PC Direct 1995 May/PC Direct CD-ROM (May 1995).ISO/ipe/misc/vsum/vsumx.xdb

HyperText VSUM | 1994-09-26 | 2.3 MB | 110,464 lines

VSUMX 9409
Copyright (c) 1990-94 by Patricia M. Hoffman.
All rights reserved.
Patricia M. Hoffman              Telephone:  [phone]
3333 Bowers Avenue Suite 130     Fax:        [phone]
Santa Clara, CA 95054, USA       BBS:        [phone]
aVTK/N
above
action
activates
activation
added
additional
after
aliases
alias
allocation
altered
anti-Pascal
anti-viral
anything
appear
approximately
april
attempting
attempts
august
available
based
becomes
become
beginning
being
below
besides
boundary
bulgaria
bytes
cHKDSK
cOMMAND.COM
cPAV/N
certification
changed
changes
change
characters
command
common
contains
contain
corruption
current
dark Avenger
date/time
december
decreased
decrease
delete
described
detection Method
directory
direct
discovered
discovery
diskettes
diskette
displayed
display
drive
drVirus
eff Length
encrypted
errors
error
europe
executed
execute
execution
experience
f-Prot
family
february
file's
files
first
following
found
functionally
general Comments
growth
hangs
hooked
iBMAV
including
increase
indicated
infected
infecting
infection
infector
infects
infect
information
innoc
install
interrupts
interrupt
isolated
isolation
itself
january
jerusalem
keyboard
known
lProt
length
listing
located
master
memory
messages
message
nShld
naughty Hacker
nAV/N
netherlands
non-Resident
non-resident
november
nProt
occassionally
occurred
occur
october
opened
originally
original
origin
other
overwrite
overwriting
overwritten
panda
parasitic
partition
point
previously
program's
programs
program
properly
pS-MPC
received
removal Instructions
replicate
resident
result
return
screen
sectors
sector
september
similar
stealth
stoned
strings
string
submitted
sweep/N
sweep
symptoms
systems
system
table
their
there
these
though
total
uTScan
uninfected
united States
unknown
updated
v Status
vBuster
vi-Spy
variant(s)
variants
variant
version
vienna
violator
viral
virexPC
viron
viruScan
virus Name
virus
visible
which
COLORS=1f,1e,0f,1b,1e,1d,0f,,1f,1f,1f,1f,1f,1f,1e,11,1f,1e,11,18,0f,,,,
DISABLECOPY=1
(C)=HyperText VSUM Copyright (c) 1990-94 by Patricia M. Hoffman [phone]
THINSCROLLBAR=1
_CA=Copyright (c) 1990-94 by Patricia M. Hoffman.
_CB=All rights reserved.
_CD=Patricia M. Hoffman              Telephone:  [phone]
_CE=3333 Bowers Avenue Suite 130     Fax:        [phone]
_CF=Santa Clara, CA 95054, USA       BBS:        [phone]
_BA=fff5,ffee,45,05, F1:Help
_BB=0002,ffc4,00,00,F2:Menu
_BC=ffec,ffe1,53,03,F4:Srch
_BD=ffed,ffe7,50,03,F5:Print
_BE=ffe5,ffe8,4f,04,F7:Color
_BF=ffee,ffef,57,06,F8:Viewed
_BG=fffb,002d,2d,02,<<-
_BH=fffa,002b,2b,00,+>>
_BI=fffe,ffd3,58,05,F10:Exit
_BJ=fffc,ffd0,42,06,ESC:GoBack
_BK=ffe9,ffc0,00,00,F6:Credits
_BL=ffef,ffbd,00,00,F9:Files
_BM=fff9,ffc3,00,00,F3:Index
_BN=ffea,ffa9,00,00,SearchAgain
_MA=0000,0000,56,00,VSUM Sections
_MB=04e2,0000,57,02,A Word From Patricia...
_MC=0571,0000,55,0c,Licensing VSUM
_MD=0574,0000,41,00,Authorized VSUM Agents
_ME=04e9,0000,43,00,Certification Data and Info
_MF=055f,0000,52,05,VSUM Revision History
_MG=ffff,0000,00,00,-
_MH=0003,0000,49,06,Virus Index by VSUM Virus Name
_MI=04e5,0000,4e,07,Common Name Cross-Reference
_MJ=050f,0000,54,06,Viral Type Cross-Reference
_MK=04e7,0000,4c,00,Length Cross-Reference
_ML=0517,0000,4f,00,Origin Cross-Reference
_MM=0548,0000,50,0b,Relationship Charts
_MN=050b,0000,44,12,Virus Activiation Dates
_MO=ffff,0000,00,00,-
_MP=04e8,0000,53,0b,Common Virus List
_MQ=0543,0000,45,06,Virus Entry Fields
_MR=050c,0000,4d,00,McAfee Scan-IDs
FZPAPN
Hyper
 Patricia M. Hoffman's
xSummary List (tmi
 The Reference for all
MS-DOS
 H y p e r T e x t
may not be used in a business, corporation, organization,
 government, or agent en
ment
out a negotiated site license.
 Copyright (c)
-94 by Patricia M. Hoffman.  All rights reserved.
3 Bowers Ave Suite 130, Santa Clara, CA 95054 Tel: [phone]
PZPAPN
Alpha
Index
        (    E
        0    H
        H    Q
5    X    Y
lPTyC
 Alphabetic
Index
   4Res
   5Lo
 10 Past 3
   302
   337
   500
   572
   621
   702
   834
   923
 1008
   1024 Print
 1024 SBC
 1067
   1210
 1226
 1241
   1244
 1260
 1308
   1385
 1392
 1403
   1452
 1575
   1605
 1661
 1689
   1720
 1784
 1804
   1835
 1840
 1963
   2153
 2559
 2560
   2623
 3040
 3445-
   4096
 5120
 7808
   A&A
 Abraxas 5
   Accept.3619
   Ada
 Adolf Hitler
 Adolph
   African 109
 Agena
   AIDS II
 AirCop
 Akuku
   Alabama
 Alameda
 Albania
   Albanian
   Alex-368
 Alexander
 Alfa
   All Sys 9
 Alpha-743
 Ambulance Car
   Andre
 Andromeda 1.0
   Andromeda 1.1
 Angarsk
 Animus
   Anna
 Anthrax
   Antimon
 Anti-D
 Anti-DAF
 Anti-Tel
   Anto
 Aragon
 Aragorn
   Arale
 ARCV 330
 ARCV Friends
   ARCV Xmas
 ARCV-670
 ARCV-n
   Arf
 Argentina
 Armagedon
   Arriba
 Arusiek
   Ash
 Ashar
 ASP-472
   Astra
 AT144
 Atas
   Atas II
 AtomAnt 3.0
   Atomic 1
 Atomic 2
 Attack
   Attention!
 Attention-629
   Aurea
 Aussie Dir
 Aussie Parasite
   Australian
 Australian 403
 Australian
   Avispa
 AVV-2300
 Axe-1024
   Azusa
   B&B
 Baba
 Back
   BackFont-896
 Bad Boy
 Bad-389
   Badsec
 Bad
 Bandit
   Baobab
 Barcelona
 Barrotes
   Basilisk
 Beast-N-Black
   Bebe
 Beeper
 Beer
   Belgium-320
 Benoit
 Best Wishes
   Beta
 Beware
   Big Bang
 Big Joke
 Big-2000
   Bios
 Bit Addict
 Bizarre
   Black Monday
 Black Wizard
 Blinker
   Blinky
 Bljec
 Blood
   Blood Sugar
 Bloody Warrior
   Bloody!
 Bomber
   Boojum
&Killer
     Bow
   Boys
 Brain
 Brainy
   Brazilian Bug
 Breeze
 Bryansk
   Bubonic
 Burghofer
 Burma.563
   Butterflies
 Butt Stink
 ButtUgly
   Cacophony
 Cadkill
 Cannabis
   Cansu
 Capitall
 Cara
   Career Of Evil
 Carfield
 Carioca
   Cartuja
 Cascade
 Casino
   Casper
 Casteggio
 Catman
   Caz
 CB-1530
 CCCP-510
   CD
 Cerburus
 Chad
   Chang
 Changu Mangu
   Chaos
   Chaos Year
 Chaser
 CheckSum
   Cheeba
 Chemmy
 Chemnitz
   Chile Mediera
 China
 CHR-869
   Chris
   Christmas Tree
 Chromo 1.0
 Cinderella
   Civil War
 Clone 2.0
 Clonewar
   Close
 CLS-853
 Cmdr Bomber
   Cobra
 Coffeeshop-1568
   Collor de Mello
7wealth
   Commy
 Como
 Copyright
   Cossiga
 Costeau
 CPSU-2535
   CPW
 Cracker Jack
 Crash
   Crazy Eddie
 Crazy Imp
 Creeper
   Crew-2480
 Criminal
   Cruncher
 Crusher
   Curse
 Cyber
   Cybercide
 CyberTech
 Cysta
   Dad
 Dada
 Damage
   DAME
 Dark End
   Dark Lord
 Darkray
 Datacrime
   DataLock
 Davis
 Day10
   dBASE
 Dead-790
 Death Dragon
   Deicide
 Dejmi
 Democracy
   Demolition
 Demon Viper
     Den Zuk
   Deranged
 Desperado
 Dest
   Destructor V4.00
 Devil's Dance
 Devils & Evangels
   Dewdz
   Die
 Digger
 Dima
   Dir
 Dir-2
 Dirty
   Discom
KKiller
     Dismember
   Distrust
 DLSU
   DM
 Do-Nothing
   Doctor Qumak 2
 DoDo
 Dodo 2456
   Doom II
 DOS-1
 DOS3
   DOS7
 DOSHunter
 Dostepu
   DOSVer
 Dot Killer
 Doubleheart
   Dreamer
 Drop
 Dutch 555
   Dutch
   Ear
   Ebbelwoi
   Edcl
 Egg-1000
   Eight Tunes
 Ein Volk
 Einstein
   Eliza
 Elvis-1250
   Emmie
 Emo-899
 End Of
   Enemy
 Enemy
 Enigma
   Enola
   Estepa
   ETC
 Evil
   Evil Empire
 Exebug
 Experiments
   Experiments-416
     Explosion
 Exunt
   Faerie
   Fairz
 Father
 Father Christmas
   FeelBad
   Feist
 Fellowship
   Fich
 Fichv-896
>11-537
 Filler
   Fingers
 Finnish-709
     FireFly
   Fish
   Fish
 Fisher
 Flagyll
   Flash
 Flex
 Flip
   Flower
 Flue
 Fly 1.1
   Foetus 1.1
   FoneSex
 Forger
 FORM-
   Frajer-649
 Freddy
ew-692
   Freak
 Frere Jacques
 Friday 13th
   Friends
 Frodo Soft
 Frogs
   Fu Manchu
 Funeral
 Fungus
   Fuse Box Dwarf
 FWord-383
   G2
   Geek
 Genesis
 Geodesic 2.0
   Gergana
 Ghostballs
 Gidra-469
   Gingerbread Man
     Gippo
 Gipsy-304
   Gliss
 Globe
 Gnose
   Godoy
 GoldGeld
 Golgi
   Gorlovka
 Gosia
 Got-You
   Gotcha
 Granada
 Grapje
   Graveyard-479
   Green Caterpillar-1989  Green Joker
     Gremlin
   Grither
 Groen Links
     Grog 3.1
   Groove
 Growing Block
 Groz-999
   Grunt-1
 Guillon
 Guppy
   Ha
 Hacktic
 Hafenstrass
   Hafenstrass 2
 Haifa
 Hallo-496
   Halloechen
 Halloween
 Hambone
   Hamster
 Handi-215
   Happy
 Happy New Year
kDays
   Harm-1082
 Hary Anto
 Hates-213
   Hell
 Hellween
 Hero
   Hero-394
 Hexametricx
     HH&H
   Hi
 HiDos
 Highlander
   Hiperion
 Hitchcock
 HLLS
   Hobbit
   Holiday
 Holocaust
 Hominy
   Honey
 Horror
 Horse
   Hungarian
 Hungarian 482
 Hybryd
   Hydra
 Hymn
   Ice 9
 Icelandic
 Idle
   Ieronim
 Ignorant
   IKV 528
 Ilja-1704
   Imi
 Incest
 Incom
 Infinity
 Inky
   Interceptor
 Internal
 Intruder
   Invader
 Invol
   Ionkin
 Iper
 Iranian
   Iraqui Warrior
 Iron Umbrella
   Italian 803
 Italian Boy
     Itavir
   IVP
   James Bond
 Japanese Christmas  Jason
   JD
 Jeff
 Jericho
   Jerk
11-30
-Haifa
   Joanna
 JoJo
 JoJo 2
   Joker
 Joker 2
 Joker-1602
   Jos
 Joshi
 Joshua
   Julia-1000
 Junior
   K-4B
 K-4C
 K-Hate
   Kalah
 Karin
 Karlik
   Keeper
 Kemerovo
   Keydrop
 Keypress
 Kiev 483
   Kiev 2049
 Kiwi-550
   Klaeren
 KLF-356
 Kode4
   Kohntark
 Korea
 Kremikovtzi
   Krivmous
 Kthulhu
 Kuku-448
   Label
 Lancs
 Larry
   Laufwerk
 Lazy
   LCT
 Leech
 Legalize
   Lehigh
 Leningrad II
 Liberty
   Liberty-2
 Liberty-1172
 Lippi-286
   Lisbon
 Little Br
 Little Girl
   Little Pieces
   Little Red
 Little-139
 Loa Duong
   LockUp
 Lockup 3.0
 Loki
   Lokjaw
 Lord-933
 Los-693
   LoveChild-2710
 LowerCase
 Lozinsky
   LPT Off
 Luca-309
 Lucifer
   Lurve
 LV 1.2
 Lycee
   Lythyum
 LZRQ
   M.I.R.
 Maaike
 Macedonia
   MacGyver
 Magnitogorsk 2048
   Malaga
 Malaise
 Malign
   Malmsey
 Maltese Amoeba
 Mannequin
   Manola
 Manta
 Marauder
   March 25th
 Mardi Bros
   Mark II
 Marl
 Marzia
   Matura
 Max.347
   Mayak
 Mayberry
 Medical
   Meditation
Lapse
 Mercenary
   Merry Xmas
 Meta-2048
 Metallica II
   Mexican Mud
 MGTU
   Mich II
 Michelangelo
 Micro 128
   Microbes
 Micropox
 Miky
   Milano
 Milena
 MiniMax
   Minimite
 Ministry
 Minsk Ghost
   Mirror
 Mithrandir
 Mix1
   Mix2
   MMIR
 Moctezumas Revenge  Monika-686
   Monkey
 Mono
 Month 4-6
   Monxla
 Monxla B
 Mordor.1110
   More-649
 Mosquito
 MPS 1.1
   MPS 3.1
 MPS 3.2
 MPS 4.01
   MPS II-754
 Mr. D
   Mr. G
 MShark
   MSTU
 Mugshot
 Mule
   Multi 1.1
 Multi Child
     Multi-123
   Multi-Face
 Mummy
 Munich
   Murphy
 MusicBug
 Mutant
   Mutation
 MX-335
   Mystic-377
   Natas
 Nazgul
 NaziPhobia
   NCU LI
 Necro Fear
 Necro Shadow
   Necrosoft Dementia
 NeverMind
 Newcom
   NGV
 Nina
   Nines
 Ninja
 No Frills
   NoBock
 NoInt
 Nomenklatura
   Not-586
 NPox
   NR-481
 NTKC
 Null Set
   Null-178
 Number 6
 Nygus
   Nympho 1.0
   Offspring
 Ohio
 Oi Dudley
   OMud-512
 Ontario
   Ontario 730
 Ontario III
     Oropax
   Otto6
 Outland
 Oxana
   Pa
 Parasite
   Paris
 Parity
 Parity
   Particle Man
 Path
 Pathhunt
   Patient
   Paturuzu
 Pay Rise
 PC Flu
   PC Flu-2
 PCBB
   Peace Man
 Pegg-833
   Pentagon
 Penza
 Perfume
   Phalcon.894
 Phantom
 Phoenix
   Phoenix 2000
 PhoenixD
   Piazzolla
 Pila
   Ping Pong
 Pinky
   Pirate 1344
 Pisello
 Pitch
   Piter-1228
 Pixel
 Pixie
   Plastique
 Plastique-B
     Play Tetris
   Plovdiv 1.1
 Plovdiv 1.3
     Plumbum
   Plutto
 Poem
 Poet
   Pogue
 Poison
   Pojer
 Polimer
 Polish 217
   Polish 529
 Polish 583
 Polish
   Polish-376
 Poor Man
 Porridge
   Possessed
 Praying
 Predator
   Pregnant
 Press
 Prime
   Print
 PrintMonster
 Problem
   Protecto
 Protipus
 Proud
 Psychosis
 Puke-393
   PV-81
   QMU
 Quake
   Queens
 Quiet
 Quick
   Quirk
   R-10
 R-11
 Radyum
   Rael
 Rage
 RAM
   Random
 Rattle
 RaubKopie
   Reaper
 Red Diavolyata
   RefRef
 Reklama
 Relzfu
   Reset
 Revenge Attacker
   Revelation
   Reverse.A
 Riihi
 RIP-699
   RNA
 Rocko
 Roguey
   Rosen
 RPVS
 RSP-1876
   RTL4
 Ryazan
 Rybka
   Sabbath
   Saddam
 Sadist
 Sayha Watpu
   Sandwich
 Saturday The 14TH   Schrunch-420
   Scott's Valley
 Scream
 Scroll
   Scythe
 SeaCat
 Search-1000
   Self
 Semtex
 Sentinel
   Serena
 Seventh Son
     Shadow
   Shake
 Shaker
 Shaman
   Shanghai
 Shield
 Shifter
   Shiny Happy
 Shirley
 Shock Therapy
   Sicilian Mob
 Signs
 Silence
   Silly
 Silly
     Silly-365
   Simple
 Simulati
 Sinep
   Siskin
 Sistor
 Skater
   Skew-469
   Skynet
 Skull
 Slayer
   Sleepwalker
 Slime
 Slovak
   Slow
 Sluknov
 Small ARCV
   Small
 Small-115
 Small-145
   Small-178
 Smaug
 Smiley
   Socha
   Sofia Term
 Solano 2000
thing
   Sonik Youth
 Sorlec
 Sorry
   Soupy
 Spanish
   Spanish
Fools
 Spanz
 Sparse
   Spring
 Spyer
   Squawk
 Squeaker
 Squisher
   Staf
 Stahl
 Stanco
   StarDot 600
 StarDot 789
     StarDot 801
   Stasi
 Sterculius
 Sticky
   StinkFoot
 Stone`90
   Storm-1163
 Storyteller
     Striker #1
   Student-776
   Stupid-1355
 Suicidal
 Sunday
   Sunday-2
 Sundevil
 Suriv 1.01
   Suriv 2.01
 Suriv 3.00
 Suriv 4.02
   Surrender
 Susan
 SVC 3.1
   SVC 4.0
 SVC 5.0
 SVC 6.0
   SVC-2936
 SVC.3241
   Sverdlov
 SVir
 Swap
   Swedish Boys
 Swedish Disaster
 Swiss 143
   Swiss Phoenix
 Sylvia
 SysLock
   TBug-634
 Tabulero
 Tack
   Tai-Pan
 Taiwan
 Taiwan 3
   Taiwan 4
 Tajfun
 Talentless
   Tamanna
 Tankard
 Tao Cheng
   Tatou
   Tchantches
 TechnoRat
 Telecom
   Ten
 Tequila
 Terminator
   Terminator-2294
     Terminator-3549
 Tester
   Thimble
 Thirty Three
   Timid
 Timor
 Tiso
   TMTM
 Tobacco
 Todor
   Tokyo
 Tolbuhin
 Tomato
   Tony
 Tony
 Tormentor
   Tormentor-205
 Totoro
   TPWorm
 Traceback
 Traceback 3029
   Traceback II
 Traveller
 Tremor
   Trident
 Trigger
 Troi
   Tu-482
 Tula
 Tumen
   Turbo
 Turn.557
 Tver-308
   Twin-351
   Twister
 Typo
 Typo
   UFA-1201
 Ugur
   Ultimation
 Under 7
 UnExe
   Unk
 Urfydus
 Uruguay
   Uruk-hai
   V-3n
 V270x
 V351
   V388
 V483
   V651
 V800
 V801
   V82
 V1024
 V2000
   V2100
 V2P2
 V2P6
   Vacsina
   Varicell
 VComm
   VCS
 VFSI
   VHP2
 Victor
   Vinchuca
 Vindicator
 Violetta
 Violite
   Viperize
 VirDem
 VirDem-792
   VirDem-1542
 Vivaldi
 VMem
   Voice-1495
   Voodoo
 Voronezh
 Voronezh-370
   Voronezh-Chemist
 Vote
   Vriest
 VS-2790
 VVF 3.4
   VX-163
   W13
 Walker
 Wanderer
   Warez-1341
 Warning
 Warrior
   Warsaw-850
 Wave
 Weak
   Were Here
 Westwood
 Whale
   Wharps
 Wild Thing 2
istrover III
 Windmill
 WinVir
   Wisconsin
 Witch
 Wolfman
   Wonderful
 WordSwap
 World Peace
   Worm-16850
 Worm-17690
 WW-658
   WXYC
   X-2
 Xpeh
   XPH
 Xuxa
   Yafo
 YAM-3599
   Yankee Doodle
 Yankee 2
   YB.Old Scribe
 Year
 Youth
   Zaphod
 Zaragosa
 Zero Bug
   ZeroHunt
 Zherkov
 ZK900
   ZMT
 Zoid
 Zombie
   Zu1
s and Research
   382 Recovery
 422
   4870
   Acid
 AIDS
 Amstrad
   Argentina-102
 Bad Brain
 Banana
   Blaze
 Blood Lust
 Budo
   Burger
 Busted
 Darth Vader
   Define
 DisDev
 Druid
   Explode
 Fat
   Fratricide
 Groove OW
 Green Peace
   Gyro
 Harakiri
 Hastings
   Hellraiser
 House
   Immolation
 Itti
 Kamikazi
   Leprosy
 Madismo
 Mindless
   MindRiot
 Mini-45
 Naught-865
   Nowhere Man
 Number One
 Ondra
   Over-4032
     Pascal-4260
   Pascal-5220
 Pirate
 Polish-45
   Possum
 Psychogenius
 Repent
   Seneca-B
 Shhs
 Silver Dollar
   Simple Minds
 Skism
 Small-38
   T-1000
 TalkingHeads
 Today
   Toxic
 Twin Peaks
   Tyst
 V-1n
 Viper
 Wonder
   WWT
 Yukon
  ZigZag
PZPAPN
MAIN MENU
   WEL
-E TO
 A word
fPatricia...
 Using
Index
 Cross-Reference
 Relationship Chart
 Revision History
 Licensing
 Appendices
 Exit
PZPAPN
Index
PZPAPN
     10 Past 3
     4Res
     5Lo
     99%
     302
     310
     334
     337
     382 Recovery
     405
     408
     422
     439
     500
     512
     557
     572
     595
     604
     621
     646
     66A
     702
     708
     834
     889
     914
     923
     981
     1008
     1024 Print
     1024 SBC
     1067
     1210
     1226
     1241
     1244
     1253
     1260
     1308
     1385
     1392
     1403
     1452
     1575
     1605
     1661
     1689
     1720
     1784
     1804
     1835
     1840
     1963
     2153
     2559
     2560
     2623
     3040
     3445-
     4096
     4870
     5120
     7808
PZPAPN
     A&A
     ABC
     Abraxas 5
     Accept.3619
     Acid
     Ada
     Adolf Hitler
     Adolph
     African 109
     Agena
     AIDS
     AIDS II
     Aircop
     Akuku
     Alabama
     Alameda
     Albania
     Albanian
     Alex-368
     Alexander
     Alfa
     All Sys 9
     Alpha-743
     Ambulance Car
     Amstrad
     Andre
     Andromeda 1.0
     Andromeda 1.1
     Angarsk
     Animus
     Anna
     Ant
     Anthrax
     Anti-D
     Anti-DAF
     Anti-Tel
     Antimon
     Anto
     Aragon
     Aragorn
     Arale
     ARCV 330
     ARCV Friends
     ARCV Xmas
     ARCV-670
     ARCV-n
     Arf
     Argentina
     Argentina-102
     Armagedon
     Arriba
     Arusiek
     Ash
     Ashar
     ASP-472
     Astra
     AT144
     Atas
     Atas II
     AtomAnt 3.0
     Atomic 1
     Atomic 2
     Attack
     Attention!
     Attention-629
     Aurea
     Aussie Dir
     Aussie Parasite
     Australian
     Australian 403
     Australian
     Avispa
     AVV-2300
     Axe-1024
     Azusa
PZPAPN
     B&B
     Baba
     BackFont-896
     Back
     Bad Boy
     Bad Brain
     Bad
     Bad-389
     Badsec
     Banana
     Bandit
     Baobab
     Barcelona
     Barrotes
     Basilisk
     Beast-N-Black
     Bebe
     Beeper
     Beer
     Belgium-320
     Benoit
     Best Wishes
     Beta
     Beware
     BFD
     Big Bang
     Big Joke
     Big-2000
     Billboard 1.0
     Bios
     Bit Addict
     Bizarre
     Black Monday
     Black Wizard
     Blaze
     Blinker
     Bljec
     Blood
     Blood Lust
     Blood Sugar
     Bloody Warrior
     Bloody!
     Bob
     Bomber
     Boojum
&Killer
     Bow
     Boys
     Brain
     Brainy
     Brazilian Bug
     Breeze
     Bryansk
     Bubonic
     Budo
     Burger
     Burghofer
     Burma.563
     Busted
     Butterflies
     Butt Stink
     ButtUgly
PZPAPN
     Cacophony
     Cadkill
     Cannabis
     Cansu
     Capitall
     Cara
     Career Of Evil
     Carfield
     Carioca
     Cartuja
     Cascade
     Casino
     Casper
     Casteggio
     Catman
     Caz
     CB-1530
     CCCP-510
     Cerburus
     Chad
     Chang
     Changu Mangu
     Chaos
     Chaos Year
     Chaser
     CHCC
     CheckSum
     Cheeba
     Chemmy
     Chemnitz
     Chile Mediera
     China
     CHR-869
     Chris
     Christmas Tree
     Chromo 1.0
     Cinderella
     Civil War
     Clone 2.0
     Clonewar
     Close
     CLS-853
     Cmdr Bomber
     Cobra
     Coffeeshop-1568
     Collor de Mello
7wealth
     Commy
     Como
     Copyright
     Cossiga
     Costeau
     CPSU-2535
     CPW
     Cracker Jack
     Crash
     Crazy Eddie
     Crazy Imp
     Creeper
     Crew-2480
     CRF
     Criminal
     Cruncher
     Crusher
     CSL
     Curse
     CV4
     Cyber
     Cybercide
     CyberTech
     Cysta
PZPAPN
     Dad
     Dada
     Damage
     DAME
     Dark End
     Dark Lord
     Darkray
     Darth Vader
     Datacrime
     DataLock
     Davis
     Day10
     dBASE
     Dead-790
     Death Dragon
     Define
     Deicide
     Dejmi
     Democracy
     Demolition
     Demon Viper
     Den Zuk
     Deranged
     Desperado
     Dest
     Destructor V4.00
     Devil's Dance
     Devils & Evangels
     Dewdz
     Die
     Digger
     Dima
     Dir
     Dir-2
     Dirty
     Discom
     DisDev
KKiller
     Dismember
     Distrust
     DLSU
     DNR
     Do-Nothing
     Doctor Qumak 2
     DoDo
     DoDo 2456
     Doom II
     DOS-1
     DOS3
     DOS7
     DOSHunter
     Dostepu
     DOSVer
     Dot Killer
     Doubleheart
     Dreamer
     Drop
     Druid
     Dutch 555
     Dutch
     DWI
PZPAPN
     Ear
     Ebbelwoi
     ECU
     Edcl
     EDV
     Egg-1000
     Eight Tunes
     Ein Volk
     Einstein
     EkoT
     Eliza
     Elvis-1250
     Emf
     Emmie
     Emo-899
     End Of
     Enemy
     Enemy
     Enigma
     Enola
     Estepa
     ETC
     Exebug
     Experiments
     Experiments-416
     Explode
     Explosion
     Exunt
     Evil
     Evil Empire
PZPAPN
     Faerie
     Fairz
     Fat
     Father
     Father Christmas
     FCB
     FeelBad
     Feist
     Fellowship
     FGT
     Fich
     Fichv-896
     Fil
>11-537
     Filler
     Fingers
     Finnish-709
     FireFly
     Fish
     Fish
     Fisher
     Flagyll
     Flash
     Flex
     Flip
     Flower
     Flue
     Fly 1.1
     Foetus 1.1
     FoneSex
     Forger
     FORM-
     Frajer-649
     Fratricide
     Freak
     Freddy
ew-692
     Frere Jacques
     Friday 13th
     Friends
     Frodo Soft
     Frogs
     Fu Manchu
     Funeral
     Fungus
     Fuse Box Dwarf
     FWord-383
PZPAPN
     Geek
     Generic
     Generic
     Genesis
     Geodesic 2.0
     Gergana
     Ghostballs
     Gidra-469
     Gingerbread Man
     Gippo
     Gipsy-304
     Gliss
     Globe
     Gnose
     Godoy
     GoldGeld
     Golgi
     Gorlovka
     Gosia
     Got-You
     Gotcha
     Granada
     Grapje
     Graveyard-479
     Green Caterpillar-1989
     Green Joker
     Green Peace
     Gremlin
     Grither
     Groen Links
     Grog 3.1
     Groove
     Groove OW
     Growing Block
     Groz-999
     Grunt-1
     Guillon
     Guppy
     Gyro
PZPAPN
     Hacktic
     Hafenstrass
     Hafenstrass 2
     Haifa
     Hallo-496
     Halloechen
     Halloween
     Handi-215
     Hambone
     Hamster
     Happy
     Happy New Year
     Harakiri
kDays
     Harm-1082
     Hary Anto
     Hastings
     Hates-213
     Hell
     Hellraiser
     Hellween
     Hero
     Hero-394
     Hexametricx
     HH&H
     HiDos
     Highlander
     Hiperion
     Hitchcock
     HLLS
     Hobbit
     Holiday
     Holocaust
     Hominy
     Honey
     Horror
     Horse
     House
     Hungarian
     Hungarian 482
     Hybryd
     Hydra
     Hymn
PZPAPN
     I-B
     Ice 9
     Icelandic
     Idle
     Ieronim
     Ignorant
     IKV 528
     Ilja-1704
     Ill
     Imi
     Immolation
     Incest
     Incom
     Infinity
     Interceptor
     Internal
     Intruder
     Invader
     Invol
     Ionkin
     Iper
     Iranian
     Iraqui Warrior
     Iron Umbrella
     Italian 803
     Italian Boy
     Itavir
     Itti
     IVP
PZPAPN
     James Bond
     Japanese Christmas
     Jason
     Jeff
     Jericho
     Jerk
11-30
-Haifa
     Joanna
     JoJo
     JoJo 2
     Joker
     Joker 2
     Joker-1602
     Jos
     Joshi
     Joshua
     Julia-1000
     Junior
     JW2
PZPAPN
     K-4B
     K-4C
     K-Hate
     Kalah
     Kamikazi
     Karin
     Karlik
     Keeper
     Kemerovo
     Keydrop
     Keypress
     Kiev 483
     Kiev 2049
     Kit
     Kiwi-550
     Klaeren
     KLF-356
     Kode4
     Kohntark
     Korea
     Kremikovtzi
     Krivmous
     Kthulhu
     Kuku-448
PZPAPN
     Label
     Lancs
     Larry
     Laufwerk
     Lazy
     LCT
     Leech
     Legalize
     Lehigh
     Leningrad II
     Leprosy
     Liberty
     Liberty-2
     Liberty-1172
     Lippi-286
     Lisbon
     Little Br
     Little Girl
     Little Pieces
     Little Red
     Little-139
     Loa Duong
     LockUp
     LockUp 3.0
     Loki
     Lokjaw
     Lord-933
     Los-693
     LoveChild-2710
     LowerCase
     Lozinsky
     LPT Off
     Luca-309
     Lucifer
     Lurve
     LV 1.2
     Lycee
     Lythyum
     LZRQ
PZPAPN
     M.I.R.
