273 at the end of the Tokyo may [frequent are made to hang Nnot , often the mas the is expecting, pauses ring in output operations, such as to the It is if Tokyo PZPAPN Tolbuhin : Tolbuhin Sk1, Tolbuhin-1147 H: R: 1,147 4: PRhC - .1.4+, 6.00+, 2.43a+, 25.10+, \2.07+, 1.53S+ The Tolbuhin, or Sk1, . Its . Tolbuhin is a vof . , but not bTolbuhin X, the Tolbuhin at the top of #the , as rby the DOS ?by 2,048 {20 and 21 Tolbuhin. The xone . in the Tolbuhin is , it qof 1,147 the end of the a. The =and in the DOS to the =and . The can be din all the Tolbuhin "Created 21.I. - PMG\OTME - Tolbuhin" "*.com" ,MAND" kfrequently . It destructive of Tolbuhin are: Tolbuhin-992: on the Tolbuhin 2,048 (. It hooks 13, 20, and 21. qof 992 at the end of the a. The and in the DOS to the =and . The can be in the "Created 21.I. - PMG\OTME - Tolbuhin" "*.com" ,MAND" Tolbuhin-1004: on the Tolbuhin 2,048 (. It hooks 13, 20, and 21. qof 1,004 at the end of the a. The and in the DOS to the =and . The can be in the "*.com" ,MAND" PZPAPN Tomato : Tomato H: k; unusual R: 2,156 - 2,171 4: PRhAK - V100+, V100+ The Tomato . Its . Tomato is a vof . ,and . The the Tomato X, the Tomato at the top of #the , as rby the DOS ?by 2,736 {09, 13, and 28 nby Tomato in the Tomato , it ,and . X. If X, it may the Tomato of 2,156 to 2,171 at the end of the a. The =and in the DOS not be The in the Tomato "TOMATO!!!" "Praise the tomato! God save the tomato" "Big tomato is watching you Big Tomato says:" "Fighting for peace" "is like fucking for virginity TOMATO says:" "the pope suffers fAIDS Big Tomato says:" "NO MERCY myou ever danced the devil" "under the red light of a big tomato ?" "pray for your Ks . . . Call McAfee (408) 988-3832" "if you [problems fTomato "\VIRUS \DOS *. +tomato.tmp" the Tomato kor unusual For example, the DOS get the "Cannot *a Network it is Xeven it is not on a networked PZPAPN : Tony H: R: 200 4: PNCK - \, IBM , VET, NAV 2.1+, The Tony . It comes to us '. Tony is a vof . the Tony X, the check the day of the =. Depending on the day of the month, the determine `in the x. The algorithm is if the day = "1", `starting "B" are s. On the 2nd, `starting "C" are algorithm continues for the rest of the days of the month. Tony wall . `in the meet the selection criteria. Tony qof 200 (. The at the !of the be no 2in the =and DOS . The can be in the 4in Tony "Tony+*. Tony Nnot do of Tony are: Tony-203: to the Tony adds 203 (to the . w. The din the s in PZPAPN Tony : Tony R: N/A 4: BR - NAV 2.1+, 25.10+, 1.53S+ Kor DOS SYS The Tony . It is '. Tony %is a The fa Tony J, Tony copy the to the last of the O, and xthe . The not be The next fthe K, the Tony it is , it xany non-write protected exposed to the . The in the Ks and "Tony" It is if Tony of Tony %are: Tony %Dropper: Tony %Dropper is a small places a copy of the Tony into a . The Dropper not PZPAPN Tormentor : Tormentor H: j; .PAS Sweden R: 1,024 4: PRhE - , IBM ., VET, , NAV 2.1+, The Tormentor fMikael Larssen of the Help Center, Sweden, in . Tormentor is a vof . The Tormentor is X, the Tormentor at the top of #the , as rby the DOS ?by 1,056 nby the |12's moved. Tormentor is , it over 3K in qof 1,024 at the end of the a. The =and in the DOS . The ctwo can be din Tormentor "*.PAS" "TORMENTOR!" The Tormentor A.PAS the a Tormentor kmay of Tormentor are: Tormentor-1040: , Tormentor-1040 is a 1,040 of the Tormentor . Its is 1,072 (, and like the it hooks |21. Tormentor-1040 qof 1,040 at the end of the a. No are in the : Sweden Tormentor-1072: on the Tormentor Tormentor-1072 is a 1,072 ,and . , but not Its is 1,104 (, and it hooks |21. it is , it ,and . larger by 1,072 at the end of the a. The =and in the DOS reflect the =and . The can be din all "NUKE!" "TORMENTOR,soldier of -=DY=-" ks DAv!] DEMORALIZED YOUTH!" Unlike Tormentor, Nnot .PAS kmay : Sweden Tormentor-1072B: gequivalent to the Tormentor-1072 , the are: "NUKE!" "THOMASC. KILLER !!! -=SY=-" ks DAv!] DEMORALIZED YOUTH!" Tormentor-1072C: gequivalent to the Tormentor-1072 has a few differ. Tormentor-1072D: gequivalent to the Tormentor-1072, minor Nuke: on the Tormentor-1072 , Nuke adds 1,072 (to the . w. The Nuke `, not . members of the Tormentor group do. The in the Nuke "NUKE!" ks DAv!] DEMORALIZED YOUTH!" Nuke on the second day of any month. At Kon the fC: through Z:. Nuke Dropper: A small . the Nuke . The is not a natural and serves no purpose except to release or drop the Nuke Lixo Nuke: to the Nuke reformat the Kon the 31st of any month. becoming , it are copied. Both the source and target qof 1,072 at the end of the a. The can be din the Lixo Nuke "NUKE!" "TORMENTOR,soldier of -=DY=-" ks DAv!]" "DEMORALIZED YOUTH!" : Sweden Lixo Nuke Dropper: A small . the Lixo Nuke . The is not a natural u, and serves no purpose except to release or drop the Lixo Nuke : Sweden See: Murphy PZPAPN Tormentor-205 : Tormentor-205 Lession, Lession-1 H: 2; unexpected executing Sweden R: 205 4: PNCK - \, VET, 6.00+, 3.93+, NAV 2.1.2+, 25.10+, The Tormentor-205 fSweden in is a vof . +. It is by the same author as The Tormentor and Tormentor-1072 the Tormentor-205 xall the . in the qof 205 at the end of the a. The =and in the DOS to the . The in the 4in all Tormentor-205 "(c) Tormentor ,Swedish Laboratory" "/ Demoralized Youth /" Tormentor-205 may receive unexpected include "Exec failure" and "Too many `open". usually not run of Tormentor-205 are: Tormentor-263: Tormentor-263 is a 263 of the Tormentor-205 . It in the qof 263 at the end of the The =and in the DOS to the =and . The can be din all "Modifications provided by ME, Inc." "I hope works!" "(c) Tormentor ,Swedish Laboratory" "/ Demoralized Youth /" : Sweden Tormentor-358: Tormentor-358 or Lession-2B is a 358 of the Tormentor-205 wall . in the qof 358 at the end of the . The =and in the DOS to the =and . The can be din all "(c) Tormentor / Demoralized Youth" "Rather bin hell, second in heaven." : Sweden Tormentor-358 Dropper: is a small . is a dropper for the Tormentor-358 : Sweden Tormentor-360: Tormentor-360 or Lession-2 is a 360 of the Tormentor-205 . It wall . in the qof 360 at the end of the . The =and in the DOS to the =and . It the same as Tormentor-358. : Sweden Tormentor-360 Dropper: is a small . is a dropper for the Tormentor-360 : Sweden See: Tormentor PZPAPN Totoro : Totoro H: March, 1993 1; TSR Taiwan R: 1,540 - 1,554 4: PRsA - V102+, V102+ The Totoro in March, 1993, and is fTaiwan. Totoro is a vof . , but not +. It is on the bTotoro X, the Totoro as a low TSR of 1,856 (, hooking the Totoro , it qof 1,540 at the !of the qof 1,540 to 1,554 at the end of the a. In both cases, the =and in the DOS to the =and . The in the Totoro 4in all "Totoro Dragon" "Hello! I am TOTORO CAT" "Written by Y.T.J.C.T." "Don't Worry,be Happy" "YTIT" It is what Totoro PZPAPN : TPE Girafe H: ; graphic & The R: Generally Over 3,000 4: PRhA - The TPE, or Trident Polymorphic Engine, was . It is fThe . TPE is not actually a , but rather a polymorphic encryption engine is used as part of the entry. The encryption produced by the encryption engine is extremely complex and in respects to the DAME encryption engine. engine can be identified by the presence of the encryption engine . At the of its submission, one Girafe, exists uses TPE for its encryption. Girafe uses 1.1 of the Trident Polymorphic Engine. An 1.2, has , but not encorporated it. The entry #is for the Girafe , and future using encryption engine be listed and researched. The the Girafe the Girafe at the top of but blow the &, hooking , as rby the DOS ?by 8,960 |12's moved. the Girafe , it qof 3,039 - 3,117 at the end of the a. The =and in the DOS . The in the 4in Girafe "COSCCLVSNEHTTBVIFIGIRAFEMTBRIM" "[ MK / Trident ]3 RV" "Amsterdam = COFFEESHOP!" The Girafe on Thursdays, at Ma graphic cannabis (marijuana) leaf and the "legalize cannabis". (es) use the TPE engine are: Civil War IV v1.1: A later of the Civil War Civil War IV v1.1 is a of . +. It in the qof 2,018 - 2,127 at the end of the a. The in the DOS not be The in the Civil War IV v1.1 4in all "Civil War IV v1.1, (c) Jan '93 *.com" "For all i've seen has 0my mind But still the wars go on as the years go by no love of God or human rights Cause all dreams are swept aside By bloody hands of the hypnotized Who carry the cross of homicide And history bears the scars of our Civil Wars." "[ DH / TridenT ] [ MK / TridenT ]" "[TPE 1.3]" : The March, 1993. Civil War V v1.0: A later of the Civil War IV v1.1 , Civil War V v1.0 is a of . at the top of , but X, hooking |21. , as rby the DOS ?by 8,192 , it qof 2,068 - 2,161 at the end of the a. The =and in the DOS not be . The in the Civil War V v1.0 4in all "Civil War IV v1.0, (c) Jan '92" "DH[ DH / TridenT ][ MK / TridenT ]" "[TPE 1.3" : The March, 1993. PZPAPN TPWorm : TPWorm H: `created; R: 12,969 4: SNE - Spawning 6.00+, The TPWorm . Its . TPWorm is a spawning or companion the TPWorm X, the TPWorm xthree . in the Eby creating 12,969 the same base companion . mthe =and were created. The the "Find me!" The TPWorm Nnot always . It Athe companion . , the companion `created by 12,969 are not hidden, and are in the . The can be in the TPWorm companion ".com .exe" "PATH ; ; ; \ *.exe .com rb wb . "Find me!" "Packed ais corrupt" TPWorm Nn't to do Mits and PZPAPN Traceback 00t F PTt : Traceback 3066, TB Extinct , 1988 j; TSR; graphic M1 hour R: 3,066 4: PRsA - \, IBM , NAV, , VET, , NAV, CleanUp, or The Traceback wboth . ,and . `, adding 3,066 (to the of the X, it ly, if the >5, 1988, it attempt to xone ,or . ain the E. If an Nn't exist in the E, it search the entire K, starting at the root E, looking for a candi search process terminates if it encounters an before finding a candi =non- derives its ftwo characteristics. 8the Epath of the acausing the in the 4, thus is it possible to "trace back" the uthrough a number of `. Second, succeeds in a, the attempt to access the on- Kcopy of the the copy of the was loaded it can up =a counter in the . The takes over Uhandling while trying to =the , so if it can't xit, the be unaware The primary symptom of the Traceback having if the >28, 1988, the produce a cascading effect to the Cascade (1701/1704) . The cascading s one hour If a keystroke is entered fthe during lockup one minute, the restore ing to positions. cascade and restore Mare repeated by the at one hour intervals. of Traceback are: Traceback-B: to the Traceback , the major differences are Traceback-B +and is no cascading Meffect for one hour. 8the of the became , but instead the of the a. A "MICRODIC MSG" can be Traceback-B. If the whose copy of Yany in a Uand the "halted. : Spain, March Traceback-B2: to Traceback-B2, has the cascading Meffect for one (1) hour. The " XPO DAD " replaces the "MICRODIS MSG" in Traceback-B. : Spain, May See: Spanish Traceback 3029 Traceback II PZPAPN Traceback 3029 : Traceback 3029 Traceback-4 j; TSR; graphic M1 hour R: 3,029 4: PRsAK - , NAV, , VET, The Traceback 3029, or Traceback-4, . Its . Traceback 3029 is a vof . and . +. It hour becoming bTraceback 3029 X, the Traceback 3029 xone . in the E. If the Xhappens to be a . , the a low TSR of 7,696 (. It {1C, 20, 21, and 27. If the not a . , the until the Ys an Traceback 3029 , it and . X. In addition to the , the xone ,or . . Traceback 3029 qof 3,029 (. The at the end of the a. The =and DOS . The can be in the "BASE" "SPC FIL" Traceback 3029 it has for one hour. At , all the 3on the "cascade" into a pile at the bottom of the minute has elasped, the be restored to its "pre-cascade" See: Spanish Traceback Traceback II PZPAPN Traceback II : Traceback II 2930 Extinct , 1988 j; TSR; graphic M1 hour R: 2,930 4: PRA - \, IBM , NAV, , VET, , NAV, or The Traceback II is a of the Traceback (3066) It is believed Traceback II pre =s the Traceback however the Traceback ~and reported b. As the Traceback , the Traceback II and wboth . The comments rfor the Traceback generally apply to the Traceback II the exception qis 2,930 (instead of 3,066 of Traceback II are: Traceback II-B: to Traceback II, the cascading effect s, the not be restored, instead the be hung requiring it to be powered off and See: Spanish Traceback Traceback 3029 PZPAPN Traveller : Traveller Bupt R: 1,220 - 1,237 4: PRhAK - , IBM , VET, NAV 2.1+, The Traveller . It is reported ated in the . Traveller is a generic vof . ,and . The Traveller is X, the Traveller at the top of #the , as measured by the DOS ?by 1,840 the in high , as well as |24 in low |12's moved. Traveller is , it ,and . X. It xone X, or a DOS DIR 5is issued. Traveller of 1,220 to 1,237 at the end of the be no 2to the and in a DOS Traveller 8the "Traveller (C) BUPT "Don't panic I'm harmless <<--- "*.* It is if Traveller of Traveller are: Traveller-B: as BUPT-B, is 1,840 (, hooking |21. It ,and . or one a DOS DIR 5is performed. of 1,220 (. . 1,223 to 1,238 (. In both cases, the at the end of the a. The in the DOS not be . The can be all Traveller-B "*.* !--->> Traveller (C) BUPT .4 Don't p PZPAPN Tremor : Tremor G: March, 1993 ; minor shaking of Germany R: 4,000 4: PRhEK - \2.07+ The Tremor in March, 1993, and is fGermany. Tremor is a +and . It is an "anti anti- 8ing checks to avoid detection by software. bTremor X, the Tremor at the top of #the &, hooking {15 and 21. If, however, upper or extended , the zmost of its instead, a hook to it in rby the DOS ?by 4,288 , the xthe copy of ed to by the ,SPEC variable. , the Tremor X, adding 4,000 (to the The be hidden Tremor is The at the end of the a. The =and in the DOS , but actually mhad 100 to the years field in the is the umarker for the Tremor is an , and no the the Tremor [a sluggish response to 5s and be detected by the , but not Tremor is not in Tremor has present on the for over three months, a slight shaking effect of the contents of the Mmay accompanied by a hang. The clear the Mand Mthe on the monitor: "-=> T.R.E.M.O.R was done by NEUROBASHER / May- '92, Germany <=- -MOMENT-OF-TERROR-IS-THE-BEGINNING-OF-LIFE-" a few seconds, the to "normal". The Tremor is a full , dis are read into . As a are Xto check achecksums/CRCs, or for the presence of the bverifying it isn't in not find the `. It checks for the presence of monitoring ly, Tremor is polymorphic, and an algorithmic approach must be used for detection. PZPAPN : Troi G: March, ; output not be written to input 3may not Michigan, R: 322 4: PRaCK - , VET, The Troi ~in the state of Michigan in the United States in March, is a of . The the Troi , hooking Fly in the be no rby the DOS the Troi , it X. If the Troi qof 322 at the end of the a. The =and the DOS not to the =. The s in the Troi "The Troi the Troi may notice d on the may not on the M, or output should be written to not actually be written to the of Troi are: Troi-2: Simultaneously ~in Finland and Australia in May, of Troi May 19, . It are X, adding 512 (to the end of the a. The =and not be the DOS . One the ">>>-Troi Two -->" The remap the it is May, Troi-2B: gequivalent to Troi-2, Troi-2B is a very minor Troi-2C: gequivalent to Troi-2, Troi-2C is a very minor ^, 1993. PZPAPN TSoft : TSoft TSoft-547, TurboSoft, TurboSoft-547 seconds set to "62"; Poland R: 547 4: PNCK - D: VET, V99+, 2.43a+, 6.04+, V99+, The TSoft, or TurboSoft, . It fPoland. TSoft is a vof . +. It is the the TSoft X, the TSoft xone . in the qof 547 at the end of the a. The =and in the DOS not be the seconds field in the set to "62". The can be the 4in all TSoft "TurboSoftware" TSoft a portion of the of TSoft are: TSoft-598: A 598 of the TSoft wone . in the qof 598 (. The seconds field in the in the DOS be set to "62". The can be in the 4in all TSoft-598 "\dos" "T.Software -Death 1.0" TSoft-598 a portion of the : Poland See: PZPAPN Tu-482 : Tu-482 ^, 1993 R: 482 4: PRhCK - The Tu-482 ^, 1993, and is fthe . Tu-482 is a vof . larger bTu-482 X, the Tu-482 at the top of #the &, hooking |21. , as rby the DOS ?by 512 |12's moved. the Tu-482 , it larger 8K in qof 482 the at the end of the a. The and in the DOS not be . No in the 4in Tu-482 It is if Tu-482 PZPAPN : Tula Tula-419 R: 419 4: PRtCK - , VET, 2.43a+, The Tula, or Tula-419, . It is fthe . Tula is a +. It Nnot all The the Tula Tula at the top of but #the |12's moved. , as rby the DOS ?by 1,024 21 and 22 nby Tula in the Tula , it larger qof 419 at the !of the . The =and in the DOS to the =and One in the Tula "Tula .Sat" of Tula are: Tula-417: as the F-Word or F-You is an earlier of the Tula Its is 1,024 (, hooking 08 and 21. , Tula-417 by 417 the at the end of the a. The =and in the DOS to the . The can be din all "Fuck You!" Tula-417 may [difficulties executing . , such as EDLIN. require 5line input. Tula-593: The Tule-593 is a 593 of the Tula . Its is 1,024 hooking {08 and 21. , Tula-593 ,and . by 593 at the end of the a. The =and in the DOS not be . One can be at the end of Tula-593: "TR" Tula-593 may [difficulties executing . , such as EDLIN. require 5line input. Tula-635: The Tule-635 is a 635 of the Tula . Its is 1,024 hooking {08 and 21. , Tula-635 ,and . by 635 at the end of the a. The =and in the DOS not be . No in the Tula-635 may [difficulties executing , such as EDLIN. require 5line input. Tula-1480: The Tule-1480 is a 1,480 of the Tula . Its is 2,048 hooking {03 and 21. , Tula-1480 ,and . for any reason. by 1,480 by 1,480 to 1,494 In either case, the at the end of the a. The =and in the DOS not be . No in the PZPAPN Tumen : Tumen Tumen V.5 G: May, ; music and graphics; R: 1,663 4: PRhCK - , NAV, , IBM , VET, The Tumen, or Tumen V.5, Vin May, ated in the . It is a vof . bTumen X, the at the top of but #the , as measured by the DOS by 4,096 {09 and 21 nby the Tumen is , it X. If X, it of 1,663 at the end of the a. The =and in the to the =and The in the Tumen "Full moon tonight... The of Wolfbacks... U...U...U... demonstration , but you hear howl." "(C) Copyright MMA Company All rights reserved. Tumen -v0.5 was created in Tumen by group of three Wolfbacks at General `affecting effects by Max Main consultant -- Tall Lazy Micle General Music_&_Video harmless effects by Alex BACKWOLFS OF THE WORLD, UNITE!!" The bset of s near the !of the the remaining at the end of the Tumen should produce graphic and musical effects upon event ring. of Tumen are: Tumen V1.2: , Tumen V1.2 is a later of the Tumen qof 1,255 at the end of the a. The =and in the DOS to the =and Tumen V1.3: , Tumen V1.3 is a later of the Tumen qof 1,242 at the end of the a. The =and in the DOS to the =and The can be in the 4in all Tumen V1.3 "Tumen.,v1.3" Tumen V2.0: in May, , Tumen V2.0 is a later of both Tumen and Tumen V1.2. In addition to the behavior of the modify the C: is present. It adds 1,092 (to the . The can be din all "Be carefull... Hackers tonight... present was created in Tumen in v 2.0. (c) Max Soft corporation Hackers of the work, Unite!" Tumen V2.0 may May, PZPAPN Turbo : Turbo Turbo 448, @ , Turbo @, Polish-2, Nagytud anot utilities Hungary R: 448 4: PRCK - , IBM NAV, , VET, The Turbo, or Turbo 448, Gin Hungary in is a The the Turbo X, the at the end of the 5Interpreter in nby the The Turbo is unusual in Nnot X. Instead, it are reason Z. For example, if the ,is copied to B. both sby the by 448 at the end of the a. The in the to the =and awas s. The can be dat the end of all "Udv minden nagytudasunak! Turbo @" interesting behavior of products are unaware of the Turbo 448's presence in not function the third ais read, the may fail due to a " to open the fourth of Turbo are: Turbo Kukac: Gin Hungary in is a vof . +. It cthe 5interpreter and any loaded TSRs, decreasing by 1,040 and 21 are nby the . Turbo Kukac for a reason by 512 at the end of the a. The in the DOS . The can be in all "Turbo Kukac 9.9" : Hungary PZPAPN Twin Peaks : Twin Peaks %failures; Australia R: 1,310 4: ONCK - , VET, ., IBM ., IBM V99+, 3.93+, V99+, Ahidden The Twin Peaks fAustralia in Twin Peaks is a the Twin Peaks xone . on the C: O. The Mthe , and to the DOS prompt: "Welcome to Twin Peaks.. Your PC now has the Twin Peaks the Twin Peaks mthe 1,310 be no 2to the =and in the DOS . The `, as are the "*.com*" ?com\" ?exe ?com" See: VirDem PZPAPN Twin-351 : Twin-351 ,351, Twin `created & hidden attributes; TSR R: 351 4: SRsA - Spawning , NAV, , IBM , VET, Ahidden The Twin-351 . Twin-351 is a spawning . It creating a corresponding . Yin place of the . The Twin-351 is X, Twin-351 as a low TSR of 656 nby the , Twin-351 X. Instead of altering the . a, Twin-351 creates a 351 corresponds to the of the . a. For example, if the YABC. W, Twin-351 create ABC. 4. The 351 `created by the the hidden and attributes set so `are not in the As a of the hidden . a, the Twin-351 . If Twin-351 is already , it corresponding . a. If Twin-351 wasn't already Twin-351 hide the hidden `if the Twin-351 in PZPAPN Typo : Typo Mistake , 1989 BSC; -TOM; garbled printout Israel R: N/A 4: BRt - \, IBM , NAV, , VET, \, NAV, CleanUp, or DOS SYS The Typo ~in Israel by Y. Radai in , 1989. is a taking up 2K at the upper end of it has The major symptom be noticed on Typo certain 3in printouts are always replaced phonetically 3. Since the substitutes Hebrew letters for Hebrew letters, the was most likely written by one in Israel. Digits in numbers may be transposed or replaced numbers. The substitutions impact printouts , the Mand data in `are not affected. The Typo structurally to the Ping Pong and may be a of Ping Pong. It can be removed by using M K, CleanUp, DOS SYS 5, or just about any Ping Pong dis PZPAPN Typo : Typo Fumble, 867, , 712, Typo-712 Extinct , 1989 -TOM; garbled printout (see England R: 867 4: PRtC - \, IBM , NAV, , VET, \, or The Typo to the Typo garble data is sent to the parallel port it has activated. Unlike the , the . wgeneric breported by Joe Hirst of Brighton, UK, in , 1989. The Typo `on even-numbered days. of Typo ,are: Typo-712: Typo-712 is a 712 of the Typo wall . `in the X, adding its 4to the end of the a. Its portion is 224 and hooks |16. It may intermittently interfer input. Typo-867B: Typo-867B is a minor of the Typo . It wall . `in the X. It a 480 )TSR hooks |16. qof 867 at the end of the May, PZPAPN : Tyst `truncated to 3,424 =set to 4-04-92; R: 3,424 4: ONAK - V102+ The Tyst . Its . Tyst is a W, and .SYS the Tyst X, the Tyst copy the s of the the C:\DOS Eto the E. The the 8the but instead of pure copy of the Tyst of 3,424 (. The =in the DOS Eof 4-04-92. The be set to the zero ,SPEC, may be created in the The Tyst Ms the ever an "Tyst f r fan.. Jag spr nger!" $the , the can be the 4in all Tyst "C:\DOS\*.*" ,SPEC" "/C copy" "NUL" "RoTh" PZPAPN UFA-1201 : UFA-1201 R: 1,201 4: PNCK - D: VET, 6.00+, 2.43a+, \2.07+, V100+, V100+ The UFA-1201 , and is fthe . UFA-1201 is a the UFA-1201 X, the UFA-1201 xtwo . in the 1,201 at the end of the The =and in the DOS not be . The in the UFA-1201 "*.com" It is what UFA-1201 may do PZPAPN UnExe : UnExe , 1993 R: 425 4: PNCK - V100+, V100+ The UnExe , 1993. UnExe is a non- vof . +. It the UnExe X, the UnExe xone . in the E. If E, it may of 425 at the end of the The =and in the DOS to the =and . The in the UnExe 4in all UnExe "Viru" "1 /M" The UnExe Aone . in the PZPAPN : Unk G: March, <s corrupted R: 1,015 4: PRhAK - , IBM , NAV 2.1+, .1.4+, \2.07+, The Unk . Its . Unk is a ,and . bUnk X, the Unk at the top of but #the , as rby the DOS ?by 3,008 the Unk , it for any reason. The hides the `, so it is not noticeable to the the Unk qof 1,015 at the end of the , adding an 1,015 The =and in the DOS Emay to be corrupted. One can be in the 4in Unk "(c) Szegedi & Farmosi Kiss." It is what Unk PZPAPN Urfydus : Urfydus G: May, j; TSR Italy R: 2,638 - 2,653 4: PRsAK - , VET, 1.15a+, 6.00+, The Urfydus ~in Italy in May, is a vof . ,and . +, but not very small . ,and . . Its is italian, and translates to "Nasty" in english. The Urfydus is as a low TSR of 3,152 (, hooking {21, CC, and F8. Urfydus is , it ,and . X. If the fa write protected J, the attempt xthe ing in the hanging while it to write to the write protected Urfydus of 2,638 to 2,653 (. The at the end of the a. The =and in the DOS . The can be in the 4in all "C:\SYSTEM\ +MMAND. It is what Urfydus PZPAPN Uruguay : Uruguay Uruguay 3 k; music; Uruguay R: 2,552 - 2,637 4: PRhA - V100+ The Uruguay, or Uruguay 3, and is fUruguay. Uruguay 3 is a ,and . , but not +. Uruguay 3 and the later s of are polymorphic, using a complex encryption mechanism to complicate ability to be detected by products employing ning technology. An algorithmic approach is required to detect the Uruguay 3 X, the Uruguay 3 at the top of #the , as rby the DOS ?by 5,120 |mapping indicate nany use both |13 and 21 via a tunnelling technique. the Uruguay 3 , it and . qof 2,552 - 2,637 at the end of the a. The =and in the DOS not be . The in the Uruguay 3 notice slow response to 5. The s be accompanied by tones on the speaker. "'Uruguay-#3' med in Montevideo (URUGUAY) by F3161. 06/92 is a research - DO NOT DISTRIBUTE" is not `as it is of Uruguay are: Uruguay 4: on the Uruguay 3 Uruguay 4's is 5,456 (. It adds 2,718 to 2,859 (to the . ,and . Zand aopen for read- . The Lby the accompanied by a tune on the speaker is: "'Uruguay-#4' med in Montevideo (URUGUAY) by F3161. 07/92 is a research - DO NOT DISTRIBUTE" : Uruguay Uruguay 5: on the Uruguay 4 , Uruguay 5's is 8,352 of Uruguay at all, but stays the presses CTL-ALT-DEL: "'Uruguay-#5' med in Montevideo (URUGUAY) by F3161. 08/92 is a research - DO NOT DISTRIBUTE" As Uruguay 5 Nnot , it is included here for yal purposes, and is not used for product testing. : Uruguay Uruguay 6: on the Uruguay 5 Uruguay 6's is 9,504 (. It adds 4,879 (to the . ,and . Zand aopen for read- . The qis hidden Uruguay 6 is . The DOS detect all Uruguay 6 is in . The Lby the accompanied by a tune on the speaker is: "'Uruguay-#6' med in Montevideo (URUGUAY) by F3161. 11/92 is a research - DO NOT DISTRIBUTE" : Uruguay PZPAPN Uruk-hai : Uruk-hai ^, 1993 R: 394 4: PRxCK - The Uruk-hai ^, 1993, and is . Uruk-hai is a vof . ,progams, bUruk-hai in a "hole" in low al , hooking |21. , as rby the DOS not be the Uruk-hai , it X. If X, it the Uruk-hai qof 394 at the end of the a. The =and in the DOS to the =and . The can be in the 4in all Uruk-hai "V 1.0 Igor, The Uruk-hai are upon you!" PZPAPN damage; k; long load R: 576 4: PNE - , IBM , VET, o, NAV 2.1.2+, The in the . It is generic vof . X, it search the Efor the a. If it finds one, it attempt to xit. a, it hang the leaving the Olight on, however most of the successful. by 576 to 586 at the end of the may go to its to find removed, and the ) has damaged, thus rendering the Kinaccessible. damage can be repaired using Norton KDoctor, or M the /P option. [longer normal load X. The longer normal load is due to the searching for a x, and tthe candi aif one was PZPAPN V-311, -311, Com2Con d to ,MAND.CON R: 311 4: PNCK - , IBM ., NAV 2.1+, , VET, The 311, or V-311, . It ated in the is a 311 is X, the check the to see if the seconds value is equal to one of 16 values. If it was equal to one of those 16 values, be re d to ,MAND.CON. Whether or not the , the in the by 311 (, the at the end of the a. The in the be modified to be 11:19:32, the umarker for . The =in the Eis not alter the aattributes for the ain the E. In particular, bits 8 through 15 be reset, may produce unexpected s in en ments make use of bits. PZPAPN -492, RC492, 492 R: 495 - 508 4: PRfCK - \, NAV, , IBM , VET, The and is is a v, it 492 is X, the in high but #the is not reserved by the nby the . At the of going , the check to determine if +on the C: s, if it isn't, 492 is , it xany . +on the A: Ois the way to +on A:. 495 to 508 (. The at the end of =and the 0to the =and Nnot to do PZPAPN Leapfrog, V516, 516 R: 516 4: PRCK - \, NAV, , IBM , VET, The . It is is a vof . +. It The X, the in a "hole " between MSDOS and the DOS Stacks. area labeled DOS Data. nby the be no , it had an greater qd by 516 (, the at the end of the Nnot to do . The sample was not a natural , so may be a research PZPAPN -600, V600, 600 R: 600 4: PRhCK - \, NAV, , IBM , VET, The , and is is a vof . 600 is X, the at the top of #the &. The DOS indicate are 2,048 (less expected. Nnot move the 600 uses {21 and 24. 600 is , it of at least 600 by 600 (, and the at the !of the It is PZPAPN -707, V707 R: 707 4: PRtCK - \, IBM , NAV, , VET, The . It is is a vof . at the top #the &. It move the cannot be 707 makes use of |21, map to the in high be 720 (less expected. 707 is , any . sby the qof 707 (, the at the end of the a. If X, it It is PZPAPN -711, 699, V711-2 R: 704 - 719 4: PRhC - \, NAV, , IBM , VET, The , and comes the is a vof . Nnot 711 is X, the at the top of #the is reserved. The hooks {08, 13, and 21. The DOS indicate is 704 (less what the expects. The is not 711 is , any . had an of at least 1600 sby the by 704 to 719 (, and the at the end of the 711 may notice occasional It is occasionally hang the PZPAPN -948, V948, 948 R: 948 4: PRhA - \, NAV, , IBM , VET, The , and in the is a vof . `, and 948 is at the top of #the &. The not be in use by the reserved. {1C and 21 nby the 948 is , and . ,or . for any reason sby the the exception of by between 950 to 963 (. In the case of +, the a portion of the stack space in the a, so the 2. In all cases, the =and s in the Eare not mthe at the end of the It is PZPAPN 1014 R: 1,014 - 1,028 4: PRhA - V99+, \2.07+, 2.45+, The 1014, or 1014, . It is fthe 1014 is a of . ,and . +. It smaller The 1014 at the top #the , as rby the DOS ?by 1,040 {10, 21, and 60 1014. , the 1014 ,and . qof 1,014 to 1,028 at the end of the a. The =and in the DOS not be . No in the The 1014 alter . smaller , adding 2 to 30 (to the `are not s, and continue to function PZPAPN RCE-1049, 1049 and R: 1,049 4: PRhA - , IBM VET, NAV 2.1+, The 1049 . It in the is a vof . `, and Nnot 1049 is X, the at the top of #the be 1,056 and is reserved. The is not moved. nby the 1049 is , the X. The , however, xvery small . by 1,051 to 1,064 (, the at the end of the 1049 is unusual in 4to support a 4via a special |21 call the 4may used by the author developing the to stop it 1049 occasionally actually be 1049 Nnot do See: Alfa PZPAPN V2144, 2144, 2144-B R: 2,144 4: PRhAK - \, NAV, , IBM , VET, The 2144 , and is the is a vof . 