     Maaike
     Macedonia
     MacGyver
     Madismo
     Magnitogorsk 2048
     Malaga
     Malaise
     Malign
     Malmsey
     Maltese Amoeba
     Mannequin
     Manola
     Manta
     Marauder
     March 25th
     Mardi Bros
     Mark II
     Marl
     Marzia
     Matura
     Max
     Max.347
     Mayak
     Mayberry
     Medical
     Meditation
Lapse
     Mercenary
     Merry Xmas
     Meta-2048
     Metallica II
     Mexican Mud
     MGTU
     Mich II
     Michelangelo
     Micro 128
     Microbes
     Micropox
     Miky
     Milano
     Milena
     Mindless
     MindRiot
     Mini-45
     MiniMax
     Minimite
     Ministry
     Minsk Ghost
     Mirror
     Mithrandir
     Mix1
     Mix2
     MMIR
     Moctezumas Revenge
     Monika-686
     Monkey
     Mono
     Month 4-6
     Monxla
     Monxla B
     Mordor.1110
     More-649
     Mosquito
     MPS 1.1
     MPS 3.1
     MPS 3.2
     MPS 4.01
     MPS II-754
     Mr
     Mr. D
     Mr. G
     MShark
     MSJ
     MSTU
     Mugshot
     Mule
     Multi 1.1
     Multi Child
     Multi-123
     Multi-Face
     Mummy
     Munich
     Murphy
     MusicBug
     Mutant
     Mutation
     MVF
     MX-335
     Mystic-377
PZPAPN
     Natas
     Naught-865
     Nazgul
     NaziPhobia
     NCU LI
     Necro Fear
     Necro Shadow
     Necrosoft Dementia
     NeverMind
     Newcom
     NGV
     Nina
     Nines
     Ninja
     No Frills
     NoBock
     NoInt
     Nomenklatura
     Not-586
     Nowhere Man
     NPox
     NR-481
     NTKC
     Null Set
     Null-178
     Number One
     Number 6
     Nygus
     Nympho 1.0
PZPAPN
     Offspring
     Ohio
     Oi Dudley
     OMT
     OMud-512
     Ondra
     Ontario
     Ontario 730
     Ontario III
     Oropax
     Otto6
     Outland
     Over-4032
     Oxana
PZPAPN
     Parasite
     Paris
     Parity
     Parity
     Particle Man
     Pascal-4260
     Pascal-5220
     Path
     Pathhunt
     Patient
     Paturuzu
     Pay Rise
     PC Flu
     PC Flu-2
     PCBB
     PCV
     Peace Man
     Pegg-833
     Pentagon
     Penza
     Perfume
     Phalcon.894
     Phantom
     Phoenix
     Phoenix 2000
     PhoenixD
     Piazzolla
     Pif
     Pila
     Ping Pong
     Pirate
     Pirate 1344
     Pisello
     Pitch
     Piter-1228
     Pixel
     Pixie
     Plastique
     Plastique-B
     Play Tetris
     Plovdiv 1.1
     Plovdiv 1.3
     Plutto
     Plumbum
     Poem
     Poet
     Pogue
     Poison
     Pojer
     Polimer
     Polish 217
     Polish 529
     Polish 583
     Polish
     Polish-45
     Polish-376
     Poor Man
     Porridge
     Possessed
     Possum
     Praying
     Predator
     Pregnant
     Press
     Prime
     Print
     PrintMonster
     Problem
     Protecto
     Protipus
     Proud
     Psychogenius
     Psychosis
     Puke-393
     PV-81
PZPAPN
     QMU
     QP3
     Quake
     Quiet
     Quick
     Quirk
     Queens
PZPAPN
     R-10
     R-11
     Radyum
     Rael
     Rage
     RAM
     Random
     Rattle
     RaubKopie
     Reaper
     Red Diavolyata
     RefRef
     Reklama
     Relzfu
     Repent
     Reset
     Revenge Attacker
     Revelation
     Reverse.A
     Riihi
     RIP-699
     RNA
     Rocko
     Roguey
     Rosen
     RPVS
     RSP-1876
     RTL4
     Ryazan
     Rybka
PZPAPN
     Sabbath
     Sad
     Saddam
     Sadist
     Sandwich
     Saturday The 14TH
     Sayha Watpu
     Schrunch-420
     Scott's Valley
     Scream
     Scroll
     Scythe
     SeaCat
     Search-1000
     Seneca-B
     Self
     Semtex
     Sentinel
     Serena
     Seventh Son
     Shadow
     Shake
     Shaker
     Shaman
     Shanghai
     Shhs
     Shield
     Shifter
     Shiny Happy
     Shirley
     Shock Therapy
     Sicilian Mob
     Signs
     Silence
     Silly
     Silly
     Silly-365
     Silver Dollar
     Simple Minds
     Simple
     Simulati
     Sinep
     Siskin
     Sistor
     Skater
     Skew-469
     Skism
     Skull
     Skynet
     Slayer
     Sleepwalker
     Slime
     Slovak
     Slow
     Sluknov
     Small ARCV
     Small
     Small-38
     Small-115
     Small-145
     Small-178
     Smaug
     Smiley
     Socha
     Sofia Term
     Solano 2000
thing
     Sonik Youth
     Sorlec
     Sorry
     Soupy
     Sov
     Spanish
     Spanish
Fools
     Spanz
     Sparse
     Spring
     Spyer
     Squawk
     Squeaker
     Squisher
     Staf
     Stahl
     Stanco
     StarDot 600
     StarDot 789
     StarDot 801
     Stasi
     Sterculius
     Sticky
     StinkFoot
     Stone`90
     Storm-1163
     Storyteller
     Striker #1
     Student-776
     Stupid-1355
     Suicidal
     Sunday
     Sunday-2
     Sundevil
     Suriv 1.01
     Suriv 2.01
     Suriv 3.00
     Suriv 4.02
     Surrender
     Susan
     SVC 3.1
     SVC 4.0
     SVC 5.0
     SVC 6.0
     SVC-2936
     SVC.3241
     Sverdlov
     SVir
     Swap
     Swedish Boys
     Swedish Disaster
     Swiss 143
     Swiss Phoenix
     Sylvia
     SysLock
PZPAPN
     T-1000
     Tabulero
     Tack
     Tai-Pan
     Taiwan
     Taiwan 3
     Taiwan 4
     Tajfun
     Talentless
     TalkingHeads
     Tamanna
     Tankard
     Tao Cheng
     Tatou
     TB1
     TBug-634
     Tchantches
     TechnoRat
     Telecom
     Ten
     Terminator
     Terminator-2294
     Terminator-3549
     Tequila
     Tester
     Thimble
     Thirty Three
     Timid
     Timor
     Tiso
     TMTM
     Tobacco
     Today
     Todor
     Tokyo
     Tolbuhin
     Tomato
     Tony
     Tony
     Tormentor
     Tormentor-205
     Tormentor-1072
     Totoro
     Toxic
     TPE
     TPWorm
     Traceback
     Traceback 3029
     Traceback II
     Traveller
     Tremor
     Trident
     Trigger
     Troi
     TSoft
     Tu-482
     Tula
     Tumen
     Turbo
     Turn.557
     Tver-308
     Twin Peaks
     Twin-351
     Twister
     Typo
     Typo
     Tyst
PZPAPN
     UFA-1201
     Ugur
     Ultimation
     Under 7
     UnExe
     Unk
     Urfydus
     Uruguay
     Uruk-hai
PZPAPN
     V-1n
     V-3n
     V270x
     V351
     V388
     V483
     V651
     V800
     V801
     V82
     V1024
     V2000
     V2100
     V2P2
     V2P6
     Vacsina
     Varicell
     VComm
     VCL
     VCS
     VFSI
     VHP
     VHP2
     Victor
     Vinchuca
     Vindicator
     Violetta
     Violite
     Viper
     Viperize
     VirDem
     VirDem-792
     VirDem-1542
     Vivaldi
     VMem
     Voice-1495
     Voodoo
     Voronezh
     Voronezh-370
     Voronezh-Chemist
     Vote
     Vriest
     VS-2790
     VVF 3.4
     VX-163
PZPAPN
     W13
     Walker
     Wanderer
     Warez-1341
     Warning
     Warrior
     Warsaw-850
     Wave
     Weak
     Were Here
     Westwood
     Whale
     Wharps
     Wild Thing 2
istrover III
     Windmill
     WinVir
     Wisconsin
     Witch
     Wit
     Wizard 3.0
     Wolfman
     Wonder
     Wonderful
     WordSwap
     World Peace
     Worm-16850
     Worm-17690
     WW-658
     WWT
     WXYC
PZPAPN
     X-2
     X77
     Xpeh
     XPH
     Xuxa
PZPAPN
     Yafo
     YAM-3599
     Yankee Doodle
     Yankee 2
     Yap
     YB.Old Scribe
     Year
     Youth
     Yukon
PZPAPN
     Zaphod
     Zaragosa
     Zero Bug
     ZeroHunt
     Zherkov
     ZigZag
     ZK900
     ZMT
     Zoid
     Zombie
     Zu1
PZPAPN
:  4Res
H:
&failure;
R:  1,049
5:   PNAK -
6.55+,
n1.04+,
2.10+,
V111+,
\2.10g+, NAV 3.0A02+,
2.58+,
1.22+,
V111+,
2.58+,
 The 4Res
.  Its
.  4Res is a
uof .
-and .
the 4Res
wone .
-or .
in the
the 4Res
pof 1,049
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
 can be
in the
5in all
 "4RESPATH=
-SPEC=*.
W4RES"
jfrequently
© of
r, the
fail to
fthe
PZPAPN
:  5Lo
H:
 Poland
R:  1,030 - 1,040
5:   PRhE -
3.96+, NAV 3.0+,
1.25+
 The 5Lo
, and is
fPoland.  5Lo is a
uof .
b5Lo
X, the 5Lo
at the top of
 the
', hooking
|21.
 5Lo
pof 1,030 to
 1,040
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
can be
in the
5in all 5Lo
 "92.05.24.5lo.2.23MZ"
PZPAPN
10 Past 3
:  10 Past 3
H:
keypresses
kware devices disabled or interference
R:  748
5:   PRaCK -
, NAV,
 The 10 Past 3, or 748,
was actually
}much earlier, in early
.  10 Past 3
 is a
uof .
 The
the 10 Past 3
in low
, hooking
{21 and 6B.
, as measured by the DOS
not be
the 10 Past 3
, it
pof 748
at the end of the
a.  The
in the DOS
not be
.  No
in the
 The 10 Past 3
between 15:10 and 15:13 (3:00PM and
 3:15PM) every day, at
cause the "Ctrl" or "Shift"
 keys to be invokes
enters a
 character on the
.  As a
, the character input
 may not be the same as what the
intended.
ly, it
 either disables or interfers
the functioning of the
 devices on the days of any month
 1st day of any month -
 10th day of any month -
 16th day of any month -
monitor/
 29th day of any month -
 On the 22nd day of any month, unexpected
&s may
of 10 Past 3 are:
 10 Past 3-B: A 789
of the 10 Past 3
adds 789
)to the .
,.  It
 the
on the
monitor:
 The
in the
5in all
 10 Past 3-B
:  Republic Of South Africa
PZPAPN
:  99%
 99 Percent, Traveling Jack
H:
seconds set to 14
R:  821 - 835
5:   PNE -
/2.0+,
8/93+,
3.96+, NAV 3.0+,
 The 99%
.  Its
, but it
s to be
V.  99% is a
uof .
99% is
X, the 99%
wone .
in the
Eor in the
O's root
pof 821 to 835
 the end of the
a.  The
>and
in the DOS
to not be
, but the
 seconds
!set to "14".
 The
in the 99%
 "Het 99%-
heeft toegeslagen. . ."
is my revenge E.V !"
released 6
W\* \"
 It is
what 99% may do
of 99% are:
 99%-B:
in May
fthe
, 99%-B is a
 979
of the 99%
.  It
vone .
ain the
ever an
pof 979 to 993
 at the end of the
a.  The
>and
in the
 DOS
.  The
in the 99%-B
 "\*. *.
 The 99%-B
5to perform an absolute
 write
:  The
 May,
PZPAPN
:  302
H:
2; TSR
R:  302
5:   PRsCK -
, NAV,
/2.0+,
8/93S+,
8/93+,
.2.0+
 The 302
.  Its
.  The 302
is a
uof .
b302
X, the 302
as a low
 TSR of 864
).  It hooks
the 302
, it
pof 302
at the end of the
a.  The
>and
in the
 DOS
to the
>and
.  No
9ed in the
 The 302
Nn't do
PZPAPN
:  310
H:
i; write protect
R:  310
5:   PRaCK -
, NAV,
 The 310
.  Its
is a
uof .
 The
310 is
X, the 310
 hooking
{21 and 63 in the
|area.
 the DOS
the 310
, it
X.  If
X, it
the 310
pof 310
at the end
 of the
a.  The
>and
in the DOS
the 310
notice
fwrite protected
 write protect
Lby DOS.
 because the
Nn't check for the
Uand
handle
PZPAPN
:  334
 Made
H:   May,
 England
R:  334
5:   PNCK -
3.96+, NAV 3.0+,
8/93+,
 The 334
in May,
.  It is
 England.
is a
the 334
X, the 334
check the
bthree .
in the
 see if
it finds the
three .
`, it
wit.
 completed
process, the
the 334
 of 334
at the end of the
a.  The
>and
in the DOS
to the
>and
.  No
in the
 The 334
Nn't
to do
of 334 are:
 334-B:
on the 334
 very
.  It
vone .
ain the
Nnot
`past the
bfive in the
pof 334
at the end
 of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
 "Made in England"
:  England
 334-C:
on the 334
is an
 very minor
.  It
8the
 "Made in England"
:  England  May,
PZPAPN
:  337
 V337
H:   May,
i; TSR
R:  337
5:   PRsC -
, NAV,
1.53S+,
 The 337
Vin May,
.  337 is a
uof .
.  It
Nnot
 The
337 is
X, the
as a low
TSR of
 944
mby the
337 is
, it
by 337
at the end of
`.  The
>and
in the
not be
 337
Nnot do
PZPAPN
382 Recovery
:  382 Recovery
 382, Recovery, 382 Recovery.1
H:
b382
)of .
 spurious
Ospinning;
&failures
 Taiwan
R:  N/A
5:   ONAK -
, NAV,
 The 382 Recovery
in Taiwan.  It is
generic
uof .
-and .
the 382 Recovery
X, the
check the
Efor a .
has not
.  If it finds an
a, it
wit.  If the
 less
, the
now be 382
were
greater
not show any
 always
lthe
b382
)of the
 the
all .
`in the
Eare
r, the next
Xthe
`to .
`, however, may or may
 not later
of the 382 Recovery
#present on a
aare
 the
.  In
cases, the
hang upon
Z, requiring the
to be re
&ed.  In
cases, spurious
on the
 and the
not run.  Lastly, the
may do nothing but
 leave the
Ospinning, requiring the
to be powered
 off and re
 Occasionally, the 382 Recovery
corrupt IO.SYS, one of
 the hidden
:has
fthe
fail.
 Since the
b382
 the
`cannot be recovered.  The
 the
aare permanently lost.
`should be
Bd or
 erased and replaced
backup copies
to be
of 382 Recovery are:
 382 Recovery.1: A minor
of 382 Recovery
gequivalent to the
differs by
 See:  Burger
PZPAPN
:  405
 Hammelburg, 405-EST
H:   1987
`fail to run;
b405
)of .
 Austria or Germany
R:  N/A
5:   ONC -
\, NAV,
\, NAV, or
 The 405
is an
 in the C:
Oroot
E.  If the
of the .
less
), the
of 405
;ly cannot recognize
are already
r, so it
attempt to
 them again.
 The 405
Nn't carry an
>, and
Nn't do
in the C:
Oroot
E.  However,
 since it
s the
b405
)of .
`are not recoverable except by replacing them
 backups or
distribution
of 405 are:
 405-EST:
, 405-EST is an
of the 405
.  The purpose of the alteration
 is to avoid detection by
 See:   Burger
PZPAPN
:  408
H:
i; unexpected
; write protect
Ton write protected
R:  408
5:   PRfCK -
 The 408
.  408 is a
uof .
 The
408 is
in low
be no
qby the DOS
{80, 82, 83, 85,
 88, 89, 8A, 8C, 8E, 91, 93, 95, 96, 98, 9C, 9E, A0, A1, A2, A3, A5,
 A7, A8, AA, AC, AF, B4, B8, and BB
all be
mby the
408 is
, it
wany .
by 408
at the end of the
be no
3in the
>and
in the DOS
[write protect
fwrite-protected
require
6line input
 receive
6line input was not
 408
Nnot
to do
PZPAPN
:  422
H:   March,
`corrupted;
2; TSR;
 DOS DIR
6output not correct;
fail to function
R:  422
5:   PRsC -
1.22+
 The 422
in March,
.  Its
.  422
is a
, but not
b422
as a low
 TSR of
1,120
 by the
the 422
, it
 one .
a DOS DIR
X.  The
6output of the DOS DIR
be affected, usually
one .
#repeated multiple
the 422
pas the
where in the middle of the host
a.  The one exception is
were
smaller
 over 65K
t.  The
in the DOS
to the
>and
.  No
in the
the 422
not function
PZPAPN
:  439
H:
 Poland
R:  439
5:   PRhCK -
, NAV,
8/93+,
.2.0+
 The 439
.  It is
 Poland.  439 is a
uof .
 The
the 439
 the 439
at the top of
$the
, as
qby the DOS
@by 2,064
 by the
the 439
, it
pof 439
at the end of the
a.  The
 and
in the DOS
not be
 The 439
Nn't
to do
of 439 are:
 439-B:
gequivalent to the
, 439-B is
 a minor
.  A couple
)differ
fthe
: Poland
PZPAPN
:  500
H:
R:  500
5:   PRaCK -
3.96+, NAV 3.0+,
1.53S+,
 The 500
uof .
b500
 Since the
Nnot reserve the
it occupies, and
 keep
it in
 may
[frequent
the 500
, it
pof 500
at the
"of the
.  The
 and
in the DOS
not be
 The 500
cannot determine
it has
, so re
`may
tof a
in an
to the
PZPAPN
:  512
 512-A, Number of the Beast
H:
, 1989
crashes;
j; TSR
R:  512
5:   PRCK -
, NAV,
:  CleanUp, or
 The 512
is not the same as the
Friday The 13th
.  The 512
, 1989, by Vesselin Bontchev.  It
zing
is run.
becoming
, any
for any reason
rif its
is at least 512
the 512
crashes
 due to unexpected
T, as well as
j.  Damage may
`if the
runs
the /F
 parameter as the
of the
in the
Eentry
 not match the actual
Kspace used.
adjust the
ing in damaged
 The
of "Number of the Beast"
is because the
 author of the
used a signature of
666 near the end of the
to determine if the
ais already
r.  Since 512 adds
 its
5to the end of
`, it is easy to verify
rby the 512
by checking for
 signature.
of 512 are:
 512-B:
to the 512
, except
the DOS
check
 in the
!omitted.  The author's
 signature of '666' has
!omitted.
 512-C:
to the 512-B
, minor
 512-D:
to the 512-C
, except
no longer
 checks to see if a
ahas the
Attribute on it before
 512-E:
to the
, such as
on video cards.
la 55,104
qby the DOS
Nnot use the
666 signature to designate
 512-F:
, the DOS
 show any
.  The "666"
signature can be
`as offset 1FD.
PZPAPN
:  557
H:
R:  557 - 566
5:   PRhE -
, NAV,
3.96+, NAV 3.0+,
1.22+,
 The 557
.  Its
is a
b557
at the top of
 the
qby the DOS
@by 624
mby the 557
the 557
, it
pof 557 to 566
at the
 end of the
a.  The
>and
in the DOS
to the
 and
.  One
s in all
 "X[YZ]"
 The 557
Nn't
to do
PZPAPN
:  572
H:
R:  572
5:   PRhE -
, NAV,
1.53S+,
 The 572
.  Its
is a
 The
the 572
at the top of
$the
, as
qby the DOS
@by 1,024
{21 and 24
 the 572
the 572
, it
pof 572
at the end of
 the
a.  The
>and
in the DOS
to the
>and
 It is
if 572
of 572 are:
 572-COD: A minor
of the 572
has three
differ.
 May,
PZPAPN
:  595
H:
R:  595
5:   PNCK -
2.58+,
1.22+,
2.58+
 The 595
.  Its
.  The 595
is a
uof .
the 595
X, the 595
wone .
in the
E.  If all of the .
`in the
 already
r, the
search for a .
in the
Oroot
pof 599
 the end of the
a.  The
>and
in the DOS
to the
 and
is one
in the
 It is
if 595
PZPAPN
:  604
H:
R:  604
5:   PRhCK -
/2.0+,
2.10+,
.2.0+,
6.64+
 The 604
.  Its
.  604 is a
uof .
b604
at the top of
 the
', not moving
|12's
, as
qby the DOS
@by 880
mby the
the 604
, it
pof 604
at the end of the
a.  The
>and
in the DOS
not be
.  No
in the
PZPAPN
:  621
thing
H:
R:  621
5:   PNCK -
 NAV,
 The 621
.  Its
~are
.  621 is a
uof .
621 is
X, the
search
 the
Oand
Efor an
, it
rby the 621
 621
at the end of the
a.  The
in the
 "Water detected in math-co-processor"
 "PARITY ERROR"
halted"
thing wonderful has happened, your PC is alive..."
 It is
what 621
PZPAPN
:  646
H:
R:  646
5:   PNCK -
, NAV,
 The 646
.  Its
is a
uof .
the 646
X, the
wone
ain the
by 646
 the end of the
`can be easily identified as
always end
 the hex
: "EAF0
s to do nothing except
PZPAPN
:  66A
 Satan-B
H:
 failure; "Too many
`open"
R:  512
5:   PNCK -
3.96+, NAV 3.0+,
 The 66A
.  Its
~are
is a
the 66A
search the
Eto locate all
`.  As the
`are
d, the
wthem.
the 66A
pof 512
at the end of the
a.  The
>and
in the DOS
to the
>and
 The
can be
in all 66A
 "66A"
 The "66A"
is used by the
to determine if the
awas
r, and is
at the end of the
the 66A
may fail to
 or unusual
, such as "Too many
`open".
PZPAPN
:  702
H:
i; TSR
R:  702
5:   PRsC -
/2.0+,
\2.09+,
n1.03+,
2.10+,
, NAV 3.0A06+,
1.22+,
.2.0+,
1.0A06+
 The 702
.  702 is a
 of .
it is
what picky about what it
 The
the 702
as a low
TSR of 944
mby the
the 702
, it may
pof 702
at the end of
 the
a.  The
>and
in the DOS
not be
.  No
 the 702
 It is
if 702
PZPAPN
:  708
H:
i; TSR;
R:  708
5:   PRsCK -
\2.10g+,
2.11+,
6.64+,
1.25+
 The 708
.  Its
.  708 is a
uof .
 The
the 708
 the 708
as a low
TSR of 1,040
mby the
, the
wthe copy of
in the C:
Oroot
Eif it was not
the 708
, it
wthree .
in the
 708
at the end of the
 The
>and
in the DOS
to the
>and
 The
in the 708
 "Bad
 "C:\
-MAND .
 The 708
corrupt the
corrupted
lthe
bthree
, no
.  The
in the DOS
not be
Zof one of
corrupted
hang.
PZPAPN
:  834
 Arab
H:
i; TSR;
; unexpected
Kaccesses to
 may hang
 Saudi Arabia
R:  834
5:   PRsC -
, NAV,
 The 834
.  Its
is a
uof .
 but not
 The
the 834
 the
as a low
 TSR of 1,808
mby the
 well.  At
, the
access the
, altering it.
the 834
, it
`of a
greater
4K in
,, however,
not be
by 834
), the
at the
 end of the
.  The
>and
in the
Eis not
by the
the 834
may notice unexpected accesses
 to the
executing
accesses are the
accessing the
X, or a
 by the
.  The
wious copy of the
, but has
later
&the
fthe
in a
hang
ring during the
&process.
of 834 are:
 834-B: (Arab)
to the
are greater
1K in
before
t.  Two
5: "nsed Materi" and "
 Low
TSR is 1,792
PZPAPN
:  889
H:   March,
R:  889 - 903
5:   PRhA -
3.96+, NAV 3.0+,
 The 889
in March,
.  Its
.  889 is a
uof .
, but not
b889
X, the 889
at the top of
 the
', hooking
|21.
, as
qby the DOS
@by 960
|12's
not be
 moved.
the 889
, it
-and .
, but not
pof 889
at the end of the
by 889 to 903
at the end
 of the
a.  The
>and
in the DOS
to the
 and
.  No
 the
 It is
what the 889
may do
PZPAPN
:  914
 Russian Mutant
H:
R:  914
5:   PRhC -
, NAV,
 The 914
.  Its
.  The 914
is a
uof .
.  It
Nnot
 The
the 914
at the top of
$the
|12's
 not
!moved.
qby the DOS
@by 912
{1C and AC
mby the
the 914
, it
 larger
1K in
pof 914
 the
at the end of the
a.  The
>and
in the DOS
are no
in the
 It is
if 914
PZPAPN
:  923
 Hey You
H:
may fail to
R:  923
5:   PRhAK -
, NAV,
 The 923
.  Its
 923 is a
generic
uof .
-and .
 The
923 is
X, 923
at the top of
$the
qby the DOS
Aby 944
mby the
923 is
, it
-and .
X.  If
X, it
 923 to 942
at the end of the
Nnot alter
in the
9the
 is part of the
 "Hey, YOU !!!
thing's happening to you !
 Guess what it is ?!
 HA HA HA HA"
may be
L, the
be terminated and the
ed to
 a DOS prompt.
PZPAPN
:  981
 Joe's Demise
H:   May,
R:  981 - 1,932
5:   PRhA -
P, NAV 3.0+,
1.53S+,
.2.0+
 The 981
Gin the
in May,
.  Its
is a
-and .
`, but not
b981
X, the 981
at the top of
$the
|12's
not be
 moved.
, as
qby the
 DOS
@by 1,952
 21 and 22
mby the
, the 981
-and .
for any reason.  .
by 981
if the
smaller
 1,934
by 1,015 to 1,025
).  In
 both cases the
at the end of the
 adding an
)to the
a.  The
>and
in the DOS
not be
 One
can be
din all 981
requires MS-DOS 3.00 or later"
 It is
what the 981
may do
of 981 are:
 Joe's Demise:
to the
has 11
differ.
PZPAPN
:  1008
 Suomi, Oulu
H:
i; internal stack
halt on
 Helsinki, Finland
R:  1,008
5:   PRCK -
\, NAV,
\, NAV, or
 The 1008
by Petteri Jarvinen of
 Helsinki, Finland.  It is a
u, and
s referred to as
 the Suomi
 The
the 1008
 the
ing in its
increasing by 1,008
).  The
,cannot be seen by
 doing a
if the
is present in
&ing a
rcopy of
,may
 in an internal stack
U, and the
#halted.
 effect was noted on the author's test machine
is a
 XT-clone running Microsoft MS-DOS
3.30.
, it
wany .
X, adding 1,008
)to the
.  The
pcannot be seen by doing a
if the
is present in
PZPAPN
1024 SBC
:  1024 SBC
 Ontario II, SBC
H:
i; intermittent printing problems;
 Canada
R:  1,024
5:   PRhAK -
 NAV,
:  CleanUp, or
 The 1024 SBC
.  Its
~is Canada.  1024 SBC is a
-and .
 It is
on the Ontario
 The
1024 SBC is
at the top of
$the
', hooking
, as measured by the DOS
@by 3,072
 12's
!moved.  At
, the
,if it was not
lany
 as the
part of the 00h
at the end of
, 1024 SBC
-and .
for any reason.
 and .
pof 1,024
be hidden if the
.  The
at the end of the
 A symptom of a 1024 SBC
 intermittent printing problems
printer.
 Unlike several
hide the
 the DOS
 1024 SBC is an
, and no
 the
 See:   Ontario   Ontario III
PZPAPN
1024 Print
:  1024 Print
 1024PSCR
H:   May,
2; Print
 failure;
R:  1,024
5:   PRhCK -
, NAV,
 The 1024 Print
in May,
.  Its
 and its
~, are
is a
uof .
 The
1024 Print
X, the
at the top
$the
, as measured by the DOS
 2,048
 and 21
mby the
1024 Print
, it
over 1K in
for any
 reason.
by 1,024
at the
"of the
1024 Print
>and
in the
to the
1024 Print
, it
interfer
 the functioning of the Print
key.  Pressing the Print
in a
Mof the
's CMOS
 configuration instead of printing the contents of the
PZPAPN
:  1067
H:
; TSR;
R:  1,067
5:   PRhCK -
, NAV,
 The 1067
.  1067 is
uof .
 It is
 The
a 1067
X, the 1067
as a low
TSR of
 1,808 or 1,856
mby the
.  Unlike most
are TSRs, the
tof the
in a
in increments of 64K.  The
may be mapped by
 utilities as an
pin the
of the in
 interpretor.
the 1067
, it
wone .
over
3K in
in the
X.  If
E, it may
 1067
 1,067
).  The
at the end of the
.  The
>and
in the DOS
are no
in the
 A symptom of a 1067
Ylarge
may fail due to the
of large
 amounts of
large .
may receive the
Ythem:
too big to fit in
 1067
Nn't
to do
PZPAPN
:  1210
 Prudents
H:
?, 1989
Kwrite failure; TSR
 Spain
R:  1,210
5:   PRE -
\, NAV,
\, NAV, or
 The 1210, or Prudents
, was
}in Barcelona, Spain,
?1989.  The 1210 is a
between May 1st and May 4th of any year,
 causing
Kwrites to be
Kverifies, so writes to
 the
Knever
between
PZPAPN
:  1226
 V1226
H:
j; spurious
Lin place of
 executing;
Ospinning
R:  1,226
5:   PRhC -
\, NAV,
1.53S+,
6.64+
 The 1226
by Vesselin
 Bontchev.
is a
generic .
Nnot
,.  The 1226
is a self-
 encrypting
, and simple search
algorithms
 work to detect its presence on a
 The
the 1226
 the
, reserving 8,192
at the top of
1226 is
, the
attempt to
is at least 1,226
 before
t.  The
is rather "buggy" and the
 process is not always entirely successful.  Successfully
by 1,226
`multiple
s, it is unable to
 determine
ais already
grow in
by an
1,226
).  Eventually,
 the .
grow too large to fit into
the 1226
[unexpected
.  An
effect
instead of a
executing, a line or two of spurious
on the
M.  Lastly,
always indicate
l8,192 less
is actually on the
 machine.
of 1226 are:
 1226-B:
, 1226-B
 is a bug fixed
of the 1226
Nnot
lthe bugs present in the earlier
cause
Ming of spurious
Nstill re
walready
`until
 too large to fit into
.  It is fairly
to 1226D.
 1226-B Dropper:
is an .
drops the 1226-B
 1226D:
on the 1226
Nnot
 the
jand the
Mof spurious
.  1226D
`over 1,226
, copied,
 1226M: (V1226M)
to the 1226D
, except
 are not
aopen,
PZPAPN
:  1241
H:
i; TSR
R:  1,241
5:   PRsCK -
, NAV,
1.53S+,
 The 1241
.  Its
is a
uof .
b1241
X, the 1241
as a low
TSR of
 1,584
), hooking
|21.  Its TSR may
6data" or as part of the
6interpretor in
mapping utilities.
the 1241
, it
X.  If
X, it
ras well.  1241
pof 1,241
 at the end of the
be no
3to the
>and
in the DOS
 It is
what 1241
PZPAPN
:  1244
H:
i; TSR
R:  1,244 - 1,258
5:   PRsA -
 NAV,
 The 1244
.  It is
 where it was
}.  1244 is a
uof .
-and .
`, it
Nnot
 It is
on the
 The
the 1244
as a low
TSR of 1,440
).  It
{08 and
the 1244
, it
pof 1,244
at the
"of the
pof 1,244 to 1,258
at the end of the
be no
3to the
>and
in the DOS
.  One
can be
dconsistently
 in the
 "CONFIG"
 It is
what 1244
of 1244 are:
 1244-B:
to the
8the
"KATALOG".
:  Poland
 See:
PZPAPN
:  1253
 Anticad, V-1,
ksgiving
H:
 TSR; BSC;
 Austria
R:  1,253
5:   PRsBCKX -
, NAV,
:  NAV or
`and replace
 The 1253
.  It is believed to
ated in (or at least to
}in) Austria.
 1253 is a generic
uof .
,. It
vthe
Iand the
 The
the 1253
 the
as a low
 TSR.  The TSR
be 2,128
, hooking
 13, 21, and 60.
remain un
1, and
Aby 2,128
).  At
, the
of the
the 1253
.  If
 the
J, the
 the .
rif it hasn't
r. The 1253
appends its
5to the end of the
a, and
2the
bfew
)of the
 be a jump to the appended
 by 1,253
), and the
makes no attempt to hide the
fourth through sixth
)set to "V-1" (hex 56 2D 31).
 Any
are accessed while the
is present in
 Newly formatted
I, likewise,
rimmediately.
 The 1253
is destructive
.  The author of
was able to get it to activate by setting the
?24th and
executing an
 The
promptly went and overwrote the entire
a pattern of 9
of what
s to be a
 fragment.
has started to
J, the
way to stop the
Kactivity is to power off the
 The
in the
and/or
is of
 special note.
fthe
in the
, the
.  At
, the
 resides
the top of
$the
'.  The
be 77,840
). It can be seen
6.  At
, any .
the 1253
, even
on the
before the
 One effect of
Oor floppy is
the FORMAT
6may
 in unexpected
Kactivity to inactive
Os.  For example, on the
 author's
formatting a
OC:,
was always
Kactivity to
sthe 1253
requires
 deleting
, the
 the
of any
Iexposed to the
 be dis
r.  If the
 not dis
r, the
promptly
fthe
J.  Dis
sthe
 done
in the
's full
again
 It is
>s for
 if it
Kif an
?24th
fthe
PZPAPN
:  1260
 V2P1, Chameleon
 Research
H:
 Minnesota,
R:  1,260
5:   PNC -
Encrypting
, NAV,
1.25+
:  CleanUp,
\, or
 The 1260
 not
, but is it extremely virulent
pd by 1,260
), and the
 The encryption key
 The 1260
is derived
fthe
 is highly modified.
was developed as a research
by Mark Washburn, who
 wished to show the
community why identification
ners do not work in all cases.  The encryption used in 1260 is
 one of many possible cases of the encryption
 Washburn's later research
, V2P2.
 See:
  Casper   V2P2   V2P6
PZPAPN
:  1308
KSpoiler
H:
i; lost clusters
R:  1,308
5:   PNCK -
, NAV,
 The 1308
.  Its
.  The 1308
is a
 of .
the 1308
X, the
 1308
search the
Efor the
a.  If an
, it
 it.
pof 1,308
at the end of the
.  The
>and
in the DOS
the 1308
may notice increasing numbers
 of lost clusters
 clusters may
`, and typically
 in multiples of 10.
PZPAPN
:  1385
KPlus 1
H:
i; TSR;
R:  1,385
5:   PRsCK -
 NAV,
3.96+,
 The 1385
.  Its
~are
.  1385 is a
 of .
,.  It
Nnot, however,
wvery small .
 The
the 1385
 the 1385
as a low
TSR of 3,376
{13, 21, CC, and F8
mby the 1385
, the
,if it was not
r, and one
in the
Oand
the 1385
, it
X, plus one
in the
mechanism allows the
to spread very
 quickly.
the 1385
pof 1,385
at the
"of the
.  The
>and
in the DOS
.  Two
in the
 "c:\
 "PATH="
the 1385
 It is
if 1385
PZPAPN
:  1392
 Amoeba
H:   March,
 TSR; .
>s modified
 Indonesia
R:  1,392
5:   PRA -
\, NAV,
\, NAV, or
 The 1392, or Amoeba,
}in Indonesia in March
.  The 1392
is a
 and .
,.  It copies the
b1,089
)of the host
ato the end of the
s the
b1,089
5.  An
to the end of the
a.  As
`are
 creation/modification
1to the
>the
`were
Nnot
to cause any destructive damage.
 The
s in the
is where its
 of Amoeba was derived
 "SMA KHETAPUNK - Nouvel Band A.M.O.E.B.A"
PZPAPN
:  1403
H:
R:  1,403 - 1,417
5:   PRhAK -
1.53S+,
1.22+,
6.64+
 The 1403
.  Its
.  1403 is a
-and .
b1403
X, the 1403
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 3,296
{08, 12, 13,
 and 21
mby the
the 1403
, it
-and .
pof 1,403
).  .
by 1,403 to 1,417
).  In both cases, the
at the end of the
a.  The
>and
in the
 DOS
not be
.  No
in the
 It is
what 1403
PZPAPN
:  1452
H:
i; unexpected
R:  1,452 - 1,465
5:   PRCK -
/, NAV,
1.53S+,
 The 1452
.  Its
is a
uof .