2144 X, the at the top #the &. The DOS indicate values show 4,608 (less expected. Nnot move the . The Fly alters the |page in Ythe 2144 is , and greater in reason sby the by 2,144 (. . by 2,144 to 2,159 (. In both cases, the at the end of =and in the and Nnot hide the It is 2144 2144 are: 2144-B: in March, gequivalent to the . The ' encryption has slightly modified. PZPAPN : V-1n V-10, V-11 G: May, R: 113 or 624 4: ONCK - The V-1n group of es was in May, group's . The es in entry are earlier s of the Bin the V-3n entry. Unlike the Bin the V-3n entry, the Bhere are es. The earliest of the es, V-10, entry, member of the group #. Both of the es in entry the V-10 xthe third . in the b624 (of the . The ed to the DOS prompt. $having the b624 (of the host 4of the V-10 =and in the DOS to the =and . If the host smaller (, it 628 larger q. The can be in V-10 "V - V-10 Nn't do , destroying the host Member(s) of the V-1n group of es are: V-11: A later of the V-10 s the b113 (of the . w. The in the "V - 1.1". May, See: V-3n PZPAPN : V-3n V-30, V-31, V-32 j; seconds in set to 00 R: 268 4: PNCK - The V-3n es was . The earliest of the es, V-30, entry, ]members #under . All of the es in ]are vs of . V-30 is X, the V-30 xone in the E. If +resides in E, it may V-30 268 (. The at the end of the The seconds in the in the DOS be set to "00", is the marker the uses to determine if the ais already s. The din all V-30 "*.com V - V-30 Nn't do Members of the V-3n es are: V-31: to the V-30 adds 266 to the . w. The is now: "*.com V - 3.1". V-32: to the V-30 adds 274 to the . w. The is now: "*.com V - 3.2". See: V-1n PZPAPN V270x : V270x 268-Plus G: May, R: 268 - 272 4: PNC - , IBM NAV 2.1+, , VET, The V270x Vin May, . V270x is vof . `. It V270x is X, the xup to five . in the E. The by 268 (. The second qby 269 (. The third through fifth by 270, 271, and 272 (, respectively. In all cases, the at the . The and in the not be V270x s to not do PZPAPN : V388 V-388 ^, 1993 R: 388 - 403 4: PRhCK - The V388, or V-388, ^, 1993, and is fthe . V388 is a vof . +. It is not likely to a serious threat in its present form. bV388 X, the V388 at the top of #the &, hooking |21. , as rby the DOS ?by 102,400 |12's moved. the V388 , it qof 394 to 403 at the end of the a. The =and in the DOS not be . No in the 4in V388 the V388 [frequent PZPAPN : V483 R: 483 4: PRAK - , IBM 6.04+, The V483 . Its . V483 is a vof . ,and . V483 is becoming xthe next . ,or . X, it s. At , the hung has completed tthe V483 483 (. The at the end of the . The =and in the DOS to the =and . V483 hex "FF" 3, thus permanently corrupting them. usually not PZPAPN : V651 Eddie 3, Sofia, R: 651 4: PRtA - , IBM , NAV, , VET, : CleanUp, or The V651, or Eddie 3, ~in Sofia, by Vesselin Bontchev. V651 is believed to written by the same author as ;, V1024, and V2000. is a generic vfor . ,and . The V651 is X, the . Using the DOS , as well as ?by 688 Later, as of 651 (or greater are sby the by 651 not be seen by performing a present in . The Kspace adjusted by the Kspace due to the 's activities cannot be seen. Powering off the %ing clean J, followed by issuing a in the correct Las well as the actual space on the `can be easily identified as the "Eddie Lives." s near the end of the be 651 (longer expected is not present in A side effect of the V651 lost clusters may if the 5is used. While not for all `, the number of Treported by be much higher statistically V651 is present. Unlike ;and V2000, Nnot any aopen. It See: Alfa ; V1024 V2000 PZPAPN : V800 Live Death G: May, R: 800 4: PRC - \, NAV, , IBM , VET, : CleanUp, \, or The V800, or Live Death, Vesselin Bontchev in May, . The V800 is a self-encrypting v, and it Nnot t to written by the same person as the since many of the same techniques are used. The of the Live Death the 7the "Live Death" it cannot be seen in `as the The is run on a , the V800 . In the process of zing , it by 16K, using 8,192 (for in the top of . It hook , every ais attempted to be the check to see if it is a candi =for Whether the sdepends on the of the . it is attempted to be X. In no event is a . asmaller 1024 s, but not all . `over 1024 (are seither. The V800 increasing by 800 u. It Nnot, however, `more eight of V800 are: V800M: Very to V800, the major difference is V800M `on both aopen and putting into the " category. the 8,192 not mthe "Live Death" in it. PZPAPN : V801 V791, V-801, 805 G: March, R: 791 4: PNAK - \, IBM , VET, , NAV 2.1+, : CleanUp, or The V801 in March, fthe is a vof . . It V801 is X, the search the Efor an . If one is d, it xthe . If an is not d, the search for an in the E, and V801 by 791 to 808 (. . mthe !. . mthe at the end of the a. The =and in the not be may cause a hang attempted to be V801 Nn't to do PZPAPN : V82 aalternation; R: 2,000 4: PRhAK - The V82 . The submitter awas '. V82 is a vof . ,and . , and internally , but not actually 8a replicating copy of the The V82 is X, the V82 at the top of #the , as rby the DOS ?by 8,192 |12's moved. nby the . It za 48 )portion in low , V82 either xor alter . ,and . In the case of . over 2,000 at the end of the smany s as the Nnot recognize the already it is later Xby the by 2,000 uof the on the a. V82 xor alter . `smaller 2,000 sby the fairly large, and usually not many the part of the host . In most . `, however, the not actually xthe abut a portion of the 8ing 00h 3, thus altering it. 4may actually be a trojan if it is by the host It is what V82 See: Phoenix Phoenix 2000 PZPAPN V1024 : V1024 ;III, , Diamond, 1024 G: May, TSR; R: 1,024 4: PRA - , NAV, IBM , VET, The V1024, or ;III, by Daniel Kalchev. V1024 is a generic vof . ,and . `. It is believed to written by the same person wrote ;and V2000. may actually be an earlier of the it has many of the same characteristics, Nnot all for any reason. The V1024 is X, the . At , it checks to see if several {are "monitored, 1 and 3. If {1 and 3 are monitored, V1024 allow the to run, but any subsequent hang the and V1024 V1024 is by 1,072 The mremapped several {by altering location in the |map page in now be controlled by V1024. V1024 , the is greater in 1,024 (. Both ,and . `are +is not by 1,024 if the is present in and a DIR is done. V1024 `can be identified by a s very close to the end of `. The is: '7106286813'. V1024 Nnot 8any of V1024 are: Diamond: to V1024, Diamond's main difference is at the top of #the , and , as measured by the DOS ChkDsk @by 1,072 {08 and nby the Diamond-B: to Diamond, slightly to avoid detection by See: Alfa ; V651 V2000 Ah Damage PZPAPN V2000 : V2000 ;II, , Travel , Eddie 2000, Apocalypse II G: 1989 TSR; . W, .OV? j(see ); crashes; cross-linked R: 2,000 4: PRA - , NAV, IBM , VET, : NAV, or The V2000, or ;II, is a generic v. The ~samples of ', where it was ~by Daniel Kalchev and Niki Spahiev. V2000 W, and Overlay `, as well as X, the , and it has not already an execu for any reason, it is sif it hasn't not be shown if the V2000 present in a DIR 5is issued. Issuing a in cross-linking of since the ymay not to match the entries in the (FAT). the V2000 [unexpected crashes, ing in lost data. %able due to the modification of +or the hidden One of the ctwo in the `, thus accounting for the of Travel used in "Zopy me - I want to travel" "Copy me - I want to travel" are reports the V2000 looks for and kthe written by Vesselin Bontchev are attempted to be would explain the presence of the ccopyright notice in the "(c) 1989 by Vesselin Bontchev" of V2000 are: V2000-B: (Die Young) to the V2000 , the main difference is "Zopy me - I want to travel" is now " the Good die young..." or "Mnly the Good die young..." and the encryption used by the different. is actually the predating V2000. Apocalypse II: Apocalypse II was Vin May, . It is to V2000 and V2000-B, the major it no longer crashes the , and the "Zopy me - I want to travel" is now "Apocalypse II begin!!". modifies the , but not xious copy of the See: ; V651 V1024 PZPAPN V2100 : V2100 2100, R: 2,100 4: PRtA - , NAV, IBM , VET, : NAV, or The V2100, or 2100, ~in Sofia, Vesselin Bontchev in . It is a generic of . W, and overlay `. It s to released into the public domain on an was uploaded to a BBS in V. While not all copies of U are carriers of was one exists has the embedded in its 4. The cannot be detected on Trojan using search algorithms for . V2100 is believed to written by the author of The V2100 is X, the top of the &. The top of ed by be lower expected by 4,288 (. Likewise, ?by 4,288 (. At same , V2100 be hidden by the , it xany . or overlay of at least 2100 for any reason. The simple act of copying an execu in both the source and target becoming be 2,100 (longer, hide the isn't noticeable Fories are listed. In cases, to be 2,100 (smaller expected if the is present in the V2100 notice ring, along cross-linking of `. Due to `may corrupted. Tare truly exist whether or not the present in A side note on the V2100 : if the the Anthrax , V2100's introduction in the Anthrax again "present in the effect s because Anthrax stores a copy of on the last of the V2100 , it searches the last 16 cylinders of the for a copy of Anthrax. If V2100 finds the hidden copy of Anthrax, it copies it into the . On the next fthe K, Anthrax again be active on the PZPAPN : V2P2 Chameleon Research Minnesota, R: 1,426 - 2,157 4: PNCK - , NAV, IBM , VET, The V2P2 is a research written by Mark Washburn and distributed to authors in , according to its author, has not released. is a generic vof . the V2P2 X, it xthe ait finds in the is not . The adds its 4to the end of the a, and the qbetween 1,426 and 2,157 Like the 1260 uses a complex encryption method. In fact, the encryption used the 1260 is one of several possible encryptions V2P2 may produce. As a ning software often identify the 1260 in a "both 1260 and V2P2. identification is entirely valid as 1260 is a special case of V2P2. See: 1260 Casper V2P6 PZPAPN : V2P6 Research Minnesota, R: 1,946 - 2,111 4: PNCK - , NAV, , VET, : NAV, or The V2P6 is a research written by Mark Washburn and distributed to authors in , according to its author, has not released. is a generic vof . the 1260 and V2P2 the V2P6 X, it xthe ait finds in the is not . The adds its 4to the end of the a, and the qbetween 1,946 and 2,111 Like the 1260 and es by Mark Washburn, uses a complex encryption method. The encryption method used by V2P6 is more complex used in V2P2, but less complex used in the last ], V2P6Z. Like V2P2, an algorithmic approach must be used to identify of V2P6 are: V2P6-B: to V2P6 in behavior, by 1,990 to 2,261 V2P6Z: to V2P6 in behavior, is the last ]to be by researchers. It employs a more complex encryption algorithm requiring an algorithmic search to identify `. V2P6Z adds 2,076 to 2,364 (to the . See: 1260 Adolph Casper V2P2 PZPAPN Vacsina : Vacsina , 1989 TSR; . W, .BIN, & .SYS j; "beeps" R: 1,206 4: PRsA - , NAV, IBM , VET, : CleanUp, \, or The Vacsina 1200 and can be are at least 48 of the Vacsina as the TP not all of them ~. Later s of are included in under the "Yankee Doodle". Generally, the Vacsina wboth . ,and . `, as well as .SYS and .BIN bconvert it into . ,format by changing the MZ or ZM identifier in the btwo (of the ato a JMP instruction and adding a small piece of relocator 4, so the . acan be it were One sign of a Vacsina smay "beep" <in the 0to the were of Vacsina are: TP04VIR: `, changing them internally into . may beep X, and may be identified by searching for the "VACSINA" along the second fthe end of the 8ing a 04h. of Vacsina is a poor replicator, and while it always convert a to . aformat, adding 132 (, it Nnot always TP05VIR: to TP04VIR, except the second to the last )in the ais now a 05h. kmay TP06VIR: to TP05VIR, except the second to the last the ais now a 06h. TP16VIR: to TP06VIR, the second to the last )in the ais now 10h. TP23VIR: to TP16VIR, the second to the last )in the ais now 17h. The "VACSINA" no longer s in the TP24VIR: to TP23VIR, the second to the last )in the ais now 18h. TP25VIR: to TP24VIR, the second to the last )in the ais now 19h. See: Penza Yankee Doodle PZPAPN PTt8 : VCL 4Zero H: May, R: 576 4: PNCK - 6.00+, 2.43a+, .1.4+, The 4Zero, or the VCL created, May, . It ated in the or Canada. 4Zero is a vof . +. The es listed #under were created by a of Nowhere Man's V.C.L., a whose purpose is to simplify the task of writing 4Zero X, the 4Zero search the Eto locate an x. If it finds an , it xit, and the host continue Z. If the 4Zero Nnot find an , it Mthe "** CODE ZERO **" 4Zero qof 576 (. The at the end of the a. The =and in the DOS . Four can be din the "*.* *. "** CODE ZERO **" 4Zero Nowhere Man/[NukE]" es created VCL are: B-52: B-52 is a VCL generated generated by the PS-MPC generation . B-52 is vof . +. It wtwo . qof 3,808 at the end of the a. The and in the DOS not be . Many can be in the 4in all ".. *.* *. "c:\dos\*.com" "AT&FL0M0DT911" "[MPC] Call 911" "*.exe *.com .. *.exe" "Abort, Retry, Ignore, Fail?" "Fail on INT 24" "I'm hungry! Insert PIZZA & BEER in to OA: and" "Strike any key ready..." "Impotence Ureading 's dick" too big to fit in "Cannot load ,MAND, halted" "I'm sorry, Dave . but I'm afraid I can't do "[vcl] March, 1993. Beva 32: Beva 32 is a VCL generated ^, 1993. It wone . ain the E, or one Eup in the Estructure, qof 562 the at the end of the a. The =and in the DOS . The Beva 32 on the 22nd day of any month, at attempt to "Whats wrong my computer, you ask? Well I do believe it has ma nice day!" The in the , as are the "[VCL/BEv]" ".. *. : Oregon, ^, 1993. Beva 33: Beva 33 is a VCL generated ^, 1993. It wone . ain the E, or one Eup in the Estructure, qof 519 the at the end of the a. The =and in the DOS . The Beva 33 1st of any year, at attempt to "Happy New Years, Eat my viril lware!" The in the , as are the "[VCL/BEv]" ".. *. "-=BEv#A33=-" : Oregon, ^, 1993. Beva 96: Beva 96 is a VCL generated ^, 1993. It wone . ain the E, or one Eup in the Estructure, qof 516 the at the end of the a. The =and in the DOS . The Beva 96 4th of any year, at attempt to Mthe "Happy 4th! Hope you enjoy your messed up computer!" "-=BEv#A96=-" The in the , as are the "[VCL/BEv]" ".. *. : Oregon, ^, 1993. : Big is a VCL generated March, 1993. It wseveral . `in the qof 676 at the end of the The =and in the DOS not be . The in the ".. *.* *. "[VCL] VIRUSES!! HACKERS!!" "Who ya gonna call???Not McAfee Associates!!! Suck BIGTIME!!! [DJ]" kmay frequently are March, 1993. Chicken Pox: Chicken Pox is a VCL generated , 1993. It wthree . the E, or along the path, by 604 at the end of the a. The =and in the DOS not be kfrequently as well as write protect fwrite-protected , 1993. 4Zero-652: A 652 of the 4Zero . It was created by Nowhere Man by recompiling the 4Zero 1.0. wone . qof 652 at the end of the a. The =and in the DOS not be . The in the and are not d samples: "*.* *. "** CODE ZERO **" "[VCL] [ 4Zero] Nowhere Man, [NuKE] '92" all of the . in the Zof the next in a Mof the "** CODE ZERO" sby the 4Zero-652 becoming locked out Dial: Dial is a VCL generated March, 1993. It wfour . `in the qof 599 at the end of the The =and in the DOS not be . The in the 4in all ".. *.* *. "AT&FM0L0DT9008201110" (Note: "[VCL]" The starting "AT" is a to dial the included phone number on Hayes compatible modems. Area 4900 phone numbers typically carry a per minute connection fee, and the owner of the phone number Nn't ma connection to : North America March, 1993. Diarrhea: Diarrhea is a VCL generated . It wone . ain the E, or along the path, by 931 at the end of the Diarrhea on Fridays Zof an s in the Mof the "EAT MY DIARRHEA!" in graphic 3made of ASCII line #in normal 3: "--GG Allin & The Texas Nazi". If ANSI.SYS is loaded, the be in red, the second line "in yellow. Diarrhea6: Diarrhea6 is a later of Diarrhea. It adds 1,221 (to the . w. Like the on Fridays. In the case of Diarrhea6, it trojanize an . in the b596 the trojanized . X, it Mthe fthe Diarrhea a flashing border has to the be bright blue if ANSI.SYS is loaded. Diarrhea6 Trojan: The trojan dropped by the Diarrhea6 Fridays a Diarrhea6 trojanized by the mthe a small to produce the for the Diogenes: Diogenes is on the Diarrhea , and has specifically 4d to avoid detection by utilities can detect VCL generated es. It adds 846 (to the . Diogenes on the 31st of any month, at b718 of the C: "DIOGENES 2.0 has visited you fine product of the Lehigh Valley." "Watch (out) for future 'upgrades'." "The world's deceit has raped my soul. We melt the plastic people down, we melt plastic town are not in the DM 92 Bios: DM 92 Bios is a VCL generated . DM 92 Bios wtwo in the preference to . mthe b457 by the permanently corrupting them. The in the ".. *.* *. "DM-92 BIOS Dome: Dome is a VCL generated Canada in . It s the b546 of . , as well as +. It "*.* *. "Divide overflow" ,[VCL] DOME" : Canada Dome2: A of Dome, generated by VCL. s two . ,or . X. It may the hidden `and .BAT `, and alter the Unlike Dome, s the entire host are : Canada Dome3: An Dome one creates 433 companion . `for the . in the E. The companion . `are hidden, and 8the "Divide overflow" "*.* [VCL] DOME3" "*.* *. : Canada Dome4: An minor of the Dome one has one differs. In addition to the host , it corrupt . . Executing one of the corrupted . give unpredic unexpected Donatello: Donatello is a 827 created VCL 1.0. wthree . it is qof 827 at the end of the The =and in the DOS not be . The are in the 4, and as such are not "Cowabunga, dudes! It's Donatello!" "(Hey, John, can I be on Nightline too?)" "[VCL] [Donatello] Nowhere Man, [NuKE] '92" "Hey, Donatello, be like Mike!" kmay and the btwo Las a , a "Divide overflow" X, and no Earth Day: Earth Day is a 797 created VCL 1.0. wone . qof 797 at the end of the a. The =and in the DOS not be The in the and are not d samples: "*.* *. "Happy Earth Day!!!" "In the spirit of Earth Day, VIRUS has recycled your "[VCL] [ 4Zero] Nowhere Man, [NuKE] '92" sby the Earth Day becoming locked out X. "Divide overflow" frequently X. The Mthe and Earthquake: , 1993, Earthquake is a 1,145 companion or spawning xone . ain the Eby creating a 1,145 )hidden . same base . The hidden . Read- and Hidden attributes set, and the . The in the Earthquake ".. *.* *. "* * * Earthquake Warning! * * *" "Head for the hills!" "Take cover!!!" "Whew! We Made It!" "-=[VCL/BEv]=-" frequently , 1993. ]is a VCL generated March, 1993. It wtwo . `in the qof 663 at the end of the The =and in the DOS not be . The in the 4in all ".. *.* *. failure of Traditional ]Values! Oh no!" "[VCL]" The second may be Las a in flashing March, 1993. Heevahava: Heevahava is a VCL generated in the . It in the Xby creating companion The companion `created by the Heevahava be 514 (long and mthe read , and hidden attributes set. The base correspond to an . in the E, and the be the the companion awas created. The can be din the Heevahava hidden companion heeva-hava's get stuck THE HEEVAHAVA "HEEVA[VCL]" "*.* *. Kinison: An 806 created 1.0. wone . qof 806 at the end of the a. The =and in the DOS not be . The in the are not d samples: "*.* *. "DIE BITCH "[VCL] *VIRUS* is dedicated to the of Sam Kinsion, 1954- [Kinison]" "Nowhere Man, [NuKE] '92" sby the Kinison becoming locked out X. "Divide overflow" frequently Kinison on any Friday the 11th, at Mits and trash the Kinnison-734: Kinnison-734 is a of the Kinison is two (longer, and 7the "*.* *. "DIE BITCH "[VCL] Dedicated to the "Sam Kinnison 1954- "[Kinnison Nowhere Man, [NuKE] '92" : Canada Pearl Harbor: A 930 created VCL. wone . asmaller X. Unlike Pearl Harbor is a spawning or companion , so no to the . Instead, a 930 ais created the same base as the . s. The 930 mattributes of read- , and hidden, so it is not in the DOS . The =and on the hidden . be the =and The in the and are not d samples: >7th, 1941 -- A day live in infamy..." "*** REMEMBER PEARL HARBOR ***" "C:\*.* [VCL]" "Dedicated to the memories of the brave American men and women who gave lives at [Pearl Harbor]." "Nowhere Man, [NuKE] '92" Pearl Harbor >7th, at Mthe X, as well as attempt to write to device PRN or LPT1: >7th, 1941 -- A day live in infamy..." "*** REMEMBER PEARL HARBOR ***" 4to corrupt the C: Oroot E, but it may not actually be Voco: A 745 , Voco wseveral . `in the be permanently corrupted as the s the b745 (of the host . The host =and in the DOS not be . Voco smaller (, so . The in the 4in all Voco "PATH=" "You Now mThe VoCo BBS Was Made By My M The Car." "*.*" is made for all the s of Voco bbs. And for theentire country of volusia" "mayyou all fucking rot in hell:" , 1993. VCL-YD2: An 821 created 1.0 of VCL. wone . qof 821 at the end of the a. The =and in the DOS not be The in the and are not d samples: "PATH=" "[VCL] [Yankee Doodle 2] Nowhere Man, [NuKE] '92" [the song "Yankee Doodle" between 5:00PM and 7:00PM VCL-YD2B: on the VCL-YD2 is one longer, adding 822 (to the end of the . w. It has to avoid detection by utilities. See: Nowhere Man PZPAPN VComm : VComm 637, >, 1989 j; TSR; write failures Poland R: 637 4: PRaE - , IBM , NAV, , VET, , or The VComm is of Polish 1989. The is a . run, the attempt to xone . ain the E. It xthe of the 5interpreter. VComm a, it bpads the is a multiple of 512 it adds its 637 4to the end of the The portion of the intercepts any Kwrites are attempted, and 1them into Kreads. PZPAPN : VCS Construction Set G: May, ; autoexec.bat & config.sys replaced Germany R: 1,077 4: PNCK - \, IBM , VET, NAV 2.1+, The VCS, or Construction Set, was in May, . It fGermany. VCS is a creates of a 1,077 the VCS X, it prompt the in German for the number of generations before the activate, and for the of a includes the for the The VCS create a d VIRUS. be a live generated to the 's specification. The input by the not the VIRUS. X, the VCS-generated 1,077 fone to three . in the E. If +exists in the it may by 1,077 at the end of the be no 2in the in the DOS VCS-generated activate the number of generations was specified by the . At the , the replace AUTO WC.BAT and CONFIG.SYS in the C: Oroot E. If `did not exist, it create them. The new AUTO WC.BAT and CONFIG.SYS be 512 8the specified during the ' creation using VCS. VCS generated es are: DarkSide: DarkSide is a +. It of the . in the qof 1,077 at the end of the a. The in the "Welcome to the DarkSide of the Realm!" "We all heed a certain call, our minds cannot control," "drawn fdeep in our hearts and deep in our" "souls." "c:\autoexec.bat" "c:\config.sys" VCS-Post: A vof . +. It several . in the qof 1,077 at the end of the a. It the C: Oroot E's AUTO WC.BAT and CONFIG.SYS ever an Deutsche Bundespost Telekom Sin the AUTO WC.BAT and CONFIG.SYS `on the C: : Germany See: Manta PZPAPN : VFSI 437, Happy Day R: 437 4: PNCK - \, NAV, , IBM , VET, The VFSI at VFSI (the Higher Institute of Financial Management) in Svistov, a town on the Danube. VFSI is a the VFSI X, it xone in the Candi `to be sare baligned to be a multiple of 16, and by between 437 and 452 at the end of `can be easily identified as always the chex : 3A483F244B6F636E706C74. one out of five Zs of an the flash the on the "HELLO!!! HAPPY DAY and SUCCESS 1.1 VFSI-Svistov" Sin the 4, so it is not PZPAPN : VHP VHP-348, VHP-353, VHP-367, VHP-435, VHP-757, VHP-776 Research R: 348 - 435 4: PNC - \, NAV, IBM , VET, \, or The VHP is actually a small group or " ]" of was 'in early :ly four identified to the VHP the VHP-435 "the one the most potential for spreading. were on the . The progression of the shows to be a slightly better replicator. The VHP es are: VHP-348: Nnot due to bugs in the 4. If it did , it would The 's effective is 348 VHP-353: VHP-348 fixed so increasing its by 353 (. It Nnot is still buggy, and it occasionally hang to find a . VHP-367: VHP-353 by 367 (. Very a. VHP-353 Nnot always X, it not xany . it has in effect immunized the effect is probably a bug in VHP-435: , 1989, is 435 and is not destructive, all it Nis spread. VHP-435 attempt to xone +and . are not tall of the . on the Oand E, it attempt to OC:. VHP-435 is the VHP-367 modifications to make it less likely to be noticed. VHP-757: , VHP-757 is a 757 of the VHP group of . It wone . , but not by 757 at the end of the d samples are typically not very xious, and VHP-776: , VHP-776 is a 776 of the VHP group. It is in behaviour to the VHP-757 xthe two . `in a See: Sicilian Mob VHP2 PZPAPN : VHP2 623, VHP-623, VHP-2 Research G: March, j; re %s or R: 623 4: PNC - \, NAV, IBM , VET, \, or The VHP2 'in March, on the , and has many of the same characteristics of the VHP-435 of the VHP . It's major difference is of effective , and 1 of every 8 perform a warm VHP2 is 623 (long, `but not of VHP2 are: VHP-627: to VHP-623, except is 627 See: VHP PZPAPN Victor : Victor G: May, j; data alinkage T; unexpected R: 2,443 - 2,458 4: PRAK - \, NAV, , IBM , VET, \, NAV, or The Victor ~in May, . It is believed ated in the due to the "Victor V1.0 The Incredible High Performance Enhanced soon. was imported ks to Ivan." The can be dat the end of `, but Nnot to ever be The the Victor X, the , occupying 3,072 (at the top of intercepted by the becoming , Victor seek out and Victor is a very slow in every 10 by between 2,443 and 2,458 (. The is not hidden by the Occasionally in the process of a, the hang the in data 9. Overlay `may ing in alinkage Victor on Wednesdays, at be 3,008 bVictor Xon a Wednesday, the xall . and . larger 2,500 immediately. PZPAPN Austrian, Unesco, DOS-62, DOS-68, 1-in-8, 648 , 1988 Austria R: 648 4: PNCK - \, IBM , NAV, , VET, : CleanUp, , NAV, or The , 1988, in Moscow at a UNESCO children's computer summer camp. The vof . X, the select a . in the modified by the . Usually, the aand set the seconds in the in the Eto 62. qof 648 at the end of the One out of every six selects not be actively sby the . Instead, the bfive the selected . 0to the hex character "EAF0FF00F0", and the seconds field in the set to 62. are later X, a %may . Since corrupted do not actually 8the , and most cannot detect them, continue to [unexpected re %s until all of the corrupted . replaced clean copies. hang upon sby the The was written by a high school student in Austria as an experiment. Its large number of , as well as are in part 4, can be accounted for as its source 4has published many Due to the large number of us may not exhibit exactly the Cracky: , Cracky is a 546 the on 8088 . On 286 and higher Zof an in a hang, or the "Cracky !" Lin the upper left hand corner of the and a hang the next or .BAT X. On XT , Cracky xone . of 546 at the end of the a. The seconds field in the in the DOS Eentry set to 22, the umarker. The Mof the "Cracky !" may on 286 and higher , along hang. The can be in the 4in all "Cracky !" "*.com" DOS 625: DOS 625 is a 625 of the . It 7the ,", "PATH=", and "om OM". It is in behavior to the Nnot do Dr Q: Dr Q is a 1,161 of the . It 7the "(C) DOCTOR QUMAK" in the 4in all Dr Q-1028: Dr Q-1028 is a 1,028 of the Dr Q . It 7the "(C) DOCTOR QUMAK" in the 4in all , as well as the "Hello world "Infecks" "stuff should be here" wone . in the by 1,028 (and 2in the =and in the DOS Zof an in the Mof the "Hello world Genny-648: Genny-648 is a 648 of the It either wor trojanizes one . qof 648 at the end of the a. Trojanized %the X, the bfive (having Like the sets the seconds in the stamp to 62 to indicate March, Kuzmitch: Kuzmitch is a 1,064 of the xone . ain the E, but not qof 1,064 - 1,222 at the end of the a. It is if it New Generation: New Generation is a 1,054 of the . It xone . ain the qof 1,054 at the end of the a. On every 20th generation of the , it Mthe on the monitor: New Generation by NET CRASHER, a PROUD member in Hyper. s in a generation is devided by 20. Please don't remove was created for research purposes > Get a Life!" The in the 4, as are the ctwo "*.com PATH=" mthe seconds field in the in the DOS Eset to 62. : Israel Twer-1000: Twer-1000 is a 1,000 of the xone . ain the qof 1,000 at the end of the a. The in the DOS to be , but the seconds field has actually "60". The can be in the 4in all Twer-1000 "Twer "PATH=" 822: 822 is -B 645 in behavior. +, increasing by 822 Nnot perform either a warm re V May, -415: -415 is a 415 of the in the C: Oroot E. It adds 415 (to the . +. It sets the seconds in the in the DOS to 62 to indicate the -618: -618 is a 618 of the . It adds 618 (to the . +. It sets the seconds in the in the DOS Eto 62 to indicate the all the in the Zof an hang. -621: -621 is to the . It adds 621 (to the . w. Like -618, it sets the seconds in the 62 to indicate -634 Re -634 Re %is a 634 the . It wone . 25% of the X, a instead of s. The alteration in the %ed the next -645: to the -B 645 adds 645 (to the . w. It not trojanize to perform a warm re 7the ,", "PATH=", and -648E: on the adds 648 (to the . w. It alters `, rather tthem, by bfive hex 20 The seconds field in the be set to 62 on all trojanized and . It ,", "PATH=", and " -656: -656 is a 656 of the X, it ain the E, as well as accessing the C: O. It Nn't on the C: O, but may crosslink the C: -712: -712 is a 712 of the occasionally trojanize a instead of tit. trojanized X, a warm -716: -716 is 716 of the in "Divide overflow" ring, or possible -726: -726 is a 726 of the Like , it wone . ain the 50% of the X, a warm re ca long Kaccess. The can be "(c) Copyright IBM Corp 1981, 1987 Licensed Material" Property of IBM" -726B: -726, has six differ. -943: on the adds 943 (to the . w. Like wone . X, locating the at the end of the . The can be din the 4: "PATH=", " ,", and ,". kfrequently X. The ma NICE day...r is no longer operational due to an outbreak of". March, Vien6: , except the warm re %has removed. Effective of the is still 648 son the O, the start , except instead of a warm re the -B 645: to the effective is 645 (. It Nnot perform either a warm re . It N, however, -Beta Boys: fSweden in adds 679 (to the . +, and sets the seconds field in the to 62. The can be din all "-+[BetaBoys]+-" "PATH=" Beta Boys ^of any year, overwritting the C:, D:, and E:. : Sweden -Beta Boys 730: fSweden in adds 730 (to the . +, and sets the seconds field in the to 62. The can be din all "BetaBoys Present: Memo v2.0 /MaZ" "PATH=" : Sweden -CDM.A: fPoland in adds 642 (to the . +, and sets the seconds field in the to 58. The can be din all "PATH=" "COULD DO MORE "YOU COULD D" -CDM.A =is set to 1st thru May 5th of any year. It Nn't : Poland -CDM.B: on the -CDM.A is a minor : Poland -CDM.C: on the -CDM.A is a minor : Poland -Nag: -Nag is a 648 of the . Like the adds 648 (to the . +. It sets the seconds field in the to 62. It 7the "PATH=" -Refresh: -Refresh is a 648 of the . Like the adds 648 (to the . +. It sets the seconds field in the 32. It 7the "PATH=" -Yam 92: -Yam 92 adds 849 (to the . and sets the seconds field in the to 56. The can be din all 'Matthew Stolarski - "A Loser in deep trouble "Matthew Stolarski is a born loser..." "Let's kill him "YAM '92. Remember "PATH=" Wien: in all details, minor avoid detection. : Poland See: 1260 Arf Ghostballs Grither Lisbon Mexican Mud Parasite Rattle Sicilian Mob TSoft VHP VHP2 W13 Incom Viperize PZPAPN Vindicator : Vindicator kon 386 R: 734 4: PRhCK - , VET, NAV 2.1+, 1.53S+ The Vindicator . Its . Vindicator is a vof . The the Vindicator X, Vindicator at the top of #the , as rby the DOS ?by 1,536 {1C and nby Vindicator in . The if it was not the Vindicator , it qof 734 at the !of the . The in the DOS not be The can be in the all Vindicator It is what Vindicator PZPAPN Strain B Endangered OB:; formats Canada R: 1,055 4: PNCK - , NAV, IBM , VET, : CleanUp, or The by an anonymous of Homebase BBS. While ~in the United States, fCanada. X, what happens depends on what the =is set to. If the prior to , the xone . in the E, adding 1,055 (to the . If the , the not xany `, but format the btrack of the of an uof the include unexpected to access OB:. If is no or the OB: is write-protected, a The s in the "TransMogrified (TM) RABID N'tnl Development Corp Copyright (c) RABID! =: 08/15/90 Strain B - ! (Field Demo Test ! * NOT TO BE DISTRIBUTED * !" on the is 716 . The major 4, and >4. On reformat track 0 of all The "*.com" " B2 is a 1,000 , and related to the Arf s to written by the same group. activate on 31 and the year or later. At , it wipe out the b700h random 7the ," "Arf Arf! Got you!" " ," "-- RABID '90" "down or DIE!" "--- RABID '90" wone or two . X, along the : "Arf Arf Got you! -- RABID '90" B2-969: B2-969 is a 969 of the . It : "*. ," and B2 (C) '90 RABID Nat'nl Development Corp." B3 is a 843 . Like the s, it X. Unlike the s, it affect the C: immediately in circumstances. Damage caused by B3 can be fixed Norton KDoctor. B3 should activate on >25, at attempt to format the B3 are: " Strain B3 - RABID Nat'nl Development Corp. " "*. BT: Very to the . It includes the same -C is a 821 . Like the s, it qof 821 at the end of the a. The seconds field of the in the DOS set to "56". The in the 4, un Strain C - (C) RABID Int'nl Development Corp." strikes again..." "PATH=*. thru of any year, at Zof an in the of the !of the K, and the strikes again...". : Canada See: Arf B4 Violite PZPAPN Christmas Strain B4 jon 8088 80286 & 80386 Canada R: 5,302 4: PNCK - , IBM \, NAV, , VET, The in the United States. It is fCanada. released into the public domain on a Trojan of DSZ (DSZ1203). It is a vof . What Ndepends on what processor is in the personal computer it is Xon. On 80286 and processors, the activate immediately, portion of the K. It attempt to Christmas greeting at , but the greeting garbled if ANSI.SYS is not loaded. Damage caused by B4 at can be repaired using Norton KDoctor. On an 8088 do nothing but X, the one in the qof 5,302 The =and in the not be . The at the end of the The in the it is never Strain B4 - Written by RABID Nat'nl Development Corp. RABID would like to take opportunity to extend it's sincerest holiday wishes to all Pir8 lamers around the world! If you are reading you are lame!!! Anyway, to John McAffe! ma Merry Christmas and a filled new year. Go ahead! Make our day! Remember! In the festive season, Say No to drugs!!! suck shit! (Bah! We make a large, might as well thing positive!)" B4 are: B4-1: Very to the track 1 of the it has completed two us on a 386- machine. It same as the , and differs by a few B4-B: is the same as B4-1, it differs by two (. Its behavior is identical to B4-1. See: PZPAPN Violetta : Violetta 6- Germany j; TSR Germany R: 3,840 - 7,678 4: PRsC - ., NAV 2.1+, , VET, The Violetta Gin Germany in . It was reported to be widespread in Germany at the of its . Violetta is a vof . but Nnot The Violetta is X, the Violetta as a low TSR of 8,256 {21, CC, CE, F1, F7, and F8 the Violetta , it Violetta normally 3,840 (. However, if the was less 3,840 (, the be 7,680 (. In either case the at the !of the be no 2to the =and in the DOS The in the Violetta "VIOLETTA" 4.00" It is if Violetta of Violetta are: Violetta-1024: Violetta-1024 is a smaller of the Violetta . Its TSR is 4,432 , and hooks |21. Violetta- 1024 qof 1,024 at the !of the a. . were smaller 1,024 2,048 Violetta-1024. The =and in the DOS the =and . The can be in the 4in Violetta-1024 "Greetings to Cracker Jack..." "Loving ts to Shirley..." "Marty McFly lives where in "Kill Eddie. Kill Diana. Kill Fredo." PZPAPN Violite : Violite , 1993 <seconds = 56; North America R: 988 4: PNCK - 1.15a+, 6.04+, \2.07+, V100+, 1.53S+, V100+ The Violite , 1993, and is fNorth America, probably the . Violite is on the , and like , is a vof . the Violite X, the Violite xone . in the xvery small . . If a sui cannot be din the E, the search the path for a sui candi the Violite qof 988 at the end of the a. The =and in the DOS not to be the seconds field of the set to "56". The can be in the 4in all Violite "Vio-Lite, TAA, Virulent Graffiti, (k) "PATH=*. The Violite maintains a counter in its is intended to be the generation number of the particular of the counter r Qes a value of 10, the may Mthe as a See: PZPAPN Viper : Viper Viper Dropper fail to Australia R: 840 4: ONAK - i, IBM }, NAV 2.1+, , VET, The Viper was submitten in . It is fAustralia. Viper is a of . ,and . . It Viper is X, the Viper xup to four in the E. . be selected b, and mthe b840 the Viper . Unless the _pre- was less be no 2to the in the DOS were less 840 now be 840 `as Viper is all of the . ,and . in the Viper, the Zof the next in the L, and the ed to the DOS prompt: "-/\-] S.C.P. [-/\- Welcome, you mjust joined the SCP Wasted Victims club!, yep s right.. your've got the ViPER-I ! and Lord Venom wont even charge you for it!. NO CRIPPLE WAREZ HERE!!! Copyright by Lord Venom & S.C.P. Australia of Viper are: Viper Dropper: The sample of the Viper copy is completely un PZPAPN Viperize : Viperize R: 934 4: PNCK - , VET, NAV 2.1+, 1.53S+ The Viperize . Its . Viperize is a +. It is on the Viperize is X, the Viperize xone . in the 934 at the end of the The seconds in the stamp in the set to 62. The can be the Viperize "PATH=" Viperize on a random basis, at Mthe "THE VIPERIZE VIRUS STRAIN A (c) , STINGRAY / VIPER WITH AFFECTION TO BRENDA M.G. ONE OF THESE DAYS, YOU'LL BE MINE! AND -YOU- WILL FRY. FUCK YOU MCAFEEE." The corrupt the and hang the of Viperize are: Viperize-B: to the has two See: Generic PZPAPN VirDem : VirDem VirDem 2 Endangered G: 1986-1987 Germany R: 1,236 4: PNC - , IBM , VET, , NAV 2.1+, \, or The VirDem was written in 1986-1987 by Ralf Burger of Germany. The distributed in Vas a demonstration , to assist computer s in understanding how a computer operates. The VirDem is not , and `on the A: O. It always skip the the root E, so normally it +. It `past the second sub Eon the were less 1,500 be 2,616 u. . greater 1,500 1,236 X, VirDem xthe next candi 8the followed by the tthe . the play a "game" you, starting " VirDem Ver.: 1.06 (Generation #) aktive. Copyright by R.Burger 1986,1987 Phone.: D - is a demo computer es. Please put in a number now. If you're right, you'll be able to continue. The number is between 0 and # (Note: I mremoved the phone number here, but it s where x is . Where # is, the 's generation number , you must guess the correct number and enter it. If you put in the wrong number, you get the and your is not run: " Sorry, you're wrong More luck at next try If you guess the correct number, you receive the and your " Famous. You're right. You'll be able to continue. " Finally, all the candi `on the A: s, the " All your struck by VIRDEM. ,now." VIRDEM. ,was the distribution 8ing the and had a VIRDEM.DOC aincluded it. VirDem is not widespread, and is not destructive. of VirDem are: VirDem 2: to the , the major difference is translated to German. VirDem-833: on the VirDem , VirDem-833 wone . ain the qof 833 at the !of the a. The and in the DOS not be . The in the VirDem-833 "\ * *. "\ IRUS S" VirDem-833 on any Monday starting in 1993. At , a "bug" traverse the top of the fleft to right, and the be corrupted by the 1993. See: Burger Twin Peaks VirDem-792 VirDem-1542 Wonderful PZPAPN VirDem-792 : VirDem-792 R: 792 - 1,526 4: PNCK - , VET, , IBM , NAV 2.1+, The VirDem-792 . Its . VirDem-792 is a non- vof . +. It is on the VirDem and Burger VirDem-792 is X, the VirDem-792 search the Oand Eto locate the a. If E, it may s. If an d, the VirDem-792 xit, and the VirDem-792 qof 792 (if the _pre- was at least 736 `whose pre- was less to 1,528 uof the VirDem-792 . The at the the a, and the =and in the DOS The can be in the VirDem-792 "*.com *" ?exe" ?com" "Generation" cthe word "Generation", a number can be seen. number is the generation number of the a. It is incremented by one and stored in the newly `. The Generation number Nn't to ever be reset, so it should be possible to trace to extent the order of See: Burger VirDem VirDem-1542 Wonderful PZPAPN VirDem-1542 : VirDem-1542 k; access to unexpected R: 1,542 - 3,028 4: PNCK - , IBM NAV 2.1+, , VET, The VirDem-1542 . VirDem-1542 is a vof . `. It not +in the C: Oroot E. VirDem-1542 on the VirDem VirDem-1542 is X, the access the C: O, searching the Estructure to locate an +in the C: Oroot E, to s. If an , the xit. by 1,542 (, however if was less 3,028 3,028 VirDem-1542 access the look for a VirDem-1542 may executing symptom is if an scopy of the DOS Ureading FAT 88 Probable non-DOS Continue (Y/N)?" See: Burger VirDem VirDem-792 Wonderful PZPAPN Research >, 1989 j; TSR District of Columbia, R: 857 4: PRC - \, IBM , NAV, , VET, \, or The distributed in >, 1989 by Patrick Toulme as an "educational tool", source for sale. In , the author contacted the sites where he had uploaded the requesting remove , his having decided a live was