 The
1452 is
X, the
wall .
in the C:
Oroot
 The
, however,
Nnot
 Later,
is re
fthe C:
O, the
as part of the
6interpretor.
pof 1,452 to 1,465
at the end of the
are no
in the
5in the
1452 may
[unexpected
require
6line input.
 For example,
Zof the DOS EDLIN
in the
"Invalid
", and the
be terminated.
 It is
what 1452
and disrupt
 operation.
 See:   Antimon
PZPAPN
:  1575
 1577, 1591, Green Caterpillar
H:
; sluggishness of DIR
 "green caterpillar"
s on
 Taiwan
 Ontario, Canada
R:  1,575
5:   PRfAk -
\, NAV,
:  CleanUp, or
 The 1575
}in Ontario, Canada, in
!widely reported, and is believed to be
fthe Far East, probably Taiwan.  It is a
uof .
-and .
`, and
the 1575
X, the
in 1,760 to 1,840
 the top of
, but
$the
is not reserved, and may be
later by an
mby the
 the
Oroot
the 1575
, it
wone .
 one .
on the
ever a DOS DIR or COPY
Nnot spread
>and
in the DOS
to the
>and
show an
pof between
 1,577 and 1,591
at the end of
la green caterpillar
 the
to the
Centipede game creature.
of 1575 are:
 1575-B:
to the 1575
.  The major difference is
 reserves the
it occupies at the top of
is not moved.
 1575-C:
to the 1575-B,
Xin addition to
a DOS DIR or COPY
6is issued.
may hang
 1575-D:
Zof an
in the C:
becoming
r.  Later
 the
fthe C:
in the
 becoming
are copied (both source and target), or
a DIR
6is issued.
as Green
 Caterpillar due to the graphic caterpillar
and eat all the
fthe
 1575-E:
Zof an
in the C:
becoming
r.  The
the next
X.  Its
at the top of
 the
'is 1,840
), hooking
 1575-E
-and .
a DOS DIR
X, or a
by 1,575 - 1,591
at the end of the
a.  The
>and
 the DOS
to the
>and
 has
to avoid detection by
:  Australia
 1575-Libin: Fairly
in behavior to 1575-E,
to avoid detection by
utilities.
 See:   Green Caterpillar-1989
PZPAPN
:  1605
 1605-B, 1600, Anti
, Tel Aviv
H:
i; TSR;
slowdown
R:  1,605
5:   PRsA -
, NAV,
:  NAV, or
 The 1605
was uploaded to John McAfee's Homebase BBS by an
 anonymous
.  The
.  The 1605
is a
uof .
`, and it
Nnot
,.  It is
roughly
 on the
 The
the 1605
 the
as a low
 TSR of 1,728
{13 and 21
mby the
.  At
, the
slowdown by
 15-20%.
becoming
, any .
-or .
rby the
by 1,605
)in all cases
at the
"of the
a.  .
by between
 1,601 and 1,610
at the end
 of the
replicating, it is
carries any
 damage potential.
of 1605 are:
 1605-B:
by MicroCom in London, England in
 March
in a plain envelope
a London postmark.  The
 label on the
Jread "Solomon
 is not related in any way to Dr. Solomon.
 very
to the 1605
.  The major
 difference is
 by 1,605 to 1,619
 See:
PZPAPN
:  1661
 Cascade.1661, Turkey
H:
i; TSR
 Turkey
R:  1,661
5:   PRsCK -
n, NAV 3.0+,
30.00+,
8/93+,
 The 1661
, in Istanbul,
 Turkey.  1661 is a
uof .
`, it
 The
1661 is
X, the
as a low
TSR of
 2,000
mby the
, 1661
X.  If
X, it
by 1,661
at the end of the
 It is
what 1661
of 1661 are:
 1661-B:
as Turkey,
 Turkey in
.  It is
to the
to avoid detection by
 familiar
1661.
:  Turkey
 1661-C:
}in Turkey in
 It is
to 1661-B.
:  Turkey
 See:   Cascade
PZPAPN
1689
:  1689
H:   March,
R:  1,689
5:   PRhAK -
3.96+, NAV 3.0+,
/2.1+,
.2.0+,
 The 1689
in March,
.  Its
.  1689
is a
-and .
b1689
at the top of
$the
', hooking
{21, 22, and 2F.
, as
qby the DOS
@by 1,728
|12's
!moved.
the 1689
, it
 and .
pd in
by 1,689
), but the
 is hidden by the
it is
.  The
>and
in the DOS
not be
 Two
in the
 "5V3"
 The DOS
Ton all
.  The
 attempt to hide the
aalterations so
utilities
perform CRC or checksumming
not detect alterations on
1689
is active in
PZPAPN
:  1720
 PSQR
H:   March,
:   TSR; .
damage on
Bd on Friday the 13th
 Spain
R:  1,719 - 1,733
5:   PRsA -
, NAV,
:  NAV, or
 The 1720, or PSQR
, is a
of the
 was
}in Barcelona, Spain, in March
-and .
unlike
, it
woverlay
not be
 The
X, the
as a low
TSR of 2,048
mby 1720 in
the 1720
, it
by 1,720
), and the
at the
"of the
by 1,719 to 1,733
), and the
 the end of the
a.  In both cases,
be no
3to the
>and
in the DOS
E.  All
can be easily identified as
 the
character
"PSQR",
is the
tmarker for
 On Friday the 13th, the 1720
activate the
X, it
K.  More damaging, however, is
the 1720
check to see if the
has a
O.  If a
Ois present, the
 and
ing in all data on the
Kbecoming
.  The
to hang.
of 1720 are:
 1720-B:
}in Spain in
to the
.  The encryption
 used
in the
!slightly modified,
 most
detect
out any
 problem.
 See:   PCBB
PZPAPN
:  1784
H:
:   .
R:  1,784
5:   PRhAK -
\2.10g+,
V111+,
n1.04+,
2.10+,
2.58+,
6.60+, NAV 3.0A06+,
V111+,
2.58+,
6.64+,
1.25+,
3.0A06+
 The 1784
.  Its
is a
 of .
-and .
b1784
X, the 1784
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 2,304
mby the
, the
,if it was not
the 1784
, it
-and .
, but not
 copied.
pof 1,784
at the end of the
a.  The
>and
in the DOS
.  No
in the
 It is
what 1784
PZPAPN
:  1804
H:
:   .
 Germany
R:  1,804 - 1,805
5:   PNE -
\2.09+,
6.55+,
2.53+,
30.00+, NAV 3.0+,
2.10+,
n1.04+,
2.53+,
1.22+,
.2.0+,
6.64+
 The 1804
fGermany in
.  1804 is
uof .
the 1804
X, the 1804
wone .
in the
usually
pof 1,804
be 1,805
).  The
at the end of the
a.  The
>and
in the DOS
to the
>and
.  No
 are
in the
 It is
what 1804
PZPAPN
:  1835
H:
R:  1,835
5:   PNE -
, NAV 3.0+,
/2.1+,
.2.0+,
 The 1835
.  It is a
uof .
and is very roughly
on the Yankee
 Doodle
.  The
sample has
ated
the 1835
X, the 1835
wtwo .
in the
pof 1,835
at the end of
 the
a.  The
>and
in the DOS
not be
 Two
in the
can be
 "*.exe *.*"
 It is
if 1835
PZPAPN
:  1840
H:
i; TSR; Write protect
R:  1,838 - 1,891
5:   PRsAK -
, NAV,
 The 1840
}and
.  Its
.  1840 is a
uof .
 and .
 The
1840 is
X, the
as a low
TSR of 2,144
mby the
, 1840
X, it
by 1,838 to 1,891
).  The
at the end of the
 Two
in the
can be
 "NV71.
-MAND"
 It is
if 1840
PZPAPN
:  1963
 V1963, 1963 OverWrite
H:   May,
R:  1,963
5:   PRsAK -
, NAV,
 The 1963
in May,
.  Its
.  1963 is a
 of .
-and .
, it hides its
 regardless of whether the
.  It is related
 to the
 The
the 1963
 the
as a low
 TSR of 5,136
mby the
mark its TSR as "
is in fact
 reserved.
1963 is
, it
-and .
 over 1,963
X.  The
vthe
by writing the
b1,963
 of the
end of
amark, and
copying
into the
b1,963
)of the
a.  (.
lthe
b2,475
)of the
, the difference is
 due to the .
Wheader.)
do not
 in the DOS
Zof the DOS
#detected.
regardless whether the
 1963 is capable of dis
on the fly.  As a
unaware of
be unable to locate it on
using CRC or checksumming techniques.
 Further,
Zof an
unaware of 1963
in all
 becoming
 It is
what 1963
of 1963 are:
 1963-B:
in May,
V.  1963-B is
in behavior to 1963.  The primary difference is
are 48
differ
fthe
 See:   Cracker Jack
PZPAPN
:  2153
H:
i; TSR
R:  2,153 - 2,217
5:   PRsA -
\2.09+,
30.00+,
n1.03+,
2.10+,
 The 2153
.  Its
is a
-and .
.  It
Nnot
 The
the 2153
 the 2153
as a low
TSR of 2,672
mby the
the 2153
, it
pof 2,153 to 2,168
pof 2,203 to 2,217
).  In both cases the
at the end of the
a.  The
>and
in the DOS
not be
 It is
what 2153
PZPAPN
:  2559
 Yaunch
H:
j; unexpected
Kaccess to
R:  2,559 - 2,933
5:   PNE -
/, NAV,
 The 2559
xabout its
is un
.  2559 is a
uof .
2559 is
X, the
 search the
Efor a candi
 If one is
d, it
wit.  If not, it
search the B:
 and C:
Estructures for a candi
, and
2559
 of 2,559 to 2,933
).  The
at the end
of a 2559
tare
large .
 fail to
s due to
 the
having al
a large amount of
 host
Xby the
.  The
isn't released
 until the host
completes
jmay
PZPAPN
:  2560
 Magnitogorsk
H:
R:  2,560
5:   PRhA -
, NAV,
 The 2560
.  It is
fthe
is a
uof .
-and .
`, it
Nnot
 The
the 2560
 2560
at the top of
 but
$the
|12's
is not
 moved.
{08, 13, 21, and 22
mby the
, as measured by the DOS
Aby 5,184
becoming
, 2560
-and .
over
3K in
for any reason.
pof 2,560
at the end of
 the
a.  The
>and
in the DOS
not be
 The DOS EDLIN
fail to function
2560.
YEDLIN
in the
 "Invalid
L, and
EDLIN
 terminate leaving the
at a DOS prompt.
 2560 is a
.  While it
Nnot hide it's
p, it
Nactively employ
techniques in order to
 avoid
utilities
are unaware of it.
 It is
what 2560
of 2560 are:
 2560-B:
in May,
V, 2560-B's major
 difference
f2560 is
,the
p, regardless of whether the
 2560-C:
in May,
V, 2560-C's is
 very
to 2560-B.
 Magnito-3000:
on the 2560-C
, Magnito-3000 is a
 3,000
of the
.  Its
 6,064
), hooking
{08, 13, 21, and 22.  It
-and .
X, copied, or
for any reason.
pof 3,000
be hidden
 the
.  The
at the
.  The
>and
 in the DOS
not be
.  The
in the
-MAND"
 "AND"
 Magnum:
on the 2560-C
, Magnum has
 avoid
#detected by
.  It
reset the
>to 1-03-1988
it is
.  The
 the
 "Mr. Lozinsky
 Just  read document on your AIDSTEST
 (1-Jan-91
) we release  new
. (C)
TeleFucks, Ltd
 See:   Magnitogorsk 2048
PZPAPN
:  2623
H:   May,
R:  2,623 - 2,633
5:   PRhE -
/2.0+,
3.96+, NAV 3.0+,
8/93+,
.2.0+
 The 2623
in May,
.  Its
~are
.  The 2623
is a
 of .
 The
the 2623
at the top of
$the
, as
qby the DOS
@by 2,864
{21, 22, and 2F
 by the
|12's
!moved.
, the 2623
wa randomly selected .
in the
the 2623
, it
intermittently
wone .
in the
the 2623
pof 2,623 to 2,633
at the end of the
a.  The
>and
in the DOS
are no
in the
 in 2623
 It is
what the 2623
PZPAPN
3040
:  3040
 3040
H:
R:  3,040 - 3,183
5:   PRaA -
 NAV 3.0+,
1.25+
 The 3040
.  Its
.  3040
is a
uof .
-and .
, but not
,.  It uses
techniques to avoid detection.
 The
the 3040
at the top
$the
as the
Nnot
allocate the
where it resides.
to the
the 3040
, it may
 of the .
-and .
in the
pof 3,040 to 3,183
 at the
"of the
a.  The
>and
in the
 DOS
to the
>and
.  No
in the
 The
portion of the
performs the
 function to avoid the detection of
.  It effectively
on the fly
are read into
, thus
 avoiding
locating the
2due to
PZPAPN
3445-
:  3445-
 3445
H:
R:  3,445
5:   PRhA -
 NAV 3.0+,
 The 3445-
, or 3445,
.  Its
.  3445-
on all
configurations, and on most
Zof an
in a
hang.  It
 is a
uof .
employs
techniques to avoid detection.
 The
the 3445-
X, one of two things
happen.  On most
, the
be hung, and the
lto re
&the
, the
 3445-
, it
at the
 top of
$the
 and
, as
qby the DOS
@by 3,488
|12's
!moved.  The 3445-
 21 at the top of
|01 in low
the 3445-
, it
 and .
, but not
 copied.  In the case of copying, both the source and target
the 3445-
pof 3,445
 not be
in the DOS
if the
.  The
at the end of the
.  The
>and
in the DOS
of a 3445-
tare
the DOS
indicate
Ton all
 the
in a
hang.
PZPAPN
:  4096
 FroDo
H:
W, & overlay
i; TSR hides
 crosslinks;
:of data
 Israel
R:  4,096
5:   PRsA -
, NAV,
: CleanUp,
\, NAV or
 The 4096
 considered a
it is almost in
to the
 The 4096
W, and Overlay
`, adding 4,096
 the
in a
into
, it
 execu
oif it is
 COPY or XCOPY
is destructive to both data
`and execu
 as it very slowly cross-links
`on the
K.  The
 cross-linking
s so slowly
is a
kware
 problem, the
#almost in
.  The cross-linking of
`is the
of the
manipulating the FATs, changing the
 number of
, as well as the
issuing
think
llost
 cross-linking if the
is in
 As a side note, if the
is present in
and you attempt to
 copy
`, the new copy of the
not be
if the new copy
Nnot
lan execu
 extension.  Thus, one way to dis
is to copy off all
 the
a non-execu
aextension
 (i.e., don't use .
-, .SYS, etc.) while the
is active in
power off the
and re
fa write-protected,
&ed and the
is not in
Bthe
`and copy back the
Ito the
execu
s and extensions.
 The
wthe
, if done correctly, but
 still leave the problem of cross-linked
are permanently
 damaged.
 On or
22 of any year, the 4096
s to be a "bug" in the
 it goes into a
consuming loop.
 The 4096
in its
5; however,
 it is never written out to the
.  Moving
to the
of a
Jand re
&ing the
in the
"FRODO LIVES"
 22 is Bilbo and Frodo Baggin's birthday in the Lord of the Rings
 trilogy.
 An important note on the 4096
data
s, the data
to be
 fine on
.  However,
is later
now be corrupted and unpredic
s may
of 4096 are:
 4096-B:
to the 4096
, the main
 encryption mechanism has
1in order to avoid
 detection.
 4096-C:
of 4096 is
 to the
.  The major difference is
the DOS
not show any cross-linking of
 lost clusters.  A symptom of
Kspace
according to a DIR
be more
Kspace
according to the
 DOS
 4096-D:
of 4096 is
 to the 4096-C
in behavior.  The major difference is
it has
!modified to avoid detection by
anti-
utilities.
 4096-E:
of 4096 is
 to the 4096-C
in behavior.  The major difference is
it has
!modified to avoid detection by most anti-
utilities.  Its
is 5,648
PZPAPN
4870
:  4870
 4870
H:
fail to
R:  4,870
5:   ONAK -
, NAV 3.0+,
1.25+
 The 4870
.  It's
is not
-and .
the 4870
 the
search the
Efor an
 or .
a.  The
bsuch
rby the
lthe
b4,870
)of the candi
by the
.  If the
was 4,870
)or more,
be no
pin the
in the DOS
E.  If the
was less
4,870
 in the DOS
now be 4,870
).  The
in the
not be
the 4870
checked for a
w, and
rthe candi
if one was
d, the
 terminate and
to a DOS prompt.
 A side note on
: the
is compressed
Wutility,
accounts for much of the 4,870
lthe markers of
din the
b4,870
)of the
 It is not possible to dis
the 4870
as the
b4,870
)of the
 are lost.
must be
Bd or erased,
 replaced
clean copies.
PZPAPN
:  5120
 VBasic
, Basic
H:   May,
 West Germany
:; unexpected
Kactivity
R:  5,120
5:   PNAK -
\, NAV,
\, or
 The 5120
}in May,
.  It is a non-
generic
-and .
is was written in compiled
 Turbo Basic
assembly language.
X, the 5120
-and one .
aon the
Oand
E, followed
wone randomly selected .
-or .
Eon the
's C:
by 5,120
).  .
rby the 5120
by between 5,120 and 5,135
 Unlike most of the MS-DOS
es, the 5120
Nnot intercept
Kwrite
.  Thus,
may notice
Kwrite
no access
 should be
ring for a
O, such as the C:
 Data
`may
 corrupted on
, and
 cross-linking of
`may
 The
can be
 5120
near the end of the
 "BASRUN"
 "BRUN"
 "IBMBIO.
 "IBMDOS.
 "Access denied"
is one
of the 5120
Nnot
, but be
ls in a very
manner.
second
is not
qhere as the author
Nnot
la copy.
PZPAPN
:  7808
H:   May,
 "Not enough
R:  7,808
5:   PNA -
, NAV,
1.25+
 The 7808
in May,
.  Its
.  7808 is a
uof .
.  It
Nnot
7808 is
X, the
 search the
Oand
Efor a .
-or .
w.  It
wthe
-or .
it finds in the
by 7,808
).  The
at the
>and
in the DOS
to the
>and
 The
in the
 may
be re
rby 7808.
s, an
7,808
to the
7808 may
in the
"Not enough
L, and the
Yterminating.
in the
not be
r.  An
 symptom of 7808
take longer to
 load
Xdue to the
searching the
>and
in the
PZPAPN
:  A&A
H:
R:  506
5:   PRxC -
3.96+, NAV 3.0+,
1.22+,
6.64+
 The A&A
, and is
.  A&A is a
uof .
, but not
,.  It uses a tunneling technique to avoid detection by
monitoring
bA&A
X, the A&A
in a "hole" in low al
, hooking
|21.
, as
qby the DOS
not be
the A&A
, it
pof 506
at the
"of the
a.  The
>and
 in the DOS
to the
>and
.  The
can be
in the
5in all A&A
 "{A&A}"
 It is
what A&A may do
PZPAPN
:  ABC
H:
 keystrokes repeated;
R:  2,952 - 2,972
5:   PRhE -
, NAV 3.0+,
1.22+,
 The ABC
.  It is
 the
.  ABC is a
uof .
alter .
 The
the ABC
X, the
 ABC
at the top of
$the
', hooking
{16 and 1C.
, as measured by the DOS
, but
8,960
).  The copy of
ed to by
 the
-SPEC en
mental variable may
the ABC
, it
wor alter .
 and .
X.  .
are not
rby the
, but may be
, adding 4 to 30
may be
rby the
, adding
 2,952 to 2,972
 the end of the
a.  .
are not
rmay be
, adding 4 to 30
.  The
in the DOS
to the
>and
awas
in the
, but the
in the
 "ABC_FFEA"
 "Minsk 8.01.92"
 "ABC"
the ABC
[keystrokes on the
are frequently repeated, as well as
ring
of ABC are:
 ABC-2918: A
of ABC,
 is 8,960
), hooking
{16, 1C, and 60.  It
 adding 2,918 to 2,927
.  The
at the end of the
a.  The
 and
in the DOS
to the
>and
.  Like the
 alters .
, adding 4 to 16
 The same
in the
 are
 ABC-2918B:
to ABC-2918, ABC-2918B is a
 very minor
PZPAPN
Abraxas 5
:  Abraxas 5
H:
fail to
 graphic "ABRAXAS" and noise on
speaker;
2; C:\DOS\DOSSHELL.
-created
R:  1,171
5:   ONA -
30.00+, NAV 3.0+,
2.58+,
V112+,
V106+,
2.58+,
1.25+
 The Abraxas 5
.  Its
.  Abraxas 5 is a
-and .
, but not
the Abraxas 5
wthe copy of DOSSHELL.
in the C:\DOS
E(creating the
aif it
Nn't exist), as well as one
in the
E.  Due to a bug in the
in any
 by the Abraxas 5
the Abraxas 5
 1,171
, and
9the Abraxas 5
5.  The
>and
in the DOS
be set to the
>and
 The
can be
in the
5in all
 Abraxas 5
 "*.exe c:\dos\dosshell.com .. MS-DOS (c)
 "->>ABRAXAS-5<<--"
 "...For he is not of
 "...Nor he of
mind"
the Abraxas 5
in the
Mof a graphic "ABRAXAS" on the
 accompanied by an ascending scale
#played on the
speaker.
of Abraxas 5 are:
 Abraxas.1508:
, 1994, Abraxas.1508 is a 1,508
X, the
in the
E, if
 it was not
r, as well as create a
 1,508
d "ROMMAND.
-".
of 1,508
)and
9a copy of the
5.  The
is not saved by the
, and hence is not
 recoverable
fbackups.
 as well as the ROMMAND.
lthe
 and
in the DOS
Eset to the
>and
.  The
in the
 "*.exe"
 "rommand.com"
 "Darkest Avenger"
 "CES (c) Controlled En
ment Simulator"
 "Edwin Cleton
VirSoft (c)"
 "h! Get a ROD just thinking about it!"
 The Abraxas.1508
Mthe
 "I AM THE
 EDWIN CLETON
 VIRUS...
 AND I LOVE A
 GOOD HARD
 DRIVE ...A
h!  Get a ROD just thinking about it!"
 The
prior to the "...A
 in line graphic
, 1994.
PZPAPN
Accept.3619
:  Accept.3619
H:
, 1994
i; TSR
R:  3,619
5:   PRsA -
\2.13+,
6.64+,
n1.05+,
6.64+
 The Accept.3619
, 1994.  Its
.  Accept.3619 is a
uof .
-and .
, but not
bAccept.3619
as a low
TSR of 8,160
 hooking
{21 and 7E.
, it
 all of the .
-and .
in the
the Accept.3619
pof 3,619
at the end of the
a.  The
>and
in the DOS
not be
.  The
 the Accept.3619
 "ME PERDI A ACCEPT, SOY UN PELOTUDO"
 It is
what Accept.3619
PZPAPN
:  Acid
H:
fail to
R:  792
5:   ONAK -
 The Acid
.  Its
.  Acid is a
-and .
the Acid
wall of the .
in the
E.  Later, if an
X, it
 start
sthe .
in the
the Acid
lhad the
)of the host
the Acid
be no
punless the
was smaller
), in
case it
 792
.  The
>and
in the DOS
not be
.  The
can be
din all Acid
too big to fit in
 "Acid
 "Legalize ACiD and Pot"
 "By: Copyfright Corp-$MZU"
PZPAPN
:  Ada
H:
i; slow clicking
speaker;
 Argentina
R:  2,600
5:   PRsCK -
, NAV,
 The Ada
Gin Argentina in
.  Ada
 is a
uof .
 The
the Ada
 Ada
as a low
as measured by the DOS
@by 21,296 to 21,312
{08, 13, and
mby the
Ada is
, it
 are
X.  If
X, it
 of 2,600
at the
be no
3in the
>and
in the DOS
E.  The
 can be
 "PCCILLIN.
 "PCCILLIN.IMG"
 "HATI-HATI !! ADA VIRUS DISINI !!
[a slow clicking sound
 emitted
fthe
speaker.
clicking
occasionally
3in pitch.  The
receive a "
Kfull"
 even
Kthe
to write to is not
 actually full.
PZPAPN
Adolf Hitler
:  Adolf Hitler
 Adolf
H:
R:  475
5:   PR?CK -
3.96+,
8/93+
 The Adolf Hitler, or Adolf,
 Its
d due to a
s in the
.  It should
 not be confused
the Adolph
is no relationship
 between the two
es.  Adolf Hitler is a
uof .
bAdolf Hitler
in a "hole" in low
, hooking
|21.
, as
qby the DOS
 not be
the Adolf Hitler
, it
pof 475
at the end of the
a.  The
in the DOS
to the
>and
.  The
in the
5in all Adolf Hitler
 "Adolf Hitler"
PZPAPN
Adolph
:  Adolph
H:   May,
R:  2,109 - 2,445
5:   PNCK -
\, NAV,
6.55+,
1.25+
 The Adolph
Vin May,
.  Adolph
 is a
uof .
,.  Adolph is a
of V2P6.
Adolph is
X, the
 search the
Efor an
w.  If an
d, it
Adolph
by 2,109 to 2,445
at the end of the
 It is
if Adolph
 See:   V2P6
PZPAPN
African 109
:  African 109
H:
 Republic of South Africa
R:  109
5:   PNCK -
/, NAV,
 The African 109
in the
 Republic of South Africa by Oliver Steudler and Peter Stoffberg
 of the
Resource Centre.  African 109 is a
uof .
African 109 is
X, the African
 109
wall
`in the
E.  If
,happens to be in
ras well.
African 109
 of 109
).  The
at the
"of the
a.  The
>and
in the DOS
to the
>and
.  One
can be
din the
 African 109
Nn't do
PZPAPN
Agena
:  Agena
H:
 Spain
R:  723 - 738
5:   PRhAK -
\2.10g+,
/2.1+,
2.58+,
2.11+,
6.64+
2.58+,
6.64+,
1.25+
 The Agena
Gin Spain in
.  Agena
 is a
uof .
-and .
the Agena
 the Agena
at the top of
$the
, as
qby the DOS
@by 1,296
{20 and 21
mby Agena in
the Agena
, it
pof 723 to 738
at the end of the
a.  The
>and
in the DOS
.  No
in the
 It is
what Agena may do
PZPAPN
:  Ah
 Tuesday, David-1173
 Research
H:   May,
Kformat;
 Italy
R:  1,173
5:   PRhC -
, NAV,
 The Ah, or Tuesday,
in May,
.  Ah is
 the V1024
, its
is Italy.  Ah is a very buggy
Ah is
X, Ah
at the top of
, but
qby the DOS
Aby 1,216
{08 and 21
mby the
Ah is
, it
over 1K
by 1,173
 hidden if Ah is
>and
in the DOS
to be un
if the
 was 12:00a, it
now be blank.  The
at the
[frequent
Ah.
 frequently
is very noticeable.
 The Ah
on Tuesdays, at
attempt
 to format the
bfew tracks of the
Ah can be easily identified as
9the
 "(C) David Grant
Research
PCVRF
 Disribuite
ely!!!
 ...ah...John...Fuck You!"
 Ah is believe to
!created by the same person as several
fItaly,
oSmack and Enigma.  David Grant
 and the PCVRF had nothing to do
its creation.
of Ah are:
 Ah-B:
to the
wan .
.  It
8the same
as the
 See:   Alfa   V1024
PZPAPN
:  AIDS
 Hahaha, Taunt, VGA2CGA, Burger.Pascal
H:   1989
R:  N/A
5:   ONA -
/, NAV,
 The AIDS
as the Hahaha
 referred to as the Taunt
by IBM, is a generic .
, it
Ms the
"Your computer now has AIDS",
AIDS covering about
 half of the
.  The
halted, and must be
 powered down and re
&ed to restart it.  Since
s the
b13,952
)of the execu
, the
`must be
Bd and replaced
clean copies in order to
 remove the
.  It is not possible to recover the
 portion of the
 Note:
is NOT the Aids Info
K/PC Cyborg Trojan.
of AIDS are:
 AIDS B: Very
to the
AIDS
13,952
.  Unlike the
`, as well as
,, and
Nnot activate as the
did.  Instead,
occasionally issue the
 "I/O
U99, PC=2EFD
aborted".
 AIDS-
}at several locations in the
 May,
of the AIDS
 avoid detection by
utilities.  Among the
 to the
 less
two sub
Fories on the
jmay
X, as well
 as the
video mode may be switched to 25 x 40 Black &
 White
fcolor mode.
 May,
 See:   Number One
PZPAPN
AIDS II
:  AIDS II
 Companion
 Endangered
H:
 Creates .
`; melody;
R:  8,064
5:   SNA - Spawning
, NAV,
1.22+,
Bcorresponding .
 The AIDS II
, or Companion
, was
}for the
.  Unlike
generic
us, the AIDS
is the
to employ what could be called a
 "corresponding
atechnique" of
 target .
ais never
1.  The
takes advantage of the
 DOS feature where if a
exists in both .
-and .
Wform,
 the .
 The AIDS II
Nnot actually
`, instead it
 stores a copy of the
in a corresponding .
tries to
Yone of his .
 The .
aand the .
both
lthe same base
 The method of
tis as follows:
X, since a corresponding .
aexists, the .
9ing the
X.  The
blocates an
ain the
Eand creates a
 corresponding (or companion) .
always be 8,064
=of the
t.  The .
ais not
at all.
creating the new .
a, the
 plays a melody and
Ms the
 "Your computer is
 Aids
 - Signed WOP & PGT of DutchCrack -"
 The AIDS II
spawns to the .
 to be
X, and the
runs
out problem.
 completion of the
, control
s to the AIDS II
. The
 melody is played again
 "Getting used to me?
 Next
, use a Condom
 Since the
aremains un
, CRC checking
cannot detect
having
 One way to manually remove the AIDS II
is to check the
 for
lboth an .
Wand a .
the .
ahaving a
of 8,064
).  The .
`thus identified
 should be erased.
 The
do not
in the
PZPAPN
AirCop
00$    Q
0PT$
:  AirCop
H:
 Washington,
 BSC;
halt;
 Taiwan
R:  N/A
5:   FR -
Floppy
\, NAV,
:  CleanUp, M
K, or DOS SYS
 The AirCop
Gin the State of Washington in the
early
ts of
 however,
!traced back to Taiwan, and Taiwan is probably
 where it
ated.  AirCop is a
u, and it
w360K 5.25" floppy
 AirCop
, the
.  The
 AirCop
at the top of high
.  The
Aby 1,024
the AirCop
.  AirCop hooks
AirCop is
, any non-write protected
accessed
 the AirCop
.  AirCop
copy the
719 (Side 1, Cyl 39,
9 on a normal 360K 5.25"
J) and
replace the
a copy
 of the
.  If a
of a
 AirCop
is viewed, it
be missing almost all of the
normally
in a normal
.  The
remaining
 "Non-
just before the end of the
 The AirCop
do one of two things on
 depending on how compatible the
's software and
kware is
.  On most
, the
at random intervals:
 "Red State, Germ Offensive.
 AIRCOP."
, the
#present
in the
 receiving a Stack Overflow
Uand the
#halted.  In
case, you must power off the
in order to be able to
 AirCop
Nnot
 AirCop can be removed
bpowering off
 the
and re
&ing
clean, write-protected DOS
J.  The DOS SYS
6should
be used to replace
 the
.  Alternately, M
Kcan be used
cthe power-down and re
of AirCop are:
 AirCop-B:
in May,
fthe
, AirCop-B is
of the
AirCop
.  Like the
, it
vfloppy
.  The
 Stack Overflow
Uand
halt
no longer
.  AirCop-B
during the month of
, and
&ing
rfloppy
in a flashing, scrolling
Mof the
is Aircop"
 The
proceed.  AirCop-B has
to avoid detection by
utilities.
 Utilities
can detect AirCop may not be able to
 detect
PZPAPN
Akuku
:  Akuku
H:
 Unexpected
Oaccesses
R:  891
5:   PNAK -
/2.0+,
3.96+, NAV 3.0+,
n1.04+,
8/93+,
.2.0+
 The Akuku
, and comes
is a
uof .
 and .
Akuku is
X, the
wthree
in the
E.  If three
cannot be
din the
E, the
 search the
Eof the
O, as well as the C:
O.  Both .
-and .
r, as well as
smaller
not be
by 891 to 907
), the
at the end of the
 The
>and
in the
not be
 the
 The
in the
5, and
 can be
din all
 "A kuku, Nastepny komornik !!!"
fail to
 the Akuku
Man "
and terminate
Ythem.
of Akuku are:
 Akuku-3:
gequivalent to the
Akuku
has three
differ.  It
 switch to the C:
all the
 candi
`on the
 Columbus:
on the Akuku
, Columbus is an
 of the
.  It
wone .
in the
,.  Columbus
pof 512
at the end of the
a.  On
12th,
 of an
in the
#repeatedly
Lon the
monitor while the
reads the entire
 "Columbus Raped America.  Now I Rape your
 The
is not
`as it is
in the
5.  The
in the
-Berlin, Md"
 "NOT!!  The procedure is a bit off.  Hehe"
:  Maryland,
 Cop-Mpl: Cop-Mpl is a
of the Akuku
.  It
wthree .
-or .
X.  If the
 not find three
won the
O, it
search and
in the C:
 structure.
Cop-Mpl
pof 1,113 to 1,128
at the end of the
a.  The
 can be
in the
 "Sorry, I'm copmpletly dead."
Cop-Mpl may
[very long
loads, or
Ohas
 unexpectedly to the C:
 Metal Thunder: Metal Thunder was
 May,
fItaly.
by 892 to 908
 Unlike the
, Metal Thunder
in the
X.  The
 "(c) by Metal Thunder IVRL  MI"
the Metal Thunder
[frequent
:  Italy  May,
 Wilbur:
on the Akuku
, Wilbur is an
 the
.  It
wone .
in the
,.  Wilbur
pof 512
at the end of the
 Wilbur
lthe
 "Wilbur sez Hi!"
 The
is not
`as it is
 May,
 Wilbur-B:
on the Wilbur
 very minor
.  The
in the
 "Wilbur sez Hi!"
: Berlin, Maryland  7Apr92"
:  Maryland,
 Wilbur-C:
on the Wilbur
to avoid detection.  The
in the
 "Wilbur sez Hi!"
: Berlin, Maryland  7Apr92"
:  Maryland,
 Wilbur 2:
on the Wilbur-C
of Wilbur
adds 512
)to the .
 are two distinct
s of the
may be
fa Wilbur 2 sample.  The
Mthe
 "Wilbur sez Hi!"
 The second
Mone of the
 "I am not an Animal.  I am a Human
 "I am not an Animal.  I am Wilbur!"
 "I am not Akuku.  I am a Human
 "I am not Akuku.  I am Wilbur!"
 The
in the
 "I am not"
 "I am"
 "Wilbur sez Hi!"
 "Akuku."
 "an Animal."
 "Wilbur!"
 "a Human
:  Maryland,
 Wilbur 3:
on the Wilbur 2
in the Spring of any year, primarily during
 the month of
.  In
Zof an
 may
in the
 repeatedly, scrolling down the
, while the
 accesses the
 "Wilbur sez:  Formatting your
K.  Please stand by."
 The
Nn't actually format the
 the sample tested.  The
is not
as it is
:  Maryland,
PZPAPN
Alabama
:  Alabama
 Endangered
H:
, 1989
(see
; FAT
 Israel
R:  1,560
5:   PRfET -
, NAV,
:  CleanUp,
\, or
 The Alabama
}at Hebrew University in Israel
 by Ysrael Radai in
, 1989.  Its
was on
13, 1989.  The Alabama
 increasing
by 1,560
).  It
 however, it
Nn't use the normal TSR function.  Instead,
hooks
{09 and 21 in
a CTL-ALT-DEL combination is detected, the
causes an
 apparent
&, but remains in RAM.  The
loads
30K under
 the highest
location reported by DOS, and
Nnot lower the
 amount of
reported by the BIOS or by DOS.
for one hour, the
in a flashing box:
 "SOFTWARE COPIES PROHIBITED BY INTERNATIONAL LAW
 Box 1055 Tuscambia ALABAMA USA."
 The Alabama
uses a complex mechanism to determine whether or
 not to
wthe
b, it checks to see if
ain the
E, if
is one it
vit.
are no
`in the
Eis the
r.  However,
s instead of
sthe
candi
a, it
instead manipulate the FATs to ex
3the
 candi
out renaming it,
 so the
ends up thinking he is executing one
in effect
 he is actually executing an
one.  The end
 are slowly lost on
aswapping
 the
on ANY Friday.
PZPAPN
Alameda
:  Alameda
 Mazatlan, Merritt, Peking, Seoul, Yale
H:   1987
 Floppy
&failures;
-TOM; BSC
 California,
R:  N/A
5:   RtF -
Floppy
, NAV,
K, CleanUp,
\, NAV, or DOS SYS
 The Alameda
Gat Merritt college in
 Alameda, California in 1987.  The
 caused no intentional damage,
is now at least one
now causes floppy
Ks to
&able
a counter has r
Qed its limit (Alameda-C
 The Alameda
, and its
, all
a CTL-ALT-DEL and
5-1/4" 360K
es do stay in
through a warm re
&, and
wboth
and non-
Ks.
can be
ron a warm
&even if BASIC is loaded instead of DOS.
 The
saves the real
at track 39,
8, head 0.
 The
of the Alameda
would
run on a
 8086/8088 machine,
later
s can now run on 80286
of Alameda are:
 Alameda 1.2M:
}in the
of Alameda is able to
w1.2M
 5.25 inch
Iin addition to 360K 5.25 inch
I.  The
hang computers using
an 8088 processor
, allocating 1,024
 at the top of
$the
|12's
 moved.  It
Iin the A:
performs a CTL-ALT-DEL key combination.
 Golden Gate: The Alameda
a modification so
the counter in the
has determined
it has
r500
I.  Upon
 the C:
Ois formatted.  The counter in the
 is reset on
Qnew
:  California,
 1988
 Golden Gate-B: Same as Golden Gate, except
the counter has
f500 to 30
ts before
 and
Iare
 Golden Gate-C: Same as Golden Gate-B, except
 can
 the Mazatlan
, and is the most dangerous of the
 Alameda
: A modified
of the Alameda
the counter in the
has determined
it has
r100
I.  Upon
, the
Jin the floppy
Ois reformatted.  The SF
v5-1/4"
:  California,
?, 1987
PZPAPN
Albania
:  Albania
 Albania-429, Albania-506, Albania-575, Albania-606
H:
 failure;
R:  429 - 606
), depending on
present
5:   PNCK -
, NAV,
 Albania is actually a
]of four
were
(.  All of
 are
us of .
general behavior is
specific
xlisted under
one of the Albania
es is
 the Albania
wone .
in the
E.  If
 it may
r.  The
pfor Albania
depends on the Albania
present, but the
always be
at the end of the
.  The
>and
in the DOS
to the
>and
 The
can be
din all
 regardless of the
present:
 "PATH="
 It is
if Albania
of Albania are:
 Albania-429: The smallest of the Albania
 adds 429
)to the .
9the
 "ALBANIA" in addition to the
 Albania-506: Albania-506 adds 506
)to the .
v.  Like Albania-429, the
 "ALBANIA" can be
din all
 addition to the
 Albania-575: Albania-575 adds 575
)to the .
v.  In addition to the
for all members of
], the
 "albania"
 the Albania-575
may notice
fail to
, or
 random
may be
jmay
 Albania-606: Albania-606 adds 606
)to the .
v.  Unlike
members of
], it
Nnot always
X.  It
8the
"albania" in addition to the
PZPAPN
Albanian
:  Albanian
H:   May,
R:  1,991
5:   PRhAK -
 NAV 3.0+,
1.22+,
 The Albanian
in May,
.  Its
.  Albanian is a
uof .
-and .
the Albanian
 the Albanian
at the top of
$the
'.  It
Nnot move
|12's
 measured by the DOS
@by 2,000
{08, 17, and 21
mby Albanian in
, the
,if it
 was not
the Albanian
, it
for any reason.
pof 1,991
at the end of the
a.  The
>and
in the DOS
to 12/17/89 7:21p.  The
can be
in the
 "C:\
 It is
what Albanian
PZPAPN
Alex-368
:  Alex-368
H:
R:  368
5:   PNC -
3.96+, NAV 3.0+,
 The Alex-368
.  It is
fthe
.  Alex-368 is a
 of .
, but not
the Alex-368
wall .
larger
in the
pof 368
 the end of the
a.  The
>and
in the DOS
to the
 and
.  The
 can be
in the
5in all Alex-368
 "The One Night
(c) Alex Hacker"
PZPAPN
Alexander
:  Alexander
H:
 Romania
R:  1,951 - 1,965
5:   PRhAK -
, NAV 3.0+,
1.22+,
 The Alexander
.  It
fRomania.  Alexander is a
uof .
 and .
 The
the Alexander
X, the Alexander
 at the top of
$the
, as
qby the DOS
@by 3,088
{08, 21
 and 27
mby Alexander in
the Alexander
, it
 and .
 copied, or
for any reason.
by 1,951
by 1,951 to 1,965
).  In both cases the
at the end of the
a.  The
in the DOS
not be
.  The
in the
5in all
 "ALEX0302"
 The
in the
, and
 hence not
 "Apa depistata in microprocesor
 Functionarea poate fi compromisa
 Se recomanda oprirea calculatorului
 citeva ore pentru uscare"
 "Alexander"
 "Constanata"
 "Romania"
 It is
what Alexander
of Alexander are:
 Alexander.2104:
, 1994, Alexander.2104 is a 2,104
of the Alexander
.  Like
 the
, it
-and .
 copied.
by 2,104
 while .
by 2,104 to 2,118
 In both cases, the
at the end of the
aand the
>and
in the DOS
not be
.  The
in the
, 1994.
 See:   CB-1530
PZPAPN
:  Alfa
H:
(for
R:  Varies (see
5:   PRhAK -
8/93S+, NAV 3.0+,
 The Alfa
is actually two closely related
 similiar characteristics.  The two
es, Alfa-1150 and Alfa-1202,
Ctogether
differences
ed out
 under the "
" section.  Both
es were
, and
 The
an Alfa
X, it
at the top of
$the
'.  Depending on
is present,
, as determined by the DOS
Aby either 1,280 or 1,344
mby the
at the top of
, as well as
min graphic card
an Alfa
, it
 and .
 small .
`.  The
ps are given
Qof the
es.  In the case of both
es, the
at the end of the
be no
3to the
>and
in a DOS
in the
 It is
if Alfa
of Alfa are:
 Alfa-1150: Alfa-1150, or Yankee Doodle-1150, is the earlier
of the Alfa
.  It adds 1,150 to 1,165
`.  .
rby the
, adding an
1,152
 1,280
 Alfa-1202: Alfa-1202, or Yankee Doodle-1202, is the later
of the Alfa
.  Unlike Alfa-1150, it
 not re
`.  It adds 1,202 to 1,217
is 1,344
 Alfa-1712: Alfa-1712 is an
of the Alfa
at the top of
 but
$the
', not moving
|12's
 by 3,008
), and
, it
-and .
X, adding 1,712 to 1,731
 The
at the end of the
a.  The
>and
in the DOS
1to 14-25-12 12:01a.
 Alfa-Tired: The Alfa-Tired, or Tired,
is an
 of the Alfa
.  It
at the top
$the
', not
 moving
|12's
@by 3,760
), and
, it
X, adding 1,748 to
 1,766
.  The
 the end of the
a.  The
>and
in the
 DOS
not be
 Rust: The Rust
.  It
, as
qby the DOS
@by 2,048
), and
mby the
be used by the
, but
not be mapped by most
mapping utilities.
, Rust
X, adding 1,710 to 1,725
)to the
.  The
at the end
 of the
a.  The
>and
in the DOS
not be
.  Rust plays a three note
 melody
Ys a
 See:   Ah
 Damage   Gremlin   Lucifer   Newcom
 V651   V1024
PZPAPN
All Sys 9
:  All Sys 9
H:
i; TSR; "Abort, Retry, Ignore ?"
&s; unexpected beeps on
speaker
R:  1,838 - 2,088
5:   PRsAK -
6.55+,
2.53+,
/2.1+, NAV 3.0A06+
2.53+,
1.22+,
.2.0+,
6.64+
 The All Sys 9, or IOU,
.  Its
.  All Sys 9 is a
uof .
-and .
 The
the All Sys 9
as a low
TSR of 2,576
).  It
, All Sys 9
-and .
pof 1,838 to 1,863
at the
"of the
pof 2,080
 to 2,088
at the end of the
a.  .
may be re
rby the
, adding an
2,080
t.  The
in the DOS
not be
.  The
can be
in the
5in all
 All Sys 9
 "All
9 - (c)
, Jerry C."
 "Parity
Uat address 14344"
 "Abort, Retry, Ignore ?"
All Sys 9 may
[the "Abort, Retry,
 Ignore ?"
pressing any key
 on the
in a
&.  Beeping
be emitted
fthe
speaker.
PZPAPN
Alpha-743
:  Alpha-743
H:   March,
R:  743
5:   PNCK -
\2.09+,
30.00+,
n1.03+,
2.10+,
, NAV 3.0A06+,
V116+
 The Alpha-743
in March,
.  Its
.  Alpha-743 is a
uof .
the Alpha-743
X, the
 Alpha-743
wone .
in the
E.  If an
Nnot exist in
E, a
hang
accessing the
the Alpha-743
pof 743
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in the
5in Alpha-743
 "*.com *.*"
PZPAPN
Ambulance Car
:  Ambulance Car
 Ambulance, RedX
H:
i; graphic
M& sound
 West Germany
R:  796
5:   PNCK -
\, NAV,
:  NAV, or
 The Ambulance Car
}in West Germany in
is a
the Ambulance Car
 the
attempt to
wone .
a.  The .
ato be
on the C:
 one .
ain any
E, and never the
ain the
E.  It avoids
ais normally
 the
ain the root
 On a random basis,
 the effect of a graphics
Mof an ASCII block drawing of an
 ambulance moving across the bottom of the
 graphics
be accompanied
the sound of a siren
 played on the
's speaker.  Both of
effects
a graphics capable
Madapter.
of Ambulance Car are:
 Ambulance Car-B:
to the
Ambulance Car,
wzero, one, or two .
(s) on
 the
pof 796
 the end of the
are seven
differ between
and the RedX-Any
listed
 RedX-Any:
on the
Ambulance Car,
the Ambulance Car graphic
its accompaning siren
X.  It
vone .
on the
path
 and may
 See:   Hafenstrass 2
PZPAPN
Amstrad
:  Amstrad
H:
, 1989
 Portugal
R:  847
5:   ONCK -
, NAV,
\, or
 The Amstrad
breported in
, 1989, by Jean Luz
 of Portugal; however, it has
of in Spain and Portugal for
 a year prior to
.  The
is a generic .
u, but is
 not
.  It
,.  It is
 the Pixel
Amstrad is
X, the Amstrad
wthree .
in the
`not
by the
 The
carries a fake advertisement for the Amstrad computer:
 "=!= Buy AMSTRAD it is THE CHEAPEST
-PUTER
you can buy"
 The Amstrad
Nn't do
of Amstrad are:
 Amstrad-End Is Near: The Amstrad-End Is Near
is very
to the
Amstrad
.  The major difference
 "=!= THE END IS NEAR!!
 THE SIGNS OF THE BEAST ARE EVERYWHERE"
 The
ain the
by 847
it is
pas the
part of the host
 Amstrad-End Is Near B:
is a very minor
of the
 Amstrad-End Is Near
.  It
vthe
bfive .
`in the
 of 847
at the
 the
a.  It
8the same
as the
 End Is Near
, 1994.
 Amstrad-Luz: The Amstrad-Luz
is very
to the
Amstrad
.  The
 "=!= Hello, John Mcafee,please uprade me.
 Bests regards,Jean Luz"
:  Portugal
, 1989
 See:   Hell   Pixel   Silly   Silly-365
PZPAPN
Andre
:  Andre
 Andre-0, Andryushka
H:
R:  3,568 - 3,648
5:   PRhA -
V116+,
3.0A06+,
V116+,
1.25+,
1.0A06+
 The Andre, or Andryushka,
.  It
fthe
.  Andre is a
 of .
-and .
.  It
Nnot
 is a polymorphic
, and a simple search
for detection
 is not possible.
bAndre
at the top of
 but
$the
'.  It
Nnot move
|12's
, as
 the DOS
@by 8,192
).  It
Fly hooks
{, and
mapping utilities
 show
{mapped to the
the Andre
, it
, or
a DOS DIR
 or Copy
6is issued.  It
Nnot
wvery small .
`, nor .
`larger
64K.
`in structure.
pof 3,568 to 3,648
at the end of the
a.  The
>and
 the DOS
not be
.  The
in the
5, and are not
 "Hello!!!"
 "My
is Andryushka"
 "I come
fPerm,
 Symptom's of an Andre
tare
DOS DIR
6s may be
 very sluggish due to the
a DIR
 is issued.
alter the
of Andre are:
 Andre-3568: A minor
of the Andre
, Andre-3568
 adds 3,568 - 3,668
)to the .
-and .
v.  Its
is 7,632
8the same
as the
PZPAPN
Andromeda 1.0
:  Andromeda 1.0
H:
i; interfers
 Hungary
R:  1,140
5:   PNC -
V105+,
\2.09+,
2.53+,
n1.03+,
30.00+,
2.10+,
/2.1+,
 NAV 3.0A06+,
V106+,
2.53+,
1.22+,
1.0A06+
 The Andromeda 1.0
fHungary in
 Andromeda 1.0 is a
uof .
, but not
,.  A later
 Andromeda 1.1, is listed separately as it has different basic
 characteristics.
the Andromeda 1.0
 the Andromeda 1.0
wtwo .
 the
pof 1,140
at the
"of the
a.  The
>and
in the DOS
not be
.  The
in the Andromeda 1.0
5, and
 are thus not
 "-= The Andromeda Strain >-
1.00"
 "By : Crypt Keeper"
 "Mission Complete...
lfun
your
(es)"
 "\ANDROM.SEC *.
 "RUNME.
,SCAN.
WCLEAN.
WNAV.
 NAV_._NO"
 Andromeda 1.0 may interfer
the functioning of
of the
on non-write protected
 See:   Andromeda 1.1
PZPAPN
Andromeda 1.1
:  Andromeda 1.1
H:
 Hungary
R:  758
5:   PRhC -
\2.09f+,
2.58+,
6.64+,
2.58+,
6.64+,
1.25+
 The Andromeda 1.1
fHungary in
 Andromeda 1.1 is a
uof .
, but
 not
,.  An earlier
, Andromeda 1.0,
 is listed separately as it has different basic characteristics.
bAndromeda 1.1
wone .
in the
 as well as
at the top of
$the
, as
qby the DOS
@by 1,136
mby Andromeda
 1.1 in
|12's
not be moved.
, the Andromeda 1.1
ly, if a
X, an
ain the
    of the
Andromeda 1.1
 of 758
at the end of the
 The
>and
in the DOS
 not be
.  The
in the
5in all Andromeda 1.1
 "[ANDROMEDA V1.1] BUDAPEST HUNGARY"
 It is
what Andromeda 1.1
 See:   Andromeda 1.0
PZPAPN
Angarsk
:  Angarsk
H:
R:  238
5:   PNCK -
3.96+, NAV 3.0+,
 The Angarsk
.  It is
fthe
.  Angarsk is a
 of .
the Angarsk
X, the
 Angarsk
wall of the .
in the
pof 238
at the end of the
a.  The
>and
in the DOS
to the
>and
.  One
can be
in the
5in Angarsk
 Angarsk
Nn't
to do
PZPAPN
Animus
:  Animus
 Animus-7360, Cookie-7360
H:
i; switches
`and
 unexpected accesses to the C:
T; TSR;
R:  7,360
5:   PRsAK -
, NAV,
3.96+,
8/93S+,
30.00+,
1.25+
 The Animus, Animus-7360, or Cookie-7360
.  Its
.  Animus
 is a
uof .
-and .
. Advanced
ts may
 The
the Animus
X, the Animus
 a low
TSR, hooking
{22 and 24.
Aby as much as 70K.
 the
wtwo .
in the
the Animus
, it
wtwo .
pof 7,360
at the
"of the
a.  The
>and
in the DOS
 9-13-91 10:30a.  The
can be
din all
 Animus
 "Animus.id"
 "com
 "Animus.exe"
 Animus is a malicious
.  As the
tof Animus
 progresses, the
switch various
s so
 the
Eindicates is the
no longer matches the
 contents of the
process
both execu
and data
`.  As a
, the
may not
to run, and unpredica
.  Animus
Nnot avoid switching an
,, so unexpected warm re
&s or shelling of the
 interpretor may
.  The switching of
the .
Wextension possibly
r, and all
must be tested to determine if
9the
are dis
r, the
 actual contents of the
`must be determined and re
d to
 proper
of Animus are:
 Animus-7392: Animus-7392 is a later
of the Animus
 It adds 7,392
)to the .
>and
 the DOS
 9-13-91 10:31a.  Instead of switching
start
all of
 the .
in the
 by 7,392
at the
"of the
all of the
 the
r, it
 start
on the C:
PZPAPN
:  Anna
H:
 Manchester, England
R:  742
5:   PNCK -
/2.0+,
3.96+, NAV 3.0+,
n1.05+,
8/93+,
.2.0+,
 The Anna
fManchester, England in
.  Anna is a
uof .
the Anna
X, the Anna
wone .
in the
pof 742
 the
at the end of the
a.  The
 and
in the DOS
 the
>and
.  The
in the
 "[ANNA] Slartibartfast, ARCV NuKE the French"
la Cool Yule
fthe ARcV"
 "xCept Anna Jones"
 "I hope you get run over by a Reindeer"
 "Santas bringin' you a Bomb"
 "All my Lurve - SlarTiBarTfAsT"
 "(c) ARcV
- England Raining Again"
 "\ *.  *.com"
 It is
what Anna
PZPAPN
:  Ant
H:
has seconds set to 62
R:  770
5:   PNC -
3.96+,
n1.03+, NAV 3.0+,
1.53S+,
 The Ant
.  Its
.  Ant is a
uof .
, but not
,.  It is roughly
on the
the Ant
X, Ant
wone
in the
 Ant
pof 770
at the
"of the
a.  The
in the DOS
lhad the
 seconds field set to 62, the
tmarker.  No
in the
5in Ant
 Ant
 of any year.  At
, the
Mthe
and attempt to
 "MIT Sux!"
PZPAPN
Anthrax
:  Anthrax
H:
R:  1040 - 1279
5:   PRAKX -
W, &
\, NAV,
6.64+
:  See
 The Anthrax
in the
 it was uploaded onto several BBSs in a Trojan
 USCAN.ZIP.  It is the second
to be
din a copy of U
 during
, the
#V2100.  Anthrax is a
generic
uof .
-and .
 The
the Anthrax
 on the
K, the
wthe
).  At
, the
 is not
.  It
write a copy of
on the
 last few
of the
K.  If data existed on those
 last few
of the
K, it
be destroyed.
fthe
K, the Anthrax
.  It
remain
 until the
X.  At
, it
wone .
-or .
Nnot
`in the
b, but instead starts to
`at the lowest level of the
Etree.
 Later,
X, Anthrax
-or .
a, searching the
Estructure
fthe lowest
 level of the
Etree.  If the
on the floppy
O, a .
-or .
amay or may not be
 The Anthrax
5is 1,024
)long, but
by 1,040 to 1,279
).  On the author's
 test
, the largest
[d was 1,232
always
 is a multiple of 16.
 The
can be
 Anthrax
 "(c)Damage, Inc."
 "ANTHRAX"
 A third
s in the
5, but it is in the
 Cyrillic alphabet.  Per Vesselin Bontchev,
third
 translates to:
 "Sofia
 Since Anthrax
vthe
must
lthe
ror rebuilt in
 order to remove the
tcan be done
 either a low-level format or use of the M
for the
 correct DOS
powering off and re
&ing
 write-protected
Jfor the
.  Any .
-or .
Anthrax must
be dis
ror erased.
 Since a copy of the
exist on the last few
of the
must
 Anthrax interacts
: V2100.  If a
Anthrax should
 V2100
, the V2100
check the last few
of the
Kfor the spare copy of Anthrax.  If the spare copy is
Anthrax
be copied to the
 It is not
if Anthrax carries any destructive capabilities or
 trigger/
PZPAPN
Antimon
:  Antimon
H:
R:  1,452 - 1,465
5:   PNCK -
, NAV,
1.53S+,
 The Antimon
.  Its
.  Antimon is a
Antimon is
X, the Antimon
wall
in the C:
Oroot
E.  Since
,normally resides in
E, it
ras well.
 Antimon
by 1,452 to 1,465
 The
at the end of all
be no
3in the
>and
in a DOS
 The
in the
 Antimon
 "*.com"
 "FLUSHOT3.
 "C:\PANDA\MONITOR.
-TSRMON.
-TSRMONEZ.
 "= C:\PDPROG"
 It is
what Antimon
 See:   1452
PZPAPN
Anti-D
:  Anti-D
 Xuxa-945
H:   March,
i; TSR; interfers
 Argentina
R:  945
5:   PRsC -
n, NAV,
1.53S+,
 The Anti-D, or Xuxa-945,
in March,
.  It is
fArgentina.  Anti-D is a
uof .
 but it
Nnot
 The
the Anti-D
X, Anti-D
as a low
TSR of 1,264
).  It
hook
 21, and F8.
the Anti-D
, it
pof 945
at the
"of the
a.  The
>and
in the
 DOS
not be
.  Two
 can be
din the
-MAND
 "$$TMP.
 Anti-D interfers
the usage of the "D" key on the
, hence the
of Anti-D are:
 Anti-D B:
to the Anti-D
is a very minor
:  Argentina
 See:   Xuxa
PZPAPN
Anti-DAF
:  Anti-DAF
H:   March,
 The
R:  561
5:   PNCK -
n1.03+,
 NAV 3.0+,
8/93+,
1.22+,
 The Anti-DAF
in March,
, and is
.  Anti-DAF is a
 of .
the Anti-DAF
wone .
in the
pof 561
at the end of the
a.  The
>and
in the DOS
not be
 The
in the Anti-DAF
 "*.com"
 "The Anti-DAF
 "DAF-TRUCKS Eindhoven"
 "Hugo vd Goeslaan 1"
 "Postbus 90063"
 "5600 PR Eindhoven, The
 "DAF sucks..."
 "(c)
Dark Helmet + The
Research Centre"
 The company
and individual mentioned
, along
 address, are not associated
the creation of
PZPAPN
, AP, AP-605, C-605, V605
 Research
H:
i; .BAK and .PAS
 Sofia,
R:  605
5:   PNCK -
, NAV,
:  NAV, or
 The
, V605 or C-605, was
}in Sofia,
by Vesselin Bontchev.
, it was
fthe
or Poland, but
 it has since
!determined to
!a research
written
(over one year before it was
}.  The author was
 not aware
it had "escaped" until
 The
is a generic .
,.  While
is not
it is in
 the process of
X, the
attempt to
wtwo
`on the
Oor on
are between 605 and 64,930
`must not
lthe read-
attribute set.  If
ameeting the
's selection criteria is
d, the
b605
)of the
5.  The
)of the
appended
 to the end of the
by 605
), and
begin
"PQVWS" as well as
9the
"combakpas???exe" at
 offset 0x17.
lhad
 stamps in the
to the
 If the
cannot find two .
w, it
check the
Oand
Efor .BAK and .PAS
`exist,
5.  If the
`were .PAS
`, the
 has now lost
Pascal source
 .BAK and .PAS
`, the
attempt to re
them to .
`, or .
`if a .
aalready exists.
renaming
Nnot work due to a bug in the
 AP-529:
to the 605
, the major
 differences are
AP-529
`over
 2,048
 529
ly, instead of
the .BAK
 and .PAS
`, one .BAK and .PAS
Bd if
are no
of at least
 2,048
)on the
O.  .
`on the C:
Oroot
Emay
rby AP-529
fthe A: or B:
should be
 considered a "Research
", as it is not believed to
!publicly released.
 See:
PZPAPN
400, AP-400
 Research
H:
i; .BAK, .BAT and .PAS
adeletion;
 alteration on
 Sofia,
R:  400
5:   PNCK -
, NAV,
 The
, or AP-400, was
}in Sofia,
by Vesselin Bontchev.  It is one of five
es or
in the
].  Two of the earlier
(AP-605) and AP-529, are documented under the
".  The
listed under
 separated due to
characteristics differing
 605
*and 529
 The
is a generic .
,.  While
is not
it is in
 the process of
 The
Xon a
, the
attempt to
wone .
ain the root
Oaccessible on the
`are
is at least 2,048
), and
 the
be less
64K in
.  Since
,is usually the
aon a
O, it
 immediately
r.  One
ron the
O.  The mechanism used to
ais to write the
5to the end of the
a.  A jump is
 used to
Ythe
5before the
`do not
=stamps in the
to the
>and
 If the
cannot find a .
won a
 given
O, or two .
won the
O, it
check for the existence of .BAK, .PAS, or .BAT
`.  If
Bd.
deletions
 root
Fories and on the
 Since
Qroot
E(as well as the
 typically not
lall of its .
rat the same
 the deletions
on different
Os and
Fories at
 different
tof the
include
ps of 400
), unexpected
Kaccess to
O, and dis
ing .BAK, .PAS, and .BAT
`.  One
symptom of an
be slightly
by the
CRC-check the
indicate
tmay
.  The
 alteration
Nnot
9a live
, but
throw the
off into thinking
problem is
 instead of a
u, and if the
Kwas a
&able
K, it
now be un
&able.
 The
and its
$are not
 believed to
!publicly released.  As such,
 classified as "Research
II are:
 AP-440: Very
to the 400
of the
, the major characteristic
 has a
of 440
).  The
is no longer
by the
is an intermediary
 between AP-480 and the 400
documented
 AP-440B:
on AP-440,
's major difference is
wtwo .
in the
E, and
 one in the
Qof the
 accessible on the
 AP-480:
to the
is the
is 480
.  It
Nnot
 .BAT
`, but
.BAK and .PAS.
is the
 latest
of the
II grouping.
 AP-480B:
on AP-480,
's major difference is
wtwo
in the
E, and one
in the
Eof all
Os accessible on the
 See:
PZPAPN
Anti-Tel
:  Anti-Tel
 Telecom
H:
 BSC;
slowdown
 Spain
R:  N/A
5:   BRtX -
, NAV,
\, or M-
K/P on
 DOS SYS on
&able
 The Anti-Tel
.  It is
fSpain.
 Anti-Tel is a
uof the
) and
.  It is extremely
 destructive
Anti-Tel,
 the
at the top of
, but
$the
'.  The DOS
indicate
is 1,024
)less
is expected.
|12's
!moved.
Anti-Tel is
, it
wthe
I, as well as the
ais accessed on the
 On high density 1.2MB 5.25"
I, the
28.  The Anti-Tel
0, and continued in
27.  Since
27 and 28 are the last two
of the root
`may be lost
portion of the root
 On double density 360K 5.25"
I, the
11.  The Anti-Tel
0, and continued in
10.  Since
10 and 11 are the last two
of the root
`may be lost
portion of the root
Ks, Anti-Tel
vthe
at Side 0, Cylinder 0,
1.  The
is continued
 in the
at Side 0, Cylinder 0,
6.  The
at Side 0, Cylinder 0,
 Data
be lost on the
Kimmediately upon
 if the
Khad
!initialized or formatted
 placed data in
are normally not used by DOS.
 Anti-Tel is a
, it actively
to prevent
#able to detect it if the
.  However,
is a bug in
5, and it is
 unsuccessful on
I.  Anti-Tel
hide the
&secotr
t, so if the
utilities
not be able to detect Anti-Tel on the
is very destructive
&s.  On the 400th
&, it
Mthe
btwo
random
 data:
 "VIRUS ANTITELEFONICA (BARCELONA)"
II are:
 Telecom
&:  Telecom
&is the
ts of the Telecom
.  Telecom
&is very
to Anti-Tel,
the major
 difference
Nnot
like Anti-Tel.  Since
of Anti-
 Tel always
Telecom
ts, it is
 suggested
be powered off and re
a clean write-protected
Kand checked
 for the Telecom
 See:   Telecom
PZPAPN
:  Anto
H:
&failure; Divide overflow
R:  129
5:   PNCK -
, NAV,
/2.1+,
 The Anto
.  Its
, or
~, are
.  Anto is a
uof .
the Anto
X, the Anto
wall .
in the
E, it
cannot recognize
rby the
, so
be re
the Anto
pof 129
tof the Anto
present
 on the host
a.  The
at the
 the
a, and in the case of re
dat the end of the
a.  The
>and
in the
 DOS
to the
>and
the last
the Anto
may notice frequent
jor "Divide overflow"
rcopy of
in a
hang
"Cannot start
-MAND, exiting".
PZPAPN
Aragon
:  Aragon
H:
 BSC;
R:  N/A
5:   BRtX -
\2.09+,
2.53+,
 NAV 3.0+,
2.10+,
:  DOS SYS on
I; M-
K/P on
 The Aragon
.  Its
.  Aragon is a
vthe
) and the
I.  It cannot be detected on
 the
 The
fan Aragon
J, the Aragon
 at the top of
$the
', moving
|12's
qby the DOS
@by 1,024
, the Aragon
wthe
if it was not
r.  The
!moved to side 0, cylinder
the Aragon
, it
an unwrite-protected
Jis accessed for any
 reason.  In the case of 360K 5.25"
I, the
!moved to
 Aragon is a
.  It
Fany
to read
 the
stored by the
be shown
 instead.  As such, no
3in the
, or the
, cannot be detected on the
 the
PZPAPN
Aragorn
:  Aragorn
H:   March,
i; write protect
 Italy
R:  1,522 - 1,537
5:   PNAK -
\2.09+,
6.55+,
2.53+,
30.00+, NAV 3.0+,
2.10+,
n1.04+
2.53+,
1.22+,
6.64+
 The Aragorn
in March,
, and is
fItaly.  Aragorn is a
-and .
,.  It
Ms an
 Ansi graphics
on its
28th of any
 year.
the Aragorn
wone .
aand one .
 the
E.  Due to a bug in the
Aragorn
vthe
ain the
E, it
in the
same bug
the Aragorn
pof 1,522 to 1,537
 the end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the
5in all Aragorn
 "(C)
Aragorn-Rome"
 "*.com *.exe"
 The last
s at the very end of
 The Aragorn
28th of any year, at
in Ansi
.  The
q{color bar} is
 a representation of the Italian flag:
 "MUSSOLINI
 28 OTTOBRE
 ANNIVERSARIO
 MARCIA SU ROMA
 {  color bar }
 BOIA CHI MOLLA"
 The
is not
PZPAPN
Arale
:  Arale
H:
^, 1994
i; TSR;
to DOS prompt
 Spain
R:  1,526 - 1,541
5:   PRsA -
V112+,
/2.1+,
\2.13+,
.2.0+,
V113+
 The Arale
^, 1994.  It is
fSpain.
 Arale is a
uof .
-and .
, but
 not
,.  It
Ms a
on seven days during the
 year.
bArale
as a low
TSR of 1,984
mby the Arale
, the Arale
-and .
pof 1,526 to 1,541
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
5in all Arale
 "FELICIDADES:"
 "Maite C. P."
 "Roberto R. I."
 "Elsa B. E."
 "Esther F. P."
 "Carol C. B."
 "David M. E."
 "Anselmo B. V."
 "(P)
by Arale & Goku Corp."
 The
are used by the
Mthe
 two line
on seven days of the year:
 "FELICIDADES:
 (P)
by Arale & Goku Corp."
 The "
be the
 for the particular
 March 14th
 : "Elsa B. E."
 : "Roberto R. I."
 May 13th
 : "Anselmo B. V."
 May 17th
 : "David M. E."
 : "Carol C. B."
 : "Esther F. P."
?12th : "Maite C. P."
 Arale
Ys a
on one of the
>s.  The two line
L, and the
ed to the DOS prompt.
PZPAPN
ARCV 330
:  ARCV 330
H:
 England
R:  330
5:   PNCK -
n1.03+,
3.96+, NAV 3.0+,
8/93+,
1.22+,
 The ARCV 330, or 330,
.  It is
fEngland.  ARCV 330 is a
uof .
the ARCV 330
X, the
 ARCV 300
wone .
in the
E.  If
E, it may
the ARCV 330
pof 330
 the end of the
a.  The
>and
in the DOS
to the
 and
.  The
near the end of all
the ARCV 330
 "aRcv"
 The ARCV 330
in the month of
of any year.
 During
, the
Mthe
and hang
 the
 "[330] by ICE-9"
in the
5, as is the
 "*.com"
PZPAPN
ARCV Friends
:  ARCV Friends
H:
 England
R:  839
5:   PNCK -
/2.0+,
3.96+,
30.00+, NAV 3.0+,
1.22+,
.2.0+,
 The ARCV Friends
 England.  ARCV Friends is a
uof .
,.  It is not related to the Friends
the ARCV Friends
wone .
in the
 839
at the end of the
a.  The
>and
in the DOS
to the
>and
 The ARCV Friends
12th of any year,
ing in the
Mof the
on the
monitor:
 [FRIENDS]  ICE-9
 (c) ICE-9
 released 5th
 ARcV Productions.