not a "good idea" for an educational tool "contacted by several authorities. The cdescription was by Patrick Toulme in for inclusion in educational, research was written by Patrick Toulme to aid developers in understanding and in creating -resistant software. is a simple Oand advises the aon a floppy Kis to be s. Of course, no damage the and all `advise the of the upon Z. The safeguards provided by the author prevent accidental uand the disassembly of the 4is extremely difficult. Upon request fthe community, -90 is now to approved anti- researchers." See: PZPAPN Research TSR; BSC; . j(floppy District of Columbia, R: 2,560 4: PRAFK - \, NAV, , VET, The -101 is the "big br " of -90, written by Patrick Toulme as an "educational tool" in , and employs an encryption scheme to avoid detection on `. It +, and all execu it has sall the `on a J, it xthe . It wfloppy Iin its The cdescription was by Patrick Toulme for inclusion in -101 is a sophisticated, continually encrypting, research written by Patrick Toulme, author of -90. wboth ,and `and evade most anti- software and continually encrypt to prevent non-algorithmic search is not to the general public and is presently used by government agencies and corporate security departments to test anti- software and lware devices." See: PZPAPN Vivaldi : Vivaldi j; TSR R: 4,102 - 4,112 4: PRsE - , VET, NAV 2.1+, The Vivaldi . Its , are . Vivaldi is a vof . The the Vivaldi X, the Vivaldi a low TSR of 4,160 {21 and CC nby Vivaldi in the Vivaldi , it qof 4,102 to 4,112 at the end of the a. The =and in the DOS not be . One can be din the 4in Vivaldi "VIVALDI" It is what Vivaldi PZPAPN : VMem G: May, j; VMEM.SYS hidden acreated; CONFIG.SYS Israel R: 3,291 4: PRsAK - .1.4+, 25.10+, The VMem ~in Israel in May, . VMem is a employs technology to avoid detection by utilities. bVMem X, the VMem create a hidden a, VMEM.SYS, in the root hidden be 3,275 and mits =and set to either all blanks or the =and , the VMem =the CONFIG.SYS ain the root Eto add the cline: "device=\vmem.sys" If CONFIG.SYS Nnot exist in the O's root the create one 8ing the line. has completed process, the run. The is not yet The next %s the had the VMEM.SYS created and its CONFIG.SYS the VMem as a device , as rby the DOS 3,696 nby VMem in the VMem , it qof 3,291 at the end of the a. The =in the DOS mhad its day set to "00". The VMem hides the qand the 2in the ='s day it is . The can be din VMem "DOS50VMS" or "DOS33VMS" "LLP" The in the VMem are not "TERMINATOR" ,SPEC" "VMEM" the VMem crashes . The DOS not indicate PZPAPN Voronezh : Voronezh R: 1,600 4: PRhA - \, NAV, IBM , VET, The Voronezh . It is fthe . Voronezh is a vof . ,and . `, and Nnot The Voronezh is at the top of #the &. While the reserves 3,744 , it Nnot move the nby the reserve 24 on the Madapter card. Voronezh is ,and . by 1,600 (, the at the end of 8the "Voronezh, 2.01". It is of Voronezh are: Voronezh B: to the Voronezh , the major difference Voronezh B is Voronezh B any reason. The did not open. The rfor Voronezh is See: Voronezh-370 Voronezh-Chemist PZPAPN Voronezh-370 : Voronezh-370 370-B j; TSR; R: 370 4: PRsCK - IBM ., NAV 2.1+, The Voronezh-370 Its . Voronezh-370 is a of . . It Nnot The Voronezh-370 is as a low TSR of 1,712 (. It Voronezh-370 is , it qof 370 at the !of the a. The =and in the DOS to the =and It is if Voronezh-370 See: Voronezh Voronezh-Chemist PZPAPN Voronezh-Chemist : Voronezh-Chemist Chemist, Video Mode, Voronezh-650 R: 650 4: PRhCK - , VET, NAV 2.1+, The Voronezh-Chemist, or Chemist, . Its it is related to the Voronezh and Voronezh-370 es. Voronezh-Chemist is a vof . The the Voronezh-Chemist at the top of #the and ?by 2,048 |12's moved. {21 and nby the Voronezh-Chemist is , it qof 650 the !of the a. The =and the DOS The can be in the all Voronezh-Chemist "Video mode 80x25 not supported" "16.01.91, v1.00" It is if Voronezh-Chemist of Voronezh-Chemist are: Voronezh-650: to the Voronezh-Chemist has three differ. See: Voronezh Voronezh-370 PZPAPN : Vote R: 1,004 4: PNCK - \, VET, 3.93+, 25.10+, The Vote . It is '. Vote is a vof . the Vote X, the Vote xthe in the E. If Vote, the xit. The run. , .BAT a, or DOS 5, a hang usually the Vote qof 1,004 (for uof Vote in the The Vote at the end of the a. The =and in the DOS not be of Vote are: Vote-1000: A later of the Vote not re . It wone of the bfour `in the qof 1,000 the end of the a. The =and in the DOS not be . Vote-1000 attempt to the may be in cyrillic and is thus unreadable on most PZPAPN : VP G: May slowdown England R: 913 4: PNCK - \, NAV, IBM , VET, \, or The VP ~in May, . It is a generic . v, and is run, the attempt to locate and a. In cases, such as +, the Mthe contents of the s. In cases, the may attempt to Ythe by 913 (, and can be identified as the chex near both the !and the end of an : '4503EB1808655650'. PZPAPN Vriest : Vriest j; TSR R: 1,280 4: PRsCK - \, IBM , NAV, VET, The Vriest and is believed to be where in V. Vriest is a The Vriest is X, Vriest as a low TSR of 1,584 {20, 21, and 27 nby the Unlike most , Vriest . It copied, at the target Vriest by 1,280 The at the !of the The =and in the DOS Vriest s, adding an 1,280 (to the . Re is again copied. Vriest Nnot to do PZPAPN VVF 3.4 : VVF 3.4 R: 1,614 - 1,628 4: PRhA - , VET, NAV 2.1+, 25.10+, The VVF 3.4 . It is reported to fthe . VVF 3.4 is a ,and . , but not The VVF 3.4 is at the top of #the , as measured by the DOS by 3,488 |12's moved. {1C and 21 nby VVF 3.4. VVF 3.4 is , it ,and . qof 1,614 at the !of the qof 1,614 to 1,628 at the end of the a. The =and in the DOS not be . One can be in the 4in VVF 3.4 "VVF3.4" It is what VVF 3.4 PZPAPN VX-163 : VX-163 R: 163 4: PNCK - V100+, V100+ The VX-163 . Its . VX-163 is a vof . the VX-163 X, the VX-163 xone . in the 163 at the !of the a. The =and in the DOS not be . The the 4in all VX-163 "*.com" VX-163 Nnot in the the bfive . in the VX-163 Nn't do frequently PZPAPN : W13 Toothless Endangered >, 1989 Poland R: 534 4: PNCK - \, IBM , NAV, , VET, \, NAV, or The W13 is a . Nn't do much except for `. The >1989 in Poland. While W13 is on the , it Nnot damage of the side effects of the . It 7a number of bugs prevent it "a good replicator. of W13 are: Dushanbe: The Dushanbe is a 458 of the W13 . It xone . qof 458 at the end of the mhad the month in the =in the 0to "13". the "DUSHANBE M&A!" W13-B: The several bugs fixed. is 507 (instead of 534 W13-361: The W13-361 is a 361 of the W13 . It xone . by 361 the end of the mhad the month in the =in the 0to "13". frequently W13-361 are 8the "ctivated!" : Poland W13-377: The W13-377 is a 377 of the W13 . Like W13-361, it wone . be 371 (. It 1the month in the =to "13". The W13-361 do not . The can be : Poland W13-534B: The W13-534B is a 534 of the W13 . It xone . X. The month in the =in the DOS 0to "13", is how the determines the is a minor of the W13. Like the , it 7several rences of the "Microsoftyright" in the May, W13-Req: The W13-Req is a 494 of the W13 . It wone . X. It 7the ?.com" "REQ ! Ltd (c) 18:41:22 3-I- : Poland See: Plumbum PZPAPN Walker : Walker ; man walks across intermittenly Turkey R: 3,846 - 3,861 4: PRhAK - 1.15a+, 6.00+, \2.07+, V99+, The Walker . It is fTurkey. Walker is a vof . ,and . bWalker X, the Walker at the top of #the , as rby the DOS by 12,304 {16 and 21 nby the , it ,and . qof 3,846 to 3,861 at the end of the a. The =and in the DOS not be . The in the Walker "WALKER V1.00 - absolutely harmless and self destructive is written by UJHPTTLZ in the city of Istanbul, The Walker it has a few minutes, at a colorful ASCII block graphic man 20 lines tall walk fright to left across the M. The graphic man walks across the every few seconds. the graphic man walks across the input be suspended until he goes off the PZPAPN Warning : Warning G: May, & warm R: 3,072 4: PNCK - , VET, 3.93+, The Warning ~in May, . Its . Warning is a xof . the Warning X, the warning xone . in the the Warning qof 3,072 (. The both the !and end of `. The in the DOS the =and If the Warning is unable to in the E, it Mthe "WARNING: computer self-destruct in 5 seconds" A pause s, and 5 seconds later a warm . The is not `as it is PZPAPN Warrior : Warrior G: May, j; unexpected access to R: 1,024 4: PRfE - , IBM , NAV 2.1+, 1.15a+, 2.43a+, 25.10+, The Warrior in May, . It is Warrior is a vof . The Warrior is X, the at the top of , but #the &. The hooks {21 and 22. At , the Warrior access the C: tall . in the root E. It xone . in the Oand Warrior is , it by 1,024 at the end of the a. The =and in the DOS not be Warrior 8the "... and justice for all!" "Dream Over ... And the alone warrior is warrior. The powerfull WARRIOR!" It is if Warrior See: Brainy PZPAPN : Weak Vulner R: 1,253 4: PRfCK - 2.43a+, 6.04+, \2.07+, V102+, V102+ The Weak, or Vulner, . Its . Weak is a vof . bWeak X, the Weak , hooking |21. , as by the DOS not be the Weak , it are copied or providing the in a sub in the root the Weak qof 1,253 at the !of the a. The =and in the DOS . The in the "Et tu vulneratus es sicut et nos, nostri similis effectus es..." kfrequently PZPAPN Were Here : Were Here Here R: 838 - 851 4: PNCK - , VET, , NAV 2.1+, 1.53S+ The Were Here . It is a vof . Were Here is X, the xone . in the E. If +resides in E, it may Were Here of 838 to 851 at the end of the a. The =and in the DOS The Were Here Mthe "We're Here" Xstarting in is not, however, always PZPAPN Westwood : Westwood j; TSR; slowdown; black window; adeletion on Friday the 13th Westwood, California, R: 1,819 - 1,829 4: PRsA - \, IBM , NAV 2.1+, , VET, : CleanUp, NAV, or The Westwood in Westwood, California. is a substantially of the , enough so s tested could detect were unable to identify it. Like , it W, and overlay `, but not The the Westwood X, the as a low TSR of 1,808 {8 and 21 n. If the =happens to be a Friday the 13th, , any the Westwood qby 1,829 at the !of the `and overlay are to the end of the . . by between 1,819 and 1,829 (. Unlike most of the , Westwood not re slowdown for 30 minutes. At , the "black window" or "black box" 6to the on the lower left hand side of the 8around the area of the "box" may be corrupted if writes happened to be ring the box On Friday the 13th, the Westwood Aany See: PZPAPN Whale : Whale Fish, , Z The Whale Research slowdown; video flicker; slow writes; T; simulated Hamburg, West Germany R: 9,216 4: PRhA - , IBM : CleanUp, or The Whale in early had rumored to exist since the of the Fish 6 . It has referred to by several Whale, Fish and Z The Whale. The is subject to speculation, it is probably Hamburg, West Germany due to a reference in the it is decrypted. The the Whale the Whale in high but #the &. On the author's XT clone, the always starts at address 9D90. ?by 9,984 (. Most utilities usage indicate a value for 9,984 (less what is actually The can be the Whale "Z THE WHALE". Immediately upon becoming , the [the slowing down. Noticeable effects of the slowdown include video flicker to extremely slow writes. to "hang", eventually in most cases since the "hang" is due to the slowing of the the Whale , the xthe , the actual is usually 9,216 (. Note the "usually": Noccasionally "mutant" be a different . If the qis exactly 9,216 (, the Whale hide the X. If the of the to the 9,216 (, the either the actual , or the actual minus 9,216 Executing the DOS "reported. If */F is adamage The Whale alters the <in the the it is not set to the u. Occasionally, Whale alter the Eentry for the it is ing in the Eentry becoming invalid. invalid Eentries Eis listed, but Kutilities not allow access to the . In cases, the Eentry can be fixed Norton Utilities FD 5to reset the The Whale occasionally 2its behavior while it is . While most of the are periods of xany for any reason. It , at s, dis are copied the DOS COPY 5, at not "dis xon the fly". Occasionally, the Whale simulate what s to be a %. While Nn't always the Break key is disabled so cannot exit unexpectedly fthe Zof the 's autoexec.bat a. If the autoexec.bat 8ed any software aopens of execu , those execu were not Typically, manner qby 9,216 not be shown in a A hidden amay be din the root OC: on ais not always present, the s remove it, to recreate it again at a later . The hidden ais FISH-#9.TBL, it 7an image of the ), along the "Fish A Whale is no Fish! Mind her Mutant Fish and the hidden Fish Eggs for are damaging. The sixth Fish mutates if the Whale is in her Cave." hidden a, the author of document made several attempt to mthe Fish 6 mutate by introducing it and Whale into a . Under no circumstances did a mutation of either , the `were both an identifiable Fish 6 uand a Whale Whale is hostile to debuggers and 7many traps to prevent successful decryption of the . One of its "traps" is to lock out the if it determines a debugger is in use. PZPAPN Wharps : Wharps ; buzzing on speaker; seconds set to "62" R: 572 4: PNCK - V102+, V102+ The Wharps . Its . Wharps is a vof . the Wharps X, the Wharps xone . in the 572 at the end of the The =and in the DOS to be un , but actually the seconds field in the set to "62". The in the Wharps "[wHaRpS]" "wHaRpS! It is 3:00 a.m. > ETERNAL" The second Lby the Xat 3:00 AM. frequently PZPAPN Wild Thing 2 : Wild Thing 2 Mswitched to 40 column mode & North America R: 567 4: PNCK - V100+, \2.07+, V100+ The Wild Thing 2 and is North America. It is a the Wild Thing 2 xall of the . in the qof 567 at the end of the a. The =and in the DOS not be . The in the "Wild Thing ][" "It's Friday... Enjoy the weekend "your computer! [YAM '92]" "By: Admiral Bailey [YAM]*.com \ 5.com" The Wild Thing 2 on Fridays, at of an in the monitor switched to 40 column mode and the "It's Friday... Enjoy the weekend your computer! [YAM '92]" of Wild Thing 2 are: Wild Thing: An earlier of the Wild Thing 2 Wild Thing was . The sample Nnot , and is not used for /purposes. It 7the is a Wild Thing" "LEGALIZE MARIJUANA!" "ACiD RULEZ!!! hahaha" ed by Magic" "*.com" : North America, Wild Thing-289: A later of the non-functional Wild Thing , Wild Thing-289 wthree . the qof 289 the end of the a. The =and in the DOS to the =and . It 7the is a Wild Thing" med By Admiral Bailey [YAM]" "(C) YAM Inc." "*.com" The bthree : North America, ^, 1993. PZPAPN Windmill : Windmill Windmill Dropper BSC; "windmill" on accessing write protected Philipines R: N/A 4: BRtF - 6.00+, \2.07+, : DOS SYS on The Windmill Gin the Philipines in Windmill is a , and is a . It Nnot Ks in its present form. the Windmill , Windmill at the top of #the , as rby the DOS ?by 1,024 |12's moved, and Windmill is , it xnon-write protected are accessed. Upon accessing the J, the be moved to an location on the J, and If the to access a write-protected J, such as fit, a spinning slash character ("/") may in the center of the while the xthe K. A flickering box may slightly to the left of center. Eventually the give up trying to the write protected J, and the be able to the or access the aon the write-protected Windmill is a . If Windmill is and the to view or access the , the Windmill present the instead of the real . Thus, utilities unaware of Windmill in not be able to detect any 2in the Windmill is not , the can be in the "WINDMILL Strain 2" "Windmills in your mind.." "LLCPHPU" of Windmill are: Windmill Dropper: A small . 7the Windmill in the by the Windmill PZPAPN WinVir : WinVir WVir Windows . j; Windows . Windows intermittenly fail to Sweden R: 854 4: PNE - 2.43a+, 6.04+, \2.07+, : Replace The WinVir or WVir fSweden in is a in a Windows en nment. It are in Microsoft's New Execu (Windows execu format. It Nnot are not Windows specific WinVir is Xunder Windows, search the Eto locate Windows execu relocating a portion of the host to the end of the a, and tthe middle of the host . The by 854 the =and in the DOS not be . WinVir remove fthe the is not always ed to its condition before it was The terminates, and the Nnot run. If the again the , it function Two can be din all sby WinVir: _for_Windows v1.4" "MK92" Either of WinVir has is rather buggy, and in testing was function it was copied into the Windows fany E, unexpected would rather bizarre PZPAPN Wisconsin : Wisconsin Death To Pascal ; write protect T; .PAS Wisconsin, R: 825 4: PNC - \, NAV, , VET, The Wisconsin . The the sample was Wisconsin, is where its came f. It is reported to ~at about same California. Wisconsin is a vof . but it Nnot the Wisconsin X, the alter the =and of the the =and . The Wisconsin xone ain the by 825 at the !of the If an attempt is made to Wisconsin fa write-protected J, a write protect Nnot intercept Mthe "Death to Pascal." L, any .PAS in the Ad. cannot be seen in `as it is PZPAPN Witch : Witch j; unexpected access to accompanied by R: 1,140 4: PNE - 6.04+, \2.07+, V100+, V100+ The Witch . Its . Witch is a vof . the Witch X, the Witch xone . of at least 5,000 in the E, and access the qof 1,140 at the end of the a. The =and in the DOS not be . The in the Witch 4in all "IT'S WITCHING HOUR... YOUR ,PUTER IS BEING HAUNTED! HAHAHA..." "Bad luck... You've got a in your "*.eXe \dOs ChKdSk.eXe XcOPy.eXe MeM.ExE cHkLiS*.*" "Think about using a is more up-to- "Here lies a in its coffin, Xby a too often..." The Witch between midnight (00:01) and 1AM (01:00), at Land a hang may "IT'S WITCHING HOUR... YOUR ,PUTER IS BEING HAUNTED! HAHAHA..." The Witch interfer the functioning of the DOS 5.0 *, XCOPY, and MEM, and the Central Anti- PZPAPN : Wit %able Germany The R: 966 - 980 4: PRhE - .1.4+, VET, 6.0+, 3.93+, 2.43a+, 25.10+, V100+, V100+ The Wit fthe . It is fGermany, and has rumored to exist for over one year. Wit 4is a The the Wit the Wit at the top of #the , as rby the DOS ?by 1,520 nby the the Wit , it qof 966 to 980 the end of the a. The =and in the DOS not be . The in the 4in all Wit "Wit The Wit on several different criteria. If the =and match more one criteria, any or all of the effects for those s may be noted. On any day of the week f22:00 to 06:00, the the 1 out of every 16 "Gee, I wanna sleep now!" On any Sunday, the Mthe 1 out of every 32 "You really shouldn't work on Sundays..." On any Monday, as well as on any Friday The 13th, the btwo (of the C: , rendering the %able. The trojan has a 1 in 64 chance of triggering >24th through >31st of any year, the Mthe "Merry Christmas" Lastly, the very infrequently Mthe "You got a fine machine!" All of the in the 4, and are not See: Stasi PZPAPN Wizard 3.0 : Wizard 3.0 & beeping Poland R: 268 4: PRCK - 6.04+, \2.07+ The Wizard 3.0 . It is fPoland. Wizard 3.0 is a of . bWizard 3.0 X, the Wizard 3.0 in a "hole" in low , hooking |21. , as rby the DOS not be the Wizard 3.0 , it qof 268 at the end of the a. The in the DOS not be . The in the 4in all Wizard 3.0 "I'm WIZARd 3.0" The Wizard Mthe the monitor L, it is slowly d character by character accompanying beeps on the speaker. PZPAPN Wolfman : Wolfman Wolf TSR; . Taiwan R: 2,064 4: PRsA - \, NAV, , IBM , VET, The Wolfman Gin Taiwan in . It is a generic vof . ,and . `, but not The the Wolfman X, the as a TSR 2 blocks of reserved. The bblock of reserved is 68,032 , the second block of reserved is 4,544 . The 72,640 is in low , and a corresponding amount. The hooks {09, 10, 16, 21, 2F, ED, and F5. , the xany . or . Xif the pre- greater or equal to 2,064 by 2,064 (. . at the !of the . mthe at the end. =and in the to the =and It is Wolfman , or if it is destructive. of Wolfman are: Wolfman 2: is fairly to the Wolfman Its TSR is 67,984 (, and it hooks {09, 10, 16, 21, CF, D1, D3, and several `smaller 5,120 not be sby the the "WOlf_mAN", cannot be as it PZPAPN Wonder : Wonder fail to R: 7,424 4: ONE - NAV 2.1+, , VET, .1.4+, 1.53S+ The Wonder . Its . Wonder is a , over- writing Wonder is X, the Wonder xall . in the E. The b7,424 the Wonder . Unless the _pre- less 7,424 be no 2in the whose pre- was smaller 7,424 7,424 . The =and in the DOS to the =and Wonder frequently hang the X. If the is larger 64K in may instead in an " and the ed to the DOS prompt. of Wonder are: Wonder-2: The Wonder-2 is a minor of the Wonder . It has Nn't `over 64K in . As a , the " no longer PZPAPN Wonderful : Wonderful j; unexpected access to C: R: 1,338 - 2,602 4: PNC - NAV 2.1+, , VET, The Wonderful . Its . Wonderful is a non- xof . It is a member of the Burger es, and is specifically on the VirDem Wonderful is X, the search the C: Estructure to locate the is not d, the Wonderful normally qof 1,336 (. However, if the . was less 1,280 (, the 2,616 fore, qs can be anywhere f1,336 (to 2,614 (. In any case, the at the !of the be no 2to the =and in the DOS The can be in the Wonderful "*.com *" ?exe" ?com" "*.*" "\V 4V2 A" "KILLER" "SOMETHING WONDERFUL" "HAS HAPPENED !!!" It is if Wonderful See: Burger VirDem VirDem-1542 PZPAPN WordSwap : WordSwap WordSwap-1069, WordSwap-1085, WordSwap-1387, WordSwap-1503 j; TSR; R: 1,069, 1,085, 1,387, or 1,503 ((depends on 4: PRsAK - , NAV 2.1+, 1.53S+ The WordSwap es were fthe . WordSwap is actually a ]of initially four share many characteristics. All of are vs of . ,and . `, and damage pdata are written to The a WordSwap X, WordSwap as a low TSR. The of the TSR vary, depending on of the is present, and is documented In all cases, nby the WordSwap WordSwap is , it ,and . kmay qs of 1,069, 1,085, 1,387 or 1,503 (, depending on the . The at the end of `in all cases. WordSwap es are very destructive. `are written to K, the randomly swap words in the corrupting the data. In one case, the a portion of the data of WordSwap are: WordSwap-1069: WordSwap-1069 is a 1,069 )member of the WordSwap ]. It adds 1,069 mhad =and in the DOS the =and ' TSR is 1,072 kdo not . WordSwap-1069 swap words in `written to K, corrupting the a. WordSwap-1069 to be a bug-fixed of WordSwap-1085. WordSwap-1085: WordSwap-1085 is a 1,085 )member of the WordSwap es. It adds 1,085 `, and no in the DOS E. WordSwap-1085's TSR is 1,072 Unlike WordSwap-1069, hang the the next . The sby WordSwap-1085. Damage to `written to Kis the same as the WordSwap-1069 , words occassionaly be swapped, ing in WordSwap-1387: WordSwap-1387 is a 1,387 )member of the WordSwap es. It adds 1,387 `, and unlike the members of be no `. Its TSR is 2,784 differs in the of damage it `written to swapping words, it shift the data 18 (to the left so (of data records are missing. WordSwap-1503: WordSwap-1503 is a 1,503 )member of the WordSwap es. It adds 1,503 be no 2in the DOS E. It `. The s on Kwrites "partially written data , in addition to the swapping of words. The swapping of words if the aisn't . WordSwap-1503's TSR is 3,008 PZPAPN World Peace : World Peace G: May, BSC; Malaysia R: N/A 4: BRtF - : DOS SYS on The World Peace fMalaysia in May, World Peace is a and is a . It Nnot Ks in its present form. the World Peace, the World Peace the top of #the , as rby the DOS ?by 1,024 |12's moved and nby the World Peace is , it xnon-write protected are accessed. Upon accessing the J, the be moved to an location on the J, and 4. In the case of 360K 5.25" I, the 11, the last of the root World Peace Nnot x1.2Meg 5.25" if the , it Fany attempt to read the may trigger anti- utilities into thinking the fthe root Eof the J, and not a copy of the If the to access a write-protected J, such as fit, a " Ureading Umay World Peace is a . If World Peace is and the to view or access the , the World Peace present the instead of the real, . Thus, utilities unaware of World Peace in not be able to detect any 2in the World Peace is not , the can be in the "World Peace" PZPAPN Worm-16850 : Worm-16850 Hidden Read- created R: 16,850 4: SNA - Spawning V95+, NAV 2.1+, 2.43a+, The Worm-16850 . Its is a spawning or companion by creating corresponding hidden . the Worm-16850 search the Efor an . Nnot ma matching . such a d, the wit by creating a 16,850 the same base newly created . not be to the as the aattributes are set to hidden and read- . The host . is not any way. The can be in the hidden, read- 8the "Turbo-C - Copyright (c) 1988 Borland Intl..Divide "Abnormal termination" .rb.PATH." Worm-16850 can be easily dis deleting all of the hidden, read- of 16,850 correspond to . in the PZPAPN Worm-17690 : Worm-17690 17690 G: May, 17,690 & .SYS, .PRG, .FIL, and .DAT `created R: 17,690 4: SNE - Spawning , NAV 2.1+, 25.10+, \2.07+, `and re The Worm-17690 ~in May, . Its is a vof . and can be difficult to dis the Worm-17690 xone . on the A:, B:, or C: O. The decides to be re base man extension of either .SYS, .PRG, .FIL, or .DAT. The write a copy of . The new copy of be 17,690 and of the =and . The host continue Worm-17690 is difficult to dis xsince the . 8ing the 4are dand Ad, the must be and re d back to the correct PZPAPN : WWT WWT 01, WWT 02, WWT 02B G: May, R: 67 or 125 4: ONCK - , VET, , IBM , NAV 2.1+, The WWT es were Vin May, . As of May, are two es in ]. One , WWT 01, is a . The , WWT 02, is a 125 Both es are a WWT X, the xall . in the E. If resides in the E, it mthe !portion of 4. The number of depends on of the WWT es are present. The =and in the Emay to the =and a WWT since permanently corrupted due to the 4having WWT Nnot do of WWT are: WWT 01: The WWT 01 is 67 mthe by the . If the was less (, the are 67 or greater before q. WWT 01 in the =and in the Ehaving to the =and WWT 02: The WWT 02 is 125 mthe b125 by the . If the was less (, the are 125 (or greater before q. WWT 02 2to the =and in the WWT 02B: WWT 02B is very to the WWT 02 . Its difference is has one has at offset 2C. PZPAPN : WXYC BSC; Jroot Edamage R: N/A 4: BRtX - V99+, : M- K, or DOS SYS on The WXYC . WXYC is a and the ). It s to be related to the The fa WXYC the WXYC at the top of #the &, moving |12's , as rby the DOS ?by 2,048 , the xthe if it was not s. The WXYC saves the at Side 0, Cylinder 0, the WXYC , it xthe of any non-write protected Iaccessed on the On 360K 5.25" I, the save the 11. On 1.2M 5.25" I, the saves the 28. In both cases, is the last the root E, and any Eentries be lost. The can be in the Ks and "JAM WXYC" "WXYC rules roost" See: PZPAPN : X-2 H: <seconds set to "60" England R: 795 4: PRhE - V100+, 6.04+, \2.07+, V100+ The X-2 fManchester, England, in . X-2 is a vof . employs techniques to avoid detection. The the X-2 at the top of #the , as measured by the DOS ?by 3,008 nby X-2 in the X-2 , it qof 795 hidden X-2 is . The the end of the a. The seconds field in the in the DOS set to "60". The in the "[X-2] ICE-9, -<ARCV>- Made in England." "Hi I'am called X-2, get my right!" "Look out for the X-3 twins." [the DOS finding Ton all X-2 is in a hang. of X-2 are: X-1: An earlier of the X-2 , X-1 is a vof . . It wone . in the X. A hang qof 568 to 578 at the end of the a. The and in the DOS not be X-1 on March 5th of any year, at of an in the Mof the and a hang: ICE-9 Presents In Association The ARcV [X-1] Michelangelo -< TOMORROW >-" in the 4, and is not PZPAPN : Xpeh H: May, R: 4,016 4: PRhA - , VET, , NAV 2.1+, 6.00+, The Xpeh, or 4-B, in May, . Its . Xpeh is a of . ,and . , but not The the Xpeh at the top of #the &. It Nnot move 12's , as by the DOS ?by 4,032 (. The {1C and 21. the Xpeh , it for any reason. qof 4,016 at the end of the a. The =and in the DOS not be . No in the 4of Xpeh the Xpeh [frequent It is if Xpeh 7any damage potential. of Xpeh are: Xpeh-3600: on the Xpeh is 3,600 (. Like Xpeh, it hooks {1C and 21. Xpeh-3600 adds 3,600 to 3,615 (to the . ,and . be no 2to the =and in the DOS . No in the : Eastern Xpeh-3840: A 3,840 of the Xpeh , Xpeh-3840's is 4,080 (. Like members of the Xpeh group, hooks {1C and 21. ,and . qof 3,840 at the end of the a. The =and in the DOS not be Two in the "execombak" "lextxt" : Eastern Xpeh-4048: A 4,048 of the Xpeh , Xpeh-4048's at the top of , using 4K. Like members of the Xpeh group, hooks {1C and 21. ,and . qof 4,048 at the end of the a. The =and in the DOS not be in the kmay are : Eastern Xpeh-B: gequivalent to the Xpeh has one differs. May, PZPAPN : Xuxa H: March, j; TSR; order of music Argentina R: 1,413 4: PRsC - NAV 2.1+, The Xuxa in March, . It was ~in Argentina. Xuxa is a vof . . It Nnot The Xuxa is as a low TSR of 1,728 {1C and 21 nby Xuxa in the Xuxa , it qof 1,413 (. The at the !of the . The =and in the DOS not be . Two the 4in all ,MAND "$$TMP. the Xuxa may notice no longer be in position in the DOS towards the end of the E, or in the position where the entry for a the has recently The Xuxa play music between 5:00PM and 6:00PM. The tune is the theme song fthe children's TV show "El show de Xuxa" is broadcast in Argentina during period. of Xuxa are: Xuxa-1405: Gin Argentina in , Xuxa-1405 is a slightly smaller of the Xuxa . It adds 1,405 (to the end of . w. The at the `. Its TSR is 1,712 , and hooks {1C and 21. : Argentina Xuxa-B: to the Xuxa is a very minor : Argentina See: Anti-D PZPAPN : Yafo Mog, Macabi G: May, 0to 2-15-91 12:00a; R: 328 4: PNCK - , VET, 25.10+, The Yafo, or Mog, in May, . Its . Yafo is a vof . the Yafo X, the Yafo xall . in the E, it sall of the . `in the Mthe the host continue to "Maccabi Yafo Alufa !!!" the Yafo qof 328 at the end of the a. The =and in the DOS to 2-15-91 12:00a. The the is not in the as it is in the PZPAPN YAM-3599 : YAM-3599 Peni , 1993 ; graphic <seconds = 02 R: 3,599 4: PRhCK - V102+, V102+ The YAM-3599 or Peni , 1993. Its . YAM-3599 is a vof . bYAM-3599 X, the YAM-3599 at the top of #the &, hooking {09 and 21. , as rby the DOS ?by 3,616 |12's moved. the YAM-3599 , it qof 3,599 hide the it is The YAM-3599 at the end of `. The =and in the DOS to be un , or may not be listed, the having set the seconds field in the to "02". The in the 4in YAM-3599 "FUCK YOU ASSHOLE!" "[ Y A M ] 9 2" The third actually has closed ascii heart ) between the 3, instead of spaces. YAM-3599 Man indiscriminate graphic on the monitor. PZPAPN Yankee Doodle : Yankee Doodle TP44VIR, Five O'clock , 1989 , Austria j; melody @ 5 p.m. R: 2,885 or 2,899 4: PRsA - \, IBM , NAV, , VET, : CleanUp, \, NAV, or The Yankee Doodle ~by Alexander Holy of the North Atlantic Project in , Austria, on 30, 1989. It was 'shortly , where it is TP44VIR. is a wboth . ,and . `, and , it play Yankee Doodle on the speaker at 17:00. qd in 2,899 "disruptive by playing Yankee Doodle, Nnothing else harmful As a side note, of the Yankee Doodle out and modify Ping Pong es, changing them so self- destruct of Yankee Doodle are: TP33VIR: disables {1 and 3, thus interfering using debuggers to isolate it. The behavior of the play Yankee Doodle at 5PM. The second to the last `is the number", in the case of TP33VIR, it is 21h (decimal 33). TP34VIR: to TP33VIR, except , and X. The second to the last `is 22h. TP38VIR: to TP34VIR, except ,and . handled in a different way, and if it is loaded 4View active in . The second to the last 26h. TP38VIR was 1988, and is the oldest TP41VIR: to TP38VIR, except the second to the last `is 29h. TP42VIR: of Vacsina tests to determine if the the Ping Pong , and if it is, attempt to disable the Ping Pong by modifying it. The second to the last `is now 2Ah. TP44VIR: to TP42VIR, the second to the last `is 2Ch. TP45VIR: to TP44VIR, the second to the last `is 2Dh. TP46VIR: to TP45VIR, except can detect and kill the Cascade (1701) . The second to the last `is now 2Eh. Yankee Doodle-1905: on the TP44VIR listed by 30,464 it is . It hooks {1C and 21. , it and . qof 1,905 to 1,924 at the end of the a. The "Zak!" can dnear the end of all Yankee Doodle-2505: on the TP44VIR listed by 5,408 it is . It hooks {1C and 21. , it and . qof 2,505 to 2,524 at the end of the a. The =and in the DOS not be Yankee Doodle-2973: on the TP44VIR listed by 3,232 it is . It hooks {09, 13, and 21. , it ,and . qof 2,973 to 2,986 at the end of the a. The =and in the DOS not be Yankee Doodle-B: Very to the Yankee Doodle , except the of the 4is 2,772 YD Logon-D: , YD Logon-D is a 3,045 to 3,060 of the TP44VIR Its is 3,312 (, hooking {1C and 21. It ,and . 8the "LOGON. W" and "bbuG". May, YD Logon-E: on YD Logon-D, is a minor adding 3,045 to 3,060 (to the . are "LOGIN. and "bb". May, YD Logon-X: An TP44VIR , YD Logon-X is a 2,968 to 2,987 ,and . X. It may corrupt overlay `as well. Its is 3,232 hooking {09, 1C, 21, and 28. See: Vacsina PZPAPN Yankee 2 : Yankee 2 Yankee , Yankee-go-Home, 1961, Old Yankee Endangered , 1989 j; Yankee Doodle melody R: 1,961 4: PNE - , Virex PC, NAV, IBM , VET, The Yankee 2, or Yankee , was 'in 1989. Unlike the Yankee Doodle , the Yankee 2 is not . It `, adding 1,961 . The attempt to xan . ain the ever an X. If it is successful in locating an a, and Yankee Doodle be played on the speaker. mthe hex '6D6F746865726675636B6572' at the end. The Yankee 2 4View. of Yankee 2 are: 1624: to Yankee 2 in function, the major its effective is 1,624 See: Enigma PZPAPN : Yap G: March, j; TSR; "Bugs" may R: 6,258 4: PRsCK - , NAV, IBM , VET, The Yap Gin March, , in the Yap is a v. It The the Yap the as a low TSR of 11,344 {09 and 21 the Yap is , it are X. If X, it by 6,258 (. The at the end of The =and in the not be the Yap , if the holds down the ALT key, or presses the ALT key and an key in combination, numerous graphic "bugs" on the the contents of the M. Pressing the ALT key, or ALT key combination, again in the restored. Yap is an , using encryption very employed by the Cascade and its PZPAPN Year : Year R: 1,731 - 1,746 4: PRhA - , IBM , NAV 2.1+, The Year . Year vof . ,and . . It is destructive The Year X, the at the top of #the , as rby the DOS by 2,016 |12's moved. Year Year , it ,and . qof 1,731 to 1,746 at the end of the . The and in the DOS . Year is an , and no in the Year if the year of the . Upon , it the K, starting at side 0, cylinder 0, The Qtrack 8the !of the . The be able to din the Qtrack: "-- E.U.P.M. The be unrecoverable if the is not powered down immediately as the , root E, and quickly PZPAPN Youth : Youth Sweden R: 640 4: PRhCK - V99+, 6.00+, 2.43a+, V99+, The Youth . It is fSweden, of the is in German and French. Youth is a vof . The the Youth Youth at the top of #the , as rby the DOS ?by 1,792 {21 and 22 the the Youth , it qof 640 at the !of the a. The =and in the DOS not be . The can be in the 4in all "McAfee, geht nach Hause! Wir sind un berwindlich" "DemoralizedYouth vous a eu" The roughly translates fGerman and French to: "McAfee, go back Home! We are in control" "DemoralizedYouth got you" of Youth are: Futhark: on the Youth is 2,432 (, hooking |21. It X, adding 968 to 1,479 to the w. The the !of the a. The =and the DOS not be . The can be din all "[Futhark] by -:\) DEMORALIZED YOUTH (/:-" "Ni S Solu Sot Uk Ni Sakse Stain Skorin" : Sweden See: Silence PZPAPN Yukon : Yukon Divide Overflow Canada R: 151 4: ONCK - , IBM VET, NAV 2.1+, 1.53S+ The Yukon Canada. is a the Yukon X, the xall . in the mthe b151 (of the =and in the not be in the process of tall of the . `in the E, the fail a Divide Overflow can be easily identified because the Divide Overflow$ !at offset 87h in the the Yukon cannot be sas the portion by the is not stored. must be Ad and replaced copies. PZPAPN Zaphod : Zaphod England R: 399 4: PNCK - V100+, 6.04+, V100+ The Zaphod . Zaphod is a vof . +. It is fEngland. the Zaphod X, the Zaphod xthe in the E. It Nnot further down the the Zaphod qof 399 at the end of the a. The and in the DOS to the =and The Zaphod ^28th of any year. On Zof an in the "Greetings fZAPHOD." $the , the in the "Lu*. Zaphod Nn't do Mits PZPAPN Zaragosa : Zaragosa Caz-1159 R: 1,159 4: PRhAK - can, , VET, NAV 2.1+, The Zaragosa . Its . Zaragosa is a vof . ,and . +. It employs techniques. The the Zaragosa Xon a , the Zaragosa xthe copy of in the C: Oroot E. A hang %s the K, or a scopy of the Zaragosa at the top of #the |12's moved. rby the DOS 2,048 {21 and 2F the Zaragosa , it and . qof 1,159 the not be if the Zaragosa . The Zaragosa at the end of the . The =and in the DOS The can be in the Zaragosa "CLEAN." Zof the DOS Zaragosa in the utility indicating all Zaragosa It is if Zaragosa of Zaragosa are: Caz-1159: gequivalent to the Zaragosa has three differ. See: Caz PZPAPN Zero Bug : Zero Bug Palette, 1536, Zero Endangered , 1989 j(see ); TSR; graphics R: 1,536 4: PRsC - can, , NAV, IBM , VET, : CleanUp, \, or The Zero Bug ~in the by Jan Terpstra in , 1989. is a by 1,536 (, however the not show up the The 's main objective is to xthe copy of rby the en ment variable ,SPEC. If ,SPEC , the Zero Bug using INT 21h. has either , it xall . are accessed, pthose accessed by s such as COPY or XCOPY. Any acreated on an If the :ly loaded s, the hook into the |1Ch, and a certain amount of has past, a smiley face character ( eat all the zeros it can find on the . The `or format Ks in its present form. of Zero Bug are: Zero Bug B: to Zero Bug, the copy of ed to by the ,SPEC ment variable X. Zero Bug B are copied. The Zero Bug B ' TSR is 1,840 and hooks {21 and 60. PZPAPN ZeroHunt : ZeroHunt Minnow, , Zero-Hunt, Hunt Research Internal 1to . R: 416 4: PRCK - can, IBM \, NAV, , VET, The ZeroHunt, or Minnow, Paul Ferguson of Washington, DC. ZeroHunt is a is classified as a the ZeroHunt X, the in the ment area. It occupies and hooks a number of 21 by remapping. ZeroHunt is , it waits for a . ato be 7416 or more (of 00h 3usually are stack space in the and most converted to `. If the candi 7enough 00h 3, ZeroHunt xthe aby writing its over the b416 (of the 00h 3. ZeroHunt alters the bfour (of the newly Zits Like class es, ZeroHunt xthe on the fly, so cannot be detected in `if it is . Since internally by stack space, be no ZeroHunt carries no criteria at the present just of ZeroHunt are: ZeroHunt B: on the ZeroHunt in 1,408 (of reserved low . It hooks {21, 25, 26, and several s. It Xprovided a block of at least 411 binary zeros can be in the candi . If the block is the last 411 (of binary zeros in the block, and alter the bfour 3of the PZPAPN Zherkov : Zherkov Zherkov-1882, ZRK ; graphic (larger R: 1,882 - 1,896 4: PRtAK - , NAV 2.1+, VET, 3.93+, The Zherkov, or Zherkov-1882, , at its , are fthe . It is on the earlier Lozinsky . Zherkov is a ,and . The the Zherkov at the top of #the &, moving |12's , as rby the DOS ?by 4,096 and 21 nby Zherkov. If not the Zherkov , it qof 1,882 by 1,882 to 1,896 (. In both cases, the at the end of the . The =and in the DOS It is if Zherkov of Zherkov are: Zherkov-1958: Zherkov-1958 is a 1,958 of Zherkov. It adds 1,958 (to the . and 1,958 to 1,970 (to . it is , as rby the DOS ?by 5,360 |12's moved. {01, 1C, and 21 are nby Zherkov-1958 in Zherkov-2968: on Zherkov, adds 2,968 to the . w, and 2,968 to 2,982 (to . , as rby the DOS ?by 10,000 {01, 09, 1C, and 21 n, and |12's moved. Zherkov-2968 notice a graphic saying "Aidstest topaywka" Lon the monitor every few minutes while the hitting a key on the refresh the Mto its contents. Zherkov-2970: Very to Zherkov-2968, is two (larger. It adds 2,970 (to the . w, and 2,970 to 2,984 (to . Its usage of is the same as Zherkov-2968, and like Zherkov-2968, it Mthe graphic "Aidstest topaywka" every few minutes. See: Lozinsky PZPAPN ZK900 : ZK900 Pray, 900 ; music R: 900 4: PRhAK - \, NAV, IBM , VET, The ZK900 fDavid Chess of IBM. ZK900 is a ,and . v, and The ZK900 is X, the at the top of #the rby the DOS ?by 960 {1C and 21 n by the becoming , ZK900 ,and . X. If X, it by 900 at the end of the a. The =and in the not be by the "zx". ZK900 may [a tune "played every three to five minutes on the speaker. The tune is the children's rhyme "Pray for the dead, and the dead pray for you". of ZK900 are: ZK900-B: on the ZK900 Nn't play music three to five minutes becoming Interference the lower portion of the may 10 minutes . Seven (differ fthe PZPAPN : ZMT R: 262 4: PRCK - , VET, NAV 2.1+, The ZMT, ZMT-262, or 262, . Its . ZMT is a vof . The the ZMT the ZMT , hooking the ZMT , it qof 262 at the of the a. The =and in the DOS to the and . One can be din ZMT "ZMt93" the ZMT [frequent X, as well as , data be written to the %failures if the %the scopy of of ZMT are: ZMT-252: to ZMT, adds 252 (to the w. The =and in the DOS not be as a low TSR of 880 (, hooking {21 and F8. It allocates an block of 3,552 . One : "ZMt5". ZMT-365: to ZMT, adds 365 (to the w. The =and in the DOS The one is: "ZMt8". PZPAPN : Zoid R: 1,751 - 1,773 4: PRhE - 6.04+, \2.07+, V100+, V100+ The Zoid . Zoid is a vof . bZoid X, the Zoid at the top of but #the , as rby the DOS ?by 2,048 (. No be mapped to the Zoid the Zoid , it Xtwice in a row. qof 1,751 to 1,773 at the end of the a. The =and in the DOS not be . The in the 4in all Zoid "ZOID. It is what Zoid PZPAPN : Zu1 Hungary R: 473 4: PRhCK - , IBM , VET, 1.15a+, NAV 2.1+, The Zu1 . It is Hungary. is a vof . +. It Nn't to do The the Zu1 the Zu1 at the top of #the |12's moved. , as rby the DOS by 3,008 nby the Zu1 the Zu1 , it over X. If X, it the Zu1 of 473 (. The at the end of the . The =and in the DOS The "Zu1" can be in the 4in all Zu1 See: Hungarian 482 PZPAPN : ZY Austria R: 463 - 924 4: PNCK - , IBM VET, 1.15a+, 6.00+, 3.93+, The ZY ~in Austria in . ZY is a non- vof . the ZY xone the usually by 463 at the of the a. The exception is if the was smaller (, the be 926 (. The =and in the DOS not be . The can be in the 4in ZY "*.com * \ \ XSYS" ZY may kusually s, or if the Xa very small PZPAPN : ZZ G: May, R: 429 4: PNCK - 6.00+, 25.10+, The ZZ . Its . ZZ is a of . ZZ is X, the ZZ xall of the . in the E, it the ZZ of 429 (. The at the !of the a. The =and in the DOS to the =and are no in the It is Nn't 8any destructive Mthe "ZZ Top the best !!!" PZPAPN A word fPatricia... The ySummary List in Hyper Copyright (C) -1993 by Patricia M. Hoffman. All Rights Reserved. The ySummary List, , represents the cumulative knowledge produced by an ongoing research effort in the detection, identification, and removal of MS-DOS It help you understand what a specific N, how it , how it affects your , and more important, how to get rid of it! The is accurate on the day of release; however, its accuracy degrades rapidly by an amount proportional to the elapsed since release. Due to the extensive number of researchers and because a often end up s, a release might short-lived flaws. a new of a documented not necessarily characteristics identical to those of the sample was analyzed. products mentioned in Hyper shareware or commercial by the vendor or an party for ning Product a "no attached" evaluation. Products /by the 10th of the month are guaranteed of inclusion in the :month's release of Hyper Products the 10th of the month may be included in the :month's release, but due to timing, may not until the cmonth's release. As of the release of Hyper certified products mdetection and/or removal yincluded. yon the ning Product can be din the /s sub-menu off of the main menu. menu includes selections for s for Qmonth's Hyper release, as well as vendor contact yfor those vendors whose products participated in the ning Product All product testing is conducted most recent of the software provided. All testing is performed against actual live es non- . My observed s might differ fthose s obtained a different set of es and A special ks goes to John McAfee for the countless hours he has spent reviewing prior to its release, and to the numerous s who moffered invaluable support, comments, and suggestions all, enhance the quality of Patricia M. Hoffman Telephone: 1-408-988-3773 3 Bowers Ave Suite 130 Fax: 1-408-988-2438 Santa Clara, CA 95054 Data: 1-408-244-0813 (HST) USA CompuServe: 75300,3005 PZPAPN Hyper Viewer Help Function Keys instructions Go To Main Menu Index Search for Shifted: Repeat Print :Topic Credits Color settings Last 20 Topics Open Exit Cursor Motion Keys Arrow keys move the cursor hyperlink to hyperlink. On long topics, scroll the SPEED KEY Press any alphabetic character key to move the cursor to the b(or next) hyperlink begins letter. Home PgUp Home and End go to top and bottom. PageUp and PageDown move through Enter the PgDn the link at the cursor. To retrace your steps, press Using a Mouse LEFT button SELECTS RIGHT button GOES BACK hyperlink or option. or CANCELS operation. Click for up one line F1:Help F2:Home Esc:GoBack Click for up one You may click the button bar or press the associated key. Drag up and down Click for down one Click for down one line Dragging the mouse in the area scrolls the End of Instructions Press Esc to to the Previous Topic PZPAPN Using 5Key Summary Frequently Used Keys: + : Next Topic/Page in Database Sequence - : Previous Topic/Page in Database Sequence ESC : Goback to last viewed Topic/Page : Move to next hyperlink to the right : Move to next hyperlink to the left : Move up one hyperlink : Move down one hyperlink TAB : Move to next hyperlink (moves across page, down) Function Keys: F1 - Hyper Viewer Help F6 - Credits F2 - Go To Main Menu F7 - Color Settings F3 - Index by F8 - Last 20 Topics Viewed F4 - Perform ASCII Search F9 - Open a/Database Shift+F4 - Repeat Last Search F10 - Exit Hyper F5 - Print :Topic General Menu Bar Keys: ALT+F - aMenu ALT+C - Configuration Menu ALT+F,P - Print :topic ALT+C,C - Set Colors ALT+F,X - Exit Hyper ALT+C,W - Set Window ( ALT+C,O - Set Options ALT+G - Goto Menu ALT+C,S - Save Setup ALT+G,B - Backtrack or GoBack ALT+G,H - Last 20 topics viewed ALT+H,U - Viewer Help ALT+G,M - Bookmarks ALT+H,A - Credits / ALT+G,N - MNext Topic Author ALT+G,P - MPrevious Topic ALT+G,S - Perform Topic Search ALT+G,F - Perform Search ALT+G,S - Repeat Last Search Sections Menu Bar Keys: ALT+V,W - A Word fPatricia... ALT+V,I - Index / ALT+V,U - Licensing ALT+V,N - ALT+V,A - Authorized Agents ALT+V,T - ALT+V,C - /Data & Info ALT+V,L - ALT+V,R - Revision History ALT+V,O - ALT+V,S - ALT+V,P - Relationship Charts ALT+V,E - Entry Fields ALT+V,D - ALT+V,M - McAfee PZPAPN Cross-Reference PZPAPN Appendices Appendices Cross-Reference Entry Fields Cross-Reference Cross-Reference PZPAPN -XRef Select Effective Range: 0 thru 499 500 thru 999 1000 thru 1999 2000 thru 3999 4000 and over PZPAPN The determined to be " ureports by various organizations track 1024 SBC Flip Plastique 1575 FORM- Possessed 4096 Haifa Print 5120 Internal R-11 AirCop Invader Scream 2-696 Alameda Invol Slayer Anti-Tel Slow Azusa Joshi StarDot 600 Bloody! Keypress Sticky Brain Lehigh Cansu Liberty Sunday Cascade Loa Duong SVC 5.0 Curse Maltese Amoeba SVC 6.0 Michelangelo Swiss Phoenix DataLock Microbes Taiwan 3 Den Zuk Mummy 2.1 Taiwan 4 Dir-2 MusicBug Telecom KKiller NoInt Dutch 555 Nomenklatura Tequila NPox V2000 Evil Empire Ontario V2100 Exebug Perfume Vacsina Fellowship Ping Pong Fich 2 Yankee Doodle PZPAPN ning Product Vendor NLM /Info X9303 X9207 X9302 X9206 X9301 X9205 X9212 X9204 X9211 X9203 X9210 X9202 X9209 X9201 X9208 PZPAPN ning Product Companies, organizations, and individuals :ly using or evaluating detection software today face the problem is no standardized, documented test suite of es used by all vendors to determine the number of and are detected by products. While a few libraries of es exist today, are not generally for evaluation. Even a company or organization undertakes the task of evaluating detection software in- house, run the risk of the live es accidently released. The Library researched and fully documented for the ySummary List (Hyper ) has be in existence for over three years. The count of es plus rat the top of the revision history section for the . All in the Library are true spread to execu components of the no trojans joke , or "wanna be" es included in the library. The Library is constantly es and Many of the es included in the Library are or research es. In order to prevent a possible leak of es into the public domain, the Library used for /is not distributed to vendors or organizations, companies, or individuals. Any for the Library can be ear-marked as /set" insure never be redistributed to vendors or individuals. Access to the library, either for a demonstration of the es or for vendors wishing to work on detecting a in the collection is on a scheduled, billed machine hourly basis in Santa Clara, California. All such access monitored and require a signed agreement indicating not be transfered to Iand removed fthe premises. The ning Product /is an objective evaluation of how well a ning product detected the es included in the library as of a particular release of Hyper and the certified product release. Nnot consider product features cannot be objectively evaluated, such as the look and feel of the interface. library indicate the number of es and detected by the certified product. Since many es require multiple ssamples to determine if it is accurately detected, /is not on the number of `detected, would be meaningless and skewed, but the actual number of es and detected. is given equal weight. A copy of the testing protocol used for the /s is on request. A ning Product /may be quoted by vendors who mrequested /for a release of product. give product s a reliable indication of how well the product detected es included in the documented Library. Organizations and companies can use the to evaluate ning products. In the case of several products for evaluation at the same comparison be produced comparing the detection capabilities of the ning products by ning Product /is priced at $500 US per product release and library . Dis /for es is for an $500 US, and be performed on the companion product or dis umodules of a product release :ly or ning Product /. The client is expected to provide an evaluation copy of the product "certified. In order to be able to answer any follow-up questions, and to avoid any problems in the unlikely event the software s, the evaluation copy of the software not be ed at the end of the For further yon the ning Product , contact: Patricia M. Hoffman Tel: 1 (408) 988-3773 3 Bowers Avenue Suite 130 Fax: 1 (408) 988-2438 Santa Clara, CA 95054 PZPAPN /Info ning NLM /Service Info Companies, organizations, and individuals :ly using or evaluating detection software today face the problem is no standardized, documented test suite of es used by all vendors to determine the number of and are detected by products. While a few libraries of es exist today, are not generally for evaluation. Even a company or organization undertakes the task of evaluating detection software in- house, run the risk of the live es accidently released. NLM (Novell Load Module) products, exposure qs since the es typically be required to reside on one of the aserver's volumes. The Library researched and fully documented for the ySummary List (Hyper ) has be in existence for over three years. The count of es plus rat the top of the revision history section for the . All in the Library are true spread to execu components of the no trojans, joke , or "wanna be" es included in the library. The Library is constantly as new es and , and the new researched. Many of the es included in the Library are or research es. In order to prevent a possible leak of es into the public domain, the Library used for /is not distributed to vendors or organizations, companies, or individuals. Any for the Library can be ear-marked as /set" insure never be redistributed to vendors or individuals. Anyone may submit es for library. are tested and documented before actual addition to the library. Access to the library, either for a demonstration of the es or for vendors wishing to work on detecting a in the collection, is on a scheduled, billed machine hourly basis in Santa Clara, California. All such access monitored and require a signed agreement indicating not be transfered to Iand/or laptop computers be removed fthe premises. The ning NLM /Service is an objective evaluation of how well a ning NLM detected the es included in the library as of a particular release of Hyper and the certified NLM release. The certificating party receives a /form at completion of the testing. The s are included in the /Section of Hyper library be the number of es and detected by the certified product. Note is not on the number of `detected, but rather the number of unique were detected. excluded /s as es do not xthe or of a Novell Netware386 server operating under normal conditions. A copy of the NLM testing protocol used for ning NLM /s is on request. A ning NLM /may be quoted by anti- vendors who mrequested /for a release of product. give product reliable indication of how well the product detected included in the documented Library. Organizations and companies can use the to evaluate ning NLM products. In the case of several products for evaluation at the same comparison be produced on special request comparing the products certified by the client. ning NLM /is priced at $1,000 US per product release. Dis /, and custom testing services, on special arrangement, price depending on the client's requirements for the /. The client is expected to provide an evaluation copy of the NLM product "evaluated. software not be ed in order to avoid any problem in the unlikely event it s, or is required to answer future questions relating to the software or its documentation. For further yon the ning NLM , or for a copy of the testing protocol, please contact: Patricia M. Hoffman Tel: 1 (408) 988-3773 3 Bowers Avenue Suite 130 Fax: 1 (408) 988-2438 Santa Clara, CA 95054 PZPAPN Vendor Anti- Vendor Central Software Tel: 1 (503) 690-8080 15229 NW Greenbrier Pkwy, Ste 200 Fax: 1 (503) 690-7133 Beaverton, OR 97006 BBS: 1 (503) 690-6650 $ Product: .NLM Certus International See: Symantec ( 6896 W. Snowville Road Product: Brecksville, OH 44141 Commcrypt, Inc. Tel: 1 (301) 470-2500 0 Virginia Manor Dr. Ste 300 Product: Detect Plus Beltsville, MD 20705 Comrac ! Tel: +31 2503-21388 Postbus 710 Fax: +31 2503-21102 2130 AS Hoofddorp BBS: +31 3200-48835 The Product: Gobbler II Cybec Pty Ltd. Tel: +03 521-0655 3/350 Hampton St. Fax: +03 521-0727 Hampton. 3188 Victoria Product: VET Australia Fifth Generation Tel: 1 (504) 291-7221 P. O. Box 83560 Fax: 1 (504) 295-3268 Baton Rouge, LA 70884-3560 Product: Untouchable Frisk Software International Fax: +354-1-28801 Postholf 7180 Product: IS-127 Reykjavik Iceland I. B. M. Product: IBM [Contact your local marketting branch] ning Intel PCED Tel: 1 (800) 538-3373 5200 N.E. Elam Young Pkwy or: 1 (801) 379-2200 Hillsboro, OR 97124 Fax: 1 (908) 530-0622 $ Product: LanProtect }Software Tel: +972-3-5715319 6 Hamavo St. Fax: +972-3-318731 Givataim 53303 Product: Anti- ISRAEL Leprechaun Software International Ltd. Tel: 1 (404) 971-8818 P. O. Box 669306 Fax: 1 (404) 971-8828 Marietta, GA 30066-0106 BBS: 1 (404) 971-8886 $ Product: Buster Logidisque Inc. Tel: 1 (514) 933-2225 C.P. 10, succ. D Fax: 1 (514) 933- Montreal Qc H3K 3B9 Product: Softech Dr CANADA McAfee Associates Tel: 1 (408) 988-3832 3350 Scott Blvd, Building 14 Fax: 1 (408) 970-9727 Santa Clara, CA 95054 BBS: 1 (408) 988-4004 $ Product: 5 NetShield Microcom Inc. Tel: 1 (919) 490-1277 P. O. Box 51489 Product: Durham, NC 27717 Tel: 1 (302) 764-4722 801 Wilson Road Product: Wilmington, DE 19803 RG Software Tel: 1 (602) 423-8000 6900 East Camelback Rd, Suite 630 Product: Scottsdale, AZ 85251 S&S International Tel: +44 (0442) 877877 Berkley Court Fax: +44 (0442) 877882 Mill Street Product: Dr. Solomon's Berkhamsted, Hertfordshire HP4 2HB Anti- Toolkit England Safetynet, Inc. Tel: 1 (908) 851-0188 14 Tower Fax: 1 (908) 276-6575 East Hanover, NJ 07936-3220 Product: Sophos Ltd. Tel: +44 (0235) 559933 21 The Quadrant Fax: +44 (0235) 559935 Abingdon, OX14 3YS Product: England For Netware Symantec Peter Norton Group Tel: 1 (310) 449-4900 2500 Broadway #200 Fax: 1 (310) 453-0636 Santa Monica, CA 90404 Product: NAV Micro Devices Inc. Tel: 1 (310) 782-8190 2421 W. 205th Street Ste D-100 Fax: 1 (310) 328-5892 Torrance, CA 90501 Product: PC XTree Company Tel: 1 (805) 541-0604 4330 Santa Fe Road Fax: 1 (805) 541-8053 San Luis Obispo, CA 93401 BBS: 1 (805) 546-9150 $ Product: PZPAPN X9303 Library : X303 =: Mar 23, 1993 es: 1,956 es: 1,866 es: 90 Certified 1st es Detected - Tot Product Cert DOS ning Products: Central Anti- 1.4 X211 1,195 68 1,127 61.1 Dr. Solomon's X302 1,729 85 1,644 88.4 Fifth Gen Sys. Untouch 25.10 X212 1,297 66 1,231 66.3 Frisk Software's \2.07 X302 1,774 86 1,688 90.7 IBM Anti- /DOS 1.0 X211 1,456 72 1,384 74.4 McAfee Assoc. V102 X303 1,870 89 1,781 95.6 Norton Anti- 2.1.4 X302 1,272 71 1,201 65.0 RG Software's X302 1,349 68 1,281 69.0 Sophos' X302 1,630 67 1,563 83.3 NLM Anti- Products: Central AV/NLM 1.0 X211 1,084 N/A 1,084 58.1 Intel's LanProtect 1.53+1/93S X302 1,131 N/A 1,131 60.6 McAfee NetShield 1.11V102 X303 1,713 N/A 1,713 91.8 Note: NLM Anti- Products are not certified for not normally setup Novell Netware386 server. The es Detected , and the calculated using the number of es included in the Library as of the release. The "1st Cert" column indicates the Number the Anti- Product bcertified. It is rto show the age of the certified PZPAPN X9302 Library : X302 =: Feb 23, 1993 es: 1,894 es: 1,804 es: 90 Certified 1st es Detected - Tot Product Cert DOS ning Products: Central Anti- 1.4 X211 1,189 68 1,121 62.8 Certus Int'l 1.15a X210 1,204 72 1,132 63.6 Dr. Solomon's X302 1,713 85 1,628 90.4 Fifth Gen Sys. Untouch 25.10 X212 1,295 66 1,229 68.4 Frisk Software's \2.07 X302 1,750 86 1,664 92.4 IBM Anti- /DOS 1.0 X211 1,452 72 1,380 76.7 McAfee Assoc. V100 X302 1,820 89 1,731 96.1 Norton Anti- 2.1.4 X302 1,266 71 1,195 66.8 RG Software's X302 1,343 68 1,275 70.9 Sophos' X302 1,617 67 1,550 85.4 Micro Devices PC X208 1,027 57 970 54.2 NLM Anti- Products: Central AV/NLM 1.0 X211 1,079 N/A 1,079 59.8 Intel's LanProtect 1.53+1/93S X302 1,129 N/A 1,129 62.6 McAfee NetShield 1.10V100 X302 1,665 N/A 1,665 92.3 Sophos' NLM 2.44 X212 1,474 N/A 1,474 81.7 Note: NLM Anti- Products are not certified for not normally setup Novell Netware386 server. The es Detected , and the calculated using the number of es included in the Library as of the release. The "1st Cert" column indicates the Number the Anti- Product bcertified. It is rto show the age of the certified PZPAPN X9301 006 0 0PT6 Library : X301 =: Jan 20, 1993 es: 1,836 es: 1,746 es: 90 Certified 1st es Detected - Tot Product Cert DOS ning Products: Central Anti- 1.4 X211 1,184 68 1,116 64.5 Certus Int'l 1.15a X210 1,198 72 1,126 65.3 Commcrypt's Detect Plus 3.1B X210 907 64 843 49.4 Cybec's VET 7.04 X209 1,183 68 1,115 64.4 Dr. Solomon's X211 1,532 83 1,449 83.4 Fifth Gen Sys. Untouch 25.10 X212 1,290 66 1,224 70.3 Frisk Software's \2.05 X209 1,515 76 1,439 82.5 IBM Anti- /DOS 1.0 X211 1,444 72 1,372 78.7 }Anti- + 4.20.01 X208 1,117 60 1,057 60.8 Leprechaun's Buster 3.93 X211 1,340 69 1,271 73.0 McAfee Assoc. X211 1,653 89 1,564 90.0 Norton Anti- 2.1.2 X212 1,221 62 1,159 66.5 Safetynet's Net 2.04c X208 1,449 76 1,373 78.9 Sophos' 2.43a X211 1,538 66 1,472 83.8 Micro Devices PC X208 1,024 57 967 55.8 NLM Anti- Products: Central AV/NLM 1.0 X211 1,074 N/A 1,074 61.5 Intel's LanProtect 1.5 X209 935 N/A 935 53.6 McAfee NetShield 1.03V99 X211 1,520 N/A 1,520 87.1 Sophos' NLM 2.44 X212 1,465 N/A 1,465 83.9 Note: NLM Anti- Products are not certified for not normally setup Novell Netware386 server. The es Detected , and the calculated using the number of es included in the Library as of the release. The "1st Cert" column indicates the Number the Anti- Product bcertified. It is rto show the age of the certified PZPAPN X9212 Library : X212 =: Dec 20, es: 1,725 es: 1,635 es: 90 Certified es Detected Product DOS ning Products: Central Anti- 1.4 1,172 68 1,104 67.9 Certus Int'l 1.15a 1,185 72 1,113 68.7 Commcrypt's Detect Plus 3.1B 896 64 832 51.9 Cybec's VET 7.04 1,169 68 1,101 67.8 Dr. Solomon's 1,465 83 1,382 84.9 Fifth Gen Sys. Untouch 25.10 1,271 66 1,205 73.7 Frisk Software's \2.05 1,471 76 1,395 85.3 IBM Anti- /DOS 1.0 1,391 72 1,319 80.6 }Anti- + 4.20.01 1,106 60 1,046 64.1 Leprechaun's Buster 3.93 1,318 69 1,249 76.4 McAfee Assoc. 1,625 89 1,536 94.2 Norton Anti- 2.1.2 1,208 62 1,146 70.0 Pro 4.05 1,227 72 1,155 71.1 Safetynet's Net 2.04c 1,412 76 1,336 81.9 Softech's Dr 245 58 187 14.2 Sophos' 2.43a 1,468 66 1,402 85.1 Micro Devices PC 1,014 57 957 58.8 XTree's 982 58 924 56.9 XTree's 982 58 924 56.9 NLM Anti- Products: Central AV/NLM 1.0 1,061 N/A 1,061 64.9 Intel's LanProtect 1.5 925 N/A 925 56.6 McAfee NetShield 1.03V99 1,493 N/A 1,493 91.3 Sophos' NLM 2.44 1,395 N/A 1,395 85.3 = Dr was certified the release of the release of , using the Library. The documentation for product is in French. options and 5s were translated to English equivalents in order to perform the documentation was not translated, and was not reviewed. Note: NLM Anti- Products are not certified for not normally setup Novell Netware386 server. The es Detected , and the calculated using the number of es included in the Library as of the release. PZPAPN X9211 Library : X211 =: Nov 23, es: 1,640 es: 1,550 es: 90 Certified es Detected Product DOS ning Products: Central Anti- 1.4 1,153 68 1,085 70.3 Certus Int'l 1.15a 1,175 72 1,103 71.7 Commcrypt's Detect Plus 3.1B 879 64 815 53.6 Cybec's VET 7.04 1,143 68 1,075 69.7 Dr. Solomon's 1,433 83 1,350 87.4 Fifth Gen Sys. Untouchable 24 1,187 69 1,118 72.4 Frisk Software's \2.05 1,428 76 1,352 87.1 IBM Anti- /DOS 1.0 1,361 72 1,289 83.0 }Anti- + 4.20.01 1,094 60 1,034 66.7 Leprechaun's Buster 3.93 1,293 69 1,224 78.8 McAfee Assoc. 1,591 89 1,502 97.0 Norton Anti- 1,161 62 1,099 70.8 Pro 4.05 1,211 72 1,139 73.8 Safetynet's Net 2.04c 1,377 76 1,301 84.0 Sophos' 2.43a 1,433 66 1,367 87.4 Micro Devices PC 994 57 937 60.6 XTree's 960 58 902 58.5 XTree's 960 58 902 58.5 NLM Anti- Products: Central AV/NLM 1.0 1,041 N/A 1,041 67.2 Intel's LanProtect 1.5 905 N/A 905 60.0 McAfee NetShield 1.03V99 1,460 N/A 1,460 94.2 Note: NLM Anti- Products are not certified for not normally setup Novell Netware386 server. The es Detected , and the calculated using the number of es included in the Library as of the release. PZPAPN X9210 003 2 0PT3 Library : X210 =: Oct 23, es: 1,509 es: 1,426 es: 83 Certified es Detected Product DOS ning Products: Central Anti- 1.3 1,014 63 951 67.2 Certus Int'l 1.15a 1,131 69 1,062 75.0 Commcrypt's Detect Plus 3.1B 842 63 779 55.8 Cybec's VET 7.04 1,105 66 1,039 73.2 Dr. Solomon's 1,228 76 1,152 81.4 Fifth Gen Sys. Untouchable 24 1,153 67 1,086 76.4 Frisk Software's \2.05 1,362 72 1,290 90.3 }Anti- + 4.20.01 1,074 59 1,015 71.2 Leprechaun's Buster 3.92 1,168 65 1,103 77.4 McAfee Assoc. 1,455 82 1,373 96.4 MicroCom's 885 59 826 58.7 Norton Anti- 1,134 60 1,074 75.2 Pro 4.05 1,185 71 1,114 78.5 Safetynet's Net 2.04c 1,320 72 1,248 87.5 Sophos' 1,268 61 1,207 84.0 Micro Devices PC 967 56 911 64.1 XTree's 931 57 874 61.7 XTree's 931 57 874 61.7 NLM Anti- Products: Intel's LanProtect 1.5 905 N/A 905 63.5 McAfee NetShield 1.03V95 1,267 N/A 1,267 88.9 McAfee NetShield 1.03V97 1,333 N/A 1,332 93.5 /performed the release of the release of , but using the library. Note: NLM Anti- Products are not certified for not normally setup Novell Netware386 server. The es Detected , and the calculated using the number of es included in the Library as of the release. PZPAPN X9209 Library : X209 =: Sep 25, es: 1,405 es: 1,324 es: 81 Certified es Detected Product DOS ning Products: Central Anti- 1.3 996 62 934 70.9 Certus Int'l 1,060 68 992 75.4 Cybec's VET 7.04 1,074 65 1,009 76.4 Dr. Solomon's 1,213 74 1,139 86.3 Fifth Gen Sys. Untouchable 24 1,127 66 1,061 80.2 Frisk Software's \2.05 1,312 72 1,240 93.4 IBM's ner 2.1.9 893 59 834 63.6 }Anti- + 4.20.01 1,059 58 1,001 75.4 Leprechaun's Buster 3.92 1,140 64 1,076 81.1 McAfee Assoc. 1,354 79 1,275 96.4 MicroCom's 868 59 809 61.8 Norton Anti- 634 55 579 45.1 06/01/92 upd. 753 55 698 53.6 Pro 4.05 1,168 69 1,099 83.1 Safetynet's Net 2.04c 1,278 72 1,206 91.0 Sophos' 1,225 61 1,164 87.2 Micro Devices PC 961 56 905 68.4 XTree's 915 57 858 65.1 XTree's 915 57 858 65.1 NLM Anti- Products: Intel's LanProtect 1.5 898 N/A 898 67.8 McAfee NetShield 1.03V95 1,240 N/A 1,240 93.7 Note: NLM Anti- Products are not certified for not normally setup Novell Netware386 server. The es Detected , and the calculated using the number of es included in the Library as of the release. PZPAPN X9208 Library : X208 =: Aug 24, es: 1,342 es: 1,261 es: 81 Certified es Detected Product Central Anti- 1.3 986 62 924 73.5 Certus Int'l 1,049 68 981 78.2 Comrac's Gobbler 2 3.00(b) 720 47 673 53.7 Dr. Solomon's 1,201 74 1,127 89.6 Fifth Gen Sys. Untouchable 22 873 57 816 65.1 Frisk Software's \2.03B 1,179 70 1,109 87.9 IBM's ner 2.1.9 884 59 825 65.9 }Anti- + 4.20.01 1,051 58 993 78.3 Leprechaun's Buster 3.92 1,134 64 1,070 84.5 McAfee Assoc. 1,317 79 1,238 98.1 MicroCom's 862 59 803 64.2 Norton Anti- 631 55 576 47.0 06/01/92 upd. 750 55 695 55.9 Pro 4.05 1,157 69 1,088 86.2 Safetynet's Net 2.04c 1,236 72 1,164 92.1 Sophos' 1,170 60 1,110 87.2 Micro Devices PC 950 56 894 70.8 XTree's 904 57 847 67.4 XTree's 904 57 847 67.4 PZPAPN X9207 Library : X207 =: Jul 22, es: 1,273 es: 1,197 es: 76 Certified es Detected Product Central Anti- 1.3 971 60 911 76.3 Certus Int'l 1,037 67 970 81.5 Comrac's Gobbler 2 3.00(b) 713 46 667 56.0 Dr. Solomon's 1,094 65 1,029 85.9 Fifth Gen Sys. Untouchable 22 863 56 807 67.8 Frisk Software's \2.03B 1,150 69 1,081 90.3 IBM's ner 2.1.9 868 58 810 68.2 Leprechaun's Buster 3.86 860 60 800 67.6 McAfee Assoc. 1,172 74 1,098 92.1 MicroCom's 854 58 796 67.1 Norton Anti- 627 54 573 49.3 06/01/92 upd. 745 54 691 58.5 Sophos' 1,016 57 959 79.8 XTree's 888 56 832 69.8 XTree's 888 56 832 69.8 PZPAPN X9206 Library : X206 =: Jun 16, es: 1,212 es: 1,140 es: 72 Certified es Detected Product Central Anti- 1.2 750 57 693 61.9 Certus Int'l 1,024 65 959 84.5 Comrac's Gobbler 2.20 643 43 600 53.1 Dr. Solomon's 1,084 64 1,020 89.4 Fifth Gen Sys. Untouchable 22 856 55 801 70.6 Frisk Software's \2.03B 1,123 67 1,056 92.7 IBM's ner 2.1.9 857 57 800 70.7 Leprechaun's Buster 3.86 854 59 795 70.5 McAfee Assoc. 1,158 71 1,087 95.5 MicroCom's 847 57 790 70.0 Norton Anti- 624 54 570 51.5 Sophos' 1,008 56 952 83.2 XTree's 883 55 828 72.9 XTree's 883 55 828 72.9 PZPAPN X9205 Library : X205 =: May 22, es: 1,145 es: 1,078 es: 67 Certified es Detected Product Central Anti- 1.2 742 56 686 64.8 Certus Int'l 1,007 63 944 88.0 Comrac's Gobbler 2.20 639 42 597 55.8 Dr. Solomon's 891 58 833 77.8 Fifth Gen Sys. Untouchable 22 846 54 792 73.9 Frisk Software's \2.03 1,014 60 954 88.6 IBM's ner 2.1.9 841 55 786 73.5 Leprechaun's Buster 3.86 845 58 787 73.8 McAfee Assoc. 1,049 67 982 91.6 MicroCom's 837 56 781 73.1 Norton Anti- 620 53 567 54.2 Sophos' 994 55 939 86.8 XTree's 872 53 819 76.2 XTree's 872 53 819 76.2 PZPAPN X9204 Library : X204 =: Apr 24, es: 1,080 es: 1,019 es: 61 Certified es Detected Product Central Anti- 1.2 725 51 674 67.1 Certus Int'l 905 52 853 83.8 Comrac's Gobbler 2.20 627 37 590 58.1 Dr. Solomon's 870 52 818 80.6 Fifth Gen Sys. Untouchable 485 44 441 44.9 Frisk Software's \2.03 986 54 932 91.3 IBM's ner 2.1.9 818 50 768 75.7 Leprechaun's Buster 3.86 825 52 773 76.4 McAfee Assoc. 1,027 61 966 95.1 MicroCom's 822 53 769 76.1 Norton Anti- 609 49 560 56.4 Sophos' 964 52 912 89.3 XTree's 852 49 803 78.9 XTree's 852 49 803 78.9 PZPAPN X9203 Library : X203 =: Mar 27, es: 1,021 es: 960 es: 61 Certified es Detected Product Central Anti- 1.2 713 51 662 69.8 Certus Int'l 835 47 788 81.8 Comrac's Gobbler 2.20 619 37 582 60.6 Dr. Solomon's 855 52 803 83.7 Fifth Gen Sys. Untouchable 474 44 430 46.4 IBM's ner 2.1.9 800 50 750 78.4 Leprechaun's Buster 3.86 810 52 758 79.3 McAfee Assoc. V86B 917 59 858 89.8 McAfee Assoc. 