 Dedicated to all my friends"
 The
in the
, and is not
.  The
in the
PZPAPN
ARCV Xmas
:  ARCV Xmas
H:   March,
 England
R:  670
5:   PNCK -
n1.03+,
\2.09+,
2.10+,
1.22+
 The ARCV Xmas
in March,
, and is
fEngland.  ARCV Xmas is a
 of .
,.  It
Ms a
 during the Christmas season.
the ARCV Xmas
wone .
in the
Nnot
smaller
pof 670
at the end of the
a.  The
>and
in the DOS
.  The
in the
 ARCV Xmas
5in all
 "Happy Xmas
fThe ARCV."
 "*.com *.*"
?20th through
?25th in years
, the
 ARCV Xmas
Mthe
 "Happy Xmas
fThe ARCV."
PZPAPN
ARCV-670
:  ARCV-670
H:   March,
 England
R:  670
5:   PNCK -
n1.03+,
\2.09+,
2.10+,
1.22+
 The ARCV-670
in March,
, and is
 England.  ARCV-670 is a
 of .
the ARCV-670
wone .
in the
Nnot
smaller
pof 670
at the end of the
a.  The
>and
in the DOS
.  The
in the
5in all
 "*.com *.*"
all of the .
rin the
 higher level
Fories, a
hang
PZPAPN
ARCV-n
:  ARCV-n
 ARCV-4
H:
 Manchester, England
R:  664
5:   PNAK -
3.96+,
n1.03+, NAV 3.0+,
 The ARCV-n series of
es were
fEngland in
 and
es are
us of .
 and/or .
`, and
,.  The ARCV-4
members of the series
 included
$under "
members".  The three earliest members,
 ARCV-1, ARCV-2, and ARCV-3,
!generated
 The ARCV-4
fManchester,
 England.  ARCV-4 is a
uof .
-and .
the ARCV-4
wthree
in the
preference given to .
over .
pof 664
at the end of the
a.  The
in the DOS
not be
.  The
can be
in the
5in all
 ARCV-4
 "[ARCV-4] Apache Warrior, ARCV Pres."
 "*.exe *.com"
 "So Who`s the Best
 "Oh Well Sorry But The ARCV Are The Best!"
 "Well Your in Favor
 It is
what ARCV-4
members of the ARCV-n series of
es are:
 ARCV-1:
, ARCV-1 is an 826
uof .
-and .
, but not
,.  It
vone
 in the
preference given to .
pof 826
at the end of the
 The
>and
in the DOS
not be
.  The
 "Long Live The ARCV.  MUFC for the League!"
 "(c) Apache Warrior, ARCV Pres. 92"
 "Welcome to the REAL World. And the ARCV 1
 "[ARCV-1] Apache Warrior, ARCV Pres."
 "*.exe *.com"
:  Manchester, England
 ARCV-2:
, ARCV-2 is an 692
uof .
.  It
vone
in the
pof 692
at the end of the
a.  The
>and
 in the DOS
not be
.  The
 "*.exe .. [ARCV-2] Apache Warrior, ARCV. Pres."
 "Help.. Help.. I`Sinking
:  Manchester, England
 ARCV-3:
, ARCV-3 is an 657
uof .
,.  It
vfour
in the
pof 657
at the end of the
 The
>and
in the DOS
not be
.  The
 "[ARCV-3] Apache Warrior."
 "Yo.."
 "I`ve Just
.. Opps.. Sorry I`m the
 "Well let me introduce myself.."
 "I am ARCV-3
, by Apache Warrior."
 "Long Live The ARCV and Whats an
kECU?"
 "Vote Yes to the Best Vote ARCV.."
 "*.com .."
:  Manchester, England
 ARCV-5:
, ARCV-5 is an 475
uof .
,.  It
vone .
in the
pof 475
at the end of the
 The
>and
in the DOS
not be
.  The
 "[ARCV-5] Apache Warrior, ARCV Pres"
 "SU*.
:  England
 ARCV-6:
, ARCV-6 is an 335
uof .
,.  It
vone .
in the
pof 335
at the end of the
 The
>and
in the DOS
not be
.  The
 "[ARCV-6] Apache *.com"
:  England
 ARCV-7:
, ARCV-7 is an 541
uof .
.  It
vone .
in the
pof 541
at the end of the
a.  The
>and
 in the DOS
not be
.  The
 "[ARCV-7] Apache ARCV. *.exe"
:  England
 ARCV-8:
, ARCV-8 is an 679
uof .
.  It
vone .
in the
pof 679
at the end of the
a.  The
>and
 in the DOS
not be
.  The
 "Naughty, Naughty...  ARCV Productions Ltd."
 "[ARCV-8] *.exe"
:  England
 ARCV-9:
, ARCV-9 is an 745
uof .
X, ARCV-9
at the top of
, hooking
|21.
qby the DOS
 2,048
ARCV-9 is
, it
pof 745
at the end of the
 The
be hidden
.  The
>and
in the DOS
not be
.  The
 "[ARCV-9] Apache Warrior. *.com"
:  England
 ARCV-10:
, ARCV-10 is an 827
uof .
-and .
 ARCV-10
at the top of
, hooking
|21.
, as
qby the DOS
@by 1,648
ARCV-10
, it
-and .
for any reason.
pof 827
 the
at the end of the
a.  The
not be hidden.  The
in the DOS
not be
 The
 "[ARCV-10]"
 "Apache Warrior"
 "Well its finally here The -= ARCV =-"
 "Welcome To our New Members
 The last two
may be
Las a
 the
.  Write protect
and the
fa write-protected
:  England
 ARCV-10B:
to the ARCV-10
 has
to avoid detection by
familiar
ARCV-10.
:  England  March,
 See:
PZPAPN
:  Arf
 Rigor Mortis, Thor
H:   March,
 Canada
R:  1,000
5:   PNCK -
\, NAV,
 The Arf, Thor, or Rigor Mortis
in March,
fthe
.  Arf is a
written by RABID,
in Canada.
is a
uof .
,.  Arf is
on the
 and
may identify it as
Arf is
X, the
check
 to see if
,has
r.  If it is not
r, the
wit and
Mthe
 "Rigor Mortis !!!
 I am Hi.pas"
checking (and possibly
,, the
 search the
Efor one .
w.  If an
d, it
 "Arf krad krad krad
 krad krad kr"
 The
proceed to check the B:
Ofor a
the Arf
 of 1,000
).  The
at the end of the
.  The
can be
in the
 The Arf
may not be in the public domain, the
sample
is not a natural
tof the
.  Its
is due
 to the "Arf"
r.  Its
of Thor is because it is believed to
 written by a group calling
Thor.
 Note: the
sample of
was on an .
a, and is
 not a natural
may be a research
and not
 in the public domain.
of Arf are:
 Arf-B: Arf-B was
in May,
.  It is
fthe United
 States.
s to be an earlier
of the
 Arf
 Arf-B is
X, it
check the
Efor an
w.  If an
d, it
wthe
.  The B:
 may
be accessed.  Whether or not a
Mthe
 "Arf Arf Got you!
 -- RABID '90"
pof 1,000
), and
>and
in the
not to the
>and
it has
in the
, and a
hang:
WC failure
 Cannot start
-MAND, exiting"
Arf-B
usually fail to
 function
ing in a
hang.
PZPAPN
Argentina
:  Argentina
 Argentina 1.0
H:
i; TSR;
 Buenos Aires, Argentina
R:  1,249
5:   PRsC -
, NAV,
 The Argentina
Gin Buenos Aires, Argentina, in
.  Argentina is a
uof .
.  It
Nnot
 The
Argentina is
X, the
as a low
 TSR of 1,568
mby the
Argentina is
, it
pof 1,249
at the
"of the
3in the DOS
 The Argentina
on four
>s, at
pertaining to the
>s.
 are of patriotic significance in Argentina.  The
>s and
 are as follows:
 May 25th: "25 de Mayo Declaracion de la independencia Argentina
 Argentina
escrito por AfA -
benigno - ENET 35
 Pulse usa tecla para continuar"
 Jun 20th: "20 de Junio Dia de la bandera Argentina
 Argentina
escrito por AfA -
benigno - ENET 35
 Pulse usa tecla para continuar"
 Jul  9th: "9 de Julio Dia de la independencia Argentina
 Argentina
escrito por AfA -
benigno - ENET 35
 Pulse usa tecla para continuar"
 Aug 17th: "17 de Agosto Aniversario de la defuncion del Gral.
 San Martin
 Argentina
escrito por AfA -
benigno - ENET 35
 Pulse usa tecla para continuar"
 Hitting any key
in the
Xcontinuing.
%the
, one
 "Argentina
1.00"
PZPAPN
Argentina-102
:  Argentina-102
H:
& truncated to 102
 Argentina
R:  102
5:   ONCK -
6.55+,
2.10+,
\2.10g+,
2.58+,
2.58+,
6.64+,
1.25+
 The Argentina-102
fArgentina in
is a
u.  It
rby the Argentina-102
Bthe
in the
 and
create a 102
 The replacement
9pure
5.  The
>and
in the DOS
to the
>and
 Two
can be
in the
5in all
 Argentina-102
 "*.com"
 Argentina-102
Nn't do
, corrupting the
PZPAPN
Armagedon
:  Armagedon
 Arma
H:
intermittently sent to
-ports
s, Greece
R:  1,079
5:   PRsC -
\, NAV,
\, or
 The Armagedon
, by George
 Spiliotis of A
s, Greece.  Armagedon is a
`, increasing
by 1,079
 The
at the
 The
Xon a
, the
as a low
 of 1,392
), hooking
{8 and 21.  Any .
 are later
Xare
rby the
[the
"Armagedon the
 GREEK"
#sent to
-ports 1 - 4 at
d intervals.  Between
 5:00 and 7:00, the
attempt to use the
-ports
 to make a phone call to Local
xin Crete, Greece.  If
 a connection is made, the phone line
remain open until the
 notices
the phone line is in use.  (Needless to say,
Nn't work if the
outside of Greece as dialing
5s are considerably different between countries.)
wise is not destructive.
of Armagedon are:
 Armagedon #911:
on the
Armagedon
adds 1,079
)to the .
v.  The phone number called by the
 has
1to "911",
is the police and
 emergency services phone number implemented in
 much of the
.  The
 is sent to the
-ports has
 "Support Your Police".
 Armagedon-1074:
to the
Armagedon,
 adds 1,074
`.  Its
TSR is 1,408
, and hooks
{8 and 21.  The
in the
 "+++aTh0m0s7=35dp081
,141"
 "Armagedon the GREEK"
:  Greece,
 Armagedon-1077:
to the
Armagedon,
 adds 1,077
`.  Its
TSR is 1,392
, and hooks
{8 and 21.
}:  Greece,
PZPAPN
Arriba
:  Arriba
 1590
H:
R:  1,590
5:   PRaA -
/2.0,
8/93S+,
3.96+, NAV 3.0+,
8/93+,
 The Arriba
.  Its
, and the
may actually
!written in
 Arriba is a
uof .
-and .
 but not
bArriba
X, the Arriba
at 9000, hooking
{21 and 24.
, as
qby the DOS
 not be
the Arriba
, it
pof 1,590
).  In the case of .
 the
at the
"of the
a.  In .
, the
at the end of the
a.  The
>and
in the DOS
.  No
in the
 It is
what Arriba
PZPAPN
Arusiek
:  Arusiek
H:   May,
 Morocco
R:  817
5:   PRhA -
V105+,
3.96+, NAV 3.0+,
V106+,
1.22+,
 The Arusiek
in May,
, and is
fMorocco.
 Arusiek is a
uof .
-and .
 but not
bArusiek
X, the Arusiek
at the top of
$the
', hooking
, as
qby the
 DOS
@by 1,088
 12's
not be moved.
the Arusiek
, it
for any reason.
pof 817
 the
at the end of the
a.  The
 and
in the DOS
not be
 The
in the
5in all
 Arusiek
 "MKS"
 "NAV"
 "CLEAN"
-MAND"
 "Mum3"
 It is
what Arusiek
PZPAPN
:  Ash
H:
R:  280
5:   PNCK -
, NAV 3.0+,
.2.0+,
 The Ash
.  Ash is a
uof .
 Its
the Ash
X, the Ash
wall of the .
in the
 of 280
at the end of the
a.  The
>and
in the DOS
to the
>and
.  One
in the Ash
 Ash
Nn't do
 See:   Green Joker
PZPAPN
Ashar
:  Ashar
 Shoe_
, UIUC
 BSC;
R:  N/A
5:   BRt -
, NAV,
K, CleanUp,
\, NAV, or
 DOS SYS
&able
 The Ashar
is a
of the Brain
.  It differs
fthe Brain
 it can
wboth floppies and
K, and the
in the
!modified to be:
 "VIRUS_SHOE RECORD, v9.0.  Dedicated to the dynamic
 memories of millions of
who are no longer
 today".
 However, the
is never
L.  The identification
"ashar" is normally
dat offset 04a6 hex in the
of Ashar are:
 Ashar-B: (Shoe_
!modified so
 can no longer
Os.  The v9.0 in the
 has
to v9.1.
 See:   Brain
PZPAPN
ASP-472
:  ASP-472
H:
 Eastern
R:  472
5:   PRfAK -
, NAV,
 The ASP-472
.  Its
.  ASP-472 is a
uof .
-and .
 The
ASP-472 is
X, the
 ASP-472
, hooking
|21.
be no
as measured by the DOS
ASP-472 has
, it
for any reason.
by 472
at the end of the
a.  The
 and
in the DOS
can be easily identified as
 end
the three character
"ASP".
 ASP-472
Nn't do
PZPAPN
Astra
:  Astra
 Astra-976
H:
i; data
`truncated;
R:  976
5:   PRhCK -
6.55+,
6.64+
 The Astra, or Astra-976,
.  It is
 reported to be
fthe
.  Astra is a
 of .
bAstra
X, the Astra
at the top of
$the
|12's
not be
 moved.
, as
qby the
 DOS
@by 1,056
mby Astra in
the Astra
, it
X.  If
X, it
the Astra
pof 976
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the Astra
5, and are not
 "(C) AsTrA,
 The
"(2)" can be
dnear the end of all Astra
 A symptom of an Astra
data
read/write intent may be truncated by
 slowly corrupting the
's data
of Astra are:
 Astra-498:
, Astra-498 is a 498
of the Astra
v.SYS
.  It
rdevice
Or is loaded
fthe
 CONFIG.SYS
, it
 .SYS
Eentry is accessed,
by 498 - 513
tof the
a, and 498
t.  The
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
can be
din all
 "I like a flower's smell!"
 "(C) AsTrA,JPN"
 "(5)"
 Astra-510:
, Astra-510 is a 510
of the Astra
and is
to Astra-498.
 It adds 510 to 525
)to the .SYS
t, and 510
t.  It
8the
 "I like cold flavour!"
 "(C) AsTrA,
,JPN"
 "(5)"
 Astra-521:
to Astra-498 and Astra-510,
 adds 521 to 536
)to the .SYS
 the
t, and 521
8the
 "I like fragrant smell of flower!"
 "(C)AsTrA,
 "(5)"
 Astra-1010:
, Astra-1010 is a 1,010
of the Astra
.  Its
is 1,072
), hooking
 It adds 1,010
)to the .
 The
din the
 are present in
.  The "(2)"
 the end of
the Astra
1to "(3)".
Nnot truncate
 data
 Astra-1556:
, 1994, Astra.1556 is a 1,556
of the Astra
.  Its
is 1,616
), hooking
|21.  It
 all of the .
`in the
X, and .
 the are
X.  It adds 1,556
)to the
v.  The
in the
5in all
 "Child's Play"
 The
 the
 "(C) AsTrAP"
W*.SYS"
in a
 hang.
, 1994.
PZPAPN
AT144
:  AT144
H:
 8086/8088 processor
R:  144
5:   PRfbCK -
 NAV 3.0+,
 The AT144
.  AT144 is
uof .
and function on AT class machines.  On XT
 class machines, the
simply hang the
 The
AT144 is
X, AT144
a portion of the
residing in
be no
qby the DOS
{91, 93,
 94, 95, 97, 98, 9A, 9B, 9C, 9D, 9E, 9F, A0, A1, A2, A6, A7, A9, AA,
 AB, and AF
mby the
in low
AT144 is
, it
X.  If
X, it
by 144
at the end of the
lhad
>and
in the
 DOS
to the
>and
 AT144
Nnot do
 An earlier "
" of
, but it
 not
of AT144 are:
 AT108:
to the AT144
in a "hole" in low
, hooking
 21.
, it
 of 108
at the
 of the
a.  The
>and
in the DOS
to the
>and
 AT114:
to the AT144
in a "hole" in low
, hooking
 21.
, it
-and .
pof 114
at the
"of the
a.  The remainder of the
hex "FF"
4.  The
in the DOS
 to the
>and
 Frequent
, as well as
&failures
 AT118:
to the AT144
in a "hole" in low
, hooking
 21.
, it
 of 118
at the
 of the
a.  The
>and
in the DOS
to the
>and
 AT122:
to the AT144
in a "hole" in low
, hooking
 21.
, it
 of 122
at the
 of the
a.  The
>and
in the DOS
to the
>and
 AT140:
to the AT144
in a "hole" in low
, hooking
 21.
, it
 of 140
at the end of the
a.  The
>and
in the DOS
to the
 AT149:
to the AT144
adds 149
 to the .
PZPAPN
:  Atas
 Atas-384
H:
 Poland
R:  384
5:   PNCK -
, NAV 3.0+,
.2.0+,
 The Atas
.  It is
 Poland.  Atas is a
uof .
the Atas
X, the Atas
wone
 the
E.  The newly
pof 384
at the
 end of the
.  The
>and
in the DOS
to the
>and
 The
9ed in the Atas
are not
-Ok."
 "ATAS V0.1 Cr.24.01.92"
advanced
ts of Atas may notice
"Ok"
X.  The
Mof "Ok" usually
of the Atas
 Atas-400:
, Atas-400 is a 400
of the Atas
.  It adds 400
)to the end of the .
v.  The
>and
in the DOS
to the
>and
.  The
in the
-I like to travel..."
 "ATAS(Kiev) V3.03 Cr.91.10.11"
:  Poland
 See:   Atas II
PZPAPN
Atas II
:  Atas II
 Atas-3321
H:
 Poland
R:  3,321
5:   PRtCK -
3.96+,
n1.03+,
V106+,
 The Atas II, or Atas-3321,
, and
fPoland.  Atas II is a
,.  It is a semi-
 it hides the
bAtas II
X, the Atas II
at the top of
 but
$the
', moving
|12's
, as
qby the DOS
@by 10,240
{08, 10,
 16, 1C, and 21
mby Atas II in
the Atas II
, it
pof 3,321
be hidden
.  The
at the end of
`, and
 the
>and
in the DOS
 not be
.  The
in the
 Atas II
 "bye <
> music"
 "letters"
MBye-Bye"
=.==="
 "ATAS Corporation.(B)
,V1 Created in the Kiev by ATAS."
the Atas II
#detected on all
by the DOS
it is
.  It is
what else Atas may do.
 See:   Atas
PZPAPN
H:   May,
i; "General Failure
Ureading
s, Greece
R:  1,463
5:   PRfAK -
, NAV,
/2.0+,
8/93+,
.2.0+
 The A
Gin A
s, Greece, in May,
is a
 and .
the A
at the top of
$the
is not
 reserved.
not be
.  If
,was not
r, it
.  No
the A
, it
for any reason.
pof 1,463
at the end of the
a.  The
be hidden by the
it is
.  The
>and
in the DOS
not be
 The
in the
 "TROJECTOR II,(c) Armagedon Utilities, A
the A
[general
 failure
 requiring an Abort, Retry, Ignore, or Fail response.
 It is
 Trojector: Probably an earlier
of the A
, Trojector's
 3,776
), hooking
|21.  It
 1,561
not be
Trojector is
.  The
at the end of the
 The
in the
 "TROJECTOR ]I[,(c) Armagedon Utilities, A
 "Greetings to Vesselin"
Trojector may
X, as well
 as the DOS
indicating
 regardless of whether the
:  Greece
 Trojector-B:
to Trojector, Trojector-B has
 to avoid detection by
ning
, 1994.
PZPAPN
AtomAnt 3.0
:  AtomAnt 3.0
 Filling
R:  2,143 - 2,157
5:   PRhAK -
V106+,
6.55+,
2.53+,
2.11a+,
\2.13+,
V106+,
2.53+,
6.64+
 The AtomAnt 3.0 or Filling
.  Its
.  AtomAnt 3.0 is a
uof .
-and .
bAtomAnt 3.0
X, the
at the top of
$the
', not moving
|12's
, as
 the DOS
@by 2,144
{01, 09, 1C, 21 and 80
mby AtomAnt 3.0 in
the AtomAnt 3.0
, it
 and .
pof 2,143
by 2,145 to 2,157
).  In both
 cases, the
at the end of the
a.  The
>and
in the DOS
.  The
in the
 and is not
 "A billenty
zet 5000 le
sig garanci
lis.Ez most lej
rem cser
lje ki !"
 "Csak azt
n idej
ben hagyja abba!"
 "Ez nem SK
t igaz
n nem kedveltek benn
nket ?"
 "MC Hammer rap-szt
s PEPSI
lt, de most kicser
 a PEPSI-
 "valami m
sra ... FILLING, NOTHING MORE THEM FILLING ..."
rem fogadjon el egy v
rust a vall
si eszm
s egyh
 "Nem akar adakozni ?"
gi ROM-BIOS verzi
 ! Cser
lje ki
jabbra !"
 "Atomant v3.0 Er
sebb, mint valaha !"
s az I-O csatorn
bkan.
rem azonnal h
vjon szerel
ket!!!"
meg van az adatbuszon.Gyors
tsa meg azl"
 It is
what AtomAnt 3.0
of AtomAnt 3.0 are:
 AtomAnt 1.0:
, AtomAnt 1.0 is an earlier
of AtomAnt 3.0.  It's
is 576
), hooking
{21 and 80.  It
by 564
at the end of the
a.  The
in the DOS
not be
.  The
can be
 the
5in all AtomAnt 1.0
t igaz
m nem kedveltek benn
nket ?"
 "AtomAnt v1.00"
PZPAPN
Atomic 1
:  Atomic 1
 Atomic 1A
H:   May,
Zfailure;
 "Bad
 Canada
R:  371
5:   ONCK -
\2.09+,
6.55+,
30.00+,
V108+,
2.10+,
n1.04+,
/2.1+,
 NAV 3.0A06+,
V108+,
1.22+,
6.64+,
1.0A06+
 The Atomic 1, or Atomic 1A,
in May,
, and
fCanada.  Atomic 1 is a
    over-
 writing
.  It permanently corrupts the .
the Atomic 1
X, the
 Atomic 1
wthe
btwo .
in the
E, and
 "Bad
 The
ed to the DOS prompt.
the Atomic 1
lthe
by the Atomic 1
5.  Since the
 not check to see if the
it is
swere
r, it
not spread past the
btwo .
`in any
E.  The
>and
in the DOS
not be
.  The
in the
5in all Atomic 1
 "[TAD1A]
Lapse -- Toronto, CANADA"
 "The Atomic Dustbin 1A --
is just the
bstep"
 "Bad
-.. c Dustbin 1A --
is just the
bstep"
of Atomic 1 are:
 Atomic 1B: A 480
of the
vthe
btwo .
`in the
X, and
 the
Zterminated"
 The
in the
5in all Atomic 1B
 "[TAD1B]
Lapse -- Toronto, CANADA"
 "The Atomic Dustbin 1B --
is almost the second step"
Zterminated"
 "The Atomic Dustbin - YOUR PHUCKED!"
:  Canada  May,
 See:   Atomic 2
PZPAPN
Atomic 2
:  Atomic 2
 Atomic 2A
H:   May,
Zterminated"
fail to function
 Canada
R:  350
5:   PNCK -
2.53+,
30.00+,
V108+, NAV 3.0+,
n1.04+,
/2.1+,
V108+,
2.53+,
1.22+,
 The Atomic 2, or Atomic 2A,
in May,
, and
fCanada.  Atomic 2 is a
Atomic 2
not function
the Atomic 2
X, the
 Atomic 2
wone .
in the
E, and
Zterminated"
 The
ed to the DOS prompt.
the Atomic 2
pof 350
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in the
5in all Atomic 2
-[TAD2A] Created by
Lapse of Ontario, CANADA"
 "[TAD2A] The Atomic Dustbin 2A -- Just Shake Your Rump!"
 "Fail on INT 24 .. NOT!!"
of Atomic 2 are:
 Atomic 2B: A 831
of the
vthe one .
ain the
X, and
 one of the
 "Unable to
 "Fail on INT 21"
 It may
wa copy of
in the
 route
Eof the
O, even
 not the
E.  Atomic 2B
bfive .
`in any
by 831
at the end of the
a.  The
>and
in the DOS
to the
.  The
 are
in the
5in all Atomic 2B
,\DOS\
 "Copyright (c)
Lapse - Ontario, Canada"
 "[TAD2B]-The-Atomic-Dustbin-2B"
 "Unable to
 "Fail on INT 21"
 "The Atomic Dustbin 2B - I'm Here To Stay"
:  Canada  May,
 See:   Atomic 1
PZPAPN
Attack
:  Attack
 Attack-1501, Cuban
H:
i; TSR; "Not enough
 Cuba
R:  1,501
5:   PRsC -
, NAV 3.0+,
/2.0+,
8/93+,
 The Attack, or Attack-1501,
fCuba.
is a
 of .
, but not
an earlier
of the
is an
 The
the Attack
as a low
TSR of 3,552
).  It hooks
{13, 21, and
the Attack
, it
wtwo .
in the
Eany
Xor a DOS DIR
6is performed.
 the Attack
typically
 1,501
).  The exception is
if the
 was smaller
1,173
), the
of 2,684
).  The
>and
in the DOS
not be
 The
can be
din all Attack
 "The Terminator Attack Now"
,ERROR IN DEBBUG"
the Attack
may notice
no longer function
ing in a
 "Not enough
of Attack are:
 Attack-918: An earlier
of the Attack
zs a 1.2K TSR
it is
, it
 two .
in the
ever any
Xor a DOS DIR
 is performed.
lthe
 918
)of the host
by the
 Attack-918
, and must be replaced
fclean,
backups.
:  Cuba
PZPAPN
Attention!
:  Attention!
394,
-394, 394
H:
 clicking emitted
speaker on keypress;
R:  394
5:   PRhCK -
\, NAV,
 The Attention!
and was
}in the
is a
uof .
 The
the Attention!
X, the
reserve 416
)at the top of
, but
$the
'.  The
area, and hooks
|21.
 and
ed by the DOS
Aby 416
).  The
is not moved.
, a clicking sound
be emitted
 by the
speaker
a key is pressed on the
, such as the EDLIN
supplied
MS-DOS,
 receive an "Invalid
 attempted to be
 Attention!
 are
X.  The exception is
very small .
by 394
at the end of the
9the
: "ATTENTION  !" near the
"of the
PZPAPN
Attention-629
:  Attention-629
H:   March,
R:  629
5:   PNCK -
/2.0+,
n1.03+,
1.22+,
.2.0+
 The Attention-629
in March,
.  Its
.  Attention-629 is a
uof .
the Attention-629
wone .
in the
 629
at the
"of the
 The
>and
in the DOS
to the
>and
.  The
in the
5in all Attention-629
 "*.com"
 "Attention! I'm
 The second of
be repeatedly
 the
ing in a scrolling of the
 may
PZPAPN
 Iron Maiden
H:
i; unexpected access to C:
 Poland
R:  636
5:   PNCK -
, NAV,
 The
16th, or Iron Maiden,
16th is a
,.  It is
fPoland.
16th is
X, the
 16th
check to see if the
btwo .
`in the
r.  If
ln't
r, the
proceed to
wthem.  Next,
 the
16th
check the C:
 to see if it
8two .
ln't
r, and
wthose if
d.  The
 was
proceed to
16th
pof 636
at the
 end of the
be no
3to the
>and
in the DOS
 Two
can be
in the
16th
 "*.com AA"
 "=!= IRON MAIDEN"
 It is
what
16th
 16th,
9destructive
PZPAPN
Aurea
:  Aurea
H:
 random
 Italy
R:  653 - 668
5:   PNC -
\2.09f+,
V109+,
2.10+,
2.58+,
6.60+,
n1.05+
V109+,
1.22+,
2.58+,
6.64+
 The Aurea
, and is
fItaly.
 It is a
uof .
, but
 not
the Aurea
wone .
in the
pof 653 to 668
at the end of the
a.  The
>and
in the DOS
.  The
in the
 Aurea
-C:\DOS\*.
-MAND."
 "I'm sorry, you lost
thing because of AUREA"
 The Aurea
randomly
of the
K, and the
may be
Lon the
monitor:
 "I'm sorry, you lost
thing because of AUREA"
PZPAPN
Aussie Dir
:  Aussie Dir
 Sdir
H:
i; sluggish DOS Dir
 Melbourne, Australia
R:  550
5:   PRhCK -
\2.09+,
2.53+, NAV 3.0+,
2.10+,
n1.04+,
6.60+,
1.22+,
2.58+,
6.64+
 The Aussie Dir, or Sdir,
fAustralia in
 March,
.  It was
Gin Melbourne, Australia in
.  Aussie Dir was
 "Sdir", but
was not used as it is the
of a computer
unconnected to
.  Aussie Dir is a
uof .
bAussie Dir
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 608
|12's
not be
 moved.
the Aussie Dir
, it
in the
ever a DOS DIR
 550
at the end of the
a.  The
>and
in the DOS
.  The
can be
in the
5in all Aussie Dir
 "1 Did David Gerrold
la harley
he was one?"
 "2 Is John Brunner a shocking wave rider?"
 "3 Is
iam Gibson a neurotic romantic?"
 "4 Is Australian Parasite the Best?"
 "1:No, 2:Yes, 3: Probably, 4: Absolutley"
 "AP*.
 The
"AP" can
dstarting in the fourth
 of all
is the
tmarker for the
 Aussie Dir
8destructive
Oon the 29th day of a specific month,
due to
 a bug in the
not be
PZPAPN
Aussie Parasite
:  Aussie Parasite
 Australian Parasite, Aussie Parasite.292
H:
&failures;
 Melbourne, Australia
R:  292
5:   PRhCK -
\2.09+,
30.00+,
2.10+,
n1.04+,
 The Aussie Parasite, or Australian Parasite,
 in Melbourne Australia in
.  Aussie Parasite is a
uof .
the Aussie Parasite
 the Aussie Parasite
at the
 top of
$the
 and
, as
qby the DOS
@by 320
 Aussie Parasite in
the Aussie Parasite
, it
pof 292
 the
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the
5in all
 "Australian Parasite"
jfrequently
, and the
fail to
© of
of Aussie Parasite are:
 Aussie Parasite.272:
on the Aussie Parasite
, Aussie Parasite.272 is a 272
.  Its
is 336
), hooking
|21.  It adds 272
 the .
v, the
at the end
 of the
a.  The
can be
dat the end
 of all
 "AP"
1994.
 Aussie Parasite.292.B:
, 1994,
 one
differs
fthe
1994.
 Aussie Parasite.440:
on the Aussie Parasite
, Aussie Parasite.440 is a 440
.  Its
is 896
), hooking
|21.  It adds 440
 the .
v, the
at the end
 of the
a.  The
 the
5in all
 "Anke Huber is kicken butt on her way to be the number one
 womens tennis player"
 "Arantxa Sanchez-Vicario is a steroid ab
 "P440???!!"
ly, the
"ANKE" can be
dnear the
"of all
1994.
 Aussie Parasite.Gotter:
on the Aussie Parasite
, Aussie Parasite.Gotter is a 1,024
.  Its
is 1,088
), hooking
 13 and 21.  It adds 1,024
)to the .
Z, open, or copy, the
at the end
 of the
a.  The
 the
5in all
 "GOTTERDAMERUNG: Silicon Valley: The Next Golgotha"
 "hey PuKE keep up or fall behind"
r [AIH]"
alters the
, and may interfer
DOS DIR
issued against a write protected
1994.
 Dorn:
on the Aussie Parasite
 Dorn is a 377
.  Its
is 448
 hooking
|21.  Dorn adds 377
)to the .
v, the
at the end of the
a.  The
in the
5in all
 "Kill Dorn W. Stickle"
 "(C)
Australian Parasite"
:  Australia
on the Aussie Parasite
 Elviris is a 369
.  Unlike Assie Parasite, it is
uof .
,.  El
vthe
in the
is executing,
 adding 369
)to the
.  El
is unable
 to determine
r, it
many
s.  The El
 the
on the top portion of the
 monitor
Xin the evening:
 "Night of the Living
pt: El
Misstress of the Dark Assembler
ming: Australian Parasite (Enough said)
 Loves to Tonya H and Dianna G"
 The
in the
.  The
:  Australia
 Grue:
on the Aussie Parasite
 Grue is a 338
.  Its
is 400
 hooking
|21.  Grue adds 338
)to the .
v, the
at the end of the
a.  The
in the
5in all
 "It is pitch black. You are likely to be eaten by a Grue."
:  Australia
PZPAPN
Australian
:  Australian
 Clipper
H:
i; TSR
 Australia
R:  1,413
5:   PRsA -
, NAV,
 The Australian
.  It is
fAustralia.  Australian is a
uof .
 and .
.  It
Nnot
,.  It is
 on the 1720
bAustralian
X, the
as a low
TSR of
 1,392
mby the
Australian is
, it
occasionally
-and .
by 1,413
at the
"of the
by 1,413 to 1,425
at the end of the
 In both cases,
be no
3to the
>and
 in the
Australian
9one
in the
 "CLIPPER"
 It is
if Australian
PZPAPN
Australian 403
:  Australian 403
 403, Zeroto-O
H:
 403
; TSR;
`do not function
 Australia
R:  403
5:   PRsCK -
, NAV,
 The Australian 403
by Colin
 Keeble of Australia.
is a
 The
the Australian 403
X, the
as a low
TSR of 720
).  The
hook
, the
replace two .
in the
a copy of the
 any
X.  The replaced
of 403
), and
>and
in the
to the
>and
.  Needless to say, the replaced
since
9the
Nnot do
of Australian 403 are:
 Zeroto-0:
to Australian 403,
has 10
differ
fthe
g, its
TSR is 736
), hooking
Zeroto-0 is
, it
X.  As
 the
 replaced
a 403
>and
 to the
>and
PZPAPN
Australian
:  Australian
 Australian
H:
 Australia
R:  153
5:   PNCK -
\2.09+,
2.53+,
30.00+,
 NAV 3.0+,
2.10+,
n1.04+,
/2.1+,
6.60+,
2.53+,
1.22+,
.2.0+,
6.64+
 The Australian
, or Australian
-153,
cits
Hin Australia in the same
 month.  Australian
, and its
listed
$, are non-
the Australian
 the Australian
wone .
in the
E.  A
hang may
the Australian
pof 153
at the
"of the
a.  The
>and
in the DOS
not be
.  The
 can be viewed
in the
5in all
 Australian
 adding an
)to the
of Australian
 Australian
-142: A 142
of the Australian
:  Australia
 Australian
-142B:
to Australian
-142,
has a few
differ.