1,002 61 941 98.1 MicroCom's 810 53 757 79.3 Norton Anti- 601 49 552 58.9 Sophos' 880 52 828 86.2 XTree's 838 49 789 82.1 XTree's 838 49 789 82.1 PZPAPN X9202 Library : X202 =: Feb 22, es: 971 es: 912 es: 59 Certified es Detected Product Central Anti- 626 50 576 64.5 Certus Int'l 1.0.1 700 47 653 72.1 Dr. Solomon's , 5.52A 776 52 724 79.9 Fifth Gen Sys. Untouchable 472 44 428 48.6 McAfee Assoc. V86B 914 59 855 94.1 MicroCom's 805 53 752 82.9 Norton Anti- 598 49 549 61.6 Sophos' 2.3.1 765 52 713 78.8 PZPAPN X9201 Library : X201 =: Jan 22, es: 880 es: 821 es: 59 Certified es Detected Product Central Anti- 432 42 390 49.1 Certus Int'l 1.0.1 684 47 637 77.7 Dr. Solomon's , 5.52A 750 52 698 85.2 Fifth Gen Sys. Untouchable 458 44 414 52.1 McAfee Assoc. V85 812 59 753 92.3 Norton Anti- 462 44 418 52.5 Sophos' 2.3.1 739 52 687 84.0 PZPAPN X9112 Library : X112 =: Dec 22, es: 817 es: 759 es: 58 Certified es Detected Product Central Anti- 427 42 385 52.3 Certus Int'l 1.0.1 665 46 619 81.4 McAfee Assoc. V85 786 58 728 96.2 Norton Anti- 449 44 405 55.0 Sophos' 2.3.1 704 51 653 86.2 PZPAPN =/Day of Week Sundays (any) Mindless + Sunday + Sunday-2 + Wit Sundays 9th (Apr - Dec) Doctor Qumak 2 Mondays (any) Carfield + I-B (BadGuy) + I-B (BadGuy 2) + I-B (Exterminator) + Kalah (Kalah-499) + Wit Mondays (starting in 1993) VirDem (VirDem-833) Monday bof Month Beware Mondays The 28ths Crazy Eddie Tuesdays (any) + I-B (Demon) + I-B (Demon-B) + Murphy (Kamasya) Tuesday The 1st (JVT1) Tuesday The 13th (Anarkia) Wednesdays (any) PS-MPC (No Wednesday) + Victor Thursdays (any) TPE (Girafe) Thursday The 12ths Fridays (any) Bryansk + Frere Jacques + PS-MPC (Mimic-Den Zuk) + PS-MPC (Mimic- + Murphy (Smack) + NaziPhobia + TalkingHeads + VCL (Diarrhea) + Wild Thing 2 Friday Not The 13ths (Payday) Friday The 11ths VCL (Kinison) Friday The 13ths 1720 + Friday 13th + RAM + Suriv 3.00 + Westwood + Wit Friday The 13ths (starting in ) Hybryd Fridays 15th of Month (Skism) (Skism-1) Fridays Last of Month (Sub-Zero B) Saturdays (any) Murphy (Finger) (Phenome) + Murphy (Migram) Saturday The 14ths Saturday The 14TH 1st day of any month 10 Past 3 2nd day of any month Flip + Tormentor (Nuke) 5th day of any month Frogs 8th day of any month Taiwan 10th day of any month Day10 13th day of any month NPox (NPox 2.1) + Monxla + Rocko 16th day of any month 10 Past 3 18th day of any month NPox + FORM- (Form-18) 20th day of any month Day10 22nd day of any month 10 Past 3 + VCL (Beva 32) 24th day of any month FORM- + Rocko (Mutating Rocko) 29th day of any month 10 Past 3 + Geek + Highlander 30th day of any month Day10 31st day of any month Tormentor (Lixo Nuke) + VCL (Diogenes) VCL (Beva 33) Plastique (COBOL) Barrotes + Joshi Casino 25TH) ^1st - ^29th (Beta Boys) ; (Amilia) + Marauder ^23rd Swedish Boys (Why Windows) ^24th Swedish Boys (Why Windows) ^25th Swedish Boys (Why Windows) ^28th Zaphod March 1st - March 31st Fich + Micropox March 5th X-2 (X-1) March 6th Michelangelo + RIP-699 March 15th Maltese Amoeba Casper + Christmas Tree + Suriv 1.01 + Suriv 2.01 + Suriv 4.02 Akuku (Wilbur 3) Month 4-6 ARCV Friends Casino + Murphy (Swami) May 1st - May 4th 1210 May 1st - May 31st Kthulhu May 5th PS-MPC (Cinco de Mayo) (Sub-Zero B) (Kennedy) Gremlin >31st 17TH) DOSHunter Crazy Eddie ARCV 330 >31st Got-You -PLO) (Mendoza) VCL (Beva 96) Casino Bomber 1st - AirCop (AirCop-B) + Cascade + Sad + Ten RIP-699 It (Viva Mexico) 20th - >31st Plastique + Plastique-B 22nd - >31st 4096 1st - >31st 4096 + Cascade + Ten 12th Akuku (Columbus) (Anarkia-B) 13th - >31st Datacrime 15th Dark End 23rd Karin 28th Aragorn 31st Halloween bTuesday of Little Br (LB-349) 1st Maltese Amoeba 4th 11th Flower 12th Timor 17th 17th - >31st 17th (Nov 17-880) 18th (Kennedy) 22nd (Kennedy) 30th 11-30 > 1st - >31st 1253 > 1st > 4th > 7th VCL (Pearl Harbor) > 19th - >31st Father Christmas > 20th - >25st ARCV Xmas > 21st Poem > 24th Icelandic (Icelandic-III) > 24th - >31st > 24th - Christmas Tree > 25th Japanese Christmas > 28th Spanish Fools > 31st 1, 1989 Fu Manchu Flash DataLock Fingers >31, Sicilian Mob >31, CyberTech + OMT 1, 1993 Grunt-1 >31, 1993 CyberTech (CyberTech-B) Year is + Were Here + Year PZPAPN ID Cross-Reference Generic Specific PZPAPN Specific [007] Chang [100] Fish [104] [109] African 109 [144] AT144 [203] PS-MPC [205] Tormentor-205 [233] Relzfu [268P] V270x [302] 302 [334] 334 [337] 337 [344] Grunt-1 [370] Voronezh-370 [3Sht] Globe [408] 408 [417] OMT [439] 439 [453] RPVS [472] ASP-472 [487] 4870 [500] 500 [512] 512, Darth Vader, Legalize [529] Polish 529 [557] 557 [595] 595 [621] 621 [644] PS-MPC [658] thing [696] Enemy, Scream [702] 702 [707] Surrender, [730] Ontario 730 [748] 10 Past 3 [789] StarDot 789 [7S] Seventh Son [802] PC Flu [855] [880] Flower [90] [905] Badsec [910] Dir-2 [914] 914 [928] 923 [981] 981 [1008] 1008 [1014] [1024] V1024 [1030] Friends, Pisello [1067] 1067 [1182] Hellween [1186] Liberty-1172 [1193] Copyright [1210] 1210 [1241] 1241, Cossiga, Vriest [1244] 1244 [1253] 1253 [1308] 1308 [1339] Mummy [1381] Internal [1385] 1385, DAME, Gosia, Macedonia [1376] Hellween [1452] 1452, Antimon [1530] Alexander, CB-1530, CPSU-2535, CPW, Edcl, Father, Hymn, Protecto, QP3, R-10, R-11 [1554] [15xx] 1575 [1661] 1661 [1677] PCBB [1701] Cascade [170x] Cascade, Joker 2, Plumbum (Plumbum-F) [1720] PCBB [17690] Worm-17690 [1835] 1835 [1963] 1963 [1971] Eight Tunes Year MindRiot, Pila, Skism [2133] Scott's Valley [2136] Outland [2153] 2153 [2480] Crew-2480 [2559] 2559 [2560] 2560, Magnitogorsk 2048 [2623] 2623 [3040] 3040 [3066] Spanish, Traceback, Traceback 3029, Traceback II [4096] 3445- , 4096 [4A] Tack [5856] [7808] 7808 [A-403] Australian 403 [A2] Aids II [A16] [A-Vir] Anti-Tel [ABC] ABC [Abrx] PS-MPC [Acd] Acid [Ada] Ada, Kit [Agi] Month 4-6 [Agn] Agena [Aircop] AirCop [Alabama] Alabama [Alameda] Alameda [Alb] Albania, Albanian [Alf] 1840, Alfa, Damage, Gremlin, Newcom, Penza, 1049, Yankee Doodle [And] Andre [Anm] Animus [Anna] Anna [Ant] Ant, Anto [AP] [Arag] Aragon [Ar] [ARC] ARCV-n [Ark] MVF [Arma] Armagedon [Ash] Ash [Ast] Astra [Astr] Astra [Ata] Atas [Ath] [Atx] Anthrax [Aust] Australian [Azusa] Azusa [B3] DOSHunter [Barc] Barcelona [BB] Bad Boy, Bad Brain, Hellraiser [BCV] Sentinel [Bebe] Bebe [Beep] Beeper [Bet] Beta, Ministry [BFD] BFD [Bgh] Burghofer [BKil] %Killer [Blj] Bljec, Sad [Blood] Blood [Bloody] Bloody! [Blus] Blood Lust [BMon] Black Monday [Bmb] Bomber, 5er Bomber [Bob] Bob, ew-692 [Boo] Boojum [Boys] Boys [Brain] Ashar, Brain [Bro] Murphy [Bry] Brainy [Bst] Busted [BT] Back , Blinkers, Shaker [Bt] Beast-N-Black [Bud] Budo [Burger] 405, Burger, Dewdz, VirDem, VirDem-792, VirDem-1542, Wonderful [BWish] Best Wishes, Dutch 555 [Bwr] Beware [C-2B] Datacrime [C-J] Japanese Christmas [C16] Worm-16850 [Can] Cansu [Cara] Cara [Carioca] Carioca, Null-178 [Cas] Cascade [Casper] Casper [CB] Cannabis [Cerb] Cerburus [Cf1] Coffeeshop-1568, DAME [Cha] Chang [Chad] Chad [Che] Cheeba, Chemmy [Ches] PS-MPC [Chs] Chaser [CKs] CheckSum [Coa] [Con] PS-MPC (Mimic), VCL [Cpt] Capitall [Crime] Datacrime [CRJ] Cracker Jack [Crazy] Crazy Eddie [Crf] CRF [Crk] [Crm] Criminal, PS-MPC [Crp] Creeper [Crsh] Crusher [CSL] CSL, Finnish 709 [Ctm] Catman [Cub] Attack [Curse] Curse [CV] Nowhere Man [CV4] CV4 [Cybr] Cyber [D-T] Dutch [D2] Dir-2 [D10] Day10 [D28] Spanish Fools [DAME] DAME, Groove, Pogue [Dance] Devil's Dance [Data] DataLock [Dav] ;, M.I.R. [Davis] Davis [Dbase] dBASE [DC-2] Datacrime [DD] Dada [Def] Define [Dei] Casino, Deicide [Dem] I-B [Destr] Destructor V4.00 [Dio] VCL [DM300] [DMB] 310, DM, Milena [Dm2] Doom II [Dmo] Demolition [DOD] DoDo [Doodle] Yankee Doodle [Dot] Dot Killer [Dsbr] Dismember [Dst1] Dest [Dst3] Dest [Dth] PS-MPC [Dtr] Raubkopie [E92] [Ear] Ear [Ed] [EDV] EDV [EEL] Loki [Egn] NPox [Ein] Einstein [El] Eliza [Em] Emmie [Emf] Emf [Emp] Evil Empire [Eng] Bandit, Black Wizard, Enigma, Yankee 2 [Eno] Enola [Eof] End Of [Er] [ETC] ETC [F458] Frodo Soft-458 [FCH] Fich, Fichv-896 [FDt] =11-537 [Fellow] Fellowship [Fil] Fil [Filler] Filler [Fish] Fish [Flash] Flash [Flip] Flip [Flu] PC Flu-2 [FN] Fungus [Fnz] Friday 13th [For] Forger [Form] FORM- [Frg] Frogs [Fsh] Fish [Fst] Dark Lord, Feist, Lycee, No Frills [Fu] Fu Manchu [Fume] Perfume [Fune] Funeral [Futh] Youth [FW] Tula [G3] Slow [Gcat] 1575 [Gerg] Gergana [Gk] Geek [Gls] Gliss [Gomb] HH&H [Gr] Grapje [Grb] Growing Block [Gre] Green Joker [Grnt] Grunt-1 [Gtc] Gotcha, Pogue [GTk] VCS [Guppy] Guppy [GY] Got-You [Hafn] Hafenstrass [Hal] Halloechen [Happy] VFSI [Hary] Hary Anto [Hck2] Hacktic [Hf] Haifa [Hi] [Hitc] Hitchcock [Hl] Holocaust [HNY] Happy New Year [Hng] Hungarian [Hpp] Happy [Hrb] Hero-394 [Hre] Were Here [Hrr] Horror [Hrs] [HS] Vivaldi [Hst] Hastings, Possum [Huge] Warning [Hunt] ZeroHunt [HW] Halloween [Hyb] Hybryd [I9] Ice 9, Joanna [I-F] Italian 803, StarDot 801 [IB] [Ice] Mix1 [Ice-3] Icelandic [Ice-9] Joanna [Idle] Close, Idle [Ier] Ieronim [Ill] Ill [Imp] Crazy Imp [Inc] Incom [Inl] Invol [Intr] Intruder [Invader] Invader [IOU] All Sys 9 }h_3] Gnose [Irs] Maltese Amoeba [IT] [Ita] Itavir [Itt] Itti [J13] [J1663] [J26] [J4J] Sistor [Jab] JW2 [JD] [Jeff] Jeff [Jeru] 1605, 1720, Discom, Freddy, Frere Jacques, Fu Manchu, Groen Links, , Suriv 3.00, Timor, Tobacco, Westwood [Jeru-A] [JK] Big Joke [Joa] Joanna [JoJo] JoJo [Joshi] Joshi [Jrk] Jerk, Talentless [Jsh] Joshua Micropox [K1] WordSwap [K4] Kode4 [Kami] Kamikazi [Kbu] [Kem] Kemerovo [Keme] Kemerovo [Ker] PS-MPC [Key] Keypress [Kiev] Kiev 483 [Killer] KKiller [Kiri] Harakiri [Kla] Klaeren [Korea] Korea [Krv] Krivmous [Ku] Kuku-448 [L1] AT144 [Label] Label [Lam] Mosquito [Lan] Lancs [Lar] Larry [Lazy] Lazy [LB] Little Br [LCV] LowerCase [Leap] [Leech] Leech [Lehigh] Lehigh [Lep3] Leprosy [Les] Tormentor-205 [LG] Little Girl [LG3] Little Girl [Li] NCU Li [Liberty] Liberty, Liberty-2 [Lisbon] 646, Father Christmas, Ghostballs, Grither, Iraqui Warrior, NTKC, VHP, [Lix] Murphy, Tormentor [LK] LockUp [Loa] Loa Duong [Loz] Lozinsky [LPC] Little Pieces [LZ] [LZ2] [M-123] Multi-123 [M128] Micro-128 [M11] MPS 1.1 [M45] Define, Mini-45, Small-38, [MA2] Lythyum [Mant] Manta, VCS [Mar] Marauder, Marl [Mardi] Mardi Bros [Mayk] Mayak [MBug] MusicBug [MCAF] PS-MPC [Mct] Moctezumas Revenge [Mds] Madismo [Mex] Mexican Mud [MFC] Multi-Face [MG] [Mgm] 2560 [MGTU] MGTU [Mich] Michelangelo [Micro] Microbes [Mim] PS-MPC (Mimic) [Mirror] Mirror [Ml2] Sticky [Mlg] Malaga [Mls] Malaise [Mn] Mannequin [Mnc] Munich [Mno] Manola, VCL [Mog] Yafo [Mon] Monkey [Mosq] Mosquito [MPC] MPS 4.01 [MPS] MPS 3.1, MPS 3.2 [Msht] Mugshot [MSTU] MSTU [Mule] Mule [Mum] Mummy [Murphy] Murphy, Tormentor [Mut] DAME, Mutant ], Rosen, [MV] [Mx2] Mix2 [N1] AIDS, Number One [Nbk] NoBock [Ngs] Nygus [Nina] Nina [Nja] Ninja [Nl] Null Set [Nns] Nines [Nom] Nomenklatura [Not] Do-Nothing [Npx] NPox [NWed] PS-MPC [Ohio] Den Zuk, Ohio [Ont] Ontario, Ontario III [Oro] Oropax [Otto] Otto6 [OW] Argentina-102, Banana, Blaze, Druid, Explode, FCB, Leprosy, Mini-45, Ondra, , Shhs, Silver Dollar, Stanco, V-1n, Yukon [P1r] 1226, 1226D, Evil, Phoenix, PhoenixD, Proud [P45] Polish-45 [P5220] Pascal-5220 [P-2] Print [PA] [Par] Infinity, Parasite, Shadow [Paris] Paris [PCB] PCBB [PCV] PCV [Pch] Keypress [Ph] Pathhunt [Pht] Phantom [Pi] [Pia] Piazzolla [Pif] Dir , Pif [Ping] Ping Pong [Pix] Amstrad, Hell, Hydra, Pixel, Pixie, Self, Silly-365 [Plg] Leprosy [Plov] Plovdiv 1.3 [Plq] Plastique [Plu] Plutto [Pm] Poem [Pmn] Particle Man [Pnz] Penza [Poj] Pojer [Pol-2] Turbo 448, Turbo Kukac [Polimer] Polimer [Poss] Possessed [Prg] Pregnant [Prm] Prime [PS-MPC] PS-MPC [PS10] 1024 Print [Psc] Psychogenius [PSV] Loki [Pt] Patient [Ptch] Pitch [Qk] Quake [QML] QMU [Qo] [Queen] Queens [Qt] Quiet [R715] [RA] Akuku [Rad] Radyum [Raub] Raubkopie [Rag] Rage [Rea] Reaper [RedX] Ambulance Car, Hafenstrass 2 [Req] W13 [Rkm] Reklama [RKO] Ah, Lucifer, Rocko, V651, V2000, V2100 [RMIT] Leprosy [RNA] RNA [Roc] Rocko [RPKS] Den Zuk [Rst] Reset [Rttl] Rattle [S143] Swiss 143 [S3d] Silver Dollar [Sadt] Saddist [Sand] Sandwich [Sat14] Saturday The 14TH [SBC] 1024 SBC [Sck] Intruder [Scl] Scroll [SCT] Silly [Scy] Scythe [Sdm] Saddam, Stupid-1355 [Sdot] StarDot 600 [Sent] Sentinel [Set] Semtex [Sg] AT144 [Sh] Shhs [Shake] Shake [Shl] Shirley, Violetta [Shld] Shield [Sil] Silence [Silw] Silly [Sim] Simulati [Sis] Sistor, PCBB [Sk] Tolbuhin [Sk1] Tolbuhin [Slay] 5120, Slayer, Urfydus [Slow] Slow [Slv] Slovak [Sma] [Sorry] Sorry [Sov] Sov [Soy] [Spar] Sparse [SPh] Swiss Phoenix [Spyer] Spyer [Spz] Spanz [Sqe] Squeaker [Sqk] Squawk [Sqr] Quirk [Squ] Squisher [Sr] Scream [Sta] Stahl [Staf] Staf [Sti] Stinkfoot [Sti2] Stinkfoot Horse %, NoInt, , Swedish Disaster [Su2] Sunday-2 [Sub] Fingers, Solano 2000 [Sui] Ear [Sunday] Carfield, , Miky, RAM , Sunday [SurivA] Suriv 1.01, Suriv 2.01 [Sv] Sverdlov [SVC50] SVC 3.1, SVC 4.0, SVC 5.0, SVC 6.0 [Svir] SVir [Swb] Exebug, WXYC [SX] Plovdiv 1.1 [Sylvia] Sylvia [Syslock] Syslock [T133] [T3] Taiwan 3 [T4] Taiwan 4 [T-12] [Tab] Tabulero [Tab2] Tabulero [Taiwan] Taiwan Typo [Tdr] Todor [Tele] Telecom [Teq] Tequila [Tim] [Timid] Timid [Tmd] Timid [TMTM] TMTM [Tn] Tony [Tob] Tobacco [Tokyo] Tokyo [Topo] Mosquito [Tr2] s, Troi [Trk] 1661 [Troi] Troi [Tum] Tumen [TV] Tester [Twin] Twin-351 [Tzu] PS-MPC [U394] Attention! [U492] Tula, [U600] [U830] Red Diavolyata [U948] [U2144] [Une] UnExe [Unk] 572, Typo [V-5] Path [V2P2] 1260, V2P2 [V2P6] Adolph, V2P6 [V82] Phoenix 2000, V82 [V101] [V800] V800 [V801] V801 [VA] Baobab [Vacs] Rybka, Vacsina [Vcomm] VComm [Vde] VirDem [VHP] Arf, Interceptor, Monxla, Parasite, Polish 583, Sicilian Mob, Stone`90, VHP, VHP2, , Violite, Viperize [Victor] Victor [Vip] Leprosy, Viper [VM] VMem [Vor] Voronezh [Vot] Vote [VP] [VTS] RSP-1876 [vvf] VVF 3.4 [Walk] PS-MPC [War] Warrior [Whale] Whale [Why] Swedish Boys [WinVir] WinVir [Wisc] Wisconsin [Wlk] Walker [WM] Windmill [Wolf] Wolfman [Wond] Wonder [Ws] WordSwap [WWT] WWT [XA1] Christmas [Xab] Leprosy [XP] Xpeh [Yap] Yap [Yth] Youth [Z10] PS-MPC [Z900] ZK900 [Zar] Caz, Crash, Zaragosa [Zero] Zero Bug [ZMT] ZMT [Zpp] PS-MPC [Zrk] Zherkov [Zu1] Hungarian 482, Zu1 [ZY] [ZZ] PZPAPN Generic [CM] Brazilian Bug, Friday 13th, Revenge Attacker, Thimble, Violetta [F1] Mono, Socha, Voronezh-Chemist [F2] 66A, IKV 528, Parity, Plumbum, Smiley, TSoft, [F3] Alex-368, II, Hero, Siskin, V-3n, V483 [FE] Badsec, Mummy [FJ] Striker #1, Terminator [FM] CADKill, CCCP-510, Exunt, Hominy, Lisbon, Los-693, MShark, P , Polish 217, Polish-376, [FN] 1392, FGT, FN [FQ] 382 Recovery, Burger, Pirate [FR] Anti-D, Argentina, Dad, Kalah, Kthulhu, Seventh Son, Suriv 4.02, Totoro, Traveller, Vindicator, Xuxa [FS] Cinderella [GenB]/[GenP] BFD, Bloody!, Changu Mangu, EkoT U, Fish FORM- , Guillon, HiDos, Keydrop, LZRQ, Malaga, Max %, Parity %, Quick, Sticky, , Tony PZPAPN Cross-Reference Multipartite Polymorphic & Sub- PZPAPN AirCop Alameda Anti-Tel Aragon Ashar Azusa Bloody! %Killer Brain Cannabis Cansu Catman Changu Mangu Chaos Curse Den Zuk KKiller Evil Empire Exebug Filler Fish FORM- Guillon HiDos Horse Joshi Keydrop Korea Loa Duong LZRQ Mardi Bros Michelangelo Microbes Monkey Mugshot MusicBug NoInt Ohio Parity Pentagon Ping Pong Print Queens Quick Swap Swedish Disaster Tony Windmill World Peace WXYC PZPAPN Multipartite Multipartite 1253 Anthrax Crazy Eddie Crusher EkoT Flip Gingerbread Man Invader Invol Kiev 2049 Malaga Mayak Plastique-B Shifter Sticky SVC 6.0 Telecom Tequila VMem PZPAPN Polymorphic Polymorphic 1008 1024 SBC 1226 1260 Adolph Andre Cansu Casper Cheeba DAME / Dedicated DAME / Fear DM / DM-B Evil Fish Flip (All Groove Haifa (All Holocaust Invol (All Maltese Amoeba Marauder Moctezumas Revenge Oi Dudley Ontario Ontario III PC Flu-2 (All PCBB Phoenix Phoenix 2000 Pogue Proud Rocko / Mutating Rocko Silly Slovak (All Scream (Scream 2-696 & 732) Simulati Telecom Tequila Tremor Uruguay V2P2 V2P6 (All Whale Wordswap / Wordswap-1485 Wordswap / Wordswap-1504 PZPAPN & Sub- & Sub- 1008 1024 SBC 1963 2560 3040 3445- 4096 Anti-Tel Aragon ARCV-n (ARCV-9 Atas II Basilisk Bios Bomber Brain Casino Crazy Imp Crusher Curse Damage Dir-2 Edcl EkoT Emmie Exebug Filler Finnish-709 Fish Fungus Gingerbread Man Gnose Gremlin Holocaust Joanna (Jo Joshi Leech LockUp Lucifer Lycee Magnitogorsk 2048 Malaga Mayak Minsk Ghost Monkey Murphy NoInt Necro Shadow (Necro Shadow-B) NPox Ontario III Parity PCBB Plovdiv 1.1 Plovdiv 1.3 Pregnant R-11 Rocko Quick Sandwich Scroll Scythe Sentinel Shield Sistor (Sistor-J4J) Squisher Sunday-2 SVC 4.0 SVC 5.0 SVC 6.0 Swiss Phoenix Telecom Tequila Terminator-2294 Tremor Twin-351 Uruguay (Uruguay 6) V651 V1024 V2000 V2100 VMem Whale Windmill World Peace YAM-3599 Zaragosa ZeroHunt Zero Bug PZPAPN es are xthe es, in most cases, xthe or the exists on Jformatted MS-DOS, regardless of whether the Jis a a data K. The DOS uses to start the %, before control is passed and the 5interpreter. The on a 7a very small tells the J. The usually proceed to xthe of non-write protected are used on the xthe may do so the initial or later Kis accessed by the both Kand usually store the where else on the not always the case. If the writes the a critical area of the K, such as into a occupying part of the (FAT) or data on the Kmay be lost. A symptom characteristic of may be noted, even , is the amount of ed by the DOS usually be at least 1,024 (less what is actually zed on the . Note: if you man IBM PS/2, computers use 1K off the top of , so 639K of instead of present. PZPAPN es are use special techniques in order to avoid detection by both computer s and anti- software products. Most researchers agree mthe ccharacteristics: (1) The hide any 2to execu components of the , such as qs in , or alteration of the (2) The "on the fly". For example, is read into the is dis technique keeps anti- software Nnot know about the particular fdetecting indicating (3) es, in most cases, , in addition to upon Z. The purpose of texecu allows the to quickly spread throughout a The bcharacteristic, the hiding any execu components, makes es very difficult for computer s to locate the . For reason, I mincluded exhibit particular characteristic as "sub- es in the Sub- es cross-reference. If you mreason to believe your computer has a or sub- , be sure to power off the %the fa non- s, write-protected, proceed to Ya clean copy of your anti- software fa write-protected J. Since the no longer be in be no danger of further spreading the u. In addition, any fthe u, or alteration of execu components, should now be able to be noticed on the PZPAPN s Cross-Reference The s Cross-Reference section of Hyper allows the to select yfor on certain s or characteristics. The vs section lists all es, in most cases, may xthe xboth `and mnot included in section. The Multipartite es section lists those xtwo or more s of components. Typically, ,and/or . as well as and/or the . The Invol included as it and device Ors (.SYS) The Polymorphic es section lists the employ complex encryption so are difficult to detect products making use of technology. The Whale included due to its use of a complex encryption mechanism, but it is not truely polymorphic. The & Sub- es section lists those exhibit characteristics make them difficult for an average to detect hide not normally classified in the category, included due to the qd complexity present to computer PZPAPN -XRef Country of Canada Germany Israel Italy Poland Taiwan All Countries PZPAPN Country of ated in 'include: Happy New Year Shake 1226 Horse Junior 1835 Kamikazi Todor Albania Krivmous Tony Anthrax Leech Tony V651 Mini-45 V800 Boys Multi-123 V1024 Brainy Murphy V2000 Cmdr Bomber Mutant V2100 DAME Nina Vacsina Dark Lord Parity VFSI Darth Vader Phoenix Destructor V4.00 Phoenix 2000 VHP2 Dir-2 PhoenixD Vote Edcl Pogue Warrior Proud Yankee Doodle Evil Sentinel Yankee 2 PZPAPN CO_Canada Country of : Canada ated in Canada include: 1024 SBC NoInt Rocko NPox Scream Evil Empire Ontario Sicilian Mob Hellraiser Ontario 730 Small-38 Infinity Ontario III Sunday-2 Malmsey Parasite Marauder R-10 R-11 Yukon Rage PZPAPN CO_Germany Country of : Germany ated in Germany include: Flash Perfume 1804 Gliss RaubKopie 5120 GoldGeld RPVS Ambulance Car Groove Shirley Burger Hafenstrass Stahl Cascade Halloechen Tremor Kalah Violetta Christmas Tree Karin VirDem Eight Tunes Munich Fingers Number One Whale Fish Parity PZPAPN CO_Israel Country of : Israel ated in Israel include: 4096 JoJo Suriv 2.01 Alabama Mix1 Suriv 3.00 Do-Nothing Swap Emmie Saddam Typo Haifa Suriv 1.01 VMem PZPAPN CO_Italy Country of : Italy ated in Italy include: Hero Little Pieces Aragorn Lucifer Bandit Interceptor Casteggio Italian 803 Como Itavir Cossiga Pisello Cracker Jack Serena Damage Klaeren Urfydus Enigma PZPAPN Country of ated in the include: Bit Addict Gotcha Nomenklatura Breeze Grapje Quake Cannabis Groen Links RTL4 Civil War Hacktic Sylvia Crusher Legalize Terminator-3549 Datacrime Little Br Deicide LV 1.2 Zero Bug DOSHunter Dutch 555 Nazgul Dutch PZPAPN CO_Poland Country of : Poland ated in Poland include: Joker Polish Kthulhu Polish-45 Atas Mono Polish-376 Atas II MPS 1.1 Reklama MPS 3.1 Self Capitall MPS 3.2 Stone`90 CheckSum Nygus SVir Doctor Qumak 2 PC Flu-2 Tatou Father Christmas Pascal-4260 Frodo Soft Plumbum TSoft Gosia Polish 217 VComm Polish 529 Hybryd Polish 583 Wizard 3.0 PZPAPN CO_Taiwan Country of : Taiwan ated in Taiwan include: 382 Recovery Plastique-B 1575 Spyer Bloody! Taiwan KKiller Taiwan 3 Doom II Taiwan 4 Fish Totoro Invader Wolfman Mummy MusicBug Plastique PZPAPN CO_USA Country of ated in the include: 1260 Jeff Skism AirCop JoJo 2 Skull Alameda Keypress Solano 2000 Beast-N-Black Lehigh Soupy Leprosy Striker #1 Clonewar Little Girl Sunday Lythyum Tester DataLock Micropox Timid dBASE Mindless Traveller NaziPhobia Troi Necro Fear V2P2 Frere Jacques Necro Shadow V2P6 Frogs Null Set V801 Geek Otto6 Green Peace Particle Man Violite Grither Patient Grunt-1 Pixie Guppy PS-MPC Westwood Hastings Psychogenius Wild Thing 2 Highlander Quiet Wisconsin Intruder Radyum Invol ZeroHunt Iraqui Warrior Scott's Valley ZK900 Seneca-B PZPAPN Country of ated in the include: 2560 Squisher Hymn SVC 3.1 Ieronim SVC 4.0 Akuku SVC 5.0 Alex-368 Ionkin SVC 6.0 Alfa Kemerovo Sverdlov Andre Kiev 483 Tu-482 Angarsk Kiev 2049 Tula Kiwi-550 Tumen Astra KLF-356 UFA-1201 Attention! Label Uruk-hai Los-693 Bebe Lozinsky LPT Off Beeper Lycee Beer Magnitogorsk 2048 Malign Best Wishes MGTU MiniMax Beware Minsk Ghost Bryansk Catman Ninja Not-586 CCCP-510 NTKC Oxana V388 Commy Pascal-5220 Copyright Press CPSU-2535 Problem Crash Protecto Digger Plutto Dima Red Diavolyata Victor Dir Ryazan Siskin Voronezh Drop Skew-469 VVF 3.4 End of Small-178 WordSwap Enola $ Zherkov Experiments PZPAPN Countries Country of Countries Argentina: Anti-D Piazzolla Argentina Guillon Xuxa Argentina-102 Australia: Aussie Dir Growing Block Puke-393 Aussie Parasite Hominy Queens Australian Liberty Random Australian 403 No Frills RIP-699 Australian Oi Dudley Skater Fungus Slow Gingerbread Man Possessed Twin Peaks 5 Viper Austria: 1253 Belgium: Got-You Bolivia: Miky Brazil: Brazilian Bug Freddy Chile: China: Cuba: Attack Czechoslovakia: Blinker Semtex Slovak Pojer Shaker Denmark: England: HiDos Small ARCV Anna Ice 9 Small ARCV 330 Joanna TMTM ARCV Friends Lancs Typo ARCV Xmas Reaper ARCV-n Sandwich Chad Scroll Zaphod Chaos Scythe Crazy Eddie Finland: 1008 Cinderella Finnish-709 Budo Crew-2480 Relzfu France: Malaise Paris Fich Mardi Bros Pitch Fichv-896 Greece: Armagedon Pixel Hong Kong: Azusa Hungary: Filler Monxla B Polimer Hungarian Phantom Turbo Hungarian 482 Monxla Iceland: Ghostballs Icelandic India: Baobab Joshi Mugshot Changu Mangu Microbes Print Indonesia: 1392 Den Zuk Ohio Ireland: Gnose Suriv 4.02 Japan: Japanese Christmas Tokyo Korea: Korea Malaysia: Black Monday Davis World Peace Bomber Fellowship Malta: Casino Maltese Amoeba Mexico: Devil's Dance New Zealand: Shadow Pakistan: Brain Philipines: Revenge Attacker Windmill Portugal: Amstrad Lisbon Pirate Republic of South Africa (RSA): African 109 Poem Blood Medical Saturday The 14th Friday 13th Pathhunt StinkFoot Romania: Alexander Saudi Arabia: Spain: 1210 Barrotes Manola 1720 Cara Spanish Agena Spanish Fools Anti-Tel Holocaust Telecom Barcelona Sweden: Banana Mexican Mud Swedish Disaster Blood Lust PCBB Tormentor Coffeeshop-1568 Prime Tormentor-205 Dismember Sistor WinVir Harakiri Swedish Boys Youth LockUp Switzerland: Burghofer FORM- Swiss Phoenix Exebug Swiss 143 Tequila Flip Thailand: Loa Duong Mule Turkey: 1661 Cansu Walker Uruguay: Uruguay Venezuela: Tabulero PZPAPN Turbo Number One Chang Tack Xpeh 62-B 10 Past 3 10 Past 3 10 Past 3-B 10 Past 3 99 Percent African 109 AT144 163 Silly PS-MPC Tormentor-205 Polish 217 Relzfu 248-Plus V270x ARCV 330 334-B Grunt-1 370-B Voronezh-370 382 Recovery 382 Recovery 382 Recovery 382 Recovery.1 382 Recovery Attention! Australian 403 Burger 405-EST Tula VFSI 439-B NoBock RPVS Kiev 483 Burger Burger 512-A 512-B 512-C 512-D 512-E 512-F Polish 529 Burger Burger Burger Dutch 555 Burger 560-B Burger 572-COD VHP2 Icelandic (see: Saratoga) Vcomm Icelandic PS-MPC Dir PS-MPC Finnish-709 Typo Ontario 730 10 Past 3 Perfume Revenge Attacker V801 834-B Typo Flower ZK900 Fich 903-B Fich 903-C Fich Badsec Dot Killer 1008 1008 1012 + 27 Grapje 1014 Interceptor 1022 Fellowship 1024 V1024 1024 Print 1024 Print 1024 SBC 1024 SBC 1024-B Nomenklatura 1024PSCR 1024 Print 1028 1030 Pisello 1039 Grapje 1049 1063 Mono 1067 1067 1075 Crash 1077 Jerk 1130 11-30 1193 Copyright 1210 1210 1226 1226 1226-B 1226 1226-B Dropper 1226 1226D 1226 1226M 1226 1241 1241 1244 1244 1244-B 1244 1253 1253 1260 1260 1308 1308 1339 Mummy (Mummy 2.1) 1374 Little Pieces 1376 Hellween 1381 Internal 1381-B Internal 1385 1385 1392 1392 1415 1452 1452 1530 CB-1530 1536 Zero Bug 1539 Christmas Tree 1554 1559 1575 1575 1575-B 1575 1575-C 1575 1575-D 1575 1575-E 1575 1577 1575 1590 Arriba 1591 1575 1600 1605 1600 Happy New Year 1605 1605 1605-B 1605 1621 Cascade 1624 Yankee 2 1661 1661 1661-B 1661 1661-C 1661 1677 PCBB 1701 Cascade 1701 Mutation Cascade 1701-Yap Cascade 1704 Cascade 1704 Format Cascade 1704-B Cascade 1720 1720 1720-B 1720 1720-C PCBB 17Y4 Cascade 1804 1804 1808 1813 1835 1835 1840 1840 1876 RSP-1876 1963 1963 1963 1963 1963-B 1963 1961 Yankee 2 1971 Eight Tunes Year Skism 1993 Todor 2080 Fu Manchu 2086 Fu Manchu 2100 V2100 2131 Scott's Valley 2136 Outland 2144 2153 2153 2480 Crew-2480 2559 2559 2560 2560 2560-B 2560 2560-C 2560 2576 Taiwan 4 2623 2623 2930 Traceback II 2930-B Traceback II 3012 Plastique 3040 3040 3040 3040 3066 Traceback 3066-B Traceback 3066-B2 Traceback 3445 3445- 3445- 3445- 3551 SysLock 3555 SysLock 3880 Itavir 4096 4096 4096-B 4096 4096-C 4096 4096-D 4096 4096-E 4096 4711 Perfume 4870 4870 4870 4870 4915 Ondra 5120 5120 5792 5856 7808 7808 7th Son Seventh Son 8290 Print 17690 Worm-17690 909090h Burger 9800: PZPAPN A-204 ABC-2918 ABC-2918B Abraxas PS-MPC ACDC Poem Acid Acid Acme Clonewar Adolf Adolf Hitler Adolf Hitler Adolf Hitler Adolph Adolph Advent SysLock Advent-B SysLock African 109 African 109 Agena Agena Agi-plan Month 4-6 Ah-B AIDS AIDS AIDS II AIDS II AIDS- AIDS AirCop AirCop AirCop-B AirCop Akuku Akuku Akuku-3 Akuku Alabama Alabama Alabama Alameda Alameda Alameda 1.2M Alameda Albania Albania Albania-429 Albania Albania-506 Albania Albania-575 Albania Albania-606 Albania Albanian Albanian Alex-368 Alex-368 Alexander Alexander Alfa Alfa Alfa-1150 Alfa Alfa-1202 Alfa Alfa-1712 Alfa Alfa-Tired Alfa Alien-1 PS-MPC Alien-3 PS-MPC All Sys 9 All Sys 9 Ambulance Ambulance Car Ambulance Car Ambulance Car Ambulance Car-B Ambulance Car Amilia Amoeba 1392 Amstrad Amstrad Amstrad-End Is Near Amstrad Amstrad-Luz Amstrad Anarkia Anarkia-B Anathema PS-MPC Andre Andre Andre-0 Andre Andre-3568 Andre Andryushka Andre Angarsk Angarsk Angel Of Death Leprosy Animus Animus Animus-7360 Animus Animus-7392 Animus Anna Anna Anthrax Anthrax AntiCad 1253 Plastique Plastique-B Anticad 1 Plastique-B Anticad 2 Taiwan 3 Anticad 3 Plastique Anticad 4 Invader Anticad 5 Taiwan 4 Antimon Antimon Anti 1605 Antiviru Anti-D Anti-D Anti-D B Anti-D Anti-Print Anti-Tel Anti-Tel AntiChrist Murphy Anto Anto AP-400 AP-440 AP-440B AP-480 AP-480B AP-529 AP-605 Apocalypse Apocalypse II V2000 Suriv 1.01 1st-B Suriv 2.01 Arab Arab Star Aragon Aragon Aragorn Aragorn ARCV 330 ARCV 330 ARCV Friends ARCV Friends ARCV Xmas ARCV Xmas ARCV-1 ARCV-n ARCV-10 ARCV-n ARCV-2 ARCV-n ARCV-3 ARCV-n ARCV-4 ARCV-n ARCV-5 ARCV-n ARCV-6 ARCV-n ARCV-7 ARCV-n ARCV-8 ARCV-n ARCV-9 ARCV-n ARCV-n ARCV-n ARCV93 Ice 9 Arf-B Argentina Argentina Argentina 1.0 Argentina Argentina-102 Argentina-102 Arka Arkanoid Arma Armagedon Armagedon Armagedon Armagedon #911 Armagedon Armagedon-1077 Armagedon Arriba Arriba Ashar Ashar ASP-472 ASP-472 Astra Astra Astra-498 Astra Astra-510 Astra Astra-521 Astra Astra-976 Astra Astra-1010 Astra AT108 AT144 AT114 AT144 AT118 AT144 AT122 AT144 AT140 AT144 AT144 AT144 AT149 AT144 Atas Atas Atas II Atas II Atas-384 Atas Atas-400 Atas Atas-3321 Atas II Attack Attack Attack-918 Attack Attack-1501 Attack Attention! Attention! Aussie Dir Aussie Dir Aussie Parasite Aussie Parasite Australian Australian Australian 403 Australian 403 Australian Parasite Aussie Parasite Australian Australian Australian Australian Australian -142B Australian Australian Australian Australian Australian Australian Australian Australian Australian Australian Australian Austrian Azusa Azusa Azusa 2 Azusa PZPAPN B-52 DOSHunter Backfont Badsec Back Back Bad Boy Bad Boy Bad Boy 2 Bad Boy Bad Brain Bad Brain Bad Seed Gingerbread Man BadGuy BadGuy 2 Badsec Badsec Banana Banana Bandit Bandit Baobab Baobab Barcelona Barcelona Barrotes Barrotes Basic 5120 Basilisk Basilisk Bad Brain Sentinel Beast Beast-N-Black Beast-N-Black Beast-N-Black Beast-N-Black B Beast-N-Black Bebe Bebe Beeper Beeper Beer Beer Beer-2794 Beer Beer-2850 Beer Beijing Bloody! Best Wish Best Wishes Best Wishes Best Wishes Best Wishes B Best Wishes Best Wishes C Best Wishes Beta Beta Beta Boys Beta Boys-730 Better World Fellowship Beva 32 Beva 33 Beva 96 Beware Beware BFD-451 BFD-452 Big Joke Big Joke Bios Bios Birdie DoDo Bit Addict Bit Addict Black Avenger Black Friday Black Monday Black Monday Black Monday-B Black Monday Black Monday-C Black Monday Black Wizard Black Wizard Blackjack Cascade Blaze Blaze Blinker Blinker Blinker-496 Blinker Bljec Bljec Bljec-XYZ Bljec Bljec3 Bljec Bljec3B Bljec Bljec4 Bljec Bljec4B Bljec Bljec5 Bljec Bljec5B Bljec Bljec6 Bljec Bljec6B Bljec Bljec7 Bljec Bljec7B Bljec Bljec7C Bljec Bljec8 Bljec Bljec8B Bljec Bljec9 Bljec Bljec9B Bljec Blood Blood Blood 2 Blood Blood Lust Blood Lust Bloody! Bloody! Bloody!-B Bloody! Bloomington NoInt Bogota Bomb Bomber Bomber Bomber Boojum Boojum Ping Pong %Killer %Killer Borderline Black Monday Boroda Bouncing Ball Ping Pong Bouncing Dot Ping Pong Boys Boys Boys 2 Boys Brain Brain Brain Slayer Slayer Brainy Brainy Brazil Quick Brazilian Bug Brazilian Bug Breeze Breeze Brenda Brenda-B Deicide Murphy s In Arm Murphy (see Br Bryansk Bryansk Bubbles Budo Budo 'n 123 Multi-123 Bupt Traveller Bupt-B Traveller Burger Burger Burger 404 Burger Burger 509 Burger Burger 537 Burger Burger 540 Burger Burger 542 Burger Burger 560-B Burger Burger 792 VirDem-792 Burger-Pascal AIDS Burghofer Burghofer Busted Busted Butt Stink Butt Stink PZPAPN C-605 C-23963 Cadkill Cadkill Cannabis Cannabis Cannabis Dropper Cannabis Cannabis 2 Cannabis Cannabis 2 Dropper Cannabis Cannabis 3 Cannabis Cannabis 3 Dropper Cannabis Cansu Cansu Capitall Capitall Captain Trips Captain Trips 2 Cara Cara Carfield Carfield Carioca Carioca Cascade Cascade Cascade.1661 1661 Cascade-1621 Cascade Cascade-1706 Cascade Cascade-B Cascade Casino Casino Casino 2 Casino Casino-C Casino Casper Casper Casper Dropper Casper Casteggio Casteggio Catman Catman Caz-1159 Zaragosa Caz-B CB-1530 CB-1530 CCCP-510 CCCP-510 CD10 Dir-2 CD11 Dir-2 CD12 Dir-2 Cemetery Murphy Cerburus Cerburus Chad Chad Chameleon 1260 Casper V2P2 Chang Chang Chang 007 Chang Chang-B Chang Changu Mangu Changu Mangu Chaos Chaos Chaser Chaser CHCC CHCC CheckSum CheckSum CheckSum 1.00 CheckSum CheckSum 1.01 CheckSum CheckSum 1.01B CheckSum CheckSum-1569 CheckSum Cheeba Cheeba Cheeba-1691 Cheeba Cheeba-1691B Cheeba Cheeba-B Cheeba Chemist Voronezh-Chemist Chemmy Chemmy Chemmy-B Chemmy Cheesy PS-MPC Chicken Pox Chinese Fish Fish Chinese Invader Invader Choinka Father Christmas Christmas In Japan Japanese Christmas Christmas Christmas Christmas Tree Chuang Tzu PS-MPC CHV 2.1 Fich Burger CIA-2 Burger Cinco de Mayo PS-MPC Cinderella Cinderella Cinderella-B Cinderella Ciudado Moctezumas Revenge Civil War Civil War Civil War II v1.1 Civil War Civil War III v1.0 Civil War Civil War IV v1.1 Civil War V v1.0 TPE CkSum CheckSum Clint PS-MPC Clipper Australian Clonewar Clonewar Close Close CLS-853 CLS-853 CLS-853 Cmdr Cmdr Bomber Cmdr Bomber Cmdr Bomber Coahuila 4Zero 4Zero-652 Coffeeshop DAME Coffeeshop 1 Coffeeshop-1568 Coffeeshop 2 DAME Coffeeshop-1568 Coffeeshop-1568 Columbus Akuku Twin-351 Com2Con Commy Commy Como Como Como-Lake Como Computer Ogre KKiller Cookie SysLock Cookie-7360 Animus Cookie-7392 Animus Cop-Mpl Akuku Copyright Copyright Copyright-1205 Copyright Cossiga Cossiga Costeau Costeau Cover Girl Psychogenius CPSU-2535 CPSU-2535 Cracker Jack Cracker Jack Enigma Crackpot 208 Cracky Crash Crash Crazy Eddie Crazy Eddie Crazy Imp Crazy Imp Crazy Imp v1.5 Crazy Imp Crazy Imp-1402 Crazy Imp Crazy Imp-B Crazy Imp Creeper Creeper Creeper-B AIDS II Creeping Death Dir-2 Creeping Tormentor Creeper Crew-2480 Crew-2480 Crew-2480 B Crew-2480 Crew-2480 C Crew-2480 Criminal Criminal Criminal-B Criminal Crumble PS-MPC Crusher Crusher CryptLab DAME Cuban Attack Cunning Cascade CSL Beta CSL V4 CSL V5 Curse Curse Cursy Nowhere Man Cyber Cyber Cyber-946 Cyber CyberTech CyberTech CyberTech-A CyberTech CyberTech-B CyberTech Czech PZPAPN Dutch Dada Dada Damage Damage Damage-B Damage DAME DAME Danube Invader DAPDM-13 Japanese Christmas ;1028 ;1801 V651 V2100 ;-Romanian V2000 V1024 Dark End Dark End Dark Lord Dark Lord Dark Lord-B Dark Lord Dark Quest DarkSide DarkStar DAME Darth Darth Vader Darth Vader Darth Vader Darth-1 Darth Vader Darth-2 Darth Vader Darth-3 Darth Vader Darth-4 Darth Vader Darth-5 Darth Vader Data Molester Swedish Boys Datacrime Datacrime Datacrime II Datacrime Datacrime IIB Datacrime Datacrime IIC Datacrime Datacrime-B Datacrime DataLock DataLock DataLock 1.00 DataLock DataLock-1043 DataLock DataLock-D DataLock DataRape-10 R-10 DataRape-11 R-11 Datarape 2.2 Sunday-2 David-1173 Davis Davis Day10 Day10 Day/10 Day10 DBase dBASE DBF blank Crash DBF dBASE DeadPool Marauder Dear Nina Happy New Year Death Rattle Rattle Death To Pascal Wisconsin Death 2 PS-MPC >24th Icelandic (see Icelandic-III) >28th Spanish Fools Dedicated DAME Dedicated 2 DAME Dedicated 3 DAME Define Define Define-256 Define Define-B Define Deicide Deicide Deicide 2 Deicide Deicide-1335 Deicide Deicide-2405 Deicide Deicide-2570 Deicide Deicide-B Deicide Delyrium Murphy Demolition Demolition Demon Demon-B Demon-C Den Zuk Den Zuk Den Zuk-RPKS Den Zuk Dest-1 Dest Dest-2 Dest Dest-3 Dest Destructor Destructor V4.00 Destructor V4.00 Destructor V4.00 Deunis Devil's Dance Devil's Dance Devil's Dance-B Devil's Dance Dewdz Dewdz Di-94 Di-101 Di-108 Di-110 Diabolik Murphy Diamond V1024 Diamond-B V1024 Dial Diana Diarrhea Diarrhea6 Die Young V2000 Digger Digger Dima Dima Diogenes Dir 2-910 Dir-2 Dir Dir Dir-2 Dir-2 Discom Discom DisDev DisDev KCrunching Icelandic KKiller KKiller KOgre KKiller KPlus 1 1385 KSpoiler 1308 Dismember Dismember DM 92 Bios DM-330 DM-400 DM-B DM 1.01 DM 1.01B DM 1.04 DM 1.05 Do-Nothing Do-Nothing Doctor Qumak 2 Doctor Qumak 2 DoDo DoDo Dome Dome2 Dome3 Dome4 Doom I Taiwan Doom I-B Taiwan Doom II Doom II Doom II-B Doom II Donald Duck Donatello Dorn Aussie Parasite DOS-62 DOS-625 DOS-68 DOS3 DOS3 DOSHunter DOSHunter Dot Eater Dot Killer Dot Killer Dot Killer Dot Killer B Dot Killer Dr Q Dr Q-B Dr Qumak 2 Doctor Qumak 2 Dragon Drop Drop Druid Druid RaubKopie (see: Raubkopie-FRD) Dudley Oi Dudley Durban Saturday The 14TH Dushanbe Dust Mini-45 Dutch 424 Dutch 555 Dutch 555 Dutch 555-B Dutch 555 Dutch 1039 Grapje Dutch Dutch Dutch Dutch Dutch Dutch Dutch Dutch Dutch -124B Dutch Dutch Dutch Dyslexia Solano 2000 Dyslexia 2.00 Solano 2000 Dyslexia 2.01 Solano 2000 PZPAPN E.T.C. Earth Day Earthquake EB 21 Print Eclypse PS-MPC Edcl Edcl Edcl-B Edcl Edct Edcl Eddie Eddie 3 V651 Eddie 2000 V2000 Edge Friday 13th Egg-1000 Egg-1000 Egg-1000 Eight Tunes Eight Tunes Einstein Einstein EkoT EkoT Eliza Eliza Aussie Parasite Emf-625 Emmie Emmie Empire Evil Empire Encroacher DAME Encroacher 2 DAME End Of End Of Enemy Enemy England Crazy Eddie Enigma Enigma Enola Enola Erasmus Murphy V-92B Van Fish Fish Evil Evil Evil Empire Evil Empire Evil Empire-A Evil Empire Evil Empire-B Evil Empire Evil Genius NPox Evil Genius 2 NPox Evil Genius 2B NPox Evil Genius 2C NPox Evil Men Evil-B Evil Exebug Exebug Experiments Experiments Experiments-755 Experiments Explode Explode Exterminator Exunt Exunt PZPAPN F-Word Tula F-you Tula FakeVirx Relzfu Fall Cascade Falling Letters Cascade Ping Pong Falling Letters Swap Dir-2 Fat Fat Father Father Father Christmas Father Christmas Faust Spyer Fax Mosquito Fear DAME Feist Feist Fellow Fellowship Fellowship Fellowship Fellowship-B Fellowship Fich Fich Fich-897 Fich FichV Fich Fichv-896 Fichv-896 =11-537 =11-537 Filler Filler Finger Murphy Fingers Fingers Finnish-357 Finnish-709 Finnish-709 Finnish-709 Fish Fish Fish II Fish Fish 6 Fish Fish Fish Fish Fish Fishy Fish Fist Scream Five O'Clock Yankee Doodle Flash Flash Flex Flex Flip Flip Flip-2153 Flip Flip-2153B Flip Flip-2153C Flip Flip-2343B Flip Flower Flower PC Flu Flu-2 PC Flu-2 FoneSex FoneSex Forger Forger Form FORM- Form FORM- Form II FORM- FORM- FORM- FORM-18 FORM- Form-Canada FORM- Fratricide Fratricide Raubkopie Freddy Freddy ew-692 ew-692 ew-718 Frere Frere Jacques Frere Jacques Frere Jacques Frere Jacques-B Frere Jacques Frere Jacques-C Frere Jacques Frere Jacques-D Frere Jacques Friday 13th Friday 13th Friday 13th Friday 13th Friday 13th-B Friday 13th Friday 13th-C Friday 13th Friday 13th-D Friday 13th Friday 13th-NZ Friday 13th Friday The 13th Friday 13th Friday-13th-440 Reset Friends Friends FroDo 4096 Frodo Soft Frodo Soft Frodo Soft-458 Frodo Soft Frogs Frogs Frogs-B Frogs Frog's Alley Frogs Frog's Alley-B Frogs Fu Manchu Fu Manchu Fu Manchu-B Fu Manchu Fumble Typo Funeral Funeral Fungus Fungus Futhark Youth PZPAPN Perfume Sorry Geek Geek Generic Generic Generic Generic Genny-648 Gergana Gergana Gergana II Gergana Gergana III Gergana Gergana IV Gergana Gergana-182B Gergana Gergana-222 Gergana Gergana-300 Gergana Gergana-450 Gergana Gergana-512 Gergana German Telecom Get Password 1 Ghost Ghostballs Ghost Ghostballs Ghostballs Ghostballs Ghostballs.1 Ghostballs Gingerbread Man Gingerbread Man Girafe Glenn Deicide Gliss Gliss Globe Globe HH&H Gnose Gnose Goblin Murphy Golden Gate Alameda GoldGeld GoldGeld Gomb HH&H Goodbye Siskin Gosia Gosia Got-You Got-You Gotcha Gotcha Gotcha-627 Gotcha Gotcha-732 Gotcha Gotcha-906 Gotcha Gotcha-A Gotcha Gotcha-A2 Gotcha Gotcha-B Gotcha Gotcha-E Gotcha Grapje Grapje Greemlin Gremlin Green Green Joker Green Caterpillar 1575 Green Joker Green Joker Green Left Groen Links Green Peace Green Peace Gremlin Gremlin Grither Grither Groen Links Groen Links Groove Groove Groove OW Groove OW Growing Block Growing Block Grue Aussie Parasite Grunt-1 Grunt-1 Grunt-1B Grunt-1 Grunt-3 Grunt-1 Guillon Guillon Guppy Guppy Guppy-B Guppy Guru Meditation Gyorgyi Hungarian Gyro Gyro PZPAPN Hacktic Hacktic Hacktic 2 Hacktic Hafen Hafenstrass Hafenstrass Hafenstrass Hafenstrass 2 Hafenstrass 2 Hafenstrass-1191 Hafenstrass Hafenstrass-1191B Hafenstrass Hafenstrass-D Hafenstrass Hahaha AIDS Haifa Haifa Hallo Halloechen Halloechen Halloechen Halloween Halloween Hammelburg Happy Happy Happy Birthday Joshi Joshi Happy Halloween Halloween Happy N.Y. Happy New Year Happy New Year Happy New Year Happy New Year B Happy New Year Harakiri Harakiri lDays lDays Hary Hary Anto Hary Anto Hary Anto Hastings Hastings Hate Klaeren Hawaii Headache Swedish Boys Hebrew University Heevahava Hehheh Timid Hell Hell Hell-892 Hell Hellraiser Hellraiser Hellween Hellween Hellween-1182 Hellween Here Were Here Hero Hero Hero-394 Hero-394 Hero-506 Hero Hero-506B Hero Hero-B Hero-394 Hemp Hey You HH&H HH&H Hiccup PS-MPC HiDos HiDos Highlander Highlander Hitchcock Hitchcock Murphy Plastique Holland Girl Sylvia Holland Girl 2 Sylvia Holo Holocaust Holocaust Holocaust Hominy Hominy Hominy-B Hominy Hong Kong Azusa Horror Horror Horror-1112 Horror Horror-1137 Horror Horror-1137B Horror Horse Horse 2 Horse 5 Horse-8 Horse-8B Horse Horse Horse %Dropper Horse House House Vivaldi Hungarian Hungarian Hungarian 482 Hungarian 482 Hungarian-B Hungarian Hunt ZeroHunt Hybrid Hybryd Hybryd Hybryd Hydra Hydra Hydra Hydra Hydra-0 Hydra Hydra-1 Hydra Hydra-2 Hydra Hydra-3 Hydra Hydra-4 Hydra Hydra-5 Hydra Hydra-6 Hydra Hydra-7 Hydra Hydra-8 Hydra Hydra-8 Trojan Hydra Hymn Hymn Hymn-2 Sverdlov PZPAPN Ice 9 Ice 9 Ice 9B Ice 9 Iceland Icelandic Icelandic Icelandic Icelandic-IB Icelandic Icelandic-IC Icelandic Icelandic-II Icelandic Icelandic-III Icelandic IKV 528 Idle Idle Ieronim Ieronim Ieronim-512 Ieronim Ieronim-560 Ieronim Ieronim-570 Ieronim Ieronim-600 Ieronim Ieronim-1581 Ieronim IKV-512 IKV 528 IKV 528 IKV 528 Crazy Imp Incom Incom Infinity Infinity Int13 Label Interceptor Interceptor Internal Internal Internal-1459 Internal Internal-B Internal Intruder Intruder Intruder-1326 Intruder Intruder-1440 Intruder Intruder-1967 Intruder Intruder-1988 Intruder Intruder-2336 Intruder Intruder-B Intruder Invader Invader Invol Invol Invol-B Invol Ionkin Ionkin Ionkin-231 Ionkin Ionkin-2372 Ionkin All Sys 9 Iper Iper Iranian Iranian Iraqui Iraqui Warrior Iraqui Warrior Iraqui Warrior Pascal-4260 Maltese Amoeba Gnose Iron Maiden Israeli Suriv 1.01 Suriv 2.01 Suriv 3.00 Israeli Swap It-457 Italian Ping Pong Italian 803 Italian 803 Italian 803-B Italian 803 Italian Italian 803 StarDot 801 Italian Pest Murphy Italian-A Ping Pong Itavir Itavir Itti Itti Itti-A Itti Itti-B Itti IVL-1 Murphy (see HIV) PZPAPN Nowhere Man Sistor Jabberwocky Jabberwocky-B 25TH-B Japan Japanese Christmas Japanese Christmas Japanese Christmas Japanese Christmas-B Japanese Christmas Japanese Christmas-C Japanese Christmas Japanese Christmas-D Japanese Christmas Japanese Cookie Japanese Christmas Japanese-709 Japanese Christmas JD-158 JD-276 JD-356 JD-392 Jeff Jeff Jerk Jerk Jerk-B Jerk 11-30 11-30 -1361 Growing Block -Polish -Yellow Growing Block Jews2 Mayak JKTK Changu Mangu Joanna Joanna Joanna Joanna 1.11 Joanna Joanna-911 Joanna Jocker Joker Joe's Demise JoJo JoJo JoJo 2 JoJo 2 JoJo-B JoJo Joker Joker Joker 2 Joker 2 Joker-01 Joker 2 Joshi Joshi Joshi-B Joshi Joshua Joshua Jump 4 Joy Sistor (see: Sistor-J4J) Bloody! Jeff Junior Junior JVT1 JVT1-B PZPAPN Micropox Kalah Kalah Kalah-499 Kalah Kamasya Murphy Kamikaze Kamikazi Kamikazi Kamikazi Kang Yong Karin Karin Kbug Keme Kemerovo Kemerov Kemerovo Kemerovo Kemerovo Kemerovo-B Kemerovo Kemerovo-C Kemerovo Kennedy Kernel Seventh Son Kersplat PS-MPC Bug-1596 Bug-1720 Bug-1724 Keydrop Keydrop Keydrop Dropper Keydrop Keypress Keypress Keypress-1238 Keypress Keypress-1238B Keypress Keypress-1238C Keypress Keypress-1268 Keypress Keypress-B Keypress Keypress-Chaos Keypress Keypress-E Keypress Keypress-UFO Keypress Keypress-Viring Keypress KEZB Fingers Kiev Kiev 483 Kiev 483 Kiev 483 Kiev 2049 Kiev 2049 Kinison Kinnison-734 Kiwi Kiwi-550 Kiwi-550 Kiwi-550 Klaeren Klaeren Klaw Nygus KLF-356 KLF-356 Kode4 Kode4 Kode4-129 Kode4 Korea Korea Krivmous Krivmous Krivmous-B Krivmous Kthulhu Kthulhu Ku-448 Kuku-448 Kukac Turbo Kukac-2 Turbo Kuku-448 Kuku-448 Kuzmitch PZPAPN Label Label Lamer Mosquito Lancs Lancs Lancs-5476 Lancs Lancs-5882 Lancs Lancs-7376 Lancs Lancspoly Lancs Lao Duong Loa Duong Larry Larry LastDirSect NoInt Lazy Lazy Lazy-2 Lazy LBC Korea LowerCase Leapfrog Leech Leech Leech2 Leech Legalize Legalize Lehigh Lehigh Lehigh University Lehigh Lehigh-2 Lehigh Lehigh-B Lehigh Lehigh-D Lehigh Leprosy Leprosy Leprosy 1.00 Leprosy Leprosy-3 Leprosy (see Leprosy-C) Leprosy-5600 Leprosy Leprosy-B Leprosy Leprosy-C Leprosy Leprosy-D Leprosy Leprosy-FVHS Leprosy Lession Tormentor-205 Lession-1 Tormentor-205 Lession-2 Tormentor-205 Lession-3 Tormentor-205 Lib1172 Liberty-1172 Liberty Liberty Liberty-2 Liberty-2 Liberty-2A Liberty-2 Liberty-2B Liberty-2 Liberty-2C Liberty-2 Liberty-1172 Liberty-1172 Liberty-B Liberty Liberty-C Liberty Liberty-D Liberty Liberty-E Liberty Liberty-F Liberty Liberty-G Liberty Liberty-H Liberty Liberty-I Liberty Liberty-J Liberty Lima Pirate Lippi Lippi-286 Lippi-286 Lippi-286 Lisbon Lisbon Lisbon-B Lisbon Lisbon-B2 Lisbon Little Br Little Br Little Br Little Br Little Br Little Br Little Br Little Br Little Br Little Br Little Br Little Br Little Girl Little Girl Little Girl 2.0 Little Girl Little Girl 3.0 Little Girl Little Pieces Little Pieces Little-139 Little-139 Live Death V800 Live Death 3 Evil Lixo Nuke Tormentor Lixo Nuke Dropper Tormentor Loa Duong Loa Duong Locker Murphy LockUp LockUp LockUp-B LockUp Loki Loki Loki-354 Loki Loki-1237 Loki Lokjaw Lokjaw Lokjaw-Drei Lokjaw Los-693 Los-693 LowerCase LowerCase LowerCase-B LowerCase Lozinsky Lozinsky Lozinsky-1018 Lozinsky Lozinsky-1023B Lozinsky LPT Off LPT Off Luca-309 Luca-309 Lucifer Lucifer LV 1.2 LV 1.2 Lycee Lycee Lycee-1788 Lycee Lycee-1832 Lycee Lycee-1975 Lycee Lyceum Lycee Lythyum Lythyum Lythyum-B Lythyum LZ-2 LZRQ LZRQ PZPAPN M-128 Micro 128 M.I.R. M.I.R. Macabi Yafo Macedonia Macedonia Made Madismo Madismo Magnitogorsk 2560 Magnitogorsk 2048 Magnitogorsk 2048 Magnito-3000 2560 Magnum 2560 Malaga Malaga Malaga-B Malaga Malaise Malaise Malign Malign Malign-575 Malign Malign-630 Malign Malmsey Malmsey Malmsey 2 Malmsey Malmsey 3 Beta Malmsey Maltese Maltese Amoeba Maltese Amoeba Maltese Amoeba Maltese Amoeba-B Maltese Amoeba Mannequin Mannequin Manola Manola ManOWar Dark Lord Manta Manta Marauder Marauder Mardi Bros Mardi Bros Marijuana Marl Marl Matura Matura Mayak Mayak Mayak-2370 Mayak Mazatlan Alameda McWhale PS-MPC Medical Medical Meditation Meditation Meditation-B Meditation Merritt Alameda Mendoza Merde-5 Loki (see: Loki-354) Merde-6 Loki Messina Messy Bomber Metal Thunder Akuku Mexican Mud Mexican Mud Mface Multi-Face MG-2 MG-3 MG-3B MGTU MGTU Michaelangelo Michelangelo Michelangelo Michelangelo Micro 128 Micro 128 Micro Cop Queens Microbes Microbes Micropox Micropox MicroElephant MicroElephant Beta MicroElephant V4 CSL MicroElephant V5 CSL Midnight Serial Killer Blaze Migram Murphy Miky Miky Miky-2390 Miky Milena Milena Milous Cadkill Mimic-Den Zuk PS-MPC Mimic- PS-MPC Mindless Mindless MindRiot MindRiot Mini Mini-45 Mini-35 Mini-45 Mini-44 Mini-45 Mini-45 Mini-45 Mini-46 Mini-45 Mini-97 Mini-45 Mini-99 Mini-45 Minimal Mini-45 MiniMax MiniMax Minimite Minimite Ministry Ministry Minnow ZeroHunt Minsk Ghost Minsk Ghost M.I.R. Mirror Mirror Mistake Typo Mithrandir III LockUp MIX1 Mix1 MIX2 Mix2 MIX/1 Mix1 Mix1 Mix1 Mix1-1636 Mix1 Mix1-B Mix1 Mix2 Mix2 MLTI Red Diavolyata Moctezuma Moctezumas Revenge Moctezumas Moctezumas Revenge Moctezumas Revenge Moctezumas Revenge Moctezumas Revenge 2 Moctezumas Revenge Yafo Monday Black Monday Monkey Monkey Mono Mono Monxla Monxla Monxla B Monxla B Mosquito Mosquito Whale Mozart Invader MPS 4.01 MPS 1.1 MPS 1.1 MPS 3.1 MPS 3.1 MPS 3.2 MPS 3.2 MPS 3.2-B MPS 3.2 MPS 4.01 MPS 4.01 MPS-OPC 1.1 MPS 1.1 MPS-OPC 3.1 MPS 3.1 MPS-OPC 3.2 MPS 3.2 MPS-OPC 4.01 MPS 4.01 MS-748 Pixel MShark MShark Blaze MSTU MSTU MSTU-531 MSTU MSTU-551 MSTU DAME MTE Spawn DAME MTE Spawn 2 DAME MuBark Keypress (see: Keypress-1268) Mugshot Mugshot Mule Mule Multi Multi-123 Multi-2 Sticky Multi-123 Multi-123 Multi-Face Multi-Face Mummy Mummy Mummy 1.0 Mummy Mummy 1.2 Mummy Mummy 2.1 Mummy Mummy 2.1B Mummy Mummy 2.1C Mummy Munich Munich Murphy Murphy Murphy-1 Murphy Murphy-2 Murphy Murphy-3 Murphy Murphy-4 Murphy Music MusicBug Music Bug MusicBug Music Oropax MusicBug MusicBug Musician Oropax Mutant 123 Mutant Mutant 127 Mutant Mutant 128 Mutant Mutant Mutant Mutating Rocko Rocko Mutation Mutation PZPAPN Nagytud Turbo Napolean Complex PS-MPC Nazgul Nazgul NaziPhobia NaziPhobia NCU LI NCU LI Necro Skull Necro Fear Necro Fear Necro Shadow Necro Shadow Necro Shadow-B Necro Shadow Necrop Cracker Jack Bios Nemesis New Generation New New Zealand Newcom Newcom News Flash Leprosy Nina Nina Nines Nines Nines-706 Nines Nines-776 Nines Ninja Ninja Nipper Brain No Frills No Frills No Frills 1.01 No Frills No Frills 2.0 No Frills No Frills 3.0 No Frills No Wednesday PS-MPC NoBock NoBock NoInt NoInt Nomen Nomenklatura Nomenclature Nomenklatura Nomenklatura Nomenklatura Noon Beep Not-586 Not-586 Nothing Do-Nothing Nov 17 Nov 17-768 Nov 17-880 Nov 17-B 17th-B Nowhere Man Nowhere Man Nowhere Man 1.9 Nowhere Man Nowhere Man 2.0 Nowhere Man NPox NPox NPox 2.0 NPox NPox 2.1 NPox NTKC NTKC Nu Way Sticky Nuke Tormentor Null Null Set Null Set Null Set Null-178 Null-178 Number 1 Number One Number of the Beast Number One Number One Number One-Argentina Number One Number One-B Number One Nygus Nygus Nygus-Klaw Nygus PZPAPN Off Ogre KKiller Ohio Ohio Oi Dudley Oi Dudley Old Yankee Yankee 2 Oliver Outland Omega Reset Ondra Ondra Ondra-B Ondra One In Eight One In Ten Icelandic One In Two Icelandic (see: Saratoga) One More Thing Ont-730 Ontario 730 Ontario Ontario Ontario 730 Ontario 730 Ontario II 1024 SBC Ontario III Ontario III Oropax Oropax Oropax-B Oropax Oscar Otto-415 Otto6 Otto6 Otto6 Oulu 1008 Outland Outland OW-37 OW-42 OW-42B OW-64 OW-Trident Oxana Oxana PZPAPN P-45 Polish-45 Evil Phoenix PhoenixD Proud P529 Polish 529 Page PS-MPC Pakistani Brain Pakistani Brain Brain Palette Zero Bug Parasite Parasite Parasite 2 Parasite Parasite 2B Parasite Paris Paris Parity Parity Parity Parity Park ESS Particle Man Particle Man Particle Man 2 Particle Man Pas-5220 Pascal-5220 Pascal-4260 Pascal-4260 Pascal-5220 Pascal-5220 Path Path Pathhunt Pathhunt Patient Patient Patsy RIP-699 Payday )Bandit PCBB PC Flu PC Flu PC Flu-2 PC Flu-2 PC Flu-2B PC Flu-2 PC Flu-2D PC Flu-2 PC Flu-2E PC Flu-2 PC Flu-2F PC Flu-2 PCBB PCBB PCBB PCBB PCBB-11 PCBB PCBB-3 PCBB PCBB-3B PCBB PCBB-1141 PCBB PCBB-3072 PCBB PCBB-5 PCBB PCBB-5B PCBB PCVRSDS Keypress Pearl Harbor Pegg Pegg-833 Pegg-833 Pegg-833 Peking Alameda Pentagon Pentagon Peni YAM-3599 Penza Penza Penza-1210 Penza Perfume Perfume Perfume-2 Sorry Pest Murphy (see Italian Pest) Pfish Mosquito Phalcon Beta Phantom Phantom Phenome Phoenix Phoenix Phoenix 2000 Phoenix 2000 PhoenixD PhoenixD Piazzolla Piazzolla Pieces Little Pieces Pif Paf B v1.0 DoDo Pig-B DoDo Pila Pila Ping Pong Ping Pong Ping Pong-B Ping Pong Ping Pong-C Ping Pong Pirate Pirate Pisello Pisello Pisello-B Pisello Pitch Pitch Pitch-B Pitch Piter Polish 529 Piter2 Polish 529 Pixel Pixel Pixel 2 Pixel Pixel-257 Pixel Pixel-275 Pixel Pixel-277 Pixel Pixel-283 Pixel Pixel-295 Pixel Pixel-297 Pixel Pixel-299 Pixel Pixel-342 Pixel Pixel-740 Silly-365 Pixel-779 Pixel Pixel-837 Pixel Pixel-847 Pixel Pixel-847B Pixel Pixel-850 Pixel Pixel-850 Dropper Pixel Pixel-852 Pixel Pixel-854 Pixel Pixel 877 Silly-365 Pixel-897 Hell Pixel-899 Hell Pixel-899B Hell Pixel-905 Hell Pixie Pixie Pixie 1.0 Pixie Pixie 1.0B Pixie Patient Plague Leprosy (see: The Plague) Plaice Sistor Plastique Plastique Plastique 1 Plastique Plastique 2 Plastique-B Plastique 4.51 Plastique Plastique 5.21 Plastique-B Plastique Invader Plastique-B Plastique-B Platinum Mummy Play Tetris Play Tetris Plov Plovdiv 1.3 Plovdiv 1.1 Plovdiv 1.1 Plovdiv 1.3 Plovdiv 1.3 Plovdiv 1.3B Plovdiv 1.3 Plumbum Plumbum Plumbum-A Plumbum Plumbum-B Plumbum Plumbum-C Plumbum Plumbum-D Plumbum Plumbum-E Plumbum Plumbum-F Plumbum Plumbum-M1 Plumbum Plumbum-M2 Plumbum Plutto Plutto Poem Poem Pogue Pogue Killer Dot Killer Pojer Pojer Polimer Polimer Polimer Tapeworm Polimer Polish 217 Polish 217 Polish 217 B Polish 217 Polish 217 C Polish 217 Polish 457 Self Polish 529 Polish 529 Polish 529B Polish 529 Polish 550 Self Polish 583 Polish 583 Polish 961 Stone`90 Polish Stupid Polish 217 Polish Polish Polish Polish Polish Polish Polish Polish Polish-2 Turbo Polish-45 Polish-45 Polish-376 Polish-376 Polish-583 Polish 583 Portugal-500 Pixel Possessed Possessed Possessed 1.03A Possessed Possessed 1.03B Possessed Possessed 1.07 Possessed Possessed 1.07B Possessed Possessed 1.08 Possessed Possessed-2443 Possessed Possum Possum Prague Joker Shaker Prague.Blinker Blinker Pray ZK900 Pregnant Pregnant Press Press Pretoria Print Print Print Print Prime Prime Prime Evil Prime Prism Flip Problem Problem Problem-734 Problem Problem-856 Problem Problem-863 Problem Profesor Saddam Protect Protecto Protecto Protecto Protecto-1157 Protecto Protecto-1196 Protecto Protecto-1355 Protecto Protecto-2535 CPSU-2535 Proto-T Civil War Proud Proud PRTSC Print Prudents 1210 PS-MPC PS-MPC PS!KO PS!KO-1459 PS!KO-1687 PS!KO-1800 PSQR 1720 Psycho Psychogenius Psychogenius Psychogenius Psychogenius-B Psychogenius Public Enemy Beast-N-Black Puerto Puke Puke-393 Puke-393 Puke-393 PZPAPN QD335 Striker #1 QFresh Friday 13th QQ-1513 Quake Quake Quake-O Queens Queens Queensland Queens Quest ; (see: Dark Quest) Questo DAME Quiet Quiet Quick Quick Quirk Quirk Quit- Dutch 555 PZPAPN R-10 R-10 R-11 R-11 Rabid Avenger Radyum Radyum Radyum 2-707 Radyum Radyum-B Radyum Radyum-C Radyum Rage Rage RAM RAM Random Random Rape-10 R-10 Rape-11 R-11 Rattle Rattle Raubkopi RaubKopie RaubKopie RaubKopie RaubKopie-FRD RaubKopie RCE-1049 Reaper Reaper Reaper Man Reaper %Patcher Pascal-5220 Recovery 382 Recovery Red Diavolyata Red Diavolyata Red Diavolyata B Red Diavolyata RedX Ambulance Car RedX-Any Ambulance Car RedStar Karin RefRef RefRef Refresh Reklama Reklama Relzfu Relzfu Repent Repent Reset Reset Revenge Revenge Attacker Revenge Attacker Revenge Attacker Rigor Mortis RIP-699 RIP-699 RIP-699 Rocko RMIT Leprosy RNA-7408 RNA2 Rocko Rocko Rocko-B Rocko Rosen Rosen Rostov RPKS Den Zuk RPVS RPVS RPVS-B RPVS RSP-1876 RSP-1876 RTL4 RTL4 Russ-1075 Crash Russian Russian Mirror Beeper Russian Mutant Rust Alfa Ryazan Ryazan Rybka Rybka PZPAPN 00B"' PTB" S-847 Pixel Sad-307 Sadam Saddam Saddam Saddam Sadist Sadist SamSoft Keypress SamSoft-B Keypress San Diego Sandwich Sandwich Sara DAME Satan-B Saturday 14th Saturday The 14TH Saturday The 14th Saturday The 14TH Saratoga Icelandic Saratoga 2 Icelandic 1024 SBC Scarey PS-MPC Schrunch PS-MPC Scott's Scott's Valley Scott's Valley Scott's Valley Scream Scream Scream 1B Scream Scream 2 Scream Scream 2-696 Scream Scream 2-732 Scream Scream 2B Scream Scream 2C Scream Scream-650 Scream Scream2 Scream Screaming Fist Scream Screaming Fist 2 Scream Scribble Leprosy Scroll Scroll Scythe Scythe SD-123 Multi-123 Sdir Aussie Dir SeaCat SeaCat Secret Service Shhs Self Self Self-457 Self Self-550 Self Semtex Semtex Semtex-B Semtex Semtex-C Semtex Semtex-D Semtex Seoul Alameda Seneca-B Seneca-B Sentinel Sentinel Sentinel-3 Sentinel Sentinel-5 Sentinel Sept 18 Italian 803 Serena Serena Seventh Son Seventh Son Seventh Son-284 Seventh Son Seventh Son-332 Seventh Son Seventh Son-350 Seventh Son Seventh Son-Kernel Seventh Son Sex Revolution V1.1 Sex Revolution V2.0 Alameda Shhs Shadow Shadow ) Necro Shadow Shadow-2 Shadow Shadow Shadow Shake Shake Shake Dropper Shake Shaker Shaker Shhs Shhs Shield Shield Shifter Shifter Shirley Shirley Shoe_ Ashar Shoe_ Ashar-B Short-45 Mini-45 Sicilian Mob Sicilian Mob Sigalit Cansu Signs Signs Signs of Life Signs Silence Silence Silly Silly Silly Silly Silly-365 Silly-365 Silver Dollar Silver Dollar Silver Dollar-8101 Silver Dollar Silver Surfer Leprosy Simple Simple Simple Minds Simple Minds Sistor Siskin Siskin Siskin-948 Siskin Siskin-1017 Siskin Siskin-Goodbye Siskin Sistor Sistor Sistor-1129 Sistor Sistor-2225 Sistor Sistor-2380 Sistor Sistor-2630 Sistor Sistor-J4J Sistor Sistor-J4J Alpha Sistor Tolbuhin Tolbuhin Skater Skater Skater-977 Skater Skater-1021 Skater Skeleton PS-MPC Skew Skew-469 Skew-469 Skew-469 Skism Skism Skism Skism Skism Skism-1 Skism-808 Skism Simulati Simulati Skull Skull Skull Skull Slayer Slayer Slayer Slayer Slayer-A Slayer Slayer-B Slayer Slayer-C Slayer Slayer-D Slayer Slayer-E Slayer Sledge Hammer Invader Slovak Slovak Slovak 1.00 Slovak Slovak 2.00 Slovak Slovak 2.02 Slovak Slovak 3.00 Slovak Slovak-4 Slovak Slovakia Slovak Slow Slow Slow II Slow Slow III Slow Slow-2131 Scott's Valley Slowdown Slow Smack Murphy Small ARCV Small ARCV Small Small Small-38 Small-38 Small-46 Small-72 Small-178 Small-178 Smiley Smiley Smiley Worm Curse Smithsonian Snow Mix1 Solano Solano 2000 Solano 2000 Solano 2000 Solono B Solano 2000 Solono D Solano 2000 Solomon 1605 thing thing thing-658 thing Sorlec Sorlec Sorlec 3 Sorlec Sorlec 4 Sorlec Sorlec 5 Sorlec Sorry Sorry Soupy Soupy Soupy-Death Soupy South African Friday The 13th South African 350 Friday The 13th Sov-545 Sov-602 Soy Un Spanish Spanish Spanish Fools Spanish Fools Spanish JB Spanish Telecom-2 Telecom Anti-Tel Spanz Spanz Sparse Sparse Sparse-B Sparse Spyer Spyer Spyer-B Spyer Spyer-C Spyer Squawk Squawk Squeaker Squeaker Squisher Squisher St Leos Keypress St. Remi Murphy (see Erasmus) Staf Staf Staff Staf Stahl Stahl Stahlplatte Stahl Stanco Stanco StarDot StarDot 600 StarDot 801 StarDot 600 StarDot 600 StarDot 789 StarDot 789 StarDot 801 StarDot 801 Stasi Stasi Stasi-1728 Stasi Sticky Sticky Stigmata Stink StinkFoot Stink 2 Timid StinkFoot StinkFoot StinkFoot-1273 StinkFoot StinkFoot-2B StinkFoot Stone`90 Stone`90 Stone-90 Stone`90 NoInt -AT Love -Collor -Mexican Mutation Stranger Enemy Striker #1 Striker #1 Stupid Do-Nothing Stupid-1355 Stupid-1355 Sub-Zero Sub-Zero B Subliminal Solano 2000 Subliminal 1.10 Solano 2000 Suicide Sunday Sunday Sunday-2 Sunday-2 Sunday-B Sunday Sunday-C Sunday Sunday Death PS-MPC Suomi 1008 SuperHacker Jerk Surfer Leprosy Suriv 1.01 Suriv 1.01 Suriv 2.01 Suriv 2.01 Suriv 3.00 Suriv 3.00 Suriv 4.02 Suriv 4.02 Suriv A Suriv 1.01 Suriv 2.01 Suriv B Suriv 3.00 Suriv01 Suriv 1.01 Suriv02 Suriv 2.01 Suriv03 Suriv 3.00 Surrender Surrender SVC 3.1 SVC 3.1 SVC 3.1-CHR SVC 3.1 SVC 4.0 SVC 4.0 SVC 4.0-1740 SVC 4.0 SVC 5.0 SVC 5.0 SVC 5.0B SVC 5.0 SVC 5.0C SVC 5.0 SVC 5.0D SVC 5.0 SVC 6.0 SVC 6.0 SVC 6.0-4677 SVC 6.0 SVC 6.01 SVC 6.0 SVC 6.01-B SVC 6.0 SVC V3.1 SVC 3.1 SVC V4.00 SVC 4.0 SVC V5.0 SVC 5.0 SVC-1740 SVC 4.0 Sverdlov Sverdlov Sverdlov-1064 SVC 3.1 Sverdlov-B Sverdlov SVir SVir SVir_0 SVir SVir-A SVir SVir-B SVir Swami Murphy Swank Swap Swap Swedish Swedish Boys Swedish 709 Finnish-709 Swedish Boys Swedish Boys Swedish Disaster Swedish Disaster Swiss 143 Swiss 143 Swiss 1813 Swiss Exebug Swiss Phoenix Swiss Phoenix Plovdiv 1.1 Sylvia Sylvia Sylvia 2 Sylvia Day10 SysLock SysLock Icelandic PZPAPN T-1000 T-1000 Tabulero Tabulero Tabulero 2 Tabulero Tabulero-B Tabulero Tack Tack Taiwan Taiwan Taiwan 2 Taiwan Taiwan 3 Taiwan 3 Taiwan 4 Taiwan 4 Taiwan-B Taiwan Talentless Talentless Talentless Jerk Jerk TalkingHeads TalkingHeads Tannenbaum Christmas Tree Tao Cheng Tao Cheng Tatou Tatou Taunt AIDS Traceback Tel Aviv 1605 Ten Ten ( (see: 1415) Telecom Telecom Anti-Tel Telecom Telecom Anti-Tel Telefonica Telecom Anti-Tel (-1514 (-1514B Terminator Terminator Terminator-2294 Terminator-2294 Terminator-3549 Terminator-3549 Dark Lord Tequila Tequila Test 441 PS-MPC Tester Tester TestVir Tester Test B V1.4 Tester ksgiving 1253 The Plague Leprosy Thimble Thimble Thor Thursday The 12th Monxla Monxla B mark 1 mark 2 Timid Timid Timid-305 Timid Timid-LM Timid Timid-Orig Timid Timor Timor Di-94 Di-101 Di-108 Di-110 Hunter Squisher Mutant Mutant Mutant Dutch Dutch Dutch Mutant Micro 128 Tired Alfa TMTM TMTM Tobacco Tobacco Tobacco-B Tobacco Todor Todor Todor-B Todor Tokyo Tokyo Tolbuhin Tolbuhin Tolbuhin-992 Tolbuhin Tolbuhin-1004 Tolbuhin Tolbuhin-1147 Tolbuhin Tomato Tomato Tongue PS-MPC Tony Tony Tony-203 Tony Tony Tony Tony %Dropper Tony Tonya Skater Tonya 2 Skater Toothless Topler Leech Topo Mosquito Tormentor Tormentor Topsy-900 Badsec Tormentor-205 Tormentor-205 Tormentor-263 Tormentor-205 Tormentor-358 Tormentor-205 Tormentor-360 Tormentor-205 Tormentor-1040 Tormentor Tormentor-1072 Tormentor Tormentor-1072B Tormentor Tormentor-1072C Tormentor Tormentor-1072D Tormentor Totoro Totoro Toys PS-MPC TP04VIR Vacsina TP05VIR Vacsina TP06VIR Vacsina TP16VIR Vacsina TP23VIR Vacsina TP24VIR Vacsina TP25VIR Vacsina TP33VIR Yankee Doodle TP34VIR Yankee Doodle TP38VIR Yankee Doodle TP41VIR Yankee Doodle TP42VIR Yankee Doodle TP44VIR Yankee Doodle TP45VIR Yankee Doodle TP46VIR Yankee Doodle TPWorm TPWorm Traceback Traceback Traceback 3029 Traceback 3029 Traceback II Traceback II Traceback II-B Traceback II Traceback-4 Traceback 3029 Traceback-B Traceback Traceback-B2 Traceback Travel V2000 Traveller Traveller Traveller-B Traveller Tremor Tremor Triple Trivial Mini-45 Trivial-Banana Banana Trivial-Blood Lust Blood Lust Troi Troi Troi-2 Troi Troi-2B Troi Troi-2C Troi Trojector TSoft TSoft TSoft-547 TSoft TSoft-598 TSoft Tu-482 Tu-482 Tuesday Tula Tula Tula-419 Tula Tula-593 Tula Tula-635 Tula Tula-1480 Tula Tumen V.5 Tumen Tumen V1.2 Tumen Tumen V1.3 Tumen Tumen V2.0 Tumen RPVS Turbo @ Turbo Turbo 448 Turbo Turbo Kukac Turbo Turbo Kukac 9.9 Turbo TurboSoft TSoft TurboSoft-547 TSoft TurboSoft-598 TSoft Turkey 1661 Turku Keypress Twer Twer-1000 Twin Twin-351 Twin Peaks Twin Peaks Twin-351 Twin-351 Two Minutes To Midnight TMTM Two Tigers Frere Jacques Typo Typo Typo Typo Typo Typo-712 Typo Typo-867B Typo Tyst Tyst PZPAPN Ucender UFA-1201 UFA-1201 Keypress UIUC Ashar UIUC Ashar Unesco UnExe UnExe Ungame Copyright Urfydus Urfydus Uruguay Uruguay Uruguay 3 Uruguay Uruguay 4 Uruguay Uruguay 5 Uruguay Uruguay 6 Uruguay Uruk-hai Uruk-hai V2100 Kemerovo Attention! Red Diavolyata SVC 4.0 2144-B SVC 5.0 Kemerovo Attention! PZPAPN 1253 V-10 V-1n V-11 V-1n V-1n V-1n V-123 Mutant V-127 Mutant V-20 Gnose V-277 Pixel V-299 Pixel V-30 V-3n V-31 V-3n V-32 V-3n V-3n V-3n V-311 V-345 Pixel V-370 Voronezh-370 V-388 V388 V-801 V801 V-847 Pixel V-847B Pixel V-852 Pixel V-Alert V-IVL110 Malaise V08-15 Fingers V123 Multi-123 V200 Silly V217 Polish 217 V257 Kemerovo V270x V270x V337 V376 Polish-376 V388 V388 V415 V483 V483 V492 V516 V600 V605 V651 V651 V707 V711-2 V791 V801 V800 V800 V800M V800 V801 V801 V817 Italian 803 V920 DataLock V948 V1024 V1024 V1193 Copyright V1226 1226 V1226D 1226 V1226M 1226 V1277 Murphy V1302 Proud V1521 Murphy V1600 Happy New Year V1701New Evil V1701New-B Evil V1963 1963 V2000 V2000 V2000-B V2000 V2100 V2100 V2144 V2480 Crew-2480 V2P1 1260 V2P2 V2P2 V2P6 V2P6 V2P6-B V2P6 V2P6Z V2P6 Vacsina Vacsina VAN Soft VBasic 5120 VBasic-2 Slayer VComm VComm VCL-YD2 VCL-YD2B VCS-Post Vengeance Parasite Vengeance-B Parasite Vengeance-C Parasite Vera Cruz Ping Pong VFSI VFSI VGA2CGA AIDS VHP-2 VHP2 VHP2 VHP2 VHP-348 VHP-353 VHP-367 VHP-435 VHP-547 Path VHP-623 VHP2 VHP-627 VHP2 VHP-757 VHP-776 Victor Victor Video Mode Voronezh-Chemist Vien6 Monxla B IKV 528 Path Polish 583 -634 Re VComm -648E -726B Grither -B 645 -Beta Boys -Beta Boys 730 -CDM.A -CDM.B -CDM.C -Dr Q -Iraqui Iraqui Warrior -Refresh -Yam 92 Vindicator Vindicator B2-969 Strain B Strain B4 Violetta Violetta Violetta-1024 Violetta Violite Violite Viper Viper Viperize Viperize Viperize-B Viperize VirDem VirDem VirDem 2 VirDem VirDem-792 VirDem-792 VirDem-833 VirDem VirDem-1542 VirDem-1542 Viring Keypress Construction Set VCS Friday 13th Viva Mexico Vivaldi Vivaldi VMem VMem VMessiah Nowhere Man Voco Voronezh Voronezh Voronezh B Voronezh Voronezh-370 Voronezh-370 Voronezh-650 Voronezh-Chemist Voronezh-Chemist Voronezh-Chemist Vote Vote Vote-1000 Vote Vote-1004 Vote Vriest Vriest Vulner Weak VVF 3.4 VVF 3.4 VX-163 VX-163 PZPAPN W13-A W13-B W13-361 W13-377 W13-534B W13-Req Walkabout PS-MPC Walker Walker Warez D00d PS-MPC Warning Warning Warrior Warrior Weak Weak Were Here Were Here Westwood Westwood Whale Whale Wharps Wharps Whit LZRQ Why Windows Swedish Boys Wien Wilbur Akuku Wilbur-B Akuku Wilbur-C Akuku Wilbur 2 Akuku Wilbur 3 Akuku Wild Thing Wild Thing 2 Wild Thing 2 Wild Thing 2 Wild Thing-289 Wild Thing 2 WinVir WinVir Windmill Windmill Windmill Dropper Windmill Wirus Pascal-4260 Wisconsin Wisconsin Wishes Best Wishes Witch Witch Wizard 3.0 Wizard 3.0 Wolf Wolfman Wolfman Wolfman Wolfman 2 Wolfman Wonder Wonder Wonder-B Wonder Wonderful Wonderful WordSwap WordSwap WordSwap-1069 WordSwap WordSwap-1085 WordSwap WordSwap-1387 WordSwap WordSwap-1503 WordSwap World Peace World Peace Worm-16850 Worm-16850 Worm-17690 Worm-17690 WVir WinVir WWT 01 WWT 02 WWT 02B WXYC WXYC PZPAPN X-Fungus Fungus Christmas Tree Xabaras Leprosy Tao Cheng Xpeh Xpeh Xpeh-3600 Xpeh Xpeh-3840 Xpeh Xpeh-4048 Xpeh Xpeh-B Xpeh Xuxa Xuxa Xuxa-B Xuxa Xuxa-945 Anti-D Xuxa-1405 Xuxa Bljec PZPAPN Yafo Yafo Yale Alameda YAM-3599 YAM-3599 Yankee 2 Yankee 2 Yankee Doodle Yankee Doodle Yankee Doodle Dropper Slayer Yankee Doodle-1150 Alfa Yankee Doodle-1202 Alfa Yankee Doodle-1905 Yankee Doodle Yankee Doodle-2505 Yankee Doodle Yankee Doodle-2973 Yankee Doodle Yankee Yankee 2 Yankee-go-Home Yankee 2 Yaunch 2559 YD Logon-D Yankee Doodle YD Logon-E Yankee Doodle YD Logon-X Yankee Doodle Year Year Year-6545 Hell Youth Youth Yukon Yukon PZPAPN Z The Whale Whale PS-MPC Zaphod Zaphod Zaragosa Zaragosa Zeppelin PS-MPC Zero Zero Bug Zero Bug Zero Bug Zero Bug B Zero Bug Zero-Hunt ZeroHunt ZeroHunt ZeroHunt ZeroHunt B ZeroHunt Zero Slow Zeroto-O Australian 403 Zherkov Zherkov Zherkov-1882 Zherkov Zherkov-1958 Zherkov Zherkov-2968 Zherkov Zherkov-2970 Zherkov ZMT-252 ZMT-262 ZMT-365 Zoid Zoid Zherkov ZK900 ZK900 ZK900-B ZK900 PZPAPN 0_thru_499 00_(] 0PT_( 30 OW Define 35 OW Mini-45 (Mini-35) 37 OW (OW-37) 38 OW Small-38 42 OW (OW-42 & OW-42B) 44 OW Mini-45 (Mini-44) 45 OW Mini-45 Polish-45 46 OW Mini-45 (Mini-46) (Small-46) 50 OW Mini-45 (Dust) 64 OW (OW-Trident) 67 OW (WWT 01) 72 OW (Small-72) 83 OW Hacktic 90 OW Hydra ] (Hydra-8 Trojan) Hacktic (Hacktic 2) Di ( Di-94) Mini-45 (Mini-97) Mini-45 (Mini-99) 99 OW Itti (Itti-B) Di ( Di-101) 102 OW Argentina-102 AT144 (AT108) Di ( Di-108) African 109 Di ( Di-110) 113 OW V-1n (V-11) AT144 (AT114) Dutch (Dutch -115) Dutch (Dutch -117) AT144 (AT118) AT144 (AT122) Multi-123 Mutant ] (Mutant 123) Dutch (Dutch -124 & 124B) 124 - 125 OW WWT (WWT 02 & WWT 02B) Dutch (Dutch -126) Mutant ] (Mutant 127) Micro 128 Mutant ] (Mutant 128) 128 OW T-1000 Anto 129 OW Kode4 (Kode4-129) Rosen 132 & More Rybka -133) -134) -138) Little-139 139 OW Banana AT144 (AT140) Australian (Australian -142) Australian (Australian -143) Swiss 143 -143) AT144 Australian (Australian -147) Exunt AT144 (AT149) Australian (Australian -150) Polish (Polish -150) 151 OW Yukon Guppy Australian -154) -156) JD (JD-158) Polish (Polish -158) -158) -159) SeaCat -160) 161 OW Itti Australian (Australian -162) VX-163 -167) Null-178 Small-178 Gergana Minimite Medical (191) -198) 200 OW Darth Vader (Darth-4 & Darth-5) Hastings Silly Tony 202 OW Possum PS-MPC (203) Tony (Tony-203) Tormentor-205 207 OW Simple Minds 208 OW I-B (BadGuy 2) Polish 217 Gergana (Gergana-222) Polish (Polish -226) 229 OW Explode Bljec (Bljec3) Ionkin Relzfu Junior Bljec (Bljec3B) Small ARCV Angarsk Civil War Clonewar Bljec (Bljec4B) ZMT (ZMT-252) 252 OW Blaze (MSK) 255 OW Darth Vader (Darth-3) LPT Off Nina (Brenda & Brenda-B) 256 OW Define (Define-256) Kemerovo Pixel (Pixel-257) Tormentor-205 (Tormentor-263) 263 OW I-B (Demon-C) 265 OW I-B (BadGuy) Nazgul V-3n (V-31) V-3n (V-30) Wizard 3.0 268 - V270x 270 OW Darth Vader (Darth-1) 272 OW I-B (Demon & Demon-B) Bljec (Bljec5B) MGTU V-3n (V-32) Pixel (Pixel-275) Bljec (Bljec6) JD (JD-276) Pixel (Pixel-277) Bljec (Bljec6B) Pixel (Pixel-283) Seventh Son (Seventh Son-284) 284 OW Blaze Lippi-286 Bljec (Bljec7) Dismember Wild Thing 2 (Wild Thing-289) Aussie Parasite Bljec (Bljec7B) Pixel (Pixel-295) Pixel (Pixel-297) Little Br (Little Br -299) Meditation Pixel (Pixel-299) Gergana (Gergana-300) Little Br (Little Br -300) 302 OW Blood Lust Timid (Timid-305 & Timid-LM) Timid Little Br Sad (Sad-307) Luca-309 317 OW Druid Timid (Hehheh) 320 OW Leprosy (Leprosy-C) Little Br (Little Br -321) Troi Dest (Dest-1) Yafo ARCV 330 DM (DM-330) Seventh Son (Seventh Son-332) (Kennedy) ARCV-n (ARCV-6) Aussie Parasite (Grue) Hydra ] (Hydra-4) 340 OW Squisher 340 - Boojum Hydra ] (Hydra-3) Pixel (Pixel-342) Hydra ] (Hydra-2) Grunt-1 Pixel 345 OW Darth Vader (Darth-2) Grunt-1 (Grunt-1B) VHP (VHP-348) Little Br (Little Br -349) Small Seventh Son (Seventh Son-350) 350 OW Repent Twin-351 VHP (VHP-353) Loki (Loki-354) JD (JD-356) KLF-356 Finnish-709 (Finnish-357) Bljec (Bljec8) Breeze Tormentor-205 (Tormentor-358) Tormentor-205 (Tormentor-360) Little Br (Little Br -361) W13 (W13-361) Bljec (Bljec8B) ZMT (ZMT-365) VHP (VHP-367) Alex-368 Hydra ] (Hydra-7) Aussie Parasite (El Bljec (Bljec9) 370 OW Leprosy (Leprosy-D) Voronezh-370 Hydra ] (Hydra-6) MShark Bljec (Bljec9B) Polish-376 Aussie Parasite (Dorn) W13 (W13-377) CSL (CSL Beta) PS-MPC (Cheesy) 382 Recovery 388 - V388 Atas 384 OW Cinderella Kalah Hydra ] (Hydra-5) JD (JD-392) Puke-393 Attention! Hero-394 Uruk-hai Kode4 Zaphod Atas (Atas-400) Macedonia Australian 403 Hydra ] (Hydra-1) 405 OW DoDo (Pig & Pig-B) DoDo Happy Otto6 (Otto-415) -415) 416 OW ZeroHunt Tula (Tula-417) 418 - Friday 13th (Friday 13th-D) Blood Tula 423 OW Mindless UnExe V-92 ( V-92B) Simple Albania (Albania-429) Beast-N-Black VCL (Dome3) VHP (VHP-435) 437 - VFSI II (AP-440) Bljec (Bljec7C) NoBock Reset Bljec (Bljec-XYZ) Parity PS-MPC (Test 441) TMTM Beware Kuku-448 Radyum Turbo (Turbo 448) It (Viva Mexico) 449 - Tack Gergana (Gergana-450) Plumbum (Plumbum-D, Plumbum-E) 450 - Geek 451 OW I-B (Exterminator) 452 OW BFD (BFD-452) RPVS It (It-457) Self (Self-457) Swedish Boys (Headache) 457 OW VCL (DM 92 Bios) Frodo Soft (Frodo Soft-458) PS-MPC (Schrunch) W13 (Dushanbe) Swedish Boys (Why Windows) Striker #1 463 - Gosia 466 OW Skull (Skull MPS 1.1 469 - Skew-469 ASP-472 Grunt-1 (Grunt-3) Zu1 Adolf Hitler ARCV-n (ARCV-5) Creeper Shake Bit Addict Highlander 477 OW LV 1.2 Dest (Dest-2) II (AP-480) Beeper Tu-482 DOSHunter Kiev 483 V483 Dest (Dest-3) Flex 491 - Larry 493 OW Seneca-B W13 (W13-Req) Hydra ] (Hydra-8) 495 OW Malmsey 495 - Blinker (Blinker-496) LockUp 498 - Astra (Astra-498) Kalah (Kalah-499) PZPAPN 500_thru_999 Boys Pixel (Portugal-500) R-10 Lythyum RTL4 Albania (Albania-506) 506 - Hero W13 (W13-B) CCCP-510 510 - Astra (Astra-510) 66A Akuku (Columbus, Wilbur Blinker Costeau Friday 13th Gergana (Gergana-512) Kthulhu Polimer Ryazan Shaker SVir Troi (Troi-2) Turbo (Turbo Kukac) 512 OW Gyro Label 512 - 1,023 Ieronim (Ieronim-512) Ontario Surrender VCL (Heevahava) VCL (Beva 96) CSL (CSL V4) Plumbum (Plumbum-M2) 518 - Quake VCL (Beva 33) 519 OW TalkingHeads PS-MPC (No Wednesday) 521 - Astra (Astra-521) Burghofer Terminator Back IKV 528 (AP-529) Polish 529 531 - MSTU PS-MPC (Hiccup) Plumbum W13 Monxla B Sorlec (Sorlec 5) Swedish Boys (Data Molester) 537 - =11-537 Butt Stink ARCV-n (ARCV-7) 542 - Friday 13th ( Plumbum (Plumbum-C) 545 - Sov (Sov-545) PS-MPC (Abraxas) VCL (Dome) (Cracky) TSoft 547 - Path Matura Aussie Dir Self (Self-550) 550 - Kiwi-550 551 - MSTU (MSTU-551) Play Tetris Sorlec (Sorlec 4) Dutch 555 Silence 555 OW Leprosy (Angel Of Death) PS-MPC (Skeleton) 557 - 560 OW Burger Marauder (DeadPool) Marl 560 - 1,119 Ieronim (Ieronim-560) VCL (Beva 32) Frodo Soft Wild Thing 2 568 - X-2 (X-1) Ieronim PS-MPC (Page) PS-MPC (Alien-1) 571 OW Busted Wharps PS-MPC (Walkabout) Albania (Albania-575) Malign Mexican Mud Rage VCL ( 4Zero) 576 OW Bad Brain 576 - Prime Polish 583 585 OW Shhs PS-MPC (Anathema) Not-586 591 OW Leprosy (The Plague) Ear (Anti-Print) Pitch Tula (Tula-593) 595 OW Leprosy (Scribble) 596 OW VCL (Diarrhea6 Trojan) PS-MPC (Tongue) Sorlec TSoft (TSoft-598) Civil War (Civil War II v1.1) VCL (Dial) Ieronim (Ieronim-600) Japanese Christmas 600 OW Shhs (Secret Service) Dewdz Plutto 602 - Sov (Sov-602) 604 - StarDot 600 Albania (Albania-606) Gotcha (Gotcha-E) Do-Nothing Rocko (Mutating Rocko) 609 OW Pirate 610 - Seventh Son (Seventh Son-Kernel) GoldGeld Random Rattle 615 - Friday 13th (QFresh & Edge) -618) Semtex (Semtex-C) -621) VHP2 623 - Friday The 13th , (-NZ 624 OW V-1n (V-10) Emf (Emf-625) PS-MPC (Alien-3) (DOS 625) Gotcha (Gotcha-627) VHP2 (VHP-627) 628 - Malign (Malign-630) Icelandic (Icelandic-II) -634 Re Shadow ) (Shadow-2) Tula (Tula-635) VComm Ice 9 Spanz MPS 3.1 Otto6 Youth PS-MPC (Eclypse) Icelandic (Saratoga) -CDM) PS-MPC (644) PS-MPC (Sunday Death) -645) -B 645) 647 OW Fratricide Genny-648 Incom Lisbon Scream (Scream-650) Voronezh-Chemist V651 VCL ( 4Zero-652) Japanese Christmas (Japanese Cookie) MPS 3.2 654 OW Leprosy (Leprosy-654) -656) 656 - Icelandic ARCV-n (ARCV-3) thing DOS3 lDays 662 - Close VCL ( ARCV-n (ARCV-4) 666 OW Deicide Leprosy Rocko Skull 669 - Saturday The 14TH ARCV Xmas Feist PS-MPC (Kersplat) PS-MPC (Death 2) Bryansk Day10 VCL (Big Taiwan (Doom I-B) ARCV-n (ARCV-8) Plumbum (Plumbum-M1) -Beta Boys) IVP (Bubbles) 684 - MPS 4.01 Flash Mutation 688 OW FoneSex Particle Man Dir ARCV-n (ARCV-2) 692 - 1,172 Scream (Scream 2B & Scream 2C) 692 - 1,362 ew-692 Deicide (Br hood) Los-693 Civil War (Proto-T) Hungarian PS-MPC (696) 696 - 1,176 Scream (Scream 2-696) Radyum (Radyum-B) RIP-699 Penza 702 OW Nowhere Man (VMessiah) PS-MPC (Z10) 704 - Nines Nines (Nines-706) Radyum (Radyum 2-707) Finnish-709 Japanese Christmas (Japanese-709) 711 - 1,191 Scream 712 - 1,396 Enemy Typo , (Typo-712) -712) Shadow -716) Lazy Signs Parasite (Vengeance) 723 OW Psychogenius 723 - Agena -726 & -726B) PS-MPC (Napolean Complex) -Beta Boys 730) 730 - Ontario 730 Sorry Gotcha (Gotcha-732) Infinity 732 - 1,212 Scream (Scream 2-732) Null Set Problem (Problem-734) VCL (Kinnison-734) Vindicator Hydra ] (Hydra-0) PS-MPC (Scarey) 740+ Silly-365 (Silly-740) Anna Green Joker Taiwan ARCV-n (ARCV-9) 745 OW VCL (Voco) 746 - 1,435 Enemy (Stranger) R-11 10 Past 3 Pixel (MS-748) Hungarian (Gyorgyi) Stahl Chad Nygus (Nygus-Klaw) Taiwan (Doom I) Socha Experiments