:  Australia
 Australian
-143: A 143
of the Australian
:  Australia
 Australian
-147: A 147
of the Australian
:  Australia
 Australian
-150: A 150
of the Australian
:  Australia
 Australian
-162: A 162
of the Australian
.  The
"AP" can be
`starting in the 4th
*of the
:  Australia
PZPAPN
Avispa
:  Avispa
H:
^, 1994
i; TSR;
=seconds = "00"
 Argentina
R:  2,048 - 2,062
5:   PRsE -
V112+,
6.64+,
V113+,
6.64+
 The Avispa
^, 1994, and is
 Argentina.
is a
uof .
bAvispa
as a low
TSR of
 2,304
|13 and 21
mby the
the Avispa
, it may
pof 2,048 to 2,062
at the end of the
a.  The
>and
 the DOS
to be un
 the seconds field
!set to "00".  The
in the Avispa
 "__
Avispa - Buenos Aires - Noviembre
 "$$
AVISPA $$ Republica Argentina$$ Elijah Baley $$
 Noviembre 10 de
is not an old
, and it was
 written in Argentina by Elijah Baley."
 "It uses polymorphic technics to avoid conventional
ning."
 "MENEM: Libertador de torturadores y asesinos de inocentes,
 que Dios se apiade de tu pobre alma. $$"
 It is
what Avispa
PZPAPN
AVV-2300
:  AVV-2300
 AVV 1.12
H:
R:  2,300
5:   PNCK -
\2.10g+,
V111+,
n1.04+,
2.10+,
/2.1+,
6.60+,
2.58+,
V111+,
.2.0+,
2.58+,
6.64+,
1.25+
 The AVV-2300 or AVV 1.12
.  Its
.  AVV-2300 is a
uof .
,.  It
wvery small .
the AVV-2300
wone .
in the
pof 2,300
 the
at the
"of the
a.  The
 and
in the DOS
not be
.  The
in the
5in all
 AVV-2300
 "The AVV
1.12, Copyright (C)
 "(ARV)"
 "*.com AVV Warning!"
 "In
.ext may be
 "AVV Warning!"
 "In
area may be
 "AVV Warning!"
 "In
may be
 "AVV=off"
 "The Anti
1.12:
 I am checking 200++
k's Yankee Doodle for
vectors"
 As implied by the
is capable of detecting
 the presence of many older
es in
, as well as
`.  It
5to remove
if the AVV en
mental variable is set to
 "off".
PZPAPN
Axe-1024
:  Axe-1024
 1024E
H:
 Hungary
R:  1,024 - 1,038
5:   PRhE -
V109+,
\2.13+,
V109+
 The Axe-1024, or 1024E,
.  It is
fHungary.  Axe-1024 is a
uof .
bAxe-1024
at the top of
 the
', not moving
|12's
, as
qby the DOS
@by 1,328
{09 and 21
mby the
the Axe-1024
, it
wthe
in the
X.  The
in the
by 1,024 to 1,038
t, and 1,024
t.  The
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the
5in all Axe-1024
 "AXE"
 It is
what Axe-1024
PZPAPN
Azusa
:  Azusa
 Hong Kong
H:
 BSR;
 LPT1 &
-1 ports may be disabled
 Hong Kong
R:  N/A
5:   BRtX -
\, NAV,
:  CleanUp, M-
K/P, F
K/MBR on DOS 5
 The Azusa
.  Its
is believed to be Hong Kong.
 is a
and the
 The
 the Azusa
, the
at the top of
, but
$the
'.  The
moves the
report 1,024
)less
zed on the
.  At
, the
wthe
 the
a copy of the Azusa
.  A copy of
 the
is not stored by the
Azusa is
, it
 are accessed on the
write intent (i.e., a
 as output, or
read/write intent) or
to re
 the
Jvia CTL-ALT-DEL.
Iare
 by copying the
to track 40
 and
writing a copy of
to the
.  On
360K 5.25"
I, the
end up in the middle of the
K, possibly corrupting
 The Azusa
keeps track of how many
s the
&s, the
 disable the
-1 and LPT1 ports on the
, and reset its
 counter. A later
in the ports functioning
 again.
of Azusa are:
 Azusa 2:
fHong Kong.
 The
portion of Azusa 2 is 2,048
at the top of
tof high-density
in severe cross-linking of
`and invalid
 clusters, as well as 0
Fories.  CTRL-C may
 fail to function, as well as
 may hang the
.  Disabling of
-1 and LPT1 may
 See:   Evil Empire
PZPAPN
:  B&B
 Beavis & Butthead
H:
aand
may not function
R:  716
5:   PNCK -
V108+,
6.55+,
\2.09f+,
2.10+,
n1.04+,
V108+,
1.22+
 The B&B, or Beavis & Butthead,
 It is
fthe
is a
uof .
the B&B
wone .
ain the
pof 716
at the end of the
a.  The
in the DOS
not be
.  The
in the B&B
 "Beavis & Butthead were here.  Huhuh."
 "Dude. check out the secret
sucks."
 "Huh Hnn Hnn Ahuh"
 "It is
what
 "Huh Huhhuh Huhhuh Huh"
 "*.**Beavis & Butthead
, by Primal FuryA*.*"
 The B&B
corrupt
and data
othe hidden
`, by adding 41
)to the end
 of the
be the
 "Beavis & Butthead were here.  Huhuh.
PZPAPN
:  Baba
 Baba.353
H:
, 1994
R:  353
5:   PRhC -
\2.13+,
6.64+,
n1.05+,
1.25+,
6.64+
 The Baba or Baba.353
, 1994.  Its
.  Baba is a
`, but not
bBaba
at the top of
 the
', moving
|12's
, as
qby the DOS
@by 384
mby the
, Baba
pof 353
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
 in all
PZPAPN
BackFont-896
:  BackFont-896
H:
i; DOS
Mfont may be
R:  896
5:   PRhE -
V106+,
\2.09+, NAV 3.0+,
3.96+,
2.53+,
/2.1+,
V106+,
8/93+,
2.53+,
1.22+,
.2.0+,
 The BackFont-896
.  Its
.  BackFont-896 is
on the Badsec
, and is a
uof .
.  It
 has
characteristics.
bBackFont-896
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 928
mby the
the BackFont-896
, it
for any reason.
pof 896
be hidden by the
it is
.  The
at the end of the
, and
 the
>and
in the DOS
.  No
in the
 The DOS
indicate
Ton all
.  The
alter the
Mfont.
 See:   Badsec
PZPAPN
:  Back
H:
clock runs backwards
R:  528
5:   PRtCK -
, NAV,
 The Back
.  Back
uof .
 Its
bBack
X, Back
at the top of
 the
Aby 528
), as measured by the DOS
{08 and 21
mby the
, it
X.  If
X, it
by 528
 The Back
at the end of the
 The
"Back
" can be
din all
 The Back
affect the operation
 of the
by running the
clock backwards.  For example,
`created
became
stamps in the
fbefore the
became
.  Re
&ing the
in the
clock
ing to the normal expected
>and
 See:   Blinker   Shaker
PZPAPN
Bad Boy
:  Bad Boy
 Bad Boy 2
H:   May,
R:  1,000
5:   PRtCK -
, NAV,
6.55+,
 The Bad Boy
in May,
V.  Bad Boy
 is a
uof .
, it
 The
Bad Boy is
X, the
at the top of
, but
$the
mby the
is not moved.  If the
became
&ing
qby the DOS
@by 3,072
).  If Bad Boy became
by executing
(not
Aof 3,072
, but
@by 6,704
).  The
is due to a low
zed by the
Bad Boy is
, the
by 1,000
 at the
`.  Occasionally,
by 1,001
).  The
>and
 the
not be
9two
, the
d, natural
ts of the
are not
Lby the
 "The bad boy halt your
 "The Bad Boy
, Copyright (C)
 The Bad Boy
on a random basis, at
to hang the
.  The hang is
followed by the
 scrolling several
s of repeated
4, and
 halt
of Bad Boy are:
 Bad Boy 2: A later
of Bad Boy, Bad Boy 2
Nnot
 the TSR
zed if the
became
&ing
 The
hang,
scrolling of
4, and
halt may still
, but not as frequently.
 The
in the
 "Make me better!"
 "The Bad Boy
2.0, Copyright (C)
Bad Boy, the
d samples of Bad Boy 2.
 Bad Boy-D:
, Bad Boy-D is a
uof .
, but not
at the top of
$the
'in 3,072
m.  Bad Boy-D
by either 1,073 or 1,074
).  The
be at the
"of the
a.  The
>and
in the DOS
.  The
 the
5in all
 "The Worthless Piece of shit vi-rus
is a joke"
 Immortal Riot:
, Immortal Riot is a
uof .
,.  It
at the
 top of
$the
 3,072
 Immortal Riot
by either 1,054 or
 1,055
), or may
lthe
b1,054
 by the
5.  The
be at the
 the
a.  The
>and
in the DOS
not be
.  The
in the
5in all
 "Senseless Destruction..."
 "Protecting what we are joining together to take
 on the world.."
 "METAL MiLiTiA [iMM0RTAL RI0T] SVW"
 The
Las a
on the
monitor.  At
hang may
 See:   Boys
PZPAPN
Bad Brain
:  Bad Brain
H:
fail to
R:  576
5:   ONCK -
3.96+, NAV 3.0+,
1.53S+,
 The Bad Brain
.  Its
.  Bad Brain is a
 of .
,.  It corrupts all
Bad Brain is
X, the Bad
 Brain
wone .
on the
Oin the 2nd or lower sub
fthe
O's root
the Bad Brain
lthe
b576
 the
5, so
be no
3in the
 in the DOS
.  The
>and
 the DOS
 The
in the Bad Brain
5, and thus are not
 "SKISM*"
 "BadBrains"
the Bad Brain
not function
Ythem.  The
ed to the DOS prompt upon
 Since the Bad Brain
s the
"of the host
cannot be dis
rand should be
 replaced
clean backup copies.
of Bad Brain are:
 Bad Brain 1.2:
, Bad Brain 1.2 is a
 554
of the
lthe
b554
by the
.  The
in the
 in all Bad Brain 1.2
 "The Thing
Should Not Be"
 "He searches"
 "Hunters of the shadow is rising"
 "Crawling chaos, underground,"
 "out
fruins
possessed"
 "Fallen city, living death..."
 "* *.
 "Metal Militia / Immortal Riot"
PZPAPN
:  Bad
H:
i; slow
response;
R:  3,430 - 3,443
5:   PRtAK -
V106+,
\2.09+,
2.10+,
/2.1+,
6.64+,
V106+,
1.22+,
.2.0+,
1.25+
 The Bad
.  Its
is a
uof .
-and .
,.  It
characteristics,
is not a full
bBad
at the top of
$the
', moving
|12's
, as
qby the
 DOS
@by 5,120
 08, 16, 21, 25, and 26
mby the
, the Bad
X.  It
wone .
 or .
in the
#accessed
a DOS DIR
6is issued.
 Bad
 of 3,430 to 3,443
at the end of
 the
p, however,
be hidden
 the
.  The
>and
in the DOS
not be
.  The
in the
5in all Bad
 "Bad
 "*.*"
[sluggish or slow
 response
, particularly
regard to the DOS DIR
 Random
:may
PZPAPN
Bad-389
:  Bad-389
H:   March,
2; TSR
R:  389
5:   PRsCK -
V106+,
3.96+,
V106+,
1.22+
 The Bad-389
in March,
.  Its
.  Bad-389 is a
bBad-389
X, the Bad-389
as a low
 TSR of 544
mby the
. Bad-389
 cannot determine
it is already
, so it
X, taking
 up an
, the Bad-389
pof 389
at the end of the
a.  The
>and
in the
 DOS
!set to the
>and
.  The
in the
5in all Bad-389
 "Bad
PZPAPN
Badsec
:  Badsec
 905, Backfont
H:
; bad
or lost clusters; unexpected accesses to
R:  765
5:   PRhE -
 NAV,
 The Badsec
.  Its
.  Badsec is a
 of .
 The
the Badsec
at the top of
$the
'.  It
Nnot move
 12's
, as
 by the DOS
@by 4,384
mby the
the Badsec
, it
pof 765
 the end of the
a.  The
>and
in the DOS
not be
the Badsec
may notice
 the
access
 unexpectedly.
accesses
, a bad
or a lost
 cluster may
, hence the
jmay
as well.
 Topsy-900:
, Topsy-900 is
on the
 Badsec
.  It is
fthe
 Topsy-900
zing
 at the top of
$the
 2,736 to 5,472
), and
 by the
, Topsy-900 may
 sporatically.
pof 900
at the
 end of the
 See:  BackFont-896
PZPAPN
Banana
:  Banana
 Trivial-Banana
H:
&failures
 Sweden
R:  139
5:   ONCK -
\, NAV,
8/93+,
 The Banana
.  It is
fSweden.  Banana is a
 of .
.  It corrupts the
the Banana
X, the
 Banana
wall of the .
in the
E.  Banana
s the
b139
)of the
v, so
were
larger
 139
smaller
 139
.  The
>and
in the DOS
not be
 The
can be
in the
 all Banana
 "BANANA,
5d by Morbid Angel -92 in Stockholm/Sweden"
 "*.com"
Banana
no longer function
 Since the
"of the host
, it is
 not possible to dis
should be
 replaced
clean,
copies.
 See:   Mini-45
PZPAPN
Bandit
:  Bandit
 Research
H:   May,
 Italy
R:  1,641
5:   PNE -
, NAV,
/2.1+,
 The Bandit
in May,
.  Bandit is
fItaly.  It is a
uof .
Bandit is
X, Bandit
search
 the
Oand
Efor an
w.  If an
d, it
r.  Bandit
 1,641
at the end of the
 The
>and
in the DOS
not be
Bandit
9the
, the second of
at the end of
 "*.* *.exe ww
 "!!PCBANDIT!!"
 Bandit is
on the Enigma
s to be a research
 See:   Enigma
PZPAPN
Baobab
:  Baobab
H:
 India
R:  1,641 - 1,651
5:   PRhE -
, NAV 3.0+,
/2.1+,
.2.0+
 The Baobab
.  It is
fIndia.  Baobab is a
uof .
bBaobab
X, the Baobab
at the top of
$the
'.  It
Nnot move
|12's
qby the DOS
 2,560
mby the Baobab
the Baobab
, it
pof 1,641 to 1,651
at the end of the
a.  The Baobab
, adding an
 1,648
>and
in the DOS
 to the
>and
the last
 of the
 It is
what Baobab may do
of Baobab are:
 Baobab-731: A 731
of the Baobab
is 1,552
, it
 are
X, adding 733 to 752
)to the
 The
at the end of the
a, and
 the
>and
in the DOS
to the
>and
.  Like the
, adding
 736
t.  The
in the
 "Fhello"
 March,
PZPAPN
Barcelona
:  Barcelona
H:
3; TSR
 Spain
R:  1,792
5:   PRsC -
/, NAV,
 The Barcelona
fBarcelona, Spain, in
.  Barcelona is a
uof .
on the
bBarcelona
X, the
 Barcelona
as a low
TSR of 2,096
).  It
Barcelona is
, it
pof 1,792
at the
"of the
a.  The
>and
in the DOS
to the
 The
can be
in the
 in Barcelona
 "CATALUNYA"
 "CATALUNYA LLIURE"
 "FORA LES FORCES D`OCUPACIO"
 "MORT ALS TERRORISTES TRICORNUTS"
 It is
if Barcelona carries any damage potential.
 See:
PZPAPN
Barrotes
:  Barrotes
H:
; vertical bars &
&failure;
corrupted
 Spain
 The
R:  1,310
5:   PRhAK -
/2.1+,
6.64+,
1.25+
 The Barrotes
}in The
s to
ated in Spain.  Barrotes is a
uof .
W, and overlay
bBarrotes
X, the Barrotes
at the top of
$the
', hooking
|21.
 and
, as
qby the DOS
@by 1,600
|12's
 be moved.
, the Barrotes
 copy of
in the C:
Oroot
Eif it
 was not
the Barrotes
, it
W, and overlay
pof 1,310
at the end of the
a.  The
 and
in the DOS
not be
 The
in the Barrotes
5in all
 "c:\
6.com"
 "l7SO"
 The Barrotes
5th of any year.  At
, the
 vertical bars across the
M, and the
at the DOS prompt:
BARROTES por OSoft"
s, the
write a portion of its
5to the
.  The next
 the
fthe
K, the
 fail.
of Barrotes are:
 Barrotes.840:
in March, 1994
fSpain, Barrotes.840
 is an 840
of the Barrotes
 Its
is 1,600
), hooking
 Like the
, it
wthe copy of
in the C:
Oroot
pof 840
at the end of the
a.  The
in the
the last
ring at the very end of all
 "c:\
6.com"
 "OS"
5th of any year, the Barrotes.840
:  Spain  March, 1994.
 Barrotes.849:
, 1994
fSpain, Barrotes.849
 is an 849
of the Barrotes
 Its
is 1,600
), hooking
 Like the
, it
wthe copy of
in the C:
Oroot
pof 849
at the end of the
a.  The
in the
the last
ring at the very end of all
 "c:\
6.com"
 "SO"
:  Spain
, 1994.
 Barrotes.1303:
fSpain in
^1994, Barrotes.1303
 is a 1,303
of the Barrotes
 Its
is 1,632
), hooking
 Like the
, it
wthe copy of
in the C:
Oroot
pof 1,303
at the end of the
a.  The
in the
5, the
Swhile the last
is un
 can be
dat the very end of all
 "C:\
 "Sta Tecla (MAD1)"
 "ST"
 It is
what Barrotes.1303
:  Spain
^, 1994.
PZPAPN
Basilisk
:  Basilisk
H:   March,
; DOS
=seconds = 62
 North America
R:  1,639 - 1,653
5:   PRhAK -
\, NAV 3.0+,
2.53+,
30.00+,
2.53+,
1.22+,
 The Basilisk
in March,
, and is
fNorth
 America.  Basilisk is
on the R-10, R-11, and Sunday 2
 and is a
uof .
-and .
,.  It should be considered a
as it
on open, as well as hiding the
bBasilisk
X, the Basilisk
at the top of
$the
', hooking
{21, 22
 and 27.
, as
qby the
 DOS
@by 3,408
 12's
not be moved.
, Basilisk
the Basilisk
, it
larger
2K in
for any reason.
pof 1,639
).  .
pof 1,639 to 1,653
).  In both cases, the
be hidden by the
.  The
at the end of the
.  The
>and
in the DOS
not to be
, but
actually
 seconds field set to 62.
 The
in the Basilisk
5in all
 "Basilisk v1.0"
 "Packed
ais corrupt"
 "(c)
YAM/RABID International"
 "The slave thinks he is released
fbondage"
to find a stronger set of chains"
the Basilisk
Tdetected on
the Basilisk
 See:  Sunday-2
PZPAPN
H:
 The
R:  1,392 - 1,406
5:   PRtE -
V108+,
2.11a+,
2.58+,
\2.13+,
V108+,
2.58+
 The B
, and is
Qes is a
uof .
.  The
8a poem,
is how it derives its
X, the B
at the top of
$the
', moving
|12's
, as
qby the DOS
@by 4,912
).  No
 are
Fly mapped to the
 The B
vup to five .
in the
ever an
pof 1,392 to 1,406
at the end of the
a.  The
>and
in the DOS
not be
 The
in the B
 "sandy b
 "bridges sinking into the sea"
 "beautiful confusion"
 "you're a fading
 "Dis
W\* \"
 It is
what B
PZPAPN
Beast-N-Black
:  Beast-N-Black
 Beast
H:
in \DOS
Emay be
R:  429
5:   PNCK -
, NAV,
 The Beast-N-Black
}in the
is a
uof .
the Beast-N-Black
search the
Efor all
, and
wthem.
it completes
E, it
attempt to
wall .
in the root
Eof the
the Beast-N-Black
pof 429
).  The
at the
 end of the
.  The
>and
in the DOS
not be
.  The
 can be
in the
5of all
-\DOS\*.
 "Beware the Beast-N-Black"
 "(C)
, Night Crawler - SKISM/PHALCON"
 The Beast-N-Black
is malicious.  It
 all .
in the DOS
Eon the
of Beast-N-Black are:
 Beast-N-Black B:
gequivalent to the
has three
differ.
:  Canada  May,
 Public Enemy:
on the Beast-N-Black
vall .
`in the
Eand the
Oroot
X.  It adds 429
)to the
,.  The
at the
 end of the
a.  The
can be
in all Public Enemy
-\DOS\*.
 "Public enemy number one"
PZPAPN
:  Bebe
H:
i; long
Kaccess on .
 clicking on
speaker and
R:  1,000 - 1,019
5:   PRCK -
, NAV,
 The Bebe
fthe
.  Bebe
 is a
s as a
Bebe is
X, Bebe
search and
wall
on the
 and
E.  If
,resides in the
E, it
Bebe
 by 1,000 to 1,019
at the end of
 the
a.  The
lhad
>and
in the DOS
to the
>and
 Since Bebe searchs the
E, and
vall .
Zof an
in a long, slow
load
much
 access while the
 Bebe is a
Nn't be
llike one.
X, it
 portion of
for awhile, the
activate.  At
, it
emit a "click" on the
speaker, and the
be hung.
 Bebe
Nnot
on 386 class
, on those
Zof a Bebe-
in a
hang.
PZPAPN
Beeper
:  Beeper
 Russian Mirror
H:
2; beeps on
 speaker;
R:  482
5:   PRCK -
, NAV,
 The Beeper, or Russian Mirror,
}in the
.  It was not
until
 to previous samples not replicating.  Beeper is a
uof .
,.  It can
 corrupt the
 The
the Beeper
 the Beeper
in low
, hooking
|21.
, as
qby the DOS
not be
the Beeper
, it
Xtwice in a row.
pof 482
at the end of the
a.  The
>and
in the
 DOS
to the
>and
.  No
in the
the Beeper
[the
Kbecoming corrupted,
ing in an "Invalid
 specification"
to access it.
s of
 may
notice
a "beep"
be emitted
fthe
 speaker
PZPAPN
:  Beer
 Beer-2794
H:
R:  2,794 - 3,069
5:   PRtA -
3.96+, NAV 3.0+,
 The Beer, or Beer-2794,
, and
fthe
.  Beer is a
-and .
, but not
bBeer
X, the Beer
at the top of
 but
$the
', moving
|12's
, as
qby the DOS
@by 4,096
mby Beer in
, the Beer
-and .
pof 2,794
pof up to 3,069
).  In both cases
 the
at the end of the
a.  The
>and
in the DOS
not be
 It is
what the Beer
of Beer are:
 Beer-2850: A 2,850
of the Beer
4,096
), hooking
|21.  It
-and .
, but not
 of 2,850
)while .
 by up to 3,125
).  The
at the
 end of the
a, and the
>and
 in the DOS
not be
 Beer-3164: A 3,164
of the Beer
4,096
), hooking
|21.  It
-and .
, but not
 of 3,164
)while .
 by up to 3,437
).  The
at the
 end of the
a, and the
>and
 in the DOS
not be
 The
in the
 Beer-3164
,AIDSTEST.
WDISKDATA.DTL"
 March,
 Beer.3399: A 3,399
of the Beer
is 4,080
 hooking
|21.  It
-and .
 but not
 copied.
pof 3,399
)while .
by up to
3,672
).  The
at the end of the
a.  The
in the DOS
not be
 The
in the
 Beer.3399
, 1994.
PZPAPN
Belgium-320
:  Belgium-320
H:   May,
 Belgium
R:  320
5:   PRaCK -
V105+,
\2.09+,
6.55+,
2.53+,
30.00+,
2.10+,
n1.04+,
V106+,
2.53+,
1.22+,
6.64+
 The Belgium-320
in May,
, and is
 Belgium.
is a
uof .
bBelgium-320
in a "hole" in
, hooking
|21.  It
 access the
it won't
on the
the Belgium-320
, it
pof 320
 the end of the
a.  The
>and
in the DOS
to the
 and
.  The
very close to the end of all
 Unexpected
jmay
PZPAPN
Benoit
:  Benoit
H:
jmay
 DOS
 England
R:  1,183
5:   PRhE -
\2.09+,
3.96+,
V108+,
n1.03+, NAV 3.0+,
V108+,
1.22+,
 The Benoit
.  It is one of the
es written by the ARCv
writing group
fEngland.
 Benoit is a
bBenoit
X, the Benoit
at the top of
$the
', hooking
, as
qby the DOS
@by 2,048
|12's
not be moved.
the Benoit
, it
for any reason.
pof 1,183
at the end of the
a.  The
p, however,
not be
.  The
>and
in the DOS
to be
the seconds field
be set to "62".  The
 the Benoit
 "[BENOIT] ICE-9"
 "Made in Engalnd"
 "Release 5th
ICE-9."
 "Dedicated to Beno
t B. Mandelbrot G"
 England is spelled as
in the
5, it isn't a typo.
may hang
the Benoit
PZPAPN
Best Wishes
:  Best Wishes
 Best Wish, Wishes
H:
anot
modification
R:  970
5:   PRtCK -
\, NAV,
 The Best Wishes
and is
 believed to be
fthe
.  Best Wishes is a
uof .
is a
, Best Wishes B,
is 1,024
 The
the Best Wishes
X, the
 high
, but
$the
'.  The
be moved.
Aby 61,440
Aby 61,360
, and the
be modified.
 modification and
still
Best Wishes is
, the
a probability of 50%.
by 970
 the end of the
near the end of the
m ...
Best Wishes!"
 Best Wishes
Nnot restore the
>and
in the
, so all
=stamps set to the
>and
 Two
of a Best Wishes
tare
 may
anot
ais actually on
K, as well as
jon every fourth
of Best Wishes are:
 Best Wishes B: An earlier
of Best Wishes,
 1,024
.  The major differences are
!modified.
Zof a .
in the
 most likely
r, but the
 hang.
 Best Wishes C: An
of Best Wishes,
 not hang the
 by the
Zof .
, however,
usually
in a
hang.
PZPAPN
:  Beta
 Phalcon
H:
R:  1,117
5:   PNC -
, NAV,
.2.0+,
 The Beta
.  Its
.  Beta is a
uof .
.  It
Nnot
a Beta
X, the Beta
wup to three .
in the
pof 1,117
).  The
at the end of the
be no
3to the
>and
in the DOS
.  No
in the
 It is
if Beta
 See:   Elvis-1250   Ministry   Phalcon.894
PZPAPN
Beware
:  Beware
H:
 Moscow,
R:  442
5:   PNC -
\, NAV,
 The Beware
.  It
s to
ated
fMoscow.  Beware is a
uof .
.  It
Nnot
the Beware
X, the
 Beware
search the
Efor an
,over
2K in
w.  If it is
d, the Beware
the Beware
pof 442
).  The
at the end of the
.  The
>and
in the DOS
.  The
 can be
in the
5in all Beware
 "BEWARE ME - 0.01,"
 "Copr (c) DarkGraveSoft - Moscow
 The Beware
on the
bMonday of any month, at
on the
PZPAPN
:  BFD
 BFD-452
H:
 BSC; .
; high density
Imay fail to
R:  452
5:   ORhEB -
/2.0+,
8/93S+, NAV 3.0+,
8/93+,
 The BFD
}in the
is a
multi-partite
and .
.  It should be considered a
do not
lany
, and it
`on open.  It spreads
 very quickly.
 The
the BFD
wthe
if the
Ois a floppy
O.  It
access the C:
the C:
, the
at the top of
$the
 DOS
, as
 by the DOS
@by 2,048
mby BFD in
.  The
should
 note
BFD can
&ing
J.  The same
the BFD
, it
, as well as
a non-write protected
Jis accessed.
pregardless of whether
 the
.  The BFD
 writing its
5to the .
Wheader area of the
lany
>and
 in the DOS
.  No
 the
the BFD
I, it
s the
.  The
be missing the usual DOS
.  In the case of high density 5.25"
fthe
fail,
 in a hung
 BFD
Nn't
to do
of BFD are:
 BFD-452: A 452
of the BFD
PZPAPN
Big Bang
:  Big Bang
H:
, 1994
R:  346
5:   PNC -
/2.1+,
V112+,
\2.13+,
6.64+,
.2.0+,
V113+
 The Big Bang
, 1994.  Its
.  Big Bang is a
`.  It
Big Bang is
X, the
wall of the .
in the
Big Bang
pd in
by 346
 the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
5in all
 "[Big Bang] (c)
Evil Avatar *.
1st of any year,
Zof an
 trigger the
PZPAPN
Big Joke
:  Big Joke
H:
R:  1,068
5:   PNC -
 NAV,
 The Big Joke
.  Its
.  Big Joke is a
`.  It
Big Joke is
X, the
wone
in the
Big Joke
pd in
by 1,068
 the end of the
a.  The
>and
in the
 DOS
to the
>and
 The Big Joke
to the
L, it is written one line at a
to the center of the
completes, it
be repeated until
 the
is re
&ed.  The
 "At last
. ALIVE
 I guess your computer is
rby the Big Joke
 Release 4/4-91
 Lucky you,
is the kind
 Be more careful while duplicating in the future.
 The Big Joke
, killer
strike
 The Big Joke rules forever."
 The
can be
Big Joke, as well as the
ctwo
-MAND"
 Big joke, in its currect
Nnot do
Mits
PZPAPN
Big-2000
:  Big-2000
 V-1391
H:   March,
3; TSR
R:  2,000
5:   PRsE -
\, NAV 3.0+,
2.10+,
6.64+,
 The Big-2000, or V-1391,
in March,
.  Its
.  Big-2000 is a
uof large .
bBig-2000
X, the Big-2000
as a low
TSR of
 2,848
), hooking
{01 and 18.
the Big-2000
, it
`larger
60K in
pof 2,000
at the end of the
a.  The
>and
in the DOS
to the
>and
in the
5in Big-2000
 It is
what Big-2000
PZPAPN
Billboard 1.0
:  Billboard 1.0
H:
=seconds = "00";
R:  835
5:   PNCK -
2.11+,
\2.13+,
n1.05+,
1.25+
 The Billboard 1.0
claims to be
fAustralia, its
.  Billboard 1.0 is a
 of .
,.  It
Nnot
wvery
 small .
the Billboard 1.0
wall of the .
in the
are larger
3K.
pof 835
at the
"of the
a.  The
in the
 DOS
may dis
as the
sets the
 seconds field in the
>and
to "00".  The
in the Billboard 1.0
     "Billboard 1.0, (c)
 [Nuke]."
     "Jeff K. - You are a lying prick, just like all politicians"
     "Patty   -
was written
fthe ground up, in Australia"
     "Alan
 - You are wasting your
chasing Rock Steady"
     "Frisk   - Pull your head out of your ass [NuKE] is way ahead
 of you AV wankers"
     "Johnny  -
is just too lame to worry about ha ha"
     "*.com"
 The Billboard 1.0
Mthe
PZPAPN
:  Bios
H:
i; continuous
R:  2,048
5:   PRhAK -
8/93+
 The Bios, or Ned,
.  Bios is
uof .
-and .
,.  It employs
techniques to avoid detection.
 The
the Bios
 the Bios
at the top of
$the
', hooking
 09, 1C, and 21.
, as
 by the DOS
@by 8,336
the Bios
, it
-and .
by 2,048
 hidden
Bios is
.  The
 the
"of .
and the end of .
.  The
>and
in the DOS
not be
.  The
in the
5and cannot be seen in
 "Mr.Watshira Sae-eu KMIT-NB
>12/28/
BIOS"
the Bios
may notice
the DOS
to re
&the
in a continuous series of re
ring.
PZPAPN
Bit Addict
:  Bit Addict
H:
 The
R:  477
5:   PRaCK -
3.96+, NAV 3.0+,
/2.1+,
1.53S+,
 The Bit Addict
fthe
.  Bit Addict is a
uof .
 The
the Bit Addict
X, the Bit Addict
 in Video Card
a hook to
in low
mby the
.  The DOS
not indicate any
the Bit Addict
, it
pof 477
at the end of the
a.  The
in the DOS
not be
.  The
can be
in the
5in all
 Bit Addict
 "BIT ADDICT"
 "The Bit Addict says"
 "You
la good taste for
Ks, it was delicious !!!"
 It is
what
may do
of Bit Addict are:
 Bit Addict-496:
, Bit Addict-496
 to be an earlier
of the
.  It
zs a 2,576
*TSR
X, hooking
pof 496
 at the end of the
a.  The
>and
 in the DOS
to the
>and
.  No
in the
PZPAPN
Bizarre
:  Bizarre
H:
 DOS
 Belgium
R:  2,716
5:   PRhCK -
6.55+,
2.58+,
2.11+,
2.58+
 The Bizarre
, and is
 Belgium.  Bizarre is a
uof .
,, as well as .SYS
`.  It is a polymorphic
a fast
bBizarre
, as well as
wthe copy of
ed to by the
-SPEC en
mental variable.  The
at the top of
$the
 not moving
|12's
, as
qby the DOS
 by 7,264
{21 and 2F
mby the
the Bizarre
, it
 .SYS
for any reason.
pof 2,716
at the
"of the
a.  The
>and
in the DOS
 year field
1to an
value, usually
during the
 50's.  The
in the Bizarre
 "Bizarre by Dreamer"
 "Do You Believe?"
 The Bizarre
interfers
the DOS
Xmay indicate fake
PZPAPN
Black Monday
:  Black Monday
 Borderline, Monday
H:
i; TSR;
stamp
 Kuala Lumpur, Malaysia
R:  1,055
5:   PRsAK -
, NAV,
:  CleanUp, or
 The Black Monday
}in Fiji in
.  It
 is reported to be widespread in Fiji and
locations in the Far
 East and Asia.
is a
generic
-and .
 The
the Black Monday
X, the
as a low
TSR of 2,048
 the
, any
the Black Monday
by 1,055
 the end of the
`.  .
by 1,055
to the end of the
Nnot
`multiple
 The
Nnot hide the
=stamp
to the
 and
awas
 The
can be
din all
`near
 the
"of the
 "Black Monday 2/3/90 KV KL MAL"
 Black Monday
X, at
attempt to format a portion of the
of Black Monday are:
 Black Monday-B:
gidentical to Black Monday,
has six
differ.  While .
`still
by 1,055
by 1,055 to 1,069
 Black Monday-C:
}in Malaysia in
, Black
 Monday-C
s to be an earlier
.  Like Black Monday-B, .
pof 1,055
)while .
pof 1,055 - 1,069
).  Unlike the
of Black Monday,
X.  It
frequently
 hang the
X, and the .
lhad
>and
in the DOS
 to the
>and
 Borderline: Borderline is a smaller
of the Black Monday
 by 781
at the end of
 the
a.  The
>and
in the
 DOS
to the
>and
 may
, adding 781
 for
 TSR is
2,048
, and hooks
 08 and 21.  It is
if it
PZPAPN
Black Wizard
:  Black Wizard
H:
i; music
R:  2,051
5:   PNE -
, NAV,
3.96+,
 The Black Wizard
.  Its
.  Black Wizard is a
 of .
.  It is
on the Enigma and Yankee 2
Black Wizard is
X, the
search the
Efor an
w.  If one is
d, it
 Black Wizard
 2,051
at the end of the
be no
3in the
>and
 in a DOS
.  Two
can be
 the
 "*.exe *.*"
 "Black Wizard"
in the
playing the
 tune "Turkey In The Straw" on the
speaker, followed by the
executing.
 Black Wizard may be a research
, and not in the public domain,
 as the
sample is not a natural
rence of the
 See:   Enigma   Yankee 2
PZPAPN
Blaze
:  Blaze
H:
2; TSR;
&failure
R:  284
5:   ORsAK -
, NAV,
3.95+,
1.53S+,
 The Blaze
.  Its
.  Blaze is a
uof .
 and .
the Blaze
wthe
btwo .
-and
btwo .
in the
E.  If
E, it may
it has
, it
za low
TSR of
 65,584
).  The
 "The Eternal Blaze
!unleashed...Beware!"
 "[JD]"
the Blaze
lthe
)of the host
the Blaze
 The
can be
be no
3to the
in the DOS
, but the
>and
to the
>and
 Since the Blaze
s the
"of the host
cannot be dis
must be
 replaced
backup copies.
the Blaze
may fail to
,has
of Blaze are:
 MSK: The MSK, or Midnight Serial Killer,
is a 252
of the Blaze
.  It
vthe
bthree .
`in the
X, as well as
the C:
lthe
b252
 by the MSK
5.  The
>and
 in the DOS
to the
=.  The
in the
 "The Midnight Serial Killer is roaming in your computer..."
 "Beware!"
 "[JD]"
 "*.exe"
 The
may be
PZPAPN
Blinker
:  Blinker
 Blinker-496, Prague.Blinker
H:
; spurious
 Prague, Czechoslovakia
R:  512
5:   PRhCK -
, NAV,
 The Blinker
.  It
ated in
 Prague, Czechoslovakia.  Blinker is a
,.  It is
on the Back
, and
may identify it as such.
 The
Blinker is
X, the
 Blinker
at the top of
$the
, as
qby the DOS
@by 528
{08 and 21
 by Blinker in
|12's
 moved.
Blinker is
, it
wany .
X.  If
X, it
ras well.  Blinker
pof 512
).  The
at the
 end of the
be no
3to the
>and
in the DOS
 It is
what Blinker
of Blinker are:
 Blinker-496: Blinker-496 is a 496
of the Blinker
.  It
8the
"Joker".
may receive the
Umeesages for no apparent reason
, both of
require a response
to abort, retry, ignore, or fail:
 "Bad
Ureading device CON"
 "Bad
Uwriting device CON"
 See:   Back
  Shaker
PZPAPN
Blinky
:  Blinky
 Blinky Ghost
H:
{01 and 03
tof  Inky
&failure
R:  1,302
5:   PRaCK -
, NAV 3.0+,
n1.04+,
6.60+,
2.58+,
1.22+,
2.58+,
.2.0+,
6.64+
 The Blinky, or Blinky Ghost,
 and is one of three related
fthe popular Pac-Man video game.  Blinky is a
uof .
.  It "drops" or
 is the carrier of a
, the  Inky
bBlinky
X, the
za portion of
 hooking
{01 and 03.
is an attempt by the
 avoid having debugger
used against it.  The
 on to
the Blinky
wthree .
in the
E.  If
,is in
E, it may
the Blinky
pof 1,302
at the
"of the
a.  The
>and
in the DOS
not be
.  The
 are
in the
5in all Blinky
 "[Blinky Ghost]"
 "The Pac-Man BLINKY Ghost is watching."
 "[-Inky!-]"
 "[INKY Ghost] by PacMan and Associates Inc."
 "Non-
 "Replace and press any key
ready..."
 The Blinky
"drops", or is a carrier for the Inky
.  The last four
fInky.  As the
 Inky
is actually a separate distinct
, it
Cin its own entry.
 See:   Inky   Pinky
PZPAPN
Bljec
:  Bljec
 Bljec3, Bljec3B, Bljec4, Bljec4B, Bljec5, Bljec5B, Bljec6,
 Bljec6B, Bljec7, Bljec7B, Bljec7C, Bljec8, Bljec8B, Bljec9,
 Bljec9B
H:   May,
 Write fault
Ton device PRN;
&failures
R:  231 - 374
5:   PNC -
, NAV,
 The
bBljec
Vin May,
.  In
, six
were
, four of them
fItaly.  Bljec is actually a
es.  All of the
es are
us of .
 exception of Bljec3 and Bljec4,
do not typically
,.  Bljec
es mark
`by checking for
 two NOP instructions (9090h) at the very
"of the
 The description
$applies to Bljec6,
the differences for
 the
qlater in
entry.
Bljec6 is
X, the
 search the
Oand
Efor three .
by 276
), the
at the
"of the
a.  The
>and
in the
to the
>and
Bljec6 may hang the
X, or
may simply refuse to function
of Bljec are:
 Bljec3: Probably the earliest
member of
 Bljec3
vthe
bfour .
`in the
ever an
X.  If
bfour .
`are already
r, it
 not
`in the
by 231
at the
"of the
a.  The
>and
in the
to the
>and
.  A symptom of an
 Bljec3 is
may receive the
 "Write fault
Uwriting device PRN"
 It is
what Bljec3 was
to write to the
printer.
in a
hang.
particular sample of Bljec3 was
fItaly
 Bljec3B:
, Bljec3B is a 236
of the Bljec3
 Bljec4:
fthe NCSA in
, Bljec4 is
to Bljec3.  It
vthe
bfour .
 in the
cthe
tof the
hang
usually
 Bljec4
by 247
at the
"of the
lhad
in the DOS
to the
>and
in a
hang
ring.
 Bljec4B:
in May,
, Bljec4B is a 252
 of the Bljec4
 May,
 Bljec5:
fthe NCSA in
, Bljec5 is
to Bljec4.  Its major difference is
`is 267
 Bljec5B:
, Bljec5B is a 272
of Bljec5.
 Bljec6: See description
is 276
 Bljec6B:
in May,
, Bljec6B is a 281
 of the Bljec6
 May,
 Bljec7:
fItaly in
, Bljec7
wthe third, fifth, and sixth .
`in the
`are already
r, nothing more
Bljec7
by 287
 at the end of the
a.  The
>and
 in the DOS
to the
>and
.  Like
 Bljec3, write fault
Ton device PRN may be
 Bljec7B: Bljec7B was
.  It is a 292
of Bljec7.
 Bljec7C: Bljec7C was
.  It is a 440
of Bljec7.
wno more
 three .
in any
E, and resets the
 clock to 2-27-1989
9the
 "Digital F/X
- Created on 2/5/92 by Phoney Phreak"
 "*?.com"
jmay frequently
 are
 Bljec8: Bljec8 was
fItaly in
.  It
to Bljec7,
the exception
pis 358
), and
be no
 in the
>and
in the DOS
Efor
 Bljec8B:
in May,
, Bljec8B is a 363
 of the Bljec8
.  The
in the
 DOS
 May,
 Bljec9:
to Bljec8,
 Italy in
.  Its
pis 369
), and no
3in the
>and
 in the DOS
s.  Unlike Bljec8, it
 not usually
 not the root
 Bljec9B:
to Bljec9, Bljec9B is a 374
 Bljec-XYZ:
on the Bljec
adds 441
 to the .
v.  It
8the
1.0 - Buddy and Chloe 5/27/89"
 "?*.com"
 "XYZ
1.0 - 5/27/89"
 Bljec-235:
on the Bljec
adds 235
 to the .
and .BAT
v.  It
 the
?.???"
 Bljec-284:
on the Bljec
adds 284
 to the .
v.  It
8the
 "*.com *.exe *.ovl *.sys"
jfrequently
 See:   Sad
PZPAPN
Blood
:  Blood
 Blood2
H:
&s and/or
 cascading
effect
 Natal, Republic of South Africa
R:  418
5:   PNCK -
, NAV,
 The Blood
by Fridrik Skulason in
 It was
}in Natal, Republic of South Africa.
are two
, Blood and Blood2.
 is a
uof .
the Blood
X, it
wone .
in the C:
Oroot
E.  The
 newly
pd in
by 418
).  If
 the
just
,, a
cthe
&, executing an
in a cascading effect of the cursor down the
 The next .
in the
 accessed followed by the
hanging.  Spurious
on the
on the line
$the
 line.
Zof an
hang.
of Blood are:
 Blood2:
to Blood,
the major difference
j, and the cascading cursor
 effect no longer
Nnot hang
 the
15th.
PZPAPN
Blood Lust
:  Blood Lust
 Trivial-Blood Lust
H:
&failures
 Sweden
R:  302
5:   ONCK -
, NAV,
8/93+,
 The Blood Lust
.  It is
fSweden.  Blood Lust is a
 of .
,.  It
s the
"of the
Blood Lust is
X, the Blood Lust
wall of the .
in the
E.  If
E, it
the Blood Lust
lthe
b302
)of the
by the
5.  Unless the
smaller
be no
smaller
 302
be no
3to the
>and
 in the DOS
 The
in the Blood Lust
and are not
 "*.C*"
 "Hi!
is the
Blood Lust striking."
 "Sorry to tell you, but your
 The
may be
Lby the
 circumstances.
 See:   Mini-45
PZPAPN
Blood Sugar
:  Blood Sugar
H:
^, 1994
R:  416
5:   PNCK -
\2.13+,
1.22+
 The Blood Sugar
^, 1994.  It's
is a
uof .
Blood Sugar is
X, the Blood Sugar
wall of the .
in the
E.  If
E, it
 of 416
at the end of the
 The
>and
in the DOS
 not be
.  The
in the
 "[C6H1206] $ Blood Sugar by MnemoniX"
PZPAPN
Bloody Warrior
:  Bloody Warrior
H:
, 1994
 Italy
R:  1,344
5:   PRhAK -
\2.10g+,
2.11a+,
V114+,
6.64+,
V116+,
1.25+,
6.64+
 The Bloody Warrior
^, 1994.  It
 to be
fItaly.
is a
uof .
 and .
bBloody Warrior
at the top of
$the
', not moving
|12's
, as
 the DOS
@by 2,768
mby the
the Bloody Warrior
, it
-and .
pof 1,344
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the Bloody Warrior's
 "FUCK YOU"
-SCANSTOPSHIELDCLEANCVDEBUGTDHello, world"
 "I am the Bloody Warrior.  Nice to meet you.  What about
? Funny ?"
is no hope for you.
was released in
 Milan
. Bloody Warrior"
 It is
what Bloody Warrior
PZPAPN
Bloody!
00]    O
PT]
:  Bloody!
 Beijing,
H:
 Extended
 Taiwan
R:  N/A
5:   BRtX -
\, NAV,
:  CleanUp, or see
 The Bloody!
, and
 reports were
V, Taiwan, and the
is a
uof floppy
as well as the
fa floppy or
 Bloody!
, the
at the
 top of
$the
Aby 2,048
).  The
be moved.  The
 much longer
expected.  The
rimmediately if it was not the source of
 the
 At the
&, the
maintains a counter of
 how many
s the
Ohas
, the
Mthe
during the
 "Bloody! Jun. 4, 1989"
4, 1989 is the
>of the confrontation in Beijing, China
 between Chinese students and the Chinese Army in
many students
 were killed.
later be
Lon every sixth
 128
&limit has
Qed.  The
in the
5, so it is not
in the
Bloody! is
, the
wany
is accessed.
not be enough to cause the
wthe
be missing all of the normal DOS
are normally
din the
.  The
!moved to
11 on 360K
I, a part of the root
E.  If
were
 root
Eentries in
, those
be lost.
 On the
K, the
 moved to side 0, cylinder 0,
 For floppies of
360K,
 unusable or
 corrupted as the
Nnot take into account the existence of
 For
I, Bloody! can be removed by powering the
off and
&ing
clean, write-protected
J. The DOS SYS
6should
Qof the
 To remove the Bloody!
fthe
 the
should be
copied
 back to its
position.  The
option is to backup the
`on the
Kand low level format the
O.  In the case
 of DOS 5.0, the
can be rebuilt by using the DOS
 FDISK
the undocumented /MBR option.
of Bloody! are:
 Bloody!-B:
in May,
 equivalent to the
.  It has
 avoid detection by most
utilities.
 May,
PZPAPN
:  Bob
ew-718
H:
R:  718 - 1,414
5:   PNCK -
/, NAV,
 The Bob
.  Its
~, are
.  Bob is a
uof .
the Bob
wall the
 in the
Eof the
usually
pof 718
 the
was less
), its
 1,416
).  The
at the
 of the
.  The
>and
in the DOS
not be
 The
can be
din all Bob
 "*. *.
,MKS_VIR.
terminated normally"
 It is
if the Bob
PZPAPN
Bomber
:  Bomber
 Bomb
H:   May,
; sluggish DOS DIR
6s; beeps &
&failures;
 Malaysia
R:  2,204
5:   PRhCK -
\2.13+,
 The Bomber, or Bomb,
fMalaysia in May,
is a
uof .
employs
technology to avoid detection.  It
31st, Malaysia's Independence Day.
the Bomber
 the Bomber
at the top of
$the
|12's
not be moved.
qby the DOS
@by 3,072
{1C, 20, 21, and 22
mby the Bomber
the Bomber
, it
.  It
 of the .
in a
a DOS DIR
 issued.
the Bomber
pof 2,204
 hidden if Bomber is
.  The
 the
"of the
>and
in the DOS
 Bomber is an
, and no
 the
 The Bomber
31st, Malaysia's Independence
 Day.  On
31st, the
emit three beeps
 and the
 "! I AM THE STEALTH BOMBER !
   I BELONG TO THE NEW
   GENERATION OF
-PUTER
 VIRUSES.  LIKE THE STEALTH
   BOMBER, I GO UNDETECTED
 BY ENEMY RADAR
 DO NOT PANIC
 I AM SHOWING OFF HOW
 EASY I CAN EVADE YOUR ANTI
 VIRUS SYSTEM - I DO NO HARM"
 Bomber
Nn't do
malicious
Ming its
.  However,
the Bomber
&failures
r, as
 well as
#detected by the DOS
Bomber is
.  Lastly, the DOS DIR
be very sluggish.
of Bomber are:
 Messy:
fMalaysia in May,
, Messy is a
of the Bomber
.  The major
3between the
 two
es is
Messy
emit more beeping on
31st, and
Mthe
 "MESSY VIRUS
 CATCH ME IF YOU CAN !!!
 HA..HA..HA!!!"
PZPAPN
Boojum
:  Boojum
H:   May,
R:  340 - 350
5:   PRhE -
, NAV,
8/93+
 The Boojum
in May,
.  Its
~are
.  Boojum is a
the Boojum
 the Boojum
at the top of
$the
|12's
not be moved.
qby the DOS
 368
mby Boojum in
the Boojum
, it
pof 340 to 350
at the end of the
a.  The
in the DOS
not be
.  No
in the
5in Boojum
 Boojum
Nn't do
PZPAPN
&Killer
&Killer
H:
 BSC;
&failures;
 inaccessible
R:  N/A
5:   BNX -
\2.09f+, NAV 3.0+,
2.10+
:  DOS SYS on
I, Norton
KDoctor on
 The
&Killer
.  Its
&Killer is a
uof the
) and
is attempted to be
&Killer
J, the
&Killer
be read into
, and
 the
fail,
Ming the
 "Non-
 Replace and press any key
ready"
has replaced the
J, and struck a key,
 the
the proceed.  If the
Jwas a non-write
 protected
J, the
&Killer
 it,
.  At
same
, the
rthe
it as well.
&Killer
[frequent
 failures
I, as well as the
Khaving
 inaccessible due to
&Killer
fthe
 in the same
 The damage to the
can be repaired using
 various
Kdiagnostic
oNorton
KDoctor.
I, the DOS SYS
6can be used to replace
 the
PZPAPN
:  Bow
 5856
H:   May,
R:  5,856
5:   PRhAK -
8/93+,
1.22+
 The Bow, or 5856,
in May,
is a
uof .
-and .
 The
a Bow
X, the Bow
at the top of
 the
', not moving
|12's
, as measured by the DOS
@by 5,888
).  The Bow
{1C and 21.
the Bow
, it
-and .
X, as well as
pof 5,856
at the end of
 the
a.  The
>in the DOS
 not be
, but the
may be
to a different
 value.  Two
in the
5in Bow
 "TRUS"
 "bow!"
 It is
if the Bow
PZPAPN
:  Boys
H:   May,
acreation
R:  500
5:   PRCK -
, NAV,
 The Boys
in May,
(.  It is a
uof .
 and
 The
the Boys
 Boys
.  Unlike most
be no
mapping utilities
not indicate
is in
as no
{are
Boys is
, any .
 larger
by 500
at the
 end of
`.  The
can be
Boys:
 "The good and the bad boy."
 The
at the end of
 Boys is a malicious
X, it
alter the attribute
)of .
 setting the
attribute.  The .
lists the
E.  If the
 to copy back the missing .
, a "
acreation
since the
`still exist.  The .
has hidden can be recovered by removing the
attribute.
of Boys are:
 Boys 2:
on the Boys
, Boys 2 is a
uof .
Boys 2 is
X, Boys 2
search the
Efor an
w.  If one is
d, it
r, and
Bone .
fthe
E.  Boys 2
pof 500
at the end of the
.  The
can be
in the
 "The good and the bad boy."
 See:   Bad Boy
PZPAPN
Brain
:  Brain
 Pakistani, Pakistani Brain, Clone, Nipper
H:   1986
 Extended
; volume label
-TOM;
 three contiguous bad
(floppy
); BSC
 Pakistan
R:  N/A
5:   BRt -
, NAV,
K, CleanUp,
\, NAV, or
 DOS SYS
 The Pakistani Brain
ated in Lahore, Pakistan and
by moving the
contents of the
 to an
location on the
K, marking those 3 clusters (6
 bad in the FAT, and
writing the
5in the
 One sign of a
Khaving
r, at least
, is
the volume label
1to "(c) Brain".
sign is
the label "(c) Brain" can be
 (the
) on an
, taking
 up between 3K and 7K of RAM.  The Brain
is able to hide
 detection by intercepting any
might interrogate the
and re
Fing the read to the
elsewhere on the
K, thus
be unable to
 see the
 The
Brain
rfloppies, however
 the
can now
Ks.
 the "(c) Brain" label removed to make them
ker to detect.
of Brain are:
 Brain-B: (
KBrain/Houston
 Brain-C: Brain-B
the "(c) Brain" label removed.
 Clone: Brain-C but restores
©right label.
 Clone-B: Clone
modified to destroy the FAT
5/5/92.
 Nipper:
fSpain in
Ks.  The
8the
in the
 "Welcome to the  Dungeon
 (c) 1999 NIPPER SOCIEDAD GAMBERRISTICA
 VIVA LA PIRATERIA.
 Dedicated to the memories of
 See:   Ashar
PZPAPN
Brainy
:  Brainy
H:
R:  768 - 1,531
5:   PRsCK -
, NAV,
 The Brainy
.  It is
(.  Brainy is a
uof .
,.  It is
on the Warrior
 The
Brainy is
X, the
 Brainy
at the top of
$the
mby the Brainy
|12's
!moved.
, as
 by the DOS
@by 1,552
the Brainy
, it
wall .
pof 768 to
 1,531
).  Unlike most
es, the Brainy
 inserted
into the
a, possibly in the middle.  The
can be
dat the end of the
5in all
 Brainy
 "eAWRREI!R"
 Brainy
usually not
 386
processor, and may hang the
 It is
if Brainy
 See:   Warrior
PZPAPN
Brazilian Bug
:  Brazilian Bug
H:   May,
 Brazil
R:  1,343
5:   PNCK -
, NAV,
 The Brazilian Bug
Gin May,
.  It is
fBrazil, and may
>back to late
is a
uof .
, but not
the Brazilian Bug is
X, the
wall .
 in the
it completes
sall the
, it
Mthe
*   HELLO FRIEND
 WE ARE SORRY TO INFORM YOU THAT YOUR
 SYSTEM IS VERY ILL
 AND WILL NOT SURVIVE
" MUCH LONGER
 YOU UNFORTUNATELY HAVE
 - THE BRAZILIAN BUG -
 FOR WHICH THERE IS NO CURE
 WE HOPE THIS WILL NOT BE AN INCONVENIENCE TO YOU
 LOVE,
$ THE MAGIK MUSICIANS"
 The host
complete
the Brazilian Bug
pof 1,343
at the end
 of the
a.  The
>and
to the
>and
.  All of the
in the
PZPAPN
Breeze
:  Breeze
H:
 The
R:  358
5:   PNCK -
/2.0+,
8/93S+,
3.96+,
30.00+, NAV 3.0+,
8/93+,
.2.0+,
 The Breeze
, and is
fThe
.  Breeze is a
uof .
,.  It is written by
 the same author as the  Deicide
the Breeze
X, the
 Breeze
wone .
in the
E.  If
E, it may
the Breeze
pof 358
 the
"of the
a.  The
>and
in the
 DOS
not be
.  The
can be
in the
5in all Breeze
 "Dutch [Breeze] by Glenn Benton"
 Breeze
Nn't
to do
 See:   Deicide
PZPAPN
Bryansk
:  Bryansk
H:
; Read-
attribute set
R:  673
5:   PNCK -
/2.0+,
3.96+, NAV 3.0+,
.2.0+,
 The Bryansk
.  It is
fthe
.  Bryansk is a
the Bryansk
X, the
 Bryansk
check the
>and
.  If it is
 not a Friday before 15:00 (3:00PM), the
wone .
in the
E.  If an
acannot be
din the
E, it
move upward
 in the
Estructure searching for a .
 until it r
Qes the root
the Bryansk
pof 673
).  The
at the end of the
a.  The
>and
in the DOS
not be
.  The
can be
in the
5in all Bryansk
 "BRYANSK
, BITE 0.01 (C)"
 On any Friday before 15:00 (3:00PM), the Bryansk
`, instead it
set the Read-
attribute on for
`using the
aspecification "*.*".
PZPAPN
Bubonic
:  Bubonic
H:   May,
i; DOS
 sluggish DOS DIR
R:  2,181 - 2,193
5:   PRhAK -
/2.1+,
2.58+,
6.64+,
1.22+,
2.58+,
6.64+
 The Bubonic
in May,
.  Its
.  Bubonic is a
, fast
-and .
 It is a
, hiding the
bBubonic
X, the Bubonic
at the top of
$the
', hooking
|6B.
, as
qby the DOS
@by 2,592
|12's
not be moved.
, the Bubonic
-and .
pof 2,181
Bubonic
 of 2,181 to 2,193
one may
by up to 2,254
).  In both cases, the
 is hidden
, and the
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
5in all Bubonic
 "Bubonic[BBP],alpha.02a,fixedFCBbug.Soon:tighter
 "anti-(debug,heuristics),norunifanti-
prog.running
 (FSP,etc.)better
 "NEW!genetic,algorithmicdarwin-encryptionandadrop
 libraryofmanyvirii,allless
 "Ooops, Sorry..."
the Bubonic
[sluggish
 DOS DIR
6output.  The DOS
 the Bubonic
detect
 all
PZPAPN
:  Budo
H:
fail to
 Finland
R:  890
5:   ONA -
3.96+, NAV 3.0+,
 The Budo
fFinland in
.  Budo
 is a
-and .
, but not
the Budo
 may
wone .
-or .
in the
 The
ed to the DOS prompt.
lthe
b890
by the Budo
5.  Unless
 the
host
was smaller
.  In the case of
 smaller
 890
.  The
>and
in the DOS
.  The
can be
in the
 "BUDO V1.2 TH
HV FINLAND PQ"
 "FLOW LIKE A RIVER - STRIKE LIKE THUNDER"
 Budo destroys the
v, and
 be replaced
fclean,
backups.
of Budo are:
 Budo.1000:
, 1994, Budo.1000 is a
 1,000
of the Budo
 the
X, it
as a low
TSR of 1,232
 hooking
{21 and 22.
, it may
 1,000
).  The
>and
in the DOS
not be
.  The
in the
5in all
 "BUDO V1.0
H & HV Finland"
 "Flow like a river - strike like a thunder"
 "Incorrect DOS
 "TELAPI"
:  Finland
, 1994.
PZPAPN
Burger
:  Burger
 404, 505, 509, 537, 540, 541, 542, 560, 560-B, 909090h, CIA,
 CIA-2
H:   1986
not run
 West Germany
R:  560
5:   ONAK -
, NAV,
 The Burger, or 909090h,
was written and copyrighted in 1986 by
 Ralf Burger of West Germany.
is extinct in the "public
 domain".
is a
-and .
the Burger
X, the
attempt to
wone
 in the C:
Oroot
E.  To determine if the
r, the
checks to see if the
bthree
)of the .
aare three NOP instructions (909090h).  If the
bthree
)are the NOP instructions, the
goes on
 checking until it finds an
a.  If no
aexists, the
s all the .
`in the
 root
Eto .
`and checks those
it finds
w, it
s the
b560
)of the
5.  At
, the
 the
to run
either end or hang the
never
as the
bportion
 of the
!destroyed.
the Burger
fail to
 the
,, or the copy of
`can be easily
 identified by the "909090B8
026A245" hex sequence
in the
bnine
)of all
`cannot be
must be replaced
fa clean source.
of Burger are:
 404:
to the Burger
's actual
 is 404
b560
bnine
9the hex
: "909090B8
026A245".
 505:
to the Burger
's actual
 is 505
b560
bnine
9the hex
: "909090B8
026A3A0".
 509:
to the Burger
's actual
 is 509
b560
bnine
9the hex
: "909090B8
026A3A4".
 540:
to the Burger
's actual
 is 540
b560
bnine
9the hex
: "909090B8
026A3A3".
 541:
to the Burger
s the
 560
 actually 541
start
the hex
 sequence: "909090B8
026A3A4".
 542:
to the Burger
s the
 560
 actually 542
start
the hex
 sequence: "909090B8
026A3A5".
 560-B:
to the Burger
s the
b560
, and the
 is 560
).  The end of the
8the
: "his
awas downloaded
fthe Vir".
in all
d samples.
start
the hex
: "909090B8
026A3B2".
 CIA:
Gin the
to the Burger
.  The
bnine
)of all
`in hex
 "909090B8
026A3A5".   The actual
 541
b560
 CIA-2:
}in May,
is a minor
 the CIA
 See:  382 Recovery   405   Dewdz   VirDem   VirDem-1542   Wonderful
PZPAPN
Burghofer
:  Burghofer
H:
 Switzerland
R:  525
5:   PRhCK -
, NAV,
 The Burghofer
, in Switzerland.
 Burghofer is a
uof .
bBurghofer
X, Burghofer
at the top of
 but
$the
 as measured by the DOS
Aby 528
mby the
Burghofer is
, it
X.  If
X, it
by 525
), the
at the end of the
 The
>and
in the
not be
Burghofer
9the
 "GS/02" at the fourth thru eighth
)of the
 Burghofer
Nn't do
PZPAPN
Burma.563
:  Burma.563
 Burma
H:
, 1994
 563
Meffect;
R:  563
5:   ONAK -
\2.13+,
6.64+,
n1.05+,
V117+,
 NAV 3.0A06+,
1.25+,
6.64+,
V117+,
1.0A06+
 The Burma.563
, 1994.  Its
is a
permanently corrupts the
 The
the Burma.563
Mthe
 "Reading
configuration, please wait."
 The
rthe
-and .
 in the
E.  The
ed to the
 DOS prompt.
 The next
the Burma.563
check to determine if the
-and .
r.  If
are, a swirling effect
on the
M.  On monochrome monitors,
effect may
as the
 The Burma.563
Nnot continue to
in the
-and .
 563
 and
in the DOS
having
to the
>and
.  The
in the
5in all
 "*.?o? *.?x? \DOS \"
 "Reading
configuration, please wait."
 Two
, "SwizzleStyxx!" and "
<", are
in the
4are separated
 by an open happy face (hex 01) character.
PZPAPN
Busted
:  Busted
H:
/corrupted
R:  571
5:   ONE -
 NAV,
1.53S+,
 The Busted
.  Its
~, are
.  Busted is a
the Busted
wall .
in the
has completed
sall .
in the
E, the
too big to fit in
lthe
b571
by the
, permanently damaging them.
 be no
3to the
unless the .
smaller
), in
case the
 571
).  The
>and
in the DOS
 Several
 are
Sin all
d samples.
 "Busted!"
on Leprosy-B."
x PCM2"
 "Busted, Strain A,
1.08y"
 "(Psychogenius),
 Busted
Nnot
to do
%replicating,
 destroying the .
PZPAPN
Butt Stink
:  Butt Stink
H:
 North America
R:  540
5:   PNE -
8/93S+,
 NAV 3.0+,
n1.04+,
6.64+,
1.22+,
.2.0+,
6.64+
 The Butt Stink
, and is probably
fNorth America.  Butt Stink is a
uof .
the Butt Stink
wall of the .
in the
 540
at the end of the
a.  The
>and
in the DOS
.  The
in the
 Butt Stink
 "You know what?"
 "Your Butt Stinks!!!"
 "And YAM can't stand it!"
 The last three lines of
forms a
Lon the
monitor
PZPAPN
Butterflies
:  Butterflies
 Butterflies-302, Goddamn Butterflies
H:
 Illinois,
jmay
R:  302
5:   PNC -
, NAV 3.0+,
8/93S+,
3.96+,
30.00+,
2.53+,
V111+,
.2.0+,
 The Butterflies, Butterflies-302 or Goddamn Butterflies,
in the state of Illinois in
 the
.  Butterflies is a
uof .
, but not
,.  It has
!given
 a status of
7as many reports of
were
 mid to late
due to its distribution on a shareware
 communications package.
reports were
fthe
 Canada,
V, and Israel.  As such, its
the Butterflies
wall of the .
in the
meet its selection criteria.
pof 302
 at the end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the
5in all Butterflies
 "Goddamn Butterflies"
 Butterflies
Nn't
to do much
jmay unexpectantly
 are
of Butterflies are:
 Crusades:
on the Butterflies
wthree or four .
`in the
by 302
at the end of the
a.  The
>and
in the DOS
.  The
 the
5in all Crusades
 "Hurray The Crusades"
jfrequently
 Crusades
to the Crusades
wfour .
`in the
by 302
at the end
 of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all Crusades
 "Hurray The Crusades"
, 1994.
PZPAPN
ButtUgly
:  ButtUgly
H:   May,
R:  552
5:   PNCK -
n1.04+,
2.58+,
1.22+,
2.58+,
 The ButtUgly
in May,
.  Its
.  ButtUgly is a
uof .
the ButtUgly
wone .
in the
pof 552
 the
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the ButtUgly
 "PATH="
 "Fool. Dolt.. Fuck You! HaHah. You Limp Cock! Damn!
 Your Butt-Ugly."
 "by Primal Fury"
 "* *.*"
 It is
what ButtUgly
PZPAPN
Cacophony
:  Cacophony
 Cacophony 1
H:
^, 1994
1to 4:08a
 tune played on
speaker
R:  950 - 960
5:   PNE -
V112+,
/2.1+,
\2.13+,
.2.0+,
V111+
 The Cacophony, or Cacophony 1,
^, 1994.
 Its
.  Cacophony is a non-
uof .
.  A later
, Cacophony 2, is
adds encryption to the
, as well as no longer altering the
>and
a Cacophony
 one .
in the
pof 950 to 960
at the end of the
a.  The
>and
 in the DOS
field is set to 4:08a.  The
in the
5in all Cacophony
 "cacophony"
 "*.e?*"
 "\ .. smartc*.cps"
 Cacophony may interfer
the functionality of the Central
 Anti-
.  The
zs a small portion of
 at the top of
$the
', hooking
|08.
5is not a complete copy of the
, but a
 routine to play a tune on the
speaker
of Cacophony are:
 Cacophony 2: A later
of the Cacophony
vone .
ain the
pof 1,056 to 1,066
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the Cacophony
 "CACOPHONY * EpidemicWare 93 G.I.P.Po."
 "Cacofonia"
W\ *.* smartchk.cp?"
 Like the
play a tune
 on the
speaker
#present on the
 for
.  It may
interfer
the functioning
 of Central
Anti-
^, 1994.
PZPAPN
Cadkill
:  Cadkill
 Milous
H:
R:  1,163
5:   PRhAK -
, NAV,
/2.1+,
8/93+,
.2.0+,
 The Cadkill
.  Its
.  Cadkill is a
generic
uof .
 and .
 The
Cadkill is
X, the
 Cadkill
at the top of
$the
, as measured by the DOS
Aby 2,048
{1C, 21, and 24
mby the
Cadkill is
, it
-and .
X.  If
X, it
by 1,163
).  The
at the end of the
 It is
what Cadkill
PZPAPN
Cannabis
00z    S
PTz
:  Cannabis
 Cannabis 2, Cannabis 3
H:
 BSC;
 The
R:  N/A
5:   BRh -
Floppy
8/93+,
.2.0+
:  DOS Sys on
 The Cannabis
fthe
.  Cannabis is a
uof floppy
.  The
;submission of
Cannabis,
 the
usually
in a
indicating
Kis a non-
J, and to replace it
Kand press any key.  Replacing the
J, or removing it
 and allowing the
&to proceed
fthe
in the
&completing.  At
, Cannabis
at the top of
$the
 DOS
 measured
the DOS
be 2,048
)less
expected.
Cannabis is
, it
wany non-write
 protected
Jexposed to the
r360K
lthe
moved to
9, and
 the Cannabis
5written to
0, the location of the
.  Since
9 is normally part of the
 root
:may
 Cannabis is a very buggy
, and it
.  As a
, the
was re
by the
 The Cannabis
occasionally
Mthe
 "Hey man, I don't wanna work.
 I'm too
right now..."
, along
the word
 "Cannabis".
of Cannabis are:
 Cannabis Dropper: A very small .