Nygus VHP (VHP-757) 760 - Badsec Perfume Copyright (Ungame) 17th (Nov 17-768) 768 - 1,531 Brainy PS-MPC (Toys) Grither Nines (Nines-776) VHP (VHP-776) Iraqui Warrior Mannequin PS-MPC (Crumble) Pixel (Pixel-779) 779 - Black Monday (Borderline) Hafenstrass (Hafenstrass-D) End Of 10 Past 3 (10 Past 3-B) IVP (Swank) 789 - StarDot 789 791 - V801 Serena 792 OW Acid 792 - 1,526 VirDem-792 795 - 1,306 Scroll Ambulance Car VCL (Earth Day) Plovdiv 1.1 V800 PC Flu Italian 803 804 - StarDot 801 Malmsey (Malmsey 3 Beta) VCL (Kinison) 808 OW Skism (Skism-808) Hafenstrass Pixie No Frills 814 OW MindRiot 814 - Jeff No Frills (No Frills 1.01) VCL (VCL-YD2) 821 - VCL (VCL-YD2B) 822 - Wisconsin ARCV-n (ARCV-1) ARCV-n (ARCV-10) VCL (Donatello) Red Diavolyata Sistor (Sistor-J4J Alpha) VirDem (VirDem-833) 833 - Pegg-833 No Frills (No Frills 3.0) Pixel (Pixel-837) 838 - Were Here 838 - 1,318 Scream (Scream 2) ARCV Friends 839 - Siskin (Siskin-Goodbye) 840 OW Viper No Frills (No Frills 2.0) VCL (Diogenes) Amstrad Pixel (Pixel-847 & Pixel-847B) -Yam 92) Pixel (Pixel-850) 848 - Icelandic (Icelandic-III) Pixel (Pixel-852) Squawk CLS-853 Pixel (Pixel-854) WinVir Problem Marauder Radyum (Radyum-C) Problem (Problem-863) LowerCase Typo Piazzolla 875 - Cossiga 877+ Silly-365 878 - Einstein Gotcha 17th (Nov 17-880) Gotcha (Gotcha-B) 883 - Flower PS-MPC (Cinco de Mayo) 889 - 1,157 Keypress (P 890 OW Budo 891 - Akuku Hell (Hell-892) 892 - Akuku (Metal Thunder) Fichv-896 Fich (Fich-897) Hell (Pixel-897) Suriv 1.01 Suriv 4.02 Lokjaw Hell (Pixel-899 & Pixel-899B) Badsec (Topsy-900) ZK900 Civil War (Civil War III v1.0) Parasite (Parasite 2) Fich Parasite (Parasite 2B) Hell (Pixel-905) Gotcha (Gotcha-906) Joanna (Joanna-911) Joanna (Joanna 1.11 & Jo 918 OW Attack (Attack-918) Saddam DataLock Funeral 921 - Dark Lord (Dark Lord-B) Clonewar (Acme) 923 - Dark Lord 923 - Capitall Swiss Phoenix 927 - Mirror 927 - 1,407 Sticky VCL (Pearl Harbor) VCL (Diarrhea) Viperize Hell Monxla Devil's Dance -943) Dot Killer Anti-D Cyber (Cyber-946) 946 OW Leprosy (Silver Surfer) 948 - Siskin (Siskin-948) 950 - Carioca Manola Ear (Quake-O) Stone`90 NPox Joshua 966 - 968 - 1,479 Youth (Futhark) B2-969) Best Wishes PS-MPC (Chuang Tzu) 972 - Krivmous Astra (Astra-976) Skater (Skater-977) 978 - Klaeren 980 - Chaser 981 - 1,932 983 - Hary Anto Joanna Violite Tolbuhin (Tolbuhin-992) Commy PZPAPN 1000_thru_1999 PT:6 1,000 Bad Boy Forger Jos Plovdiv 1.3 Semtex Tester (Stigmata) (Twer-1000) Vote (Vote-1000) 1,000 - 1,014 Egg-1000 1,000 - 1,019 Bebe 1,001 Soupy (Soupy-Death) 1,004 Tolbuhin (Tolbuhin-1004) Vote 1,008 1008 Little Girl Murphy (AntiChrist) 1,010 - 1,016 Astra (Astra-1010) 1,014 Interceptor 1,014 - 1,028 1,015 1,016 1,017 - 1,025 Siskin (Siskin-1017) 1,018 Lozinsky (Lozinsky-1018) 1,019 - 1,027 Fellowship 1,019 - 1,034 Fellowship (Fellowship-B) 1,021 Skater 1,023 Lozinsky 1,024 1024 SBC 1024 Print Best Wishes (Best Wishes B) Dima Ear Leech Nomenklatura Press Sicilian Mob Tormentor V1024 Warrior 1,024 - 2,046 Thimble Violetta (Violetta-1024) 1,025 Cara 1,028 (Dr Q-1028) 1,030 - 1,040 Mosquito Pisello 1,039 Grapje 1,040 Tormentor (Tormentor-1040) 1,040 - 1,279 Anthrax 1,043 DataLock (DataLock-1043) 1,050 - 1,162 Destructor V4.00 1,051 - 1,064 1,054 (New Generation) 1,055 Black Monday 1,062 Iper 1,062 - 1,076 1,063 Damage Mono 1,055 - 1,069 Black Monday (Black Monday-B) 1,064 SVC 3.1 1,064 - 1,222 (Kuzmitch) 1,066 or 1,076 CyberTech 1,067 1067 1,068 Big Joke 1,069 WordSwap (WordSwap-1069) 1,072 Reaper Soupy Tormentor (-1072, Nuke, Lixo Nuke) 1,075 Crash 1,076 PS-MPC (Clint) 1,077 Armagedon (Armagedon-1077) Jerk Manta Talentless VCS 1,079 Armagedon Doctor Qumak 2 1,083 - 1,097 mark ( mark 2) 1,085 WordSwap (WordSwap-1085) 1,086 Lucifer 1,090 Karin 1.091 Squeaker 1,092 Tumen (Tumen V2.0) 1,092 - 1,106 Cyber 1,098 Murphy (Kamasya) 1,110 Damage (Damage-B) 1,112 Horror (Horror-1112) 1,113 - 1,128 Akuku (Cop-Mpl) 1,117 Beta 1,125 PS-MPC (McWhale) 1,127 Revenge Attacker 1,129 Sistor (Sistor-1129) 1,131 - 1,163 Drop 1,132 Parasite 1,134 Karin 1,137 Horror (Horror-1137 & Horror-1137B) 1,140 Witch 1,141 PCBB (PCBB-1141) 1,145 VCL (Earthquake) 1,146 Gremlin 1,147 Tolbuhin 1,150 - 1,165 Alfa (Alfa-1150) 1,153 Tatou 1,154 1,157 Protecto (Protecto-1157) 1,159 Zaragosa 1,160 Milena 1,161 (Dr Q) 1,163 Cadkill 1,164 Gnose 1,168 Datacrime Ministry 1,171 Murphy (Diabolik) 1,172 Murphy (Finger) Sandwich 1,172 - 1,186 Liberty-1172 1,173 1,181 - 1,195 Spyer 1,182 Hellween (Hellween-1182) 1,188 Dark End 1,191 Hafenstrass (Hafenstrass-1191) 1,193 - 1,194 Eliza 1,193 - 1,208 Copyright 1,196 Protecto (Protecto-1196) 1,199 Pregnant 1,200 Little Girl (Little Girl 3.0) Necro Shadow 1,201 UFA-1201 1,201 - 1,209 1,202 - 1,217 Alfa (Alfa-1202) 1,204 RefRef 1,205 or 1,215 CyberTech (CyberTech-B) 1,205 - 1,220 Copyright (Copyright-1205) 1,206 Vacsina 1,208 Scythe 1,210 1210 1,210 - 1,225 Penza (Penza-1210) 1,214 OW Groove OW 1,218 - 1,245 Oi Dudley 1,220 - 1,237 Traveller 1,220 - 1,238 Traveller (Traveller-B) 1,221 Murphy (Migram) VCL (Diarrhea6) 1,226 1226 1,228 - 1,482 Keypress (Keypress-B) 1,231 Pathhunt 1,232 CheckSum (CheckSum 1.01) 1,232 - 1,486 Keypress 1,232 - 1,487 Keypress (SamSoft) 1,233 CheckSum 1,234 - 1,486 Keypress (Turku & Keypress-Viring) ( & SamSoft-B) 1,236 VirDem 1,237 - 1,252 Loki 1,238 - 1,506 Keypress (Keypress-1238) Keypress (Keypress-Chaos) 1,238 - 1,507 Keypress (Keypress-1238C) 1,241 1241 1,242 Tumen (Tumen V1.3) 1,244 - 1,258 1244 1,247 Gliss Hitchcock 1,249 Argentina 1,250 Murphy (Swami) 1,252 Doom II 1,253 1253 Weak 1,254 StinkFoot 1,255 Tumen (Tumen V1.2) 1,257 - 1,313 Simulati 1,258 - 1,273 Tokyo 1,260 1260 Casper 1,268 - 1,520 Keypress (Keypress-1268) 1,273 Sistor (Sistor-J4J) StinkFoot (StinkFoot-1273) 1,277 Murphy 1,280 Datacrime (Datacrime-B) Vriest 1,284 Murphy (Murphy-3) 1,295 Tao Cheng 1,302 Proud 1,306 Hybryd 1,308 1308 1,310 Barrotes 1,310 OW Twin Peaks 1,319 - 1,333 Intruder 1,320 Iranian 1,322 - 1,337 Fingers 1,326 - 1,340 Intruder (Intruder-1326) 1,332 Sylvia 1,335 Deicide (Deicide 2) 1,338 - 2,602 Wonderful 1,343 Brazilian Bug 1,348 - 1,365 Invol (Invol-B on . 1,352 - 1,603 Slovak (Slovak 1.00) 1,353 Cerburus 1,355 Protecto (Protecto-1355) Stupid-1355 1,357 - 1,371 Malaise 1,358 - 1,372 Dada 1,361 - 1,375 Growing Block 1,362 - 1,377 Friends 1,363 - 1,587 Slovak (Slovak-4) 1,364 - 1,378 Mummy (Mummy 2.1, 2.1B, 2.1C) 1,374 Little Pieces 1,376 Hellween 1,381 - 1,395 Internal 1,385 1385 1,387 WordSwap (WordSwap-1387) 1,392 1392 1,399 - 1,413 Mummy 1,402 Crazy Imp (Crazy Imp-1402) 1,405 Xuxa (Xuxa-1405) 1,409 - 1,421 Invol (on . 1,413 Xuxa 1,413 - 1,425 Australian 1,415 - 1,462 ( (1415) 1,417 Murphy (Cemetery) 1,417 - 1,431 Spanish Fools 1,422 Fungus 1,426 - 2,157 V2P2 1,436 - 1,450 Sadist 1,440 - 1,456 Intruder (Intruder-1440) 1,441 Multi-Face 1,445 Crazy Imp 1,449 - 1,463 Father 1,450 - 1,478 Minsk Ghost 1,452 - 1,465 1452 Antimon 1,458 - 1,472 1,459 1,459 - 1,473 ; (PS!KO-1459) Internal (Internal-1459) 1,463 1,475 Digger 1,480 Murphy (Murphy-4) 1,480 - 1,494 Tula (Tula-1480) 1,480 - 1,981 Datacrime (Datacrime IIB & IIC) 1,488 Suriv 2.01 1,489 - 1,503 Mummy (Mummy 1.0) 1,496 Solano 2000 (Subliminal 1.10) 1,539 Christmas Tree 1,500 Frogs 1,501 Attack (Attack-1501) 1,503 WordSwap (WordSwap-1503) 1,504 - 1,519 Patient 1,508 PS-MPC (Zeppelin) 1,508 - 1,522 Carfield 1,513 1,514 Datacrime (Datacrime II) 1,518 - 1,569 ( (Ten (-1514) 1,521 Murphy (Murphy-2) 1,522 - 1,537 Aragorn 1,530 - 1,544 CB-1530 17TH) 1,536 Month 4-6 Zero Bug 1,540 - 1,554 Totoro 1,542 - 1,552 Mosquito (Lamer, Pfish, Topo) 1,542 - 3,028 VirDem-1542 1,546 - 1,634 Ninja 1,552 - 1,568 1,554 1,560 Alabama 1,561 s (Trojector) 1,562 - 1,576 Timor 1,568 Coffeeshop-1568 1,569 CheckSum (CheckSum-1569) 1,575 - 1,591 1575 1,576 1,580 OW Hellraiser 1,581 Ieronim (Ieronim-1581) 1,585 Demolition 1,589 Hominy 1,590 Arriba 1,594 1,598 - 1,620 Bug ( Bug-1596) 1,600 Happy New Year Voronezh 1,600 - 1,615 Edcl 1,605 1605 1,610 1,614 ; (Amilia) Murphy (HIV) 1,614 - 1,628 VVF 3.4 1,618 - 1,634 Mix1 1,621 Cascade (Cascade-1621) 1,624 Yankee 2 (1624) 1,636 Sunday 1,636 - 1,650 Mix1 (Mix1-B) 1,639 - 1,653 Basilisk 1,641 Bandit Hafenstrass 2 1,641 - 1,651 Baobab 1,642 Murphy (Locker) 1,658 1,661 1661 1,663 Tumen (Tumen V.5) 1,670 Oxana 1,673 - 1,771 Slovak (Slovak 2.00) 1,675 - 1,677 PCBB 1,680 PCBB (PCBB-5 & 5B) 1,682 Murphy (Erasmus) 1,683 - 1,698 Cheeba 1,686 NPox (NPox 2.1) 1,687 - 1,701 ; (PS!KO-1687) 1,689 SVC 4.0 1,691 - 1,706 Chemmy Cheeba (Cheeba-1691 & Cheeba-1691B) 1,694 - 1,704 NCU LI 1,700 Necro Shadow (Necro Shadow-B) 1,701 Cascade Evil JoJo 1,701 - 1,773 Chang 1,703 JoJo 2 1,703 - 1,717 Malmsey (Malmsey 2) 1,704 Cascade Phoenix PhoenixD 1,706 Cascade (Cascade-1706) 1,710 - 1,725 Alfa (Rust) 1,712 - 1,731 Alfa (Alfa-1712) 1,716 - 1,728 Slow 1,716 - 1,730 Slow (Slow II & Slow III) 1,719 PCBB (PCBB-3) 1,719 - 1,733 1720 1,722 PCBB (PCBB-3B) 1,722 - 1,744 Bug ( Bug-1720) 1,724 - 1,759 Bug ( Bug-1724) 1,728 - 1,742 Stasi 1,731 - 1,746 Pila Year 1,735 - 1,749 (Czech) 1,740 SVC 4.0 (SVC 4.0-1740) 1,745 - 1,759 M.I.R. 1,746 - 1,766 Alfa (Alfa-Tired) 1,751 - 1,773 Zoid 1,755 Enigma 1,767 - 1,779 1,776 1,776 - 1,965 Davis 1,778 Murphy (Delyrium) 1,781 Legalize 1,788 Lycee 1,792 Barcelona 1,800 NPox (NPox 2.0) 1,800 - 1,814 1,801 ;1801) 1,800 - 1,815 ; (Dark Quest) 1,803 PS-MPC (Warez D00d) 1,803 - 1,817 ; (PS!KO) 1,804 - 1,805 1804 1,808 - 1,822 Frere Jacques RAM (on . 1,813 Suriv 3.00 1,819 - 1,829 Westwood 1,823 Necro Fear 1,825 - 1,888 Poem 1,832 Lycee (Lycee-1832) 1,835 1835 Murphy (Smack) 1,838 - 1,891 1840 1,838 - 2,088 All Sys 9 1,864 dBASE 1,864 - 1,878 Enola 1,865 - 1,883 Hymn 1,870 - 1,884 Freddy 1,876 RSP-1876 1,881 Father Christmas 1,882 - 1,896 Zherkov (Zherkov-1882) 1,888 - 1,902 Groen Links 1,888 - 2,160 RaubKopie (Raubkopie-FRD) 1,898 - 1,909 1,904 - 1,918 1,905 - 1,924 Yankee Doodle (Yankee Doodle-1905) 1,914 - 1,929 (Get Password 1) 1,917 Datacrime (Datacrime IIB) 1,919 Pojer 1,946 - 2,111 V2P6 1,947 - 1,961 ; (Kang Yong) 1,910 Murphy (Italian Pest) 1,951 Murphy (Goblin) 1,951 - 1,965 Alexander 1,958 - 1,970 Zherkov (Zherkov-1958) 1,961 Yankee 2 1,962 - 1,977 Sverdlov 1,963 1963 1,967 - 1,981 Intruder (Intruder-1967) 1,969 - 2,091 Slovak (Slovak 2.02) 1,972 OW Leprosy (Xabaras) 1,971 - 1,985 Eight Tunes 1,975 Lycee (Lycee-1975) 1,987 - 1,994 Smiley 1,988 - 2,002 Intruder (Intruder-1988) 1,990 - 2,261 V2P6 (V2P6-B) 1,991 Albanian 1,992 OW Skism 1,993 Todor PZPAPN 2000_thru_3999 2,000 EkoT Phoenix 2000 Solano 2000 V2000 V82 2,000 - 2,014 11-30 2,011 Halloechen 2,018 - 2,127 TPE (Civil War IV v1.1) 2,022 - 2,035 Como 2,045 Murphy (Br 2,048 Bios Crusher Ear (Suicide) Magnitogorsk 2048 Ontario III 2,048 - 2,062 Tabulero 2,048 - 2,063 Quiet 2,051 Black Wizard 2,051 - 2,064 Kiev 2049 2,051 - 2,177 Slovak (Slovak 3.00) 2,053 - 2,068 Discom 2,064 Wolfman 2,064 - 2,078 (Soy Un) 2,068 - 2,161 TPE (Civil War V v1.0) 2,071 OW Silver Dollar 2,076 - 2,364 V2P6 (V2P6Z) 2,080 Fu Manchu 2,083 Staf 2,086 Fu Manchu 2,100 V2100 2,109 - 2,445 Adolph 2,112 - 2,126 PC Flu-2 2,131 - 2,140 Scott's Valley 2,134 - 2,148 PC Flu-2 (PC Flu-2D & PC Flu-2E) 2,136 - 2,150 Outland 2,141 - 2,157 PC Flu-2 (PC Flu-2B) 2,144 - 2,159 2,153 Flip (Flip-2153 & Flip-2153B) Flip (Prism) 2,153 - 2,217 2153 2,156 - 2,170 PC Flu-2 (PC Flu-2F) 2,156 - 2,171 Tomato 2,161 - 2,175 2,204 Bomber 2,208 - 2,228 Moctezumas Revenge 2,218 OW Leprosy (Leprosy-FVHS) 2,219 - 2,491 RaubKopie 2,225 Sistor 2,232 - 2,251 SysLock (Cookie) 2,248 (Horse-8 & Horse-8B) 2,274 Phantom 2,268 - 2,313 Silly 2,287 - 2,294 Mix2 2,294 Terminator-2294 2,319 Horror 2,332 - 2,346 Casino 2,332 - 2,859 Idle 2,336 - 2,350 Intruder (Intruder-2336) 2,339 Mayak 2,343 Flip 2,350 - 2,364 Miky 2,351 - 2,372 Haifa 2,351 Ghostballs 2,355 - 2,370 Munich 2,358 - 2,373 Haifa (Mozkin) 2,367 - 2,381 Possessed (Possessed 1.03A) Possessed (Possessed 1.03B) 2,370 Mayak (Mayak-2370) 2,372 Ionkin (Ionkin-2372) 2,380 Sistor (Sistor-2380) 2,383 - 2,446 2,390 - 2,404 Miky (Miky-2390) 2,405 Deicide (Deicide-2405) 2,443 - 2,457 Possessed (Possessed-2443) Possessed (Possessed 1.07B) 2,443 - 2,458 Victor 2,446 - 2,460 Possessed Possessed (Possessed 1.07) Possessed (Possessed 1.08) 2,468 Tequila 2,480 Crew-2480 2,504 - 2,564 Maltese Amoeba 2,504 - 2,571 Maltese Amoeba (Maltese Amoeba-B) 2,505 - 2,524 Yankee Doodle (Yankee Doodle-2505) 2,535 CPSU-2535 2,552 - 2,637 Uruguay (Uruguay 3) 2,559 - 2,933 2559 2,560 2560 2,570 Deicide (Deicide-2570) 2,576 - 2,590 Taiwan 4 2,600 2,600 - 2,715 Crazy Eddie 2,612 - 2,626 Malaga 2,615 Criminal 2,623 - 2,633 2623 2,630 Sistor (Sistor-2630) 2,638 - 2,653 Urfydus 2,664 - 2,678 CHCC 2,702 Emmie 2,718 - 2,859 Uruguay (Uruguay 4) 2,720 Invol (Invol-B on .SYS 2,723 Reklama 2,725 - 2,994 Keypress (Keypress-UFO) 2,754 - 2,894 DAME (MTE Spawn 2) 2,755 - 2,800 Oropax (Oropax-B) 2,756 - 2,806 Oropax 2,768 - 2,783 SysLock (Advent-B) 2,772 Yankee Doodle (Yankee Doodle-B) 2,774 Gingerbread Man 2,794 - 3,069 Beer 2,832 Invol (on .SYS PS-MPC (Mimic- 2,850 - 3,125 Beer (Beer-2850) 2,859 - 2,873 Liberty 2,869 - 2,883 Liberty-2 2,877 - 2,891 Sunday-2 2,881 - 2,900 Casteggio 2,885 Yankee Doodle 2,899 Yankee Doodle 2,900 - 2,908 Taiwan 3 2,900 - 2,914 Tobacco 2,918 - 2,927 ABC (ABC-2918 & ABC-2918B) 2,930 Spanish Traceback II 2,952 - 2,972 2,968 - 2,987 Yankee Doodle (YD Logon-X) 2,968 - 2,982 Zherkov (Zherkov-2968) 2,970 - 2,984 Zherkov (Zherkov-2970) 2,971 - 3,227 DAME (Questo) 2,971 - 3,235 DAME (DarkStar) 2,973 - 2,986 Yankee Doodle (Yankee Doodle-2973) 2,973 - 3,850 Pogue 2,982 - 3,227 DAME (CryptLab) 3,000 2560 (Magnito-3000) 3,000 & Over DAME 3,004 - 3,019 Plastique (Plastique COBOL) 3,012 - 3,020 Plastique 3,029 Traceback 3029 3,039 - 3,117 TPE (Girafe) 3,040 - 3,183 3040 3,045 - 3,060 Newcom Yankee Doodle (YD Logon-D,-E) 3,052 - 3,067 Got-You 3,066 Traceback 3,072 PCBB (PCBB-3072) Warning 3,072 - 3,104 3,103 SVC 5.0 3,227 - 3,483 DAME (Encroacher & Encroacher 2) 3,291 VMem 3,321 Atas II 3,424 OW Tyst 3,445 3445- 3,517 RAM (on . 3,539 - 3,717 DAME (Dedicated 3) 3,549 OW Terminator-3549 3,551 SysLock 3,568 - 3,668 Andre 3,582 - 3,758 DAME (Dedicated 2) 3,584 Fish 3,599 YAM-3599 3,600 - 3,615 Xpeh (Xpeh-3600) 3,646 - 3,708 Groove 3,696 ; (Rabid Avenger) 3,700 Telecom 3,784 Holocaust 3,808 VCL (B-52) 3,820 - 3,974 DAME (Coffeeshop) 3,840 Sparse Xpeh (Xpeh-3840) 3,840 - 7,678 Violetta 3,845 - 3,977 DAME (Coffeeshop 2) 3,846 - 3,861 Walker 3,880 Itavir PZPAPN 4000_and_Over 4,000 Tremor 4,016 Xpeh 4,031 OW Kamikazi 4,048 Xpeh (Xpeh-4048) 4,091 HH&H 4,096 4096 Cmdr Bomber Plastique-B 4,096 - 4,110 Invader 4,096 - 4,111 Invader (Danube) 4,099 - 4,112 Shirley 4,102 - 4,112 Vivaldi 4,112 - 4,126 Mule 4,240 OW NaziPhobia 4,243 PS-MPC (Mimic-Den Zuk Trojan) 4,260 OW Pascal-4260 4,625 Sentinel 4,644 SVC 6.0 4,661 SVC 6.0 (SVC 6.01) 4,677 SVC 6.0 (SVC 6.0-4677) 4,828 OW Nowhere Man (Nowhere Man 2.0) 4,870 OW 4870 4,879 Uruguay (Uruguay 6) 4,893 PS-MPC (Mimic-Den Zuk) 4,909 - 4,925 Paris 4,915 OW Ondra (Ondra-B) 4,928 Micropox 5,000 OW Ondra 5,085 - 8,847 5,106 - 9,141 LZ (LZ-2) 5,120 5120 5,120 - 5,135 Slayer 5,152 Shield 5,173 Sentinel (Sentinel-3) 5,220 OW Pascal-5220 5,302 5,402 Sentinel (Sentinel-5) 5,476 Lancs 5,488 OW Harakiri 5,600 OW Leprosy (Leprosy-5600) 5,792 5,856 5,882 Lancs (Lancs-5882) 6,007 OW Madismo 6,144 OW DisDev 6,258 6,286 OW Nowhere Man 6,540 OW Fat 6,610 Globe 6,666 - 6,746 DAME (MTE Spawn) 6,672 Shifter 7,296 7,360 Animus (Animus-7360) 7,376 Lancs (Lancs-7376) 7,392 Animus (Animus-7392) 7,408 RNA (RNA-7408) 7,424 OW Wonder 7,529 Stanco 7,808 7808 8,064 AIDS II 8,101 OW Silver Dollar (Silver Dollar-8101) 9,216 & Larger Whale 9,977 Quirk 10,000 Halloween 11,636 OW House 12,032 OW Number One 12,969 TPWorm 13,952 OW AIDS 15,022 OW Green Peace 15,392 16,850 Worm-16850 17,690 Worm-17690 23,310 - 23,325 Chang (Chang 007) 23,963 NTKC 29,233 - 29,372 Joker 2 Up to 31,125 MiniMax 63,491 Murphy (Br PZPAPN Entry Fields 00D = `PTD Qof the entries in Hyper consists of several fields. #is a brief description of the contents of Qfield. For fields y, or a further explanation may be necessary of possible content, selecting the field provide the : One of the more s for the . The entries 8ed in Hyper alphabetized field. the same may be referred to by. s are or A.K.A.'s. : The field 7a value indicates how 6or un 6the is in the public domain. H: The brecorded =for the If the yis not the 8ed in field be the a sample was ~: In the event brecorded location Nnot correspond to the ating geographic location, field . It 8the geographic location of 1to the may be noticed by s. Examples of typical may be field is , if selected. The country or geographic location where the is believed to ated R: The (of the it has component. For vs, the ras N/A, for not applicable. 4: The rfor a indicate the general behavior characteristics of the The detection method entry indicates how to determine if a by the . Where the can be detected a shareware, public domain, or readily commercial product, it is r. Note "+" product's number indicates s of the product forward are applicable. Brief instructions on how to remove Where a shareware, public domain, or readily commercial remove the , it is hincludes yabout pbut not limited to: historical y, possible , possible damage the may cause, and criteria. PZPAPN The , or status, field 7one of the cvalues indicate how 6the is in the public domain. The is one of the most reported to various groups gather ustatistics. Most of groups are in the . Where a has had many reports fa specific geographic area, the field where x is an indicator of geographic location. Endangered: The "Endangered" classification of es are are very un 6and were fairly recently ~. Due to characteristics of es, it is highly unlikely ever a widespread problem. It Nn't mean don't exist, just the probability of one becoming sby the is fairly low. Extinct: The "Extinct" classification is for at one widespread (ie. not a research was never released into the public domain), but mnot had a reported uin at least one year. It is still possible one could one of es, but the probability is extremely low. New: The "New" category is for recently by the author and Hyper usually carry a "new" status on entries for one to three months inclusion in Hyper es are were recently in the last year) ~but do not to be widespread. es, as a general rule, characteristics would make them a possible future problem. " ma higher probability of one becoming Endangered or Extinct es, but are much less likely to be Research: A "Research" is a by at least one researcher fits source or author. are not released into the public domain, so are highly unlikely to be detected on computer researchers. Rumored: The "Rumored" classification is for the author has yabout, but no sample of the made for analysis. Any es in classification should be considered a grain of salt, may not actually exist. The " " classification is for those where the submission of the to anti- researchers is suspect for any number of reasons, or is very little about the of the The " " classification is for es. es of historically not a major threat as uof a host is very obvious. Host are corrupted and no longer function. While it is possible to sby one of es, it is extremely unlikely to accidently PZPAPN The contents of the " :" field 7easily identifiable 1to the may be noticed by s experiencing . Typical entries in field include, but is not limited to: graphics slowdowns music sound effects BSC ( 2- may require a cold re Jto find) PZPAPN Dindicates how to determine if a or sby the . Anti- products referenced in Hyper - XTree Company's <commercial> - Dr. Solomon's Anti- Toolkit <commercial> - Central Anti- <commercial> - - Central Anti- <commercial> C - Commcrypt's Detect Plus <commercial> P - Softech's Dr <commercial> \ - Fridrik Skulason's \Package ,RAC's Gobbler 2 - IBM Anti- <commercial> IBM - IBM's ning <commercial> }Software's Anti- <commercial> - Intel's LanProtect NLM <commercial> NAV - Norton Anti <commercial> - Certus International's <commercial> - McAfee Associates' NetShield NLM <commercial> - Sophos' <commercial> - Sophos' for Netware (NLM) <commercial> Micro Devices' PC <commercial> - Fifth Generation ' Untouchable <commercial> - Leprechaun's Buster <commercial> VET - Cybec's VET <commercial> - RG Software's Professional <commercial> - MicroCom's <commercial> - XTree Company's <commercial> - McAfee Associates' - Safetynet's <commercial> PZPAPN yon how to remove the . Specific products are mentioned actually dis xthe not just Athe CleanUp - McAfee Associates' CleanUp DOS COPY - Use the DOS COPY 5to copy snon- %able Ks to newly formatted, Ks. Do not use the DOS DISKCOPY Ks, or the new DOS SYS - Use the DOS SYS Be sure you power down the b, and fa write protected J, or the SYS copy the Note: DOS SYS not dis xnon- I, so you need to use the DOS COPY 5for non- - Fridrik Skulason's \package - McAfee Associates' MD v. Be sure to use the corresponds to your DOS release. NAV - Norton Anti - MicroCom's PZPAPN Relationship Chart Relationship Charts Alameda Chart Chart Possessed Chart Cascade Chart Keypress Chart Scream Chart ;Chart Leprosy Chart Chart Flip Chart Murphy Chart Syslock Chart Friday 13th Chart N. Hacker Chart ]Chart Hydra ]Chart Pixel Chart Traceback Chart Icelandic Chart Ping Pong Chart Chart Relationships PZPAPN Alameda Chart Alameda Alameda-2 Alameda 1.2M Golden Gate Golden Gate-B Golden Gate-C PZPAPN Cascade Chart Cascade (1701) 1701-B 1704 1704 Format 1704-B 17Y4 Cunning 1661 1661-B 1661-C Cascade-1621 Cascade-1706 JoJo JoJo 2 JoJo-B 1701-Yap PZPAPN ;Chart V1024 1963 Amilia Boroda CB-1530 Edcl Edct Edcl-B Alexander ;1801 Rabid Avenger ;-Romanian Dark Quest Evil Men Father Kang Yong Outland PS!KO PS!KO-1800 PS!KO-1687 PS!KO-1459 V651 V800 V800M V2000 V2000-B V2100 M.I.R. Apocalypse II VAN Soft Diamond Diamond-B Ah-B Damage Damage-B Lucifer Gremlin PZPAPN Flip Chart Flip Flip-2153 Tequila Flip-2153B Prism Flip-2343B PZPAPN Friday 13th Chart Friday 13th Friday 13th-B Friday 13th-C Friday 13th-D Friday 13th-NZ Brazilian Bug QFresh Edge PZPAPN Hydra ]Chart Hydra-0 Hydra-1 Hydra-2 Hydra-3 Hydra-4 Hydra-5 Hydra-6 Hydra-7 Hydra-8 PZPAPN Icelandic Chart Icelandic Icelandic-IB Icelandic-IC Icelandic-II Icelandic-III Dec 24th Mix1 Mix1-B Snow Mix2 Saratoga PZPAPN Chart Suriv 3.00 Fu Manchu Taiwan 3 Fu Manchu-B JVT1 JVT1-B Messina Nemesis Ucender RAM New Payday Sunday Sunday-B Sunday-C Sunday-2 Sunday-2B Carfield Spanish JB 1720 (PSQR) Australian 1720-B PCBB PCBB-3 PCBB-3B PCBB-5 PCBB-5B PCBB-3072 PCBB-1141 1210 (Prudents) 1244 1244-B Frere Jacques Anarkia Anarkia-B Antiviru Slow Scott's Valley Slow II Slow III Westwood 1605 1605-B Park ESS Skism-1 Skism (See HM2) Discom Captain Trips Captain Trips 2 Swiss 1813 Phenome Apocalypse Mule Get Password 1 25TH 25TH-B Barcelona Czech Dragon Freddy 11-30 -Polish Moctezumas Revenge Moctezumas Revenge 2 Mummy 1.0 Mummy Mummy 2.1 Mummy 2.1B Mummy 2.1C Oscar Puerto Bogota Soy Un Sub-Zero Sub-Zero B Tabulero Tabulero-B Tabulero II Timor Totoro Triple PZPAPN Keypress Chart Keypress Keypress-B Keypress-E Keypress-1238 Keypress-1238B Keypress-1238C Keypress-1268 Keypress-Chaos Keypress-UFO SamSoft SamSoft-B St Leos Turku Keypress-Viring PZPAPN Leprosy Chart Leprosy Leprosy-B The Plague Angel Of Death Leprosy-654 Leprosy-5600 Leprosy-FVHS Leprosy-C Leprosy-D RMIT Scribble Silver Dollar Silver Dollar-8101 Silver Surfer Xabaras PZPAPN Murphy Chart Murphy Murphy-2 Murphy-4 HIV Tormentor Creeper Creeper-B Tormentor-1040 Tormentor-1072 Tormentor-1072B Tormentor-1072C Tormentor-1072D Nuke Lixo Nuke Migram Italian Pest Smack Goblin Swami Diabolik Murphy-3 Finger Erasmus AntiChrist Locker Kamasya Cemetery Delyrium PZPAPN N. Hacker Chart Horse 2 Horse Horse 5 Horse-8 Horse-8B PZPAPN Pixel Chart Pixel Amstrad Pixel-847B Pixel-852 Pixel-854 Amstrad-Luz Amstrad-End Is Near Pixel-299 Pixel-277 Pixel-295 Pixel-283 Pixel-275 Pixel-257 Pixel-342 MS-748 Pixel-779 Pixel-837 Pixel-850 Dropper Pixel-850 Hell Hell-892 Pixel-897 Pixel-899 Pixel-899B Pixel-905 Silly-365 Silly Pixie Pixie 1.0B Portugal-500 Pixel-297 PZPAPN Ping Pong Chart Ping Pong Ping Pong-B Ping Pong-C Big Italian Typo Print Print Ghostballs Ghostballs.1 PZPAPN Possessed Chart Possessed 1.03A Possessed 1.03B Possessed-2443 Possessed 1.07B Possessed 1.07 Possessed 1.08 Possessed PZPAPN Scream Chart Enemy Stranger Emf Scream Scream 2 Scream 2-696 Scream-650 Scream 2-732 Scream 2B Scream 2C Scream 1B Emf-625 PZPAPN Chart Rostov Sex Revolution V1.1 Sex Revolution V2.0 -Collor -Mexican Swedish Disaster -AT Love Cansu Evil Empire Evil Empire-B HiDos Horse Michelangelo Monkey Parity Mutation Deunis WXYC PZPAPN Syslock Chart SysLock Macho Macho-B Advent Advent-B Cookie PZPAPN ]Chart -198 Note: The -163 or is not related to the PZPAPN Traceback Chart Traceback II Traceback Traceback-B Traceback-B2 Traceback 3029 Traceback II-B Spanish PZPAPN Chart Father Christmas NTKC Lisbon Lisbon-B Lisbon-B2 Ghostballs Ghostballs.1 1260 V2P2 V2P6 V2P6Z V2P6-B Casper Adolph Oi Dudley W13 (V-534) W13-B (V-507) Dushanbe Plumbum Plumbum-B Plumbum-C Plumbum-D Plumbum-E Plumbum-F Plumbum-G Plumbum-M1 Plumbum-M2 W13-Req W13-361 W13-377 Wien (Poland) Vien6 -B 645 -648E -634 Re -Refresh Violite B2-969 Grither VHP-348 VHP-353 VHP-367 VHP-435 VHP-623 VHP-627 VHP-757 VHP-776 Iraqui Warrior Arf-B Dr Q Dr Q-1028 Genny-648 Incom Interceptor Monxla Monxla B Polish 583 Sicilian Mob Parasite Parasite 2 Parasite 2B Vengeance Vengeance-B Vengeance-C Cracky Kuzmitch Mexican Mud New Generation Rattle Twer-1000 -Beta Boys -Beta Boys 730 -CDM.A -CDM.B -CDM.C -YAM 92 Viperize Viperize-B PZPAPN Relationships 10 Past 3 10 Past 3-B 334 334-B 382 Recovery 382 Recovery.1 512 512-B 512-C 512-D 512-E 512-F 834 834-B (Arab) 1226 1226M 1226D 1226-B 1963 1963-B 2560 2560-B 2560-C Magnitogorsk 2048 Magnum Magnito-3000 4096 4096-B 4096-C 4096-D 4096-E Fish Whale Fish II 5120 Slayer AirCop AirCop-B Akuku Metal Thunder Akuku-3 Cop-Mpl Wilbur Wilbur-B Wilbur-C Wilbur 2 Wilbur 3 Columbus Alfa-1150 Alfa-1202 Alfa-1712 Alfa-Tired Ambulance Car RedX-Any Ambulance Car-B Animus Animus-7392 AP-529 AP-400 AP-440 AP-480 AP-480B AP-440B Anti-Tel Telecom Holocaust Armagedon Armagedon-1077 Armagedon #911 Astra-976 Astra-1010 Astra-498 Astra-510 Astra-521 AT144 AT149 AT108 AT114 AT118 AT122 AT140 Atas Atas II Atas-400 Attack-918 Attack Azusa Azusa 2 Bad Boy Bad Boy 2 Beta Ministry Best Wishes Best Wishes B Best Wishes C BFD-452 Black Monday-C Black Monday Black Monday-B Borderline Blaze Blood Blood2 Boys Boys 2 Brain Ashar Clone Chaos Nipper Cannabis Cannabis 2 Cannabis 3 Casino Casino-B Casino-C CheckSum CheckSum 1.01 CheckSum 1.01B CheckSum-1569 Civil War Proto-T Civil War II v1.1 Civil War III v1.0 Civil War IV v1.1 Civil War V v1.0 [Note: Civil War IV v1.1 and Civil War V v1.0 are listed under the entry for TPE as the TPE engine.] Copyright Ungame Copyright-1205 Cossiga Friends Crazy Imp-1402 Crazy Imp Crazy Imp-B CSL Beta CSL V4 CSL V5 CyberTech CyberTech-B Darth-1 Darth-2 Darth-3 Darth-4 Darth-5 Datacrime Datacrime-B Datacrime II Datacrime IIB Datacrime IIC DataLock DataLock-1043 DataLock-D Deicide Breeze Deicide-B Deicide 2 hood Deicide-2405 Deicide-2570 Dest-1 Dest-2 Dest-3 Devil's Dance Devil's Dance-B DM DM-B DM 1.04 DM-330 DM 1.01B Do-Nothing Saddam Profesor Doom II Doom II-B Dot Killer Dot Killer B Dutch 555 Dutch 555-B Subliminal 1.10 Dyslexia 2.00 Solano 2000 Solano B Solano D Anti-Print Ear Suicide Quake-O NPox Evil Genius 2B Evil Genius 2C NPox 2.0 NPox 2.1 Exterminator BadGuy Demon Demon-B Demon-C BadGuy 2 Fich Fich-B Fich-C Fich-897 Fichv-896 Finnish-709 Finnish-357 FORM- FORM-18 Form II Form-Canada Frodo Soft-458 Frodo Soft Gergana Gergana-222 Gergana-300 Gergana-450 Gergana-182B Gotcha Gotcha-B Gotcha-906 Gotcha-627 Gotcha-E Gotcha-A2 Gotcha-732 Grunt-1 Grunt-1B Grunt-3 Hafenstrass Hafenstrass 2 Hafenstrass-D Hafenstrass-1191 Hafenstrass-1191B Haifa Mozkin Happy New Year Happy New Year B Hellween Hellween-1182 HM2 Plastique Plastique 4.21 Plastique 5.21 Invader Plastique COBOL Tobacco Tobacco-B Joshi Joshi-B Headache Why Windows Data Molester Horror Horror-1137 Horror-1137B Horror-1112 Hungarian 482 Hungarian Gyorgyi Intruder Intruder-B Intruder-1326 Intruder-1440 Intruder-1967 Intruder-1988 Intruder-2336 Invol Invol-B Japanese Christmas Japanese Cookie Japanese Christmas-B Japanese Christmas-C Japanese Christmas-D Japanese-709 Jerk Jerk-B Joanna Joanna 1.11 Joanna-911 Kemerovo Kemerovo-B Kemerovo-C Kennedy Brenda Brenda-B Stigmata Kode4-129 Kode4 Lazy Lazy-2 Little Br Little Br Little Br Little Br Little Br Little Br Little Girl Little Girl 3.0 Lycee Lycee-1832 Lycee-1975 LZ LZ-2 Malaga Malaga-B Malmsey Malmsey 2 Malmsey 3 Beta Marl Marauder Deadpool Mayak-2370 Mayak MG MG-2 MG-3 MG-3B Mini-45 Define Define-256 Dust Mini-35 Mini-44 Mini-46 Mini-99 Mini-97 Mosquito Topo Pfish Lamer MPS 1.1 MPS 3.1 MPS 3.2 MPS 3.2-B Mutant 128 Mutant 127 Mutant 123 Necro Shadow Necro Shadow-B Nines Nines-706 Nines-776 No Frills No Frills 1.01 No Frills 2.0 No Frills 3.0 Nowhere Man VMessiah Nowhere Man 1.9 Nowhere Man 2.0 4Zero (VCL) 4Zero-652 Diarrhea Diarrhea6 Donatello Earth Day Earthquake Heevahava Kinison Pearl Harbor VCL-YD2 Number One AIDS AIDS-B AIDS- Number One-B Number One-Argentina Nygus Nygus-Klaw Ohio Den Zuk Den Zuk-RPKS Mardi Bros Ontario 1024 SBC Ontario III Particle Man Particle Man 2 PC Flu PC Flu-2 PC Flu-2B PC Flu-2D PC Flu-2E PC Flu-2F Perfume Sorry Phoenix PhoenixD Evil-B Evil V82 Phoenix 2000 Plovdiv 1.1 Plovdiv 1.3 Plovdiv 1.3B Polish 217 Polish 217 B Polish 217 C Problem-734 Problem Problem-863 R-10 R-11 Radyum Radyum-B Radyum-C Radyum 2-707 Raubkopie Raubkopie-FRD Red Diavolyata Red Diavolyata B Rocko Mutating Rocko Rocko-B Semtex Semtex-B Semtex-C Semtex-D Sentinel Sentinel-3 Sentinel-5 Seventh Son-350 Seventh Son-284 Seventh Son-Kernel Seventh Son-332 Shhs Secret Service Siskin-1017 Siskin-948 Siskin-Goodbye Sistor-2225 Sistor-2380 Sistor-2630 Sistor-1129 Sistor-J4J Skater Skater-977 Slovak 1.00 Slovak 2.00 Slovak 2.02 Slovak 3.00 Slovak-4 Soupy Soupy-B Sparse Sparse-B StinkFoot StinkFoot-1273 StinkFoot-2B SVC 3.1 SVC 4.0 SVC 4.0-1740 SVC 5.0 SVC 6.0 SVC 6.01 SVC 3.1-CHR SVC 5.0B SVC 6.01-B SVC 5.0C SVC 6.0-4677 SVC 5.0D Sverdlov Sverdlov-B Sylvia Sylvia 2 Taiwan-B Doom I Taiwan Doom I-B Note: The Taiwan-B thru Doom I-B grouped together in the as Taiwan . Dutch -126 Dutch Dutch -124B Dutch Dutch Mini-99 Mini-97 Ten 1415 (-1514 (-1514B Dark Lord Dark Lord-B mark 2 Timid-Orig Timid Hehheh Timid-305 Timid-LM Todor Todor-B Tormentor-205 Tormentor-360 Tormentor-358 Tormentor-263 Troi Troi-2 Troi-2B Tula-417 Tula Tula-593 Tula-635 Tula-1480 Tumen V.5 Tumen V1.2 Tumen V1.3 Tumen V2.0 Uruguay 3 Uruguay 4 Uruguay 5 Uruguay 6 V-10 V-11 V-30 V-31 V-32 VCS Manta DarkSide VCS-Post Violetta Violetta-1024 Vote Vote-1000 Wild Thing Wild Thing 2 Wild Thing-289 Wit Stasi Wolfman Wolfman 2 WordSwap-1085 WordSwap-1069 WordSwap-1387 WordSwap-1503 WWT 01 WWT 02 WWT 02B X-1 Xuxa Xuxa-B Xuxa-1405 Anti-D Anti-D B Yankee 2 Enigma Bandit Youth Silence Futhark Zero Bug Zero Bug B ZeroHunt ZeroHunt B ZK900 ZK900-B PZPAPN Revision History Hyper 9303 9302 9301 9212 9211 9210 9209 9208 9207 9206 9205 9204 9203 9202 9201 Pre- revision history data on request. PZPAPN X 9303 - March 23, 1993 Number of es and : 1,956 The descriptions , or new Australian - Australian -162 Civil War - Civil War III v1.0 - Anti-Print Grunt-1 - Grunt-3 Leprosy - Leprosy-654 Malmsey - Malmsey 3 Beta Mummy - Mummy 2.1C Murphy - Locker PS-MPC - Alien-1 - Alien-3 - Hiccup Radyum - Radyum 2-707 Slow - Slow III StinkFoot - StinkFoot-2B - Civil War IV v1.1 - Civil War V v1.0 - B-52 - Beva 33 - Big - Dial Wild Thing 2 - Wild Thing-289 The cnew to the Aragorn ARCV Xmas Aussie Dir Basilisk Beer - Beer-2794 - Beer-2850 CCCP-510 CPSU-2535 Experiments Fat Gingerbread Man Kiwi-550 Little-139 Lokjaw Los-693 LPT Off Malign - Malign-575 - Malign-630 MiniMax Minimite Mutation Not-586 Oi Dudley Oxana Pegg-833 Random RIP-699 Simple Skater - Skater-977 - Skater-1021 Skew-469 Small-178 Stasi Totoro Tremor Tu-482 Uruk-hai V388 The products were /, and detection yhas (*) - McAfee Associates' NetShield 1.11V100 - McAfee Associates' 9.14V100 Note: (*) denotes the product is an NLM. PZPAPN X 9302 - ^23, 1993 Number of es and : 1,894 The descriptions , or new 10 Past 3 - 10 Past 3-B ARCV-n - ARCV-10 Bljec - Bljec-XYZ Fish - Fish II - Swank Joanna - Joanna-911 Little Girl - Little Girl 3.0 Maltese Amoeba - Maltese Amoeba-B Mix1 - Mix1-B - Small-46 - Small-72 PS-MPC - Cheesy - Chuang Tzu - Cinco de Mayo - Scarey Quick - Brasil Radyum - Radyum-B - Radyum-C Slow - Slow II Tabulero - Tabulero-2 Troi - Troi-2C - Beva 32 - Beva 96 - Chicken Pox - Voco VirDem - VirDem-833 The cnew to the 1804 Atas II Aussie Parasite - Aussie Parasite - Dorn - El - Grue Australian - Australian - Australian -142B - Australian - Australian - Australian - Australian Butt Stink Costeau DOS3 Flex FoneSex Fratricide GoldGeld Iranian Luca-309 Lythyum - Lythyum - Lythyum-B Shifter Sorlec - Sorlec 3 - Sorlec 4 - Sorlec 5 Soupy - Soupy - Soupy-Death TalkingHeads UnExe Violite YAM-3599 The products were /, and detection yhas - Dr. Solomon's Anti- Toolkit - Frisk Software's (*) - Intel's LanProtect (includes 1/93 - Symantec's Norton Anti- 2.1.4 (*) - McAfee Associates' NetShield 1.10V100 - Sophos' - RG Software's - McAfee Associates' 9.12V100 Note: (*) denotes the product is an NLM. PZPAPN X 9301 - 20, 1993 Number of es and : 1,836 The entries d or merged: Shadow - Shadow entry re The descriptions , or new - 334-B - Made 1308 KSpoiler - BFD-452 Copyright - Copyright-1205 Crazy Imp - Crazy Imp-1402 Crew-2480 - Crew-2480 C Cyber - Cyber-946 DAME - DarkStar - Dark Quest Deicide - Deicide 2 Dutch - Dutch -117 Fellowship - Fellowship-B Fich - Fich-897 Friday 13th - Edge Horror - Horror-1112 - Horror-1137B Ieronim - Ieronim-512 - Ieronim-560 - Ieronim-600 - Ieronim-1581 - Ieronim-570 Intruder - Intruder-1326 - Viva Mexico Leprosy - Leprosy-5600 - Leprosy-FVHS Little Br - Little Br -300 Lycee - Lyceum - Lycee-1975 Meditation - Meditation-B - Guru Mix1 - Snow - Horse-8B Nowhere Man - Nowhere Man 1.9 - Nowhere Man 2.0 Otto6 - Otto-415 Pixel - MS-748 Polish - Polish -226 Problem - Problem-734 PS-MPC - Napolean Complex - Test 441 - Warez D00D Radyum - Description Semtex - Semtex-B - Semtex-C - Semtex-D Tony - Tony-203 Tormentor-205 - Tormentor-263 Tumen - Tumen V1.3 - Earthquake - Twer-1000 Voronezh-Chemist - Voronezh-650 The cnew to the Adolf Hitler Alex-368 Angarsk ARCV 330 Barrotes Breeze CLS-853 Commy Como CyberTech - CyberTech-A - CyberTech-B Dark End Egg-1000 Freddy Groove OW Gyro lDays House Ionkin - Ionkin-231 - Ionkin-2372 - Bubbles Junior Kiev 2049 KLF-356 Lippi-286 LV 1.2 Matura MindRiot Nazgul NaziPhobia Outland Play Tetris Press Reaper Repent RTL4 Ryazan SeaCat Seneca-B Shirley Signs Simple Minds Skull - Skull - Skull T-1000 Tao Cheng Terminator-2294 Terminator-3549 - Girafe TPWorm Tyst UFA-1201 Uruguay - Uruguay 3 - Uruguay 4 - Uruguay 6 VX-163 Weak Wharps Witch Wild Thing 2 Zaphod The products were /, and detection yhas - Softech's Dr 1.07 (Note: product was a late /against the Library, and is shown in the X9212 Note: (*) denotes the product is an NLM. PZPAPN X 9212 - >20, Number of es and : 1,725 A major upgrade has made to the hyper engine is used . The new engine adds several new features, and corrects problems the previous of the engine. release, the Using section has . It is now a 5key summary for using Hyper . Tips on using may section in the future. The "button boxes" present throughout previous releases of Hyper removed as functionality is now supported via the Menu Bar at the top of the , or the Button Bar at the bottom of the Printing to device PRN is now supported via the Configuration Menu. To access the configuration menu, ALT+C. References to the , such as " to refer to the . The is the on the includes the , and is more descriptive of what is actually The entries d or merged: Internal - 1381 entry re Loki - Merde entry re - Arkanoid entry re PS-MPC - 203 entry merged WinVir - WVir entry re The descriptions , or new Akuku - Columbus - Wilbur-B - Wilbur-C - Wilbur 2 - Wilbur 3 Beast-N-Black - Public Enemy ew-718 CheckSum - CheckSum-1569 Clonewar - Acme DAME - Dedicated 3 - Questo ;-Romanian Deicide - Deicide-2405 - Deicide-2570 - Description & - Emf-625 Friday 13th Gotcha - Gotcha-732 Internal - Description - Internal-1459 Intruder - Intruder-1440 - Intruder-1988 17TH Keypress - Keypress-1268 - Keypress-Chaos - Keypress-UFO Kode4 - Kode4-129 Leprosy - Silver Surfer LZRQ - Whit - MVF-1954 - MVF-1954B Necro Shadow - Necro Shadow-B 17th - Nov 17-880 PS-MPC - 696 - Anathema - Clint - Eclypse - Page - Schrunch - Skeleton - Sunday Death - Tongue - Toys - Links to ARCV-n, Joshua entries Scream - Scream-650 Seventh Son - Seventh Son-332 Slovak - Slovak-4 Timid - Hehheh Tolbuhin - Tolbuhin-1147 - Tolbuhin-992 - Tolbuhin-1004 Traveller - Traveller-B - DM 92 Bios - DarkSide -CDM.A -CDM.B -CDM.C ZK900 - ZK900-B The cnew to the 10 Past 3 Arriba Bryansk Casteggio CHCC Civil War - Civil War - Civil War II v1.1 - Proto-T DisDev EkoT Kthulhu Meditation Mindless Necro Fear Plumbum - Plumbum-A - Plumbum-B - Plumbum-C - Plumbum-D - Plumbum-E - Plumbum-F - Plumbum-M1 - Plumbum-M2 Puke-393 RefRef Serena Tatou TSoft - TSoft-547 - TSoft-598 Wizard 3.0 Zoid The products were /, and detection yhas - Symantec's Norton Anti- 2.1.2 (*) - Sophos' NLM, - Fifth Generations' Untouchable, 25.10 Note: (*) denotes the product is an NLM. PZPAPN X 9211 - Number of es and : 1,640 The entries d or merged: Japanese Christmas - Christmas In Japan re - DAPDM-13 re d to Japanese-709 Mosquito - Topo entry merged - Fax The descriptions , or new 1244 - 1244-B 1575 - 1575-E 2560 - Magnito-3000 - Ah-B Alfa - Rust AT144 - AT108 - AT114 - AT118 - AT122 - AT140 Cascade - 1701-Yap Chad Criminal - Criminal-B DAME - Encroacher - Encroacher 2 - MTE Spawn 2 - Kang Yong Deicide - Deicide-B - Br hood Dir-2 - Dir 2-910 Finnish-709 - Finnish-357 Flip - Flip-2343B Frodo Soft - Frodo Soft-458 Geek , Description Hero - Hero-506B Highlander , Description - Demon-C Ice 9 - ARCV93 - Ice 9B Intruder - Intruder-1967 - Intruder-2336 Invader - Danube Japanese Christmas - Japanese Christmas-B - Japanese Christmas-C - Japanese Christmas-D -Polish Joanna - Joanna 1.11 - Jo Kalah - Kalah-499 Bug-1724 Keypress - Keypress-1238C Lancs Little Br - Little Br -299 LockUp - LockUp-B - Mithrandir III Mosquito - Pfish No Frills - No Frills 2.0 Parasite - Vengeance-C Pascal-4260 Penza - Penza-1210 Pisello Protecto - Protecto-1196 PS-MPC - Kersplat - McWhale - Walkabout Silence - Description Sistor - Sistor-2630 SVC 5.0 - SVC 5.0C - SVC 5.0D SVC 6.0 - SVC 6.0-4677 - SVC 6.01-B - Brenda-B - Diogenes - Dome4 - VCL-YD2B - New Generation -648E -Beta Boys 730 -Refresh -Yam 92 - Dushanbe Yankee Doodle - Yankee Doodle-2505 - Yankee Doodle-2973 The cnew to the 3040 - ABC - ABC-2918 - ABC-2918B Anna ARCV Friends ARCV-n - ARCV-1 - ARCV-2 - ARCV-3 - ARCV-4 - ARCV-5 - ARCV-6 - ARCV-7 - ARCV-8 - ARCV-9 Beeper Bios Bit Addict Budo Crusher Digger Dismember Doctor Qumak 2 DOSHunter Drop Druid =11-537 HiDos Ieronim Iper Joshua Larry LZRQ Merde - Merde 5 - Merde 6 Monkey NCU LI Necro Shadow Ninja - OW-37 - OW-42 - OW-42B - OW-Trident Parity Polish - Polish - Polish Quick Radyum Sandwich Scroll Scythe Small ARCV Small TMTM WXYC - X-1 - X-2 Youth - Youth - Futhark The products were /, and detection yhas - Dr. Solomon's Anti- Toolkit, - Central Anti- (*) - Central Anti- NLM, - IBM Anti- /DOS, (*) - McAfee Associates' NetShield NLM, Vers 1.03V99 - Sophos International's 2.43a - Leprechaun Software's Buster, Vers 3.93.01 - McAfee Associates' Note: (*) denotes the product is an NLM. PZPAPN X 9210 - Number of es and : 1,509 The entries d or merged: Akuku - Cop-Mpl, Wilbur merged Boys - Boys 2 merged Cascade - 1704 Format merged - MicroElephant re - Amilia merged Datacrime - Datacrime-B, Datacrime II, Datacrime IIB merged Doom II - Doom II-B merged Evil Empire - Evil Empire-B merged Flip - Prism merged Friday 13th - Friday The 13th Frogs - Frog's Alley re Holland Girl - Holland Girl 2 entry merged Icelandic - Icelandic-II, Icelandic-II, Saratoga merged Leprosy - Leprosy-3, RMIT, The Plague, & Xabaras merged - MG-2 merged Mummy - Platinum re d to Mummy 1.0 & merged Murphy - AntiChrist, Br s, Erasmus, Goblin, HIV, Italian Pest, Kamasya, Migram, & Smack merged NPox - Evil Genius re Solano 2000 - Subliminal 1.10 merged Sylvia - Holland Girl re SysLock - Cookie merged - 1554 entry re - 1415, Ten (-1514 merged - 191, Kennedy, Stigmata merged Tula - Tula-419 entry re d, F-Word merged The descriptions , or new - 439-B - Description 1024 SBC - Ontario II 2560 - Magnum 4096 - 4096-E - Satan-B Albania Armagedon - Armagedon #911 - Trojector description Baobab Copyright - Ungame DAME - Coffeeshop 2 - CryptLab - Dedicated 2 - MTE Spawn - PS!KO-1459 - PS!KO-1687 - PS!KO-1800 Datacrime - Datacrime IIC - DM 1.01B Edcl - Edcl-B Flower Geek Harakiri - It-457 - Coahuila Japanese Christmas - DAPDM-13 - Soy Un - Jabberwocky-B Keypress - Keypress-1238 - Keypress-1238B Leprosy - Angel Of Death Little Br - Little Br -349 - Little Br -361 Murphy - Delyrium 17th - 17th-B Nowhere Man - J NPox - NPox 2.0 - NPox 2.1 PCBB - PCBB-1141 - PCBB-3B Perfume - Entry has rewritten Protecto PS-MPC - 644 - Abraxas - Death 2 - No Wednesday - Z10 - Zeppelin RaubKopie - Raubkopie-FRD Rocko - Mutating Rocko - Rocko-B - Sad-307 Shhs - Secret Service Sistor - Sistor-J4J Alpha SVC 3.1 - SVC 3.1-CHR Timid - Timid-LM Timor Tula - Tula-593 - Tula-635 - Tula-1480 - Diarrhea - Diarrhea6 & dropped trojan - Heevahava - Beta Boys - Dr Q-1028 -415 VVF 3.4 - Description The cnew to the Alexander All Sys 9 Cerburus Clonewar Coffeeshop-1568 Curse Cyber Dima Exebug FCB Frodo Soft Grunt-1 - Grunt-1 - Grunt-1B Hacktic - Hacktic - Hacktic 2 Highlander Ice 9 Kode4 Lycee - Lycee-1788 - Lycee-1832 Madismo Malmsey - Malmsey - Malmsey 2 Medical Minsk Ghost Month 4-6 Nygus - Nygus - Nygus-Klaw Ontario III Otto6 Particle Man - Particle Man - Particle Man 2 Pascal-4260 Pascal-5220 Pojer Problem - Problem-856 - Problem-863 Quirk Reklama Squisher Tabulero - Tabulero - Tabulero-B mark 1 mark 2 Walker WVir The products were /, and detection yhas - Dr. Solomon's Anti- Toolkit, - Commcrypt's Detect Plus, - Symantec's Norton Anti- - Certus' 1.15a - Sophos' - McAfee Associates' Note: (*) denotes the product is an NLM. PZPAPN X 9209 - Number of es and : 1,405 NLM /Service yhas included in release. It is on the /s sub-menu main menu. NLM /data be included #the DOS product yfor Qmonth, starting Hyper release. The entries d or merged: Tormentor - Tormentor-1072 entry has merged into entry The descriptions , or new Astra - Astra-498 - Astra-510 - Astra-521 - Trojector Badsec - Topsy-900 Backfont Beware Chang - Chang 007 CheckSum - CheckSum 1.01B Crazy Imp - Crazy Imp-B DAME - Coffeeshop Define - Define-B - DM 1.04 - Quake-O Gremlin =& description Mini-45 - Dust Ondra - 4915 - Ondra-B Parasite - Vengeance-B Seventh Son - Seventh Son-Kernal Silver Dollar - Silver Dollar-8101 Tormentor - Lixo Nuke - Lixo Nuke Dropper Tormentor-205 - Lesson-1 - Tormentor-358 & Dropper - Tormentor-360 & Dropper Troi - Troi-2B - Dome - Dome2 - Dome3 - Kinnison-734 - VCS-Post -Beta Boys -Nag Xpeh - Xpeh-3600 - Xpeh-3840 - Xpeh-4048 The cnew to the Acid Agena Argentina-102 Atas - Atas-384 - Atas-400 Capitall Chad End of Funeral Globe Joanna Piazzolla Protecto - Protecto-1157 - Protecto-1355 PS-MPC - Crumble - Mimic-Den Zuk - Mimic- Stanco Swiss Phoenix Talentless Tolbuhin Tomato Twin Peaks The products were /, and detection yhas - Frisk Software's (*) - Intel's LanProtect, (*) - McAfee Associates' Net Shield, 1.03V95 - Sophos' - Fifth Generation ' Untouchable, Vers 24.00 - Cybec's VET, Note: (*) denotes the product is an NLM. PZPAPN X 9208 - Number of es and : 1,342 Revision history for the thru removed. The Relationship Chart has revised to simplify selecting items are actual entries and in entries. The descriptions d to are more representative of the Tumen - Re d entry for Tumen V.5 - Merged entries for Tumen V1.2 and Tumen V2.0 Turbo - Re d entry for Turbo 448 - Merged entry for Turbo Kukac - Re d entry for 4Zero all included in group were created of VCL. The descriptions , or new 1661 - 1661-C - Turkey Alfa - Alfa-1712 - Alfa-Tired Anti-D - Anti-D B Blaze - MSK Chang - Chang-B Dutch - Dutch -115 - Suicide Enemy - Stranger FORM- - Form-Canada Hafenstrass - Hafenstrass-1191 - Hafenstrass-1191B Hellween - Hellween-1182 Horror - Horror-1137 JoJo - JoJo-B Keypress - Keypress-E - SamSoft-B Marauder - DeadPool Mayak - Jews2 - Mayak-2370 Mosquito - Lamer Pixel - Pixel-297 Polish 529 - Polish 529B - Piter Sunday-2 - Sunday-2B - Datarape 2.2 SVC 6.0 - SVC 6.01 Tormentor - Tormentor-1040 - Donnatello Viperize - Viperize-B Xuxa - Xuxa-B Yankee Doodle - Yankee Doodle-1905 - YD Logon-D - YD Logon-E - YD Logon-X The cnew to the 2153 Andre - Andre - Andre-3568 Aragon Arkanoid Astra - Astra-976 - Astra-1010 Baobab %Killer Changu Mangu Dest - Dest-1 - Dest-2 - Dest-3 Evil Genius - Evil Genius 2 - Evil Genius 2B - Evil Genius 2C Father Geek Green Joker Happy Mexican Mud Mugshot Penza Pila Plutto Prime Rattle Silence Silly Silver Dollar Siskin - Siskin-948 - Siskin-1017 - Siskin-Goodbye The products were /, and detection yhas - Dr. Solomon's Anti- Toolkit, }Software's Anti- 4.20.01 Pro, - Sophos' Micro Device's PC - Leprechaun Software's Buster - McAfee Associates' - Safety Net's Net, 2.04c PZPAPN X 9207 - Number of es and : 1,273 The descriptions , or new - Joe's Demise 1661 - 1661-B Cannabis - Cannabis 3 & Dropper Cascade - Cascade-1621 4Zero 4Zero-652 - Earth Day - Kinison - Pearl 4Zero-YD2 ;.1E - DM-330 DoDo - Pig B Edcl - Edct Gotcha - Gotcha-E Hafenstrass Intruder - Intruder-B Invader - Description Keypress - Keypress-Viring Leprosy - Scribble - LZ-2 - Noon Beep No Frills - No Frills 3.0 Nowhere Man - VMessiah Number One - Number One-Argentina Parasite - Vengeance PCBB - PCBB-3072 Pixel - Pixel-342 StinkFoot - StinkFoot-1273 Mutation Timid - Timid-305 - Cracky Violetta - Violetta-1024 Xuxa - Xuxa-1405 The cnew to the 1835 Banana Blood Lust Cansu Chang Chaser Enola Exunt Groove Horror Krivmous - Krivmous - Krivmous-B Lancs - Lancs-5476 - Lancs-5882 - Lancs-7376 Little Girl Swedish Boys - Data Molester - Headache - Why Windows Todor - Todor - Todor-B Tormentor-205 Vote - Vote - Vote-1000 The products were /, and detection yhas - Central Anti- ,RAC's Gobbler 2, 3.0(b) - Symantec's Norton Anti- 06/01/92 PZPAPN X 9206 - Number of es and : 1,212 The descriptions d to are more representative of the PCBB - 1720-C moved f1720 entry to PCBB, and re d PCBB-3 The List has Mummy 2.1, Sticky, and Scream 2-696. has had multiple confirmed ureports in the and/or Canada. The descriptions , or new - 572-COD 4870 - 4870 AIDS - AIDS- Alabama - Ala - AP Armagedon - Arma Attack - Cuban Bad Brain - Description , BB Beast-N-Black - Beast - Beast-N-Black B Best Wishes - Wishes Beta - Phalcon Black Monday - Monday Bloody! - Bloody!-B Casino - Casino-C CB-1530 - 1530 CheckSum - CkSum Crazy Imp - Imp Creeper - Creeper-B DataLock - DataLock-D Do-Nothing - Nothing Dutch - D- Fellowship - Fellow Fish - Chinese Fish FORM- - Form II Friday The 13th , - QFresh Halloechen - Hallo Hary Anto - Hary HH&H - Gomb, GMB Hominy - Hominy-B Hungarian - Gyorgyi Icelandic - Iceland - Bogota - Sub-Zero B Kemerovo - Kemerov - Kbug Keypress - SamSoft Kuku-448 - Ku-448 Liberty-1172 - Lib1172 , Lib1186 Removed Little Pieces - Pieces LowerCase - LCV Maltese Amoeba - Maltese Micro 128 - M-128 Micropox - K Mini-45 - Mini Moctezumas Revenge - Moctezuma MPS 4.01 - MPC Multi-123 - Multi, SD-123 Multi-Face - Mface Mummy - Mummy 2.1B Nines - Nines-706 - Nines-776 Nomenklatura - Nomen 17th - Nov 17 - Nov 17-768 Null Set - Null Ontario 730 - Ont-730 PCBB - PCBB-5 - PCBB-5B Pixel - Portugal-500 Platinum Plovdiv 1.1 - SX Plovdiv 1.3 - Plov - Plovdiv 1.3B Polish 529 - P529 Polish-45 - P-45 Psychogenius - Psychogenius-B RaubKopie - Raubkopi Revenge Attacker - Revenge Rocko - RKO Scott's Valley - Scott's Scream - Scream 2-732 Seventh Son - 7th Son Shhs - Sh Sistor - Plaice, Sis - Sistor-1129 - Sistor-J4J Skism - Skism-808 StinkFoot - Stink -Mexican - Brenda Traceback - TB Troi - Troi-2 Typo - Typo-867B Voronezh-370 - 370-B Were Here - Here Wolfman - Wolf Worm-17690 - 17690 Zero Bug - Zero ZeroHunt - Hunt Zherkov - ZRK The cnew to the Bomber - Bomber - Messy Boojum Cmdr Bomber Davis Emmie Flower Gnose Harakiri LockUp Malaise - Malaise - Malaise-B Milena Ondra Pitch - Pitch - Pitch-B Slovak - Slovak 1.00 - Slovak 2.00 - Slovak 2.02 - Slovak 3.00 Sticky Tack V-1n - V-10 - V-11 VMem World Peace Xpeh - Xpeh - Xpeh-B Yafo The products were /, and detection yhas - Dr. Solomon's Anti- Toolkit, - Frisk Software's 2.03B - McAfee Associates' The cuncertified products removed detection data is out of Pro- - McAfee Associates' Pro- VirHunt - Digital Dispatch Inc's VirHunt VIRx - Ross Greenberg's VIRx detector PZPAPN X 9205 - May 22, 00( r Number of es and : 1,145 The descriptions d to are more representative of the Fich Hellween Pisello The IDs field has removed fthe descriptions release of frequently 2between releases of the McAfee Associates' , and it is no longer practical to maintain them in the descriptions. The AVPD Cross-Reference included in the Appendices submenu has removed. Cross-Reference is no longer maintainable in a ly manner in due to a 2in the management and maintenance of the AVPD Library. The descriptions , or new - Russian Mutant 1385 KPlus 1 4096 - 4096-D Alameda - Alameda 1.2M Badsec - 905 Bljec - Bljec4B - Bljec6B - Bljec8B Burger - CIA-2 DataLock - DataLock-1043 Den Zuk - Den Zuk-RPKS Haifa - Mozkin - Haifa Description Invol - Invol-B Joshi - Joshi-B Lazy - Lazy-2 Little Br - Little Br -321 Malaga - Malaga-B Miky - Miky-2390 Mummy - Mummy 1.2 - Mummy 2.1 Oropax - Oropax-B PC Flu-2 - PC Flu-2B - PC Flu-2D - PC Flu-2E - PC Flu-2F Pisello - Pisello-B Pixie - Pixie 1.0B Platinum - Mummy 1.0 Possessed - Possessed 1.07B Scream - Scream 2-696 -AT Love -Collor Tobacco - Tobacco-B -645 - W13-534B Zaragosa - Caz-1159 The cnew to the 2623 Albanian Animus - Animus-7360 - Animus-7392 Attack - Attack-918 - Attack-1501 Brazilian Bug 4Zero Edcl Explode Fungus Hellraiser Hominy Legalize Mayak No Frills - No Frills - No Frills 1.01 Quake Timor Tula-419 Urfydus V-3n - V-30 - V-31 - V-32 VVF 3.4 Warning Wilbur Worm-17690 The products were /, and detection yhas - Certus International's - Fifth Generation ' Untouchable, Vers 22.00 PZPAPN X 9204 - Number of es and : 1,080 s of Multipartite es and Polymorphic to the Cross References submenu in the Appendices section. The descriptions , or new Ambulance Car - Ambulance Car-B Bljec - Bljec7C Cascade - Cascade-1706 Cossiga Hafenstrass - Hafenstrass-D Japanese Christmas - Japanese Cookie - Ucender - Czech - Dragon - Oscar - Sub-Zero - Triple Mummy - Description - Horse-8 Platinum - Description Scream - Scream 1B - Scream 2B - Scream 2C Timid - Timid-Orig - Genny-648 -618 -621 -712 Xuxa Data The cnew to the Anti-D Bad Brain Blaze Close Crazy Eddie Enemy Forger ew-692 Friends HH&H Intruder Itti - Itti-A - Itti-B Ministry MShark Munich Null-178 PCBB - PCBB - PCBB-3 - RNA - RNA-7408 Rocko Shield Skism - Skism - Skism Squawk Stahl Stupid-1355 Terminator Tobacco Vindicator Viperize Worm-16850 The products were /, and detection yhas - Frisk Software's - Certus International's - Sophos' PZPAPN X 9203 - March 27, Number of es and : 1,021 The descriptions , or new 1661 - Caz-B Cheeba - Cheeba-1691 - Cheeba-1691B Flip - Flip-2153C - Ucender Moctezumas Revenge - Moctezumas Revenge 2 17th - Parasite - Parasite 2 - Parasite 2B SVC 5.0 - SVC 5.0B - DOS 625 - Kuzmitch -943 - ZMT-252 The cnew to the 1385 Badsec Beast-N-Black Busted Chemmy - Chemmy - Chemmy-B ,Generic Cossiga Creeper DAME - Dedicated - Fear DoDo - DoDo - Pig Fichv-896 Fish Generic - Generic Hafenstrass Hafenstrass 2 Hellween Malaga Marl Micropox Nines Null Set Pisello Possum Queens Scream - Scream - Scream 2 Thimble Troi Vivaldi Xuxa Zherkov - Zherkov-1882 - Zherkov-1958 - Zherkov-2968 - Zherkov-2970 The products were /, and detection yhas - Xtree Company's - Dr. Solomon's Anti- Toolkit, - Central Anti- IBM - IBM's ning 2.1.9 ,RAC's Gobbler 2, - Certus International's - Sophos' - Leprechaun Software's Buster - Xtree Company's - McAfee Associates' PZPAPN X 9202 - ^22, PT[ Number of es and : 971 The descriptions d to are more representative of the 1226 - Entry for 1226D was merged. Cascade - Entry for Casade-B was merged. Mini-45 - Entry for Mini-97 was merged. ]Entry Ping Pong - Entry for Ping Pong-B was merged. V2P6 - Entry for V2P6Z was merged. The descriptions , or new 1024 SBC - SBC Akuku - Akuku-3 Ambulance Car - RedX-Any Amstrad - Amstrad-End Is Near - Amstrad-Luz II - AP-440B - AP-480B AT144 - AT149 Black Monday - Borderline Bljec - Bljec3B - Bljec5B - Bljec7B - Bljec9B Crew-2480 - Crew-2480 B Define - Define-256 - DM-B Frog's Alley - Frog's Alley-B - Antiviru 25TH-B - JVT1-B - Skism Keypress - Turku MicroElephant - MicroElephant Beta - MicroElephant V4 - MicroElephant V5 Mini-45 - Mini-35 - Mini-44 MSTU - MSTU-551 17th - 855 Pixel - Pixel-854 Psychogenius - Psycho Saddam - Profesor Tormentor-1072 - Nuke - Nuke Dropper The cnew to the 1067 1308 3445- Albania - Albania-429 - Albania-506 - Albania-575 - Albania-606 Anto Beware CheckSum - CheckSum 1.00 - CheckSum 1.01 Crazy Imp Criminal Dada Feist Gliss Hungarian - Hungarian - Hungarian-B Idle Infinity - JD-158 - JD-276 - JD-356 - JD-392 Bug-1596 Bug-1720 Manola Marauder MPS 4.01 Multi-Face Mummy Parasite Platinum Pogue Quiet Rosen Sadist Shhs Sistor - Sistor-2225 - Sistor-2380 Smiley Stigmata Surrender Di-94 Di-101 Di-108 Di-110 Tumen V1.2 Violetta Voronezh-Chemist Were Here Zaragosa - ZMT-262 - ZMT-365 The products were /, and detection yhas - Central Anti- - Symantec's Norton Anti- - MicroCom's - McAfee Associates' PZPAPN X 9201 - Number of es and : 880 The Relationship Chart on the Main Menu has redesigned to incorporate a sub-menu. The addition of the sub-menu should simplify locating the relationship charts for the major families. All do not ma specific menu entry in the Relationship Chart Menu are included in the last entry of the menu. The descriptions d to are more representative of the Amstrad - Pixel moved to Pixel entry - V-277 re d to Pixel-277 & moved - Pixel - V-299 re d to Pixel-299 & moved - Pixel - Pixel 2 re d to Pixel-850 & moved - Pixel - S-847 re d to Pixel-850 Dropper & moved - V-847 re d to Pixel-847 & moved - Pixel - V-847B re d to Pixel-847B & moved - Pixel - V-852 re d to Pixel-852 & moved - Pixel Golden Gate - Merged into existing Alameda entry. B, New , and Payday merged into a new entry. - Merged into existing Alameda entry. The descriptions , or new - V191 - V337 1024 SBC 1226 - 1226-B - 1226-B Dropper 1661 - Cascade.1661 AIDS - Burger.Pascal Australian - Clipper Blinker - Prague.Blinker Bloody! Carfield Copyright - V1193 - Boroda - Evil Men Day10 - SYP Dutch 555 - Quit- Gergana - Gergana-182B Growing Block - -Yellow IKV 528 -528 Invader - Anticad 4 Invol Iraqui Warrior - -Iraqui - Description for Phenome Joshi - Description Kamasya Kamikazi - Kamikaze Kemerovo - V257 Keypress - St Leos Klaeren - Hate Lozinsky - Zherkov Micro 128 -128 Migram Multi-123 - V123 NoInt Number One - Number One-B Path -547 Pixel - Pixel-257 - Pixel-275 - Pixel-283 - Pixel-295 - Pixel-779 - Pixel-837 Plastique - Anticad 3 Plastique-B - Anticad 1 Polish 217 - V217 Polish-376 - V376 Possessed - Possessed 1.03A - Possessed 1.03B - Possessed 1.07 - Possessed 1.08 - QQ-1513 Reset - Friday-13th-440 Shake - Shake Dropper Silly-365 - Silly-740 Traveller - Bupt Twin-351 - Twin - Com2Con Victor - WWT 02B The cnew to the 1244 African 109 Amilia Cheeba - Cheeba - Cheeba-B Demolition Filler Halloween Hastings Hydra - Hydra-0 - Hydra-1 - Hydra-2 - Hydra-3 - Hydra-4 - Hydra-5 - Hydra-6 - Hydra-7 - Hydra-8 & Hydra-8 Trojan 11-30 Kalah Macedonia Mannequin Moctezumas Revenge Nowhere Man Ontario 730 PC Flu-2 Phoenix 2000 Pixie Prism Psychogenius Sicilian Mob Small-38 Timid Traceback 3029 Viper - Viper - Viper Dropper VirDem-792 Wonder - Wonder - Wonder-B Wonderful The products were /, and detection yhas - Dr. Solomon's Anti- ToolKit, 5.52A - Fifth Generation ' Untouchable, Vers 20.05 PZPAPN Licensing Individual and Site Licensing Registration is requested for the use of Hyper by domestic home s. Registration can be viewed by selecting the Individual License Agree- ment link #. The registration form, _REG.DOC, has included in the Hyper distribution Use of Hyper in a business, corporation, organization, government, or agency en ment requires a site license obtainable fthe author, or one of her authorized agents listed in Hyper Individual License Agreement Site License Agreement PZPAPN Individual License Agreement Individual License Agreement Hyper is registered to individual s for use in a domestic, home en ment. The registration fee is $30 for one year. Individual s may download s of Hyper fthe author's BBS, Excalibur!, in Santa Clara, California, USA. The phone number for Excalibur! is 1-408-244-0813. A Site License Agreement is required to use business, government, corporate, organizational, or agency en ment. Please contact the author, or an authorized agent of the author, for licensing for ments. Individual registrations fentities requiring a site license unprocessed. To provide world-wide product and sales support for an Authorized Agent was created. To license in any capacity, please contact an Authorized Agent. Authorized Agents PZPAPN Site License Agreement Site License Agreement A Site License Agreement is required to use business, government, corporate, organizational, or agency en ment. To provide world-wide product and sales support for an Authorized Agent was created. Prospective s desiring to obtain a Site License should contact an Authorized Agent to receive a complete ypackage. Authorized Agents PZPAPN Authorized Agents Authorized agents are listed by continent or major geographic area. If is no agent in your country, to request a license author, or for yabout becoming a Authorized Agent, please contact: Patricia M. Hoffman - or - Susan Lynch North America Mexico & South America Far East & Asia Australia & New Zealand PZPAPN FSales North American FLicensing Inquires, as well as requests for yon the Domestic US Authorized Agent , should be addressed to: Patricia M. Hoffman 3 Bowers Ave, Suite 130 Telephone: 1 (408) 988-3773 Santa Clara, CA 95054 Fax: 1 (408) 988-2438 USA International FLicensing Inquiries, as well as requests for yon the International Authorized Agent , should be addressed to: Susan Lynch, International Marketing Manager c/o Patricia M. Hoffman 3 Bowers Ave, Suite 130 Telephone: 1 (408) 971-3576 Santa Clara, CA 95054 Fax: 1 (408) 971-3578 USA PZPAPN Agents - North America Advanced Computer Networks Contact: Lazer Milstein 260 Old Nyack Turnpike Telephone: 1 (914) 425-5858 Spring Valley, NY 10977 Fax: 1 (914) 425-4306 USA # BBS: 1 (914) 425-2304 James C. Shaeffer & Associates Contact: Jim Shaeffer 5025 Venture Telephone: 1 (313) 741-9527 Ann Arbor, MI 48108 or: 1 (800) 968-9527 USA # Fax: 1 (313) 741-9528 ) BBS: 1 (313) 741-9529 National Computer Security Assoc Contact: Paul Gates (NCSA/US) Telephone: 1 (717) 258-1816 10 S. Courthouse Avenue, Ste C or: 1 (800) 488-4595 Carlisle, PA 17013 Fax: 1 (717) 243-8642 USA Card & VISA Accepted Vacci Contact: Roger Aucoin 84 Hammond Street Telephone: 1 (617) 893-8282 Waltham, MA 02154 Fax: 1 (617) 893-3770 USA Canada: Asgard Technologies Contact: Michael Cameron 175 Hunter Street East, Ste 313 Telephone: 1 (416) 529-9284 Hamilton, Ontario L8N 4E7 Canada Dolfin Developments Ltd. Contact: John Reid 2904 South Sheridan Way Telephone: 1 (416) 829-4344 Oakville, Ontario or: 1 (800) 668-7434 L6J 7L7 Canada Fax: 1 (416) 829-4380 Dolfin Developments - Montreal Contact: Simon Borduas 2690B Pitfield, Bureau 100 Telephone: 1 (514) 333-7240 Ville St-Laurent (Mtl), Quebec Fax: 1 (514) 333-7165 H4S 1G9 Canada Dolfin Developments - West Contact: Terry O'Hearn 1842 - 14th Street SW Telephone: 1 (403) 229-3454 Calgary, Alberta Fax: 1 (403) 229-3507 T2T 3S9 Canada PZPAPN Agents - Mexico & South America Argentina: RAN Ingenieria de Sistemas Contact: Marie Jose Alvarez Hamelin Cosquin 10-5o. C Telephone: +54 (1) 642-3689 Buenos Aires 1408 Fax: +54 (1) 334-7802 Argentina Brazil: Maple Informatica Ltda. Contact: David Rotenberg R. Maranhao, 554 cj. 26 Telephone: +55 (11) 825-9390 01240 Sao Paulo, SP Fax: +55 (11) 826-5375 Brazil Chile: Rigg S.A. Contact: Ricardo Gutierrez Avda, Salvador 1068 Telephone: +56 (2) 225-0222 P.O. Box 10.295 Fax: +56 (2) 225-0240 Santiago Chile Mexico: McAfee Associates, Mexico SA de CV Contact: Arturo De la Mora Carrasco Av. Nuevo Leon No. 253, 5 piso Telephone: +(52) 5 273-0954 Col. Escadon C.P. 11800 Fax: +(52) 5 273-1019 Mexico D. F. PZPAPN! Agents - Australia & New Zealand Australia: Computerware For Micros Contact: Priestly Hillam 23 Magill Road, Stepney Telephone (Main): +61 (08) 362-8200 Adelaide 5096 (Main): +61 (08) 363-1974 Australia (Main): +61 (08) 362-4293 ! Telephone (Sydney): +61 (02) 661-6832 ! BBS (Sydney): +61 (02) 661-7120 ! National Toll- 008 882-875 Computer Clinic Contact: Colin Keeble P.O. Box 106 Telephone (Sydney): +61 (02) 822-4303 Moorebank, 2170 NSW (Sydney): +61 (02) 822-4304 Australia Telephone (Melbourne): +61 (03) 335-3777 ! Fax (Melbourne): +61 (03) 335-3747 ! Telephone (Queensland): +61 (07) 341-9991 Doctor K(Perth Office) Contact: Rob Edwards 77 Bulwer Street Telephone (Main): +61 (09) 328-2011 Perth WA 6000 (Main): +61 (09) 328-9661 Australia Telephone (Toll- (008) 999-755 ! Telephone (Sydney): +61 (02) 281-2099 ! Telephone (Melbourne): +61 (03) 690-9100 ! Telephone (Brisbane): +61 (07) 831-0151 ! Telephone (Adelaide): +61 (08) 332-2354 New Zealand: Computer Software Library Contact: Mr. Bill Strauss of New Zealand Limited Telephone: +(64) 3 615-9333 P.O. Box 162 Fax: +(64) 3 615-9303 Timaru 8600 BBS: +(64) 3 615-9313 New Zealand $ & +(64) 3 615-9413 PZPAPN Agents - Austria: ComIn Terramar Handelsgesmbh Contact: Ronald Schmutzer Nikolsdorfergasse 8/8 Telephone: +43 (1) 543-731 A-1050 Wien " or: +43 (1) 543-337 Austria Fax: +43 (1) 543-339 ) BBS: +43 (1) 543-338 Belgium: Impakt nv Contact: Frank Lateur Ham 64 Telephone: +32-91-25-35-49 B-9000 Gent Fax: +32-91-33-00-78 Belgium SoftServe Distributors Contact: Arthur Schrey Dynamicalaan 16 b20 Telephone: +32 (3) 830-59-92 B-2601 Wilrijk Fax: +32 (3) 830-25-92 Belgium Czechoslovakia: AEC Ltd. Contact: Jiri Mrnustik MSc. Sumavska 33 Telephone: +42-5-7112 line 502 612 64 Brno Fax: +42-5-744-948 Czechoslovakia Denmark: Danadata A/S Contact: Steen Pedersen Vestergade 58 Telephone: +45 (86) 18-28-44 8100 Aarhus Fax: +45 (86) 18-28-92 Denmark BBS: +45 (86) 13-89-83 England (United Kingdom) International Data Security Contact: Oliver Mills 9 & 10 Alfred Place Telephone: +(44) 71-631 0548 London WC1E 7EB $ +(44) 71-436 2244 England Fax: +(44) 71-580 1466 ) BBS: +(44) 71-580 4800 Finland: ICL Data Oy, Contact: Erkki Mustonen P. S. Help Desk (Kayttotuki) Telephone: +358-0-567-4248 P.O. Box 458 Fax: +358-0-567-4160 SF-00101 Helsinki Finland SAFECO OY Contact: Hannu Ohrling Kirvuntie 22 Telephone: +358-0-512110 02140 Espoo Fax: +358-0-515151 Finland France: VIF "La Pepiniere" Contact: Pascal Jour 111, avenue de LODEVE Telephone: +(33)67-58-18-36 34000 Montpellier Fax: +(33)67-58-26-61 Germany: K.-H. Kitroschat, Contact: Karl-Heinz Kitroschat Engineering Office Telephone: +49 2104-48626 Naabstr. 9 Fax: +49 2104-449555 W 4006 Erkrath Germany Kirschbaum Software, GmbH Contact: Josef Kirschbaum Kronau 15 Telephone: +49 (0) 8067-1016 W 8091 Emmering b,. Wbg. Fax: +49 (0) 8067-1053 Germany perComp-Verlag GmbH Contact: Guenter Musstopf Holzmuehlenstr. 84 Telephone: +49 (0) 40 693-20-33 D-2000 Hamburg 70 Fax: +49 (0) 40 695-99-91 Germany BTX: +49 (0) 40 693-20-33 ) E-Mail: percomp@infohh.rmi.de Hungary: PiK-SYS Co. Ltd. Contact: Maria Pistar Szentmiklosi Ut. 18 Telephone: +36 (1) 276-0864 H-1213 Budapest Fax: +36 (1) 276-5714 Hungary Ireland: house Technology Group Ltd. Contact: Dermot 39-40 Upper Mount Street or: Stephen Kearon Dublin 2 Telephone: +353 (1) 615-445 Ireland Fax: +353 (1) 615-323 ) BBS: +353 (1) 288-5634 ) BBS (HST): +353 (1) 283-1908 Italy: Ultimo )Editrice, SRL Contact: Adalberto Fontana Via A. Manuzio, 15 Telephone: +39-2-655-5306 20124 Milano Fax: +39-2-659-7693 Italy Norway: Data-Utvikling AS Contact: Mr. Dag Bjornaes Vestre Rosten 81 Telephone: +(07) 890020 7075 Tiller Fax: +(07) 890021 Norway PDI Group/PDI Gruppen Contact: Datasecurity Department POBox 246, 1411 Kolbotn Telephone: +(02) 806622 Rosenbolmvelen 40, 1410 Kolbotn Fax: +(02) 806670 Norway BBS: +(02) 295626 Spain: Datamon S.A. Central Contact: Carmen M. Mestres Corcega, 485 Telephone: +34 (3) 207-2704 08025 Barcelona Fax: +34 (3) 457-1370 Spain Datamon S.A. - Macroservice Contact: Diego Saez Infanta Mercedes, 83 Telephone: +34 (1) 571-5200 28020 Madrid Fax: +34 (1) 571-1911 Spain Sweden: Help Center - Main Office Contact: Mikael Larsson Box 7018 Telephone: +46 (0) 26-100518 S 811 07 Sandviken Fax: +46 (0) 26-275720 Sweden BBS: +46 (0) 26-275710 ) FidoNet: 2:205/204 ) VirNet: 9:461/101 ) InterNet: vhc@abacus.hgs.se Help Center - Gavle Office Contact: Ola Larsson Box 1237 Telephone: +46 (0) 26-100518 S 801 37 Gavle Fax: +46 (0) 26-275720 Sweden Mobile Ph: +46 (0) 10-295 5552 ) FidoNet: 2:205/212 ) VirNet: 9:461/112 ) Internet: vhcola@abacus.hgs.se Switzerland: Dasikon AG Contact: Marcus Laeubli Computer C Telephone: +(41) 1 945-5970 Sandbuelstrasse 6 Fax: +(41) 1 946-0545 8604 Volketswil Switzerland The CPU Communications Contact: Rick Wezenaar & Productions United C.V. Telephone: +(31) 73-141252 Predikheerenpoort 8 Fax: +(31) 73-140437 5211 NK Den Bosch BBS: +(31) 73-130204 The CPU Communications Contact: Fred Janssen & Productions United C.V., Telephone: +(31) 10-4863510 Technical Support Center Fax: +(31) 10-4863640 P.O. Box 5011 BBS: +(31) 10-4863771 3008 AA Rotterdam The PZPAPN Agents - Far East & Asia Indonesia: P. T. Yakin Aman Contact: M. A. Sunardi #15-16, Block FX-1 Telephone: +62 (21) 451-0072 Jalan Kelapa Gading Boulevard +62 (21) 451-2729 Jakarta 14240 $ +62 (21) 451-2880 Indonesia Fax: +62 (21) 451-2880 4 +62 (21) 451-2731 Japan: LINK Co. Ltd. Contact: Akira Watanabe (formerly Lonrho Int'l Networks Ltd) Telephone: +(81)3 3493 5850 (Japan Computer Association) Fax: +(81)3 3493 5188 Rosebay Gotanda Building 10F BBS: +(81)3 3493 9739 8-8-15 Nishi-Gotanda Shinagawa-Ku Tokyo 141 Japan Malaysia: MCSB (M) Sdn Bhd Contact: Mr. M. F. Leong 17th Floor Menara Bousted Telephone: +(60)3 241 7400 Jalan Raja Chulan Fax: +(60)3 248 8010 50200 Kuala Lumpur Malaysia Singapore: MCSB (S) Pte Ltd Contact: Mr. M. F. Leong 1302 Lorong 1 TOA Payoh #01-08 Telephone: +(65) 353 5300 Siong Hoe Industrial Building Fax: +(65) 258 9945 Singapore 1231 PZPAPN The 4summarizes the ' normal behavioral characteristics. A brief description follows entry on the page; however, by applying the definitions, a more complete 4description A = wall B = C = D = wDOS E = F = Floppy (360K) G = Generic Detection Category K = N = O = P = R = #640k - segment A000) a - in unused portion of al Nnot , such as in CLI stack space or unused Example: Lehigh f - in Nnot prevent Example: Icelandic h - in high (Resides in high , right #TOM. is al so it won't be accidently Example: Flash s - in low ( /TSR) (reduces , typically uses a normal Int 21/Int 28 TSR) Example: t - TOM but #640k (moves Int 12 (Reduces Example: Brain 640k) b - in BIOS/Video/Shadow RAM area (segment A000 - e - in extended/expanded 1 Meg) S = Spawning or companion creates an aon the 7the actual Example: AIDS II T = Manipulation of the Example: Dir-2 X = %Record (ie. Example: Z = Example: Dir-2 PZPAPN (s) Cross-Reference is a cross-reference of s and corresponding cross-reference should alleviate of the confusion created by the same "referred to to by different s by different products and researchers. The column on the left lists the s in ASCII sort order. It's like alphabetical order, but includes numbers and special 3, too. The column on the right lists the corresponding you enter the columns, the HyperLink cursor be on the right. You should position the HyperLink cursor across the left-hand column you desire to cross-reference. Select by pressing the mouse button or the ENTER key. Presto! The power of Hyper is at your PZPAPN (Cross-Reference is a cross-reference of effective corresponding cross-reference should be useful confronted and the effective but the of the The column on the left indicates the effective (. Where are two numbers separated by a hyphen, it is a range of effective s. The column on the right lists the corresponding you enter the columns, the HyperLink cursor be on the right. You should position the HyperLink cursor across the left-hand effective you wish to cross-reference. Select by pressing the mouse button or the ENTER key. PZPAPN Country of Country of Cross-Reference is a cross-reference of the country of es, or location, back to the (s). If the , it be used. If it is not , the location is The in the Country of Cross-Reference lists countries. Selecting one of the countries a list Lof the country. PZPAPN No Usable Sample NO USABLE SAMPLE OF THIS VIRUS HAS BEEN RECEIVED FOR EVALUATION. If you ma replicating copy of or if you know one who N, PLEASE upload it to: The Excalibur! BBS 1-408-244-0813 Excalibur! is in Santa Clara, California, USA. Samples may sending them on to the caddress: Patricia M. Hoffman 3 Bowers Avenue Suite 130 Santa Clara, CA 95054 PZPAPN Not Done Yet FILL= The requested topic has not been written yet. Press Esc to Return to the Previous Topic PZPAPN Unable To Locate Topic FILL= The requested topic (or the file it's in) can't be found. Tip Pick an Option To ensure that all hypertext files are searched, put: Try again: Search all hypertext SET XVIEWPATH=d:\path files for a different topic. in your AUTOEXEC.BAT Search this file for any text. View the Index of this file. View the Home page of this file. See the list of hypertext files. Esc to Backtrack PZPAPN Unable to Display FILL= Sorry, but that topic cannot be displayed. This hypertext viewer is not capable of displaying graphics images on your video system. -OR- That link can't be accessed while in TSR mode. Press Esc to Return to the Previous Topic