9ed the
 Cannabis
 nothing but
 the Cannabis
 Cannabis 2: Cannabis 2 is a
of the Cannabis
 has the bug fixed
prevented
 Cannabis
I.  It
8one
: "CANNABIS".
where the
 DOS
number is normally
in the
.  It uses 1,024
, rather
 2,048
)required for the
.  Cannabis 2
 is a very poor replicator, and not likely to
 widespread problem.
:  The
 Cannabis 2 Dropper: A very small .
9ed the
 Cannabis 2
Nnothing but
the Cannabis 2
:  The
 Cannabis 3: Cannabis 3 is a minor
of the Cannabis 3
.  Like Cannabis 2, it
8the one
: "CANNABIS".
:  The
 Cannabis 3 Dropper: A very small .
9ed the
 Cannabis 3
Nnothing but
the Cannabis 3
:  The
PZPAPN
Cansu
:  Cansu
 Sigalit, V-Sign
H:
 BSC;
; graphic
 Turkey
R:  N/A
5:   BRXh -
Floppy
, NAV,
:  M-
K/P or DOS 5.0 F-
K/MBR on
 DOS SYS
&able
 The Cansu
fCanada in
.  It is
fTurkey.  Cansu is a
uof the
) and
bCansu
&ed, the Cansu
at the top of
 but
$the
, as
qby the DOS
 by 2,048
).  The
uses
Cansu is
, it
wthe
accesses the
K.  It
wany non-write protected
are accessed
Cansu
vthe
K, it saves
)of the
in its
s Side 0, Cylinder 0,
1.  The
is too large to
 fit entirely
in the
, so the remainder of the
is written to Side 0, Cylinder 0,
4 and 5.  On
I, the
saves 38
)of the
 and
s the
.  The remainder
 of the
be stored in the last two
of the root
E.  For example, on 360K 5.25"
10 and 11
9the remainder of the
 Cansu is slightly polymorphic, and a wildcard search
 necessary to detect the
.  Since the
 and
are not saved, dis
tshould be
 performed by replacing the
clean copies using utilities intended for
purpose.
 The Cansu
Ma V-shaped block character graphic
 on the
monitor
 the
.  The graphic is accompanied by a
hang.
PZPAPN
Capitall
:  Capitall
H:
i; TSR
 Poland
R:  927
5:   PRsCK -
, NAV 3.0+,
 The Capitall
fPoland in
is a
uof .
,.  It uses an encryption mechanism
 used by the Cascade
, so it is possible
 utilities
identify it as Cascade.
the Capitall
as a low
 TSR of
1,952
{1C, 21, and 28
mby Capitall in
the Capitall
, it
X.  If
X, it
the Capitall
pof 927
at the end of the
a.  The
in the DOS
not be
 It is
what Capitall may do
PZPAPN
:  Cara
H:
i; TSR;
 Spain
R:  1,025
5:   PRsCK -
, NAV,
 The Cara
.  It is
fSpain.  Cara is a
uof .
,.  It
alters
do not
9a live
 The
Cara is
X, Cara
at the top of
Aby 3,048
{13 and 21
 the Cara
.  At
, Cara
,if it was not
r, and alter the
Cara is
, it
 are
 by 1,025
at the end of
be no
3in the
>and
in the
 DOS
Cara
lthe
"CARA"
 in the fifth thru eighth
)of the
 is the marker used by the
to determine if the
 already
can be
dnear the
 end of
`are:
es en memoria!
 Disco es
wado. Reemplaza "
 Clandestino
 Auto-
 Reproductivo
 Anti-
 CARA"
 CARA's
of the
is an attempt to
es by providing a new
PZPAPN
Career Of Evil
:  Career Of Evil
 Career Of Evil-446
H:
-& .SYS
i; DOS
R:  446
5:   PRhCK -
30.00+, NAV 3.0+,
n1.04+,
2.58+,
2.11+,
1.22+,
2.58+,
.2.0+,
6.64+
 The Career Of Evil, or Career Of Evil-446,
.  Its
.  Career
 Of Evil is a
uses
 techniques to avoid detection and spread quickly to
`.  It
,, as well as .SYS
bCareer of Evil
at the top of
$the
', hooking
, as
qby the DOS
@by 704
|12's
not be moved.
the Career of Evil
, it
-and .SYS
for any
 reason.
 446
at the end of the
 The
p, however,
be hidden
.  The
>and
in the DOS
not be
.  The
"UK" can be
dstarting in the fourth
*of all
.  The
in the
 the end of
 "tenUKCareer of Evil"
the Career Of Evil
, the DOS
Ton all
of Career of Evil are:
 Career Of Evil-697: A 697
of the Career Of Evil
 960
), hooking
|21.  It
-and .SYS
for any reason.
pof 697
be hidden
 the
.  The
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The same
as the
 DOS
PZPAPN
Carfield
:  Carfield
H:
i; TSR;
R:  1,508 - 1,522
5:   PRsA -
, NAV,
1.53S+,
:  CleanUp, or
 The Carfield
fthe NCSA in
 Its
Hand
 Carfield is a
uof .
-and .
`.  It
Nnot
on the Sunday
 The
Carfield is
X, the
as a low
 TSR of 1,744
).  The
Carfield is
, it
-and .
by 1,508
at the
"of the
by 1,508 to 1,522
 the
at the end of the
be no
3to the
>and
in the
 DOS
 The Carfield
on Mondays.  It
hook
 in addition to
.  It
Mthe
"Carfield!" while it is
 See:   Sunday
PZPAPN
Carioca
:  Carioca
H:
 TSR; .
R:  951
5:   PRsC -
\, NAV,
 The Carioca
uof .
`, it
Nnot
 The
the Carioca
X, the
as a 1,280
*low
TSR.
mby the
.  The
Aby 1,312
, any .
 exception of
the Carioca
show an
of 951
at the end of the
lthe
chex character
 at the very end of the
a: "2EFF1E1A010203CD21".
 It is
if Carioca
8any damage potential.
of Carioca are:
 Carioca-B:
, Carioca-B is a very
 minor
to avoid
 detected by a particular
utility.  It is
 not believed to be in the public domain.
PZPAPN
Cartuja
:  Cartuja
H:
R:  1,568 - 1,600
5:   PRhAK -
n1.04+,
2.58+,
6.64+,
1.22+,
2.58+,
6.64+
 The Cartuja
.  Its
.  Cartuja is a
-and .
bCartuja
X, the Cartuja
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 60,704
|12's
!moved.
the Cartuja
, it may
Nn't always
wthe
a.  As a
, it may take several
Zs of a
 particular .
-or .
before the
the Cartuja
pof 1,568 to 1,600
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all Cartuja
 "Frz G"
 Frequent
jmay
Cartuja
X.  The damage potential for
 See:  Estepa
PZPAPN
Cascade
:  Cascade
 BlackJack, Fall, Falling Letters, 1701, 1704, 1701 Mutation,
 1704 Format, 1704-B
H:
, 1987
 TSR; falling letters; .
i; random re
 Germany
R:  1,701 or 1,704
5:   PRsC -
Encrypting .
, NAV,
:  CleanUp,
, or
was a Trojan horse
was disguised as a
was supposed to turn off the Num-Lock light
 the
&ed.  The Trojan horse instead caused all the
4on the
to fall into a pile at the bottom of the
.  In late 1987, the Trojan horse was
one into
 While the
had a
of 1,701
)and would
wboth true IBM PCs and clones, a variation exists of
is 3
)longer
wtrue IBM PCs.  Both
es are
gidentical in all
respects.
 Both of the
fairly unique qualities:  Both use an
 encryption algorithm to avoid detection and complicate any attempted
 analysis of them.  The
mechanisms are
 sophisticated randomization algorithm incorporating machine checks,
 monitor
s, presence or absence of a clock card, and the
 season of the year.
 The
activate on any machine
a CGA or VGA monitor
 in the months of
, or
?in the
 years 1980 and 1988.
of Cascade are:
 1701 Mutation:
of has
 had two
)modified in order to avoid detection.
 1701-B: Same as 1701, except
it can activate in the Fall of
 any year.
 1701-Yap:
on the
Cascade
 adds 1,701
)to the .
v.  Its
TSR is 2,048
), and hooks
 The encryption mechanism has
!slightly
to avoid
 detection by
utilities.
 1704 Format: Like the Cascade
, but the
Kis formatted
s during the
 months of
, and
?of any year except
, 1989.
 1704-C: Same as Cascade-B except
can activate in
?of any year.
 1704-D: Same as the 1704, except
the IBM selection has
 disabled so
it can
wtrue IBM PCs.
 17Y4:
to the Cascade 1704
, the
difference is
 one
*in the
 Cascade-1621:
on the
Cascade
 adds 1,621
)to the .
v.  Its
TSR is 1,936
), and hooks
Y.BAT
in the scrolling of the
"Insufficient
Kspace", and the .BAT
anot executing.
 Cascade 1701.E:
on the
Cascade
 minor
.  It drops a single character down the
it is
?31 of any year.
 Cascade.1702:
on the
Cascade
 adds 1,702
)to the .
v.  It is
employs a 1,936
 hooking
{21.  The
at the end
, 1994.
 Cascade-1704G:
on the
Cascade
 has
to avoid detection by
by the addition of a NOP instruction in the
 decryption routine.  It adds 1,704
)to the .
at the end of the
a.  It is a
employs a 1,968
*TSR hooking
:  France  May,
 Cascade-1706:
on the
Cascade
 adds 1,706
)to the .
v.  It is
employs a 2,064
 hooking
{1C and 21.  The
 at the end of
 Cascade-B:
to the Cascade
, except
 cascading
Mhas
!replaced
at random
intervals
 Cunning:
on the Cascade
, a major
3to the
it now plays music.
 See:   1661   JoJo
PZPAPN
Casino
:  Casino
 Casino-B, Casino-C
H:
T; slot machine game;
damaged
 Malta
R:  2,332 - 2,346
5:   PRhCK -
, NAV,
 The Casino
by David Chess of IBM.
 Casino was
}in Malta.
is a
uof .
 The
Casino is
X, Casino
at the top of
, as
qby the DOS
Aby 37,568 to 37,632
).  3,152
 in low
be used by the
, and
 00, 23, and 30
area.
Casino is
immediately
in the C:
 root
Casino is
, it
 any of three events
.  If the
issues a DIR
 or a
Nan internal DIR
6, one .
ain the
ly, if the
Ys an
, a .
r.  Lastly, Casino
 by an
for any reason.
Casino
 2,332 to 2,346
).  The
p, however, is mostly
 hidden if the
pof 1 to 16
), but occasionally one may show a
pof up to
).  The
Nnot alter the
>and
in the
 If Casino is
and the DOS
ed for
 If the
+/F option is used,
 Casino
15, and
play a slot machine game
 "DISK DESTROYER . A SOUVENIR OF MALTA
ljust DESTROYED the FAT on your
 However, I
la copy in RAM, and I`m giving you a last chance
 to restore your precious data.
 WARNING: IF YOU RESET NOW, ALL YOUR DATA WILL BE LOST - FOREVER!!
 Your Data depends on a game of JACKPOT
  CASINO DE MALTE JACKPOT"
 If the
looses the game, Casino
trash the
of Casino are:
 Casino-B:
to the
Casino
, the major
trash the
before playing the slot machine
 game
|21 is
 by the
 Casino-C:
to Casino-B, the major
Nnot trash the
before
 playing the slot machine game, and it is possible for the
to win, avoiding
:.  If the
wins the game, the
 "BASTARD ! You're lucky
- but for your own sake now
 SWITCH OFF YOUR
-PUTER AND DON`TURN IT ON TILL TOMORROW!!!"
hang
 May,
PZPAPN
Casper
:  Casper
 Chameleon
H:
:(see
R:  1,200
5:   PNCK -
Encrypting .
, NAV,
1.53S+,
1.25+
:  NAV, or
 The Casper
by Fridrik Skulason of
 Iceland.  The
.  Casper
 is a
generic
uof .
the Casper
X, the
attempt to
wone .
in the
 and
by 1,200
at the end of the .
 The Casper
8the
 cannot be seen in
as Casper uses a complex self-
 encryption mechanism:
 "Hi! I'm Casper The
, And On
1st I'm Gonna
 Fuck Up Your
KREAL BAD! In Fact It Might Just
 Be Impossible To Recover! How's
Grab Ya! <GRIN>"
1st,
btrack of the
Owhere the
 was
f.  Later
to access the
 in "
ring.
 The Casper
on the
.  Unlike
, it is
 self-encrypting.  The self-encryption mechanism employed is
 to the encryption mechanism used in the V2P6
, and requires an
 algorithmic approach in order to identify it as
are not any
 identifying
in the
of Casper are:
 Casper Dropper: Casper Dropper is the
Scopy
 of the Casper
.  Executing
in an
tof a .
in the
the Casper
.  The
S.  The
for Casper
 See:   1260   V2P2   V2P6
PZPAPN
Casteggio
:  Casteggio
H:
 Casteggio, Italy
R:  2,881 - 2,900
5:   PRhAK -
3.96+, NAV 3.0+,
 The Casteggio
fItaly in
 its
~in the public domain in Casteggio, Italy.  Casteggio
 is a
uof .
-and .
the Casteggio
 the Casteggio
at the top of
$the
, as
qby the DOS
@by 3,008
{1C and 21
the Casteggio
, it
pof 2,881 to 2,900
at the end of the
a.  The
>and
in the
 DOS
not be
.  No
in the
 It is
what Casteggio
PZPAPN
Catman
:  Catman
H:
 BSC;
R:  N/A
5:   BRtX -
D:  NAV,
1.25+
:  See
 The Catman
, two
 samples of
were not
 viable
es.  Catman is
fthe
.  It is a
and the
 The Catman
in the form of a "dropper"
 If the dropper
Xon a
O, the
of the
Catman.  The
71.  If
 was part of
a, the
be corrupted.  The remainder of the
be placed in the second
of the
band second
on the
 If the Catman dropper was
Xon the
K, the
copy the
is part
 of the second copy of the
 Catman
Nnot
fthe
or the
.  The
way it can spread, at least
 in its present form, is by executing the dropper
a computer
 Catman
, the
usually
in a
hang.
 Likewise,
&ing
fthe
in a
hang.
 Catman can be removed
fthe
 copying back the
71 to
 side 0, cyl 0,
1.  For
I, the DOS SYS
 can be used to replace the
.  Non-
Ishould
 be dis
rby copying all
`using the DOS COPY
6, and
reformatting the
K.  In any even,
 were damaged due to the
not be able to be
 recovered, and should be replaced
fbackup copies.
PZPAPN
:  Caz
H:
 Spain
R:  1,204
5:   PRhAK -
/, NAV,
 The Caz
}in Spain in
.  Caz is a
uof .
-and .
bCaz
Xon a
, the
 Caz
at the top of
 but
$the
, as
qby the DOS
 2,048
{08, 21, and 2F
mby the
.  At
, the
check the copy of
in the C:
Oroot
E, and if not already
 the
Caz is
, it
 1,204
not be able to be
 seen in
s if the
.  Caz
at the end of
`.  The
can be
,CLEAN."
allocate all
, such as
utilities.
[unexpected stack overflow
 successfully
Yat a later
.  An
symptom of
 Caz
ts is
if the
, the DOS
indicate
Ton all
 It is
what Caz
it is
 probably
related.
of Caz are:
 Caz-B:
, Caz-B is
 equivalent to the Caz
.  It has two
differ
fthe
:  Spain
 See:   Zaragosa
PZPAPN
CB-1530
:  CB-1530
 1530
H:
R:  1,530 - 1,544
5:   PRhAK -
, NAV,
 The CB-1530
.  Its
~, are
.  CB-1530 is a
uof .
-and .
 It is
on the
, and
software may
 detect it as such.
 The
CB-1530 is
X, the
at the top of
$the
, as measured
the DOS
@by 3,696
{21 and 27
mby CB-1530 in
|12's
!moved.
CB-1530 has
, it
very small ones)
pd in
by 1,530
pd in
by 1,530 to 1,544
 In both cases, the
at the end of the
be no
3to the
>and
 in the DOS
E.  One
: "CB".
 It is
what CB-1530
 See:   Alexander
<  Edcl   Father
PZPAPN
CCCP-510
:  CCCP-510
H:
R:  510
5:   PNCK -
, NAV 3.0+,
1.22+,
.2.0+,
 The CCCP-510
.  It is
fthe
.  CCCP-510 is a
the CCCP-510
X, the
 CCCP-510
wone .
in the
 510
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
can be
in the
5in all CCCP-510
 "*** CCCP - 75! ***"
 "DoomsDay..."
 "*.com"
 It is
what CCCP-510
PZPAPN
:  CD
 Thursday The 12th
H:
Kwrite protect
 Germany
R:  2,161 - 2,175
5:   PRhA -
n, NAV,
1.53S+,
 The CD
fGermany.  CD is
uof .
-and .
`, and
,.  On Thursdays
are the 12th day of the
 month, it
 The
CD is
X, CD
at the top of
, but
$the
, as measured by the DOS
@by 2,448
mby the
, CD
-and .
was less
 2,161 to 2,175
at the end of
 the
fwrite protected
in a write protect
Uas the
Nnot intercept
Ucondition.
 On Thursdays
are the twelveth day of the month, it
Mthe
every fourth
 VirCheck V1.2 (C)
  Be aware of those worms out
, violating
  your machine on Friday 13th = it's tomorrow!
 Special
ks to Ross M. Greenberg,
 Patricia M. Hoffmann and John McAfee
 Press any key to continue...
 The
Nnot do
Mthe
 the highlighted box in the center of the
.  If the
strikes any key, the
were
of CD are:
 Thursday The 12th:
to CD,
's major
on open as
 well as
 in Iceland, and was
PZPAPN
Cerburus
:  Cerburus
H:
i; dog's head graphic;
; interfers
 .BAT
R:  1,353
5:   PRaCK -
 NAV 3.0+,
2.58+,
 The Cerburus
.  Its
 place of
.  Cerburus is a
uof .
over
2K in
 The
the Cerburus
X, the Cerburus
, hooking
{21, 28, and 60.
be no
qby the DOS
Cerburus is
, it
in the
a DOS DIR
 issued.
 1,353
at the
"of the
a.  The
>and
in the DOS
not be
the Cerburus
may notice a graphic
 dog's head
on the upper half of the
M.  The
 head
move
fleft to right, wiping out the contents of
 the
Mas it passes.  At the same
, the
Lat the top of the
 "***CERBURUS***"
 The
is not
 the
can be
in the
 all
Zof .BAT
`may be interfered
Cerburus is
may produce odd
s.  It is particularly
 noticeable in batch
Zof the DOS DIR
PZPAPN
:  Chad
H:
1to 00-00-80 00:00;
 England
R:  751
5:   PNCK -
/, NAV 3.0+,
1.53S+,
 The Chad
.  It is
fEngland.  Chad is a
the Chad
search the
Eto locate a previouly
w.  If one is
d, it
rby the
the Chad
pof 751
at the end of the
a.  The
in the DOS
to be blank
 or missing,
it has actually
!set to 00-00-80 00:00.
 The
can be
in the Chad
5in all
 "Software
 "WOT!!  No Anti -
 "CHAD Against Damaging
es ... Save Our Software.
 The Chad
Mthe
 10th generation of the
PZPAPN
Chang
:  Chang
H:
R:  1,701 - 1,773
5:   PRhAK -
3.96+,
30.00+,
n1.04+, NAV 3.0A02+,
1.25+,
6.64+,
1.0A06+
 The Chang
.  Its
.  Chang is a
 of .
-and .
the Chang
 the Chang
at the top
$the
'.  It
 move
|12's
, as
qby the DOS
 by 1,760
mby Chang in
the Chang
, it
X.  If
pof 1,701 to 1,773
at the end of the
a.  The
>and
 the DOS
not be
 The
can be
in the
 all Chang
 "YOU CAN CHANG SOMETHING OF THE PROGRAM
 I HAVE GIVEN UP MY COPYRIGHT, AND I HAVE
 LEFT SOME SPACE FOR YOU.
 THANKS!TOO MANY WRITE PROTECT!!!"
 It is
what Chang may do
of Chang are:
 Chang-B:
gequivalent to the
is slightly modified.
 Chang 007: Behaviourly
to the
Chang
 Chang 007's
is 23,312
), hooking
|21.  It adds 23,310 - 23,325
)to the
W, and
v.  Its
 position in the
aand
are the
 same as for the
.  Most of the 23,310 plus
adds to
`consists of
 hex zero
:  Canada
PZPAPN
H:
; TSR
 China
R:  3,072 - 3,104
5:   PRsAKX -
W, &
, NAV 3.0+,
1.53S+,
2.58+,
 The C
.  It is
fChina.  C
jha is a
uof .
-and .
,.  It
vthe
X, the C
as a low
 TSR of 3,392
), hooking
{08, 13, and 21.
, it
wthe
if it was not
the C
, it
for any reason.
pof 3,072
 3,091 to 3,104
).  In both cases, the
 the end of the
a.  The
>and
in the DOS
not be
.  The
 can be
in the
5in all C
 "Welcome!"
 "Auto-Copy Deluxe R3.0"
 "(C)Copyright
. Mr. YaQi. C
jha China"
 "No one can Beyond me!"
 "Invalid
ULoading Operating
 "Missing Operating
 "New Century of Computer Now!"
 It is
what C
PZPAPN
Changu Mangu
:  Changu Mangu
 JKTK
H:
 BSC;
 India
R:  N/A
5:   BRtX -
2.53+,
:  DOS SYS on
I, M-
K/P on
, DOS FDISK /MBR for DOS 5.0
 The Changu Mangu, or JKTK,
}in India.  Changu Mangu is a
uof the
) and 360K 5.25"
.  It
Nnot
 the
of high density
 The
the Changu Mangu
at the top of
$the
 DOS
', moving
|12's
, as
qby the DOS
@by 10,240
, the
 Changu Mangu
wthe
 it was not
rby the
the Changu Mangu
, it
 the
of non-write protected, 360K 5.25"
are accessed.  The
!moved
 to cylinder 39, side 1,
 Changu Mangu
Nn't
to do
PZPAPN
Chaos
:  Chaos
H:
?, 1989
; TSR; bad
; BSC
 England
R:  N/A
5:   BR -
K, CleanUp, or DOS SYS
breported in
?, 1989 by James Berry of Kent, England,
 the Chaos
is a
uof floppy
 and
the Chaos
, it
s the
out copying it to an
location on the
9the
 "Welcome to the New Dungeon"
 "Chaos"
 "Letz be cool guys"
 The Chaos
flag the
#full of bad
 upon
most of the supposed bad
are still
 readable.  It is
what the
criteria is.
PZPAPN
Chaos Year
:  Chaos Year
 Chaos Year.1837
H:
, 1994
i; DOS
=seconds = "60"
R:  1,837
5:   PRhAK -
V116+,
\2.13+,
n1.05+, NAV 3.0 A06+,
6.64+,
1.25+,
6.64+,
V116+,
1.0A06+
 The Chaos Year, or Chaos Year.1837,
 1994.  Its
 is a
uof .
-and .
exhibits
characteristics.
bChaos Year
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 2,560
mby the
the Chaos Year
, it
 and .
pof 1,837
at the end of the
 be hidden
.  The
in the DOS
to be un
 but the seconds field
!set to "60".  The
in the
 "chao1837"
the Chaos Year
find
the DOS
detect
Ton all
.  It is
what else
 Chaos Year may do.
PZPAPN
Chaser
:  Chaser
H:
R:  980 - 994
5:   PNE -
8/93S+,
3.96+,
, NAV 3.0A06+,
1.22+,
1.0A06+
 The Chaser
.  Its
~are
.  Chaser is a
uof .
the Chaser
X, the
 Chaser
wone .
in the
it has
 hang
.  The
 not be run.
the Chaser
pof 980 to 994
 at the end of the
a.  The
>and
in the DOS
not be
.  No
in the
5in Chaser
PZPAPN
:  CHCC
H:
R:  2,664 - 2,678
5:   PNAK -
 The CHCC
.  CHCC is a
uof .
-and .
the CHCC
X, the CHCC
wone .
-and one .
on the
 2,664 to 2,678
at the end of the
a.  The
>and
in the DOS
not be
.  The
 the
5in all CHCC
WSYSBAT"
 "ChCC"
 The second
very near the end of the
 It is
what CHCC
PZPAPN
CheckSum
:  CheckSum
 CheckSum 1.00, CkSum
H:
 Poland
R:  1,233
5:   PRhCK -
, NAV,
8/93+
 The CheckSum
.  It is
fPoland.  CheckSum is a
uof .
 The
the CheckSum
X, the CheckSum
 at the top of
$the
|12's
!moved.
, as measured by the DOS
@by 1,264
mby the
the CheckSum
, it
the CheckSum
 of 1,233
at the end of the
be no
3to the
>and
 in the DOS
the CheckSum
[frequent
, and later
 the
again.
of CheckSum are:
 CheckSum 1.01:
to the
CheckSum
 is one
*shorter, adding 1,232
)to the .
:  Poland
 CheckSum 1.01B:
to CheckSum 1.01B,
has six
differ.
:  Poland
 CheckSum-1569:
on the CheckSum
it can
 Its
is 1,600
), hooking
-and .
 adding 1,569
)to the
.  The
at the end of the
a.  Most
ing in a
 "Divide overflow"
Uand the
ed to the
 DOS prompt.
PZPAPN
Cheeba
:  Cheeba
H:
R:  1,683 - 1,698
5:   PRsAK -
 The Cheeba
.  Its
.  At the
it was
were two Cheeba
es.  The
is a
uof .
,, and
$.  The second, Cheeba-B, is a
uof .
-and .
,, and
 is listed under "
 The
the Cheeba
X, it
at the top of
$the
, as
qby the DOS
@by 3,392
|12's
 not
!moved.
mby the Cheeba
Cheeba is
, it
wthe target
,, are copied.  It
 not
.  The source
aof the
 copy operation
not be
Cheeba
 1,683 to 1,698
at the end of
 the
a.  The
>and
in the DOS
are no
in the Cheeba
 It is
if Cheeba
.  It uses
 a complex encryption mechanism.
of Cheeba are:
 Cheeba-B: Very
to the
Cheeba
, the
 major difference
Cheeba-B is
are copied.  Like Cheeba,
the target
r, the source
 the copy operation
 Cheeba-1691:
gequivalent to the Cheeba-B listed
's main difference is
it adds
 1,691 - 1,706
)to the .
 March,
 Cheeba-1691B:
to Cheeba-1691,
adds 1,691 - 1,706
)to the .
minor
 March,
 See:   Chemmy
PZPAPN
Chemmy
:  Chemmy
H:
R:  1,691 - 1,706
5:   PRhAK -
 The Chemmy
.  Its
.  Chemmy is a
uof .
-and .
bChemmy
X, the Chemmy
at the top of
 but
$the
, as
qby the DOS
 by 3,392
|12's
!moved.
mby the Chemmy
the Chemmy
, it
are copied.  The source
not be
the target
 the Chemmy
pof 1,691 to
 1706
at the end of the
.  The
>and
in the DOS
not be
 Chemmy is an
, and no
 the
 It is
what Chemmy may do
of Chemmy are:
 Chemmy-B: Chemmy-B is a minor
of the Chemmy
, and
gequivalent.
 See:   Cheeba
PZPAPN
Chemnitz
:  Chemnitz
H:   March,
R:  767 - 781
5:   PRhE -
8/93S+,
3.96+, NAV 3.0+,
.2.0+,
 The Chemnitz
in March,
.  Its
.  Chemnitz is a
, and
Nnot
wvery small .
bChemnitz
X, the Chemnitz
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 848
|12's
not be moved.
, the Chemnitz
very small .
pof 767 to 781
at the end of the
a.  The
>and
in the DOS
.  The
in the
5in all Chemnitz
 "MsDos
-MAND"
 "FMCIKLMOFR|"
the Chemnitz
PZPAPN
Chile Mediera
:  Chile Mediera
H:
Bs AV
 Chile
R:  1,527
5:   PRhAK -
, NAV 3.0+,
/2.1+,
1.22+,
 The Chile Mediera
, and
fChile.  Chile Mediera is a
uof .
 and .
,.  It interfers
 functioning of several
packages by deleting or erasing
 the
a(s).
bChile Mediera
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 2,000
|12's
!moved.
, the
 the copy of
in the C:
Oroot
 it was not
the Chile Mediera
, it
-and .
larger
for any reason.
-and .
pof 1,527
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the Chile Mediera
 "CPW fue hecho en Chile en
 "VNA CHILE MIERDA!"
 "C:\
 "GUARD guard
/SCAN CHKVIRUS CLEAN TOOLKIT
 VSAFE CHKLIST.CPS"
 If the
Yone of the
 listed in the last line of
, the Chile Mediera
Bor erase the
K.  If the
happened to be
 write-protected
J, a
hang
PZPAPN
China
:  China
H:   March,
i; TSR
 China
R:  1,824 - 1,838
5:   PRsA -
, NAV 3.0A06+,
1.53S+,
.2.0+,
1.0A06+
 The China
in March,
, and is probably
 China.  The China
is a
uof .
, and
Nnot
,.  It is
on the
bChina
X, the China
as a low
TSR of
 2,128
{21 and 24
mby the China
, the China
-and .
, but not
pof 1,831
 the
at the
"of the
pof 1,824 to 1,838
at the end of the
a.  The
>and
in the DOS
not be
 Unlike many
of the
, China
Nnot re
.  No
in the
5in China
 It is
what China may do
 See:
PZPAPN
CHR-869
:  CHR-869
H:   March,
2; "#" character
Zfailure
R:  869 - 1,348
5:   PRhA -
1.22+
 The CHR-869
in March,
.  Its
.  CHR-869 is a
, but not
bCHR-869
X, the CHR-869
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 3,120
|12's
not be moved.
, the CHR-869
-and .
pof 869
pof up to
 1,348
).  In both cases, the
at the end of
 the
a.  The
>and
in the DOS
to the
 and
.  No
 the CHR-869
the CHR-869
notice
, a "#" character
Lon the
monitor
ever a
PZPAPN
Chris
:  Chris
H:
 beeping and
fail to function
 Italy
R:  463
5:   PRaCK -
\2.10g+,
V111+,
2.10+,
6.60+,
2.58+,
n1.05+,
V111+,
2.58+,
6.64+,
1.25+
 The Chris
.  It
s to be
fItaly.  Chris is a
uof .
bChris
X, the Chris
 hooking
|21.
qby the DOS
not be
, the Chris
 of 463
at the end of the
 The
>and
in the DOS
to the
>and
.  One
in the
 "<CHRIS of S.i.t.>"
 The
in the
 "Mary,
. ti AMO!"
second
Lby the
 as a
on the
monitor, accompanied by beeping.
 the
L, a
hang may
may not function
as a
PZPAPN
Christmas Tree
:  Christmas Tree
 Tannenbaum, XA1, 1539
 Endangered
H:   March,
destruction
 Germany
R:  1,539
5:   PNCX -
, NAV,
:  NAV, or
 The Christmas Tree, or XA1,
}in March
 by Christoff Fischer of West Germany.
is an encrypting
1st of any year, the Christmas Tree
activate,
 destroying the
) of
Ks the
X.  During the
 period
?24th until
1st of any year,
X, the
Ma full
 picture of a christmas tree.
PZPAPN
Chromo 1.0
:  Chromo 1.0
H:
R:  406
5:   PNC -
\2.10g+,
/2.1+,
2.11+,
n1.05+,
6.64+,
.2.0+,
1.25+,
6.64+
 The Chromo 1.0
.  Its
.  Chromo 1.0 is a
 of .
, but not
,.  It
Nnot
wvery
 small .
the Chromo 1.0
wthree .
in the
;or a
 higher level
pof 406
at the end of the
a.  The
>and
in the DOS
not be
.  The
 the
5in all Chromo 1.0
-.. [Chromo
Glitch] v1.0"
 "Copyright (c)
Lapse."
 It is
what Chromo 1.0
of Chromo 1.0 are:
 Chromo 2.0:
, Chromo 2.0 is a 407
of the Chromo 1.0
vthree .
`in the
;or a
 higher level
pof 407
 the end of the
a.  The
>and
 the DOS
not be
 The
can be
in the
5in all Chromo 2.0
 "*M.
W.. [Chromo
Glitch] v2.0"
 "Copyright (c)
Lapse."
 Chromo 3.0:
, Chromo 3.0 is a
of the Chromo 1.0 and Chromo 2.0
es.  It
at the top of
$the
, as
qby the DOS
@by 672
it is
, Chromo
 3.0
 385
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in all Chromo 3.0
 "[Chromo
Glitch] v3.0"
 "Copyright (c)
Lapse."
 See:
Lapse
PZPAPN
Cinderella
:  Cinderella
H:
i; TSR
 Finland
R:  390
5:   PRsCK -
, NAV,
 The Cinderella
}in Finland in
 Cinderella is a
uof .
 The
Cinderella is
X, the
as a low
 TSR of 560
mby the
Cinderella is
, it
for any
 reason.
by 390
 The
at the end of the
a.  The
can be
 "cInDeReL.la"
 Cinderella
Nn't do
of Cinderella are:
 Cinderella-B:
gequivalent to the
has two
differ.
: Finland
 Cinderella.C:
to the
 its
5to the
"of all
.  It
8the
 "CindyRul.ez 2"
 May, 1994.
PZPAPN
Civil War
:  Civil War
H:
 The
R:  244
5:   PNC -
3.96+, NAV 3.0+,
8/93+,
.2.0+,
 The Civil War
, and
fThe
.  Civil War is a
uof .
, but not
,.  Later
oCivil War II v1.1 and Proto-T, listed
 under
, are
us of .
, and
 may
,.  The Civil War III v1.0
.  Later
s of the Civil War
S, and listed under the  TPE  entry as
software
most likely identify the encryption engine rather
present.
the Civil War
wone .
in the
pof 244
at the end of the
a.  The
>and
in the DOS
not be
 The
in the
5in all
 Civil War
 "Civil War, (c)
Dark Helmet"
 "*.com"
of Civil War are:
 Civil War II v1.0:
, Civil War II v1.0
 is a later
of the Civil War
 The
at the top of
$the
, as
qby the DOS
@by 1,024
mby the
Civil War II
 v1.0 is
, it
, but
 not
pof 580
at the end of the
a.  The
in the DOS
not be
 The
in the
 all
 "Civil War II v1.0,(c) 06/03/
: The
 Civil War II v1.1:
, Civil War II v1.1
 is a later
of the Civil War II v1.0
 The
at the top of
$the
, as
qby the DOS
@by 1,024
mby the
Civil War II
 v1.1 is
, it
 any reason.
pof 599
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all
 "Civil War II v1.1,"
 "(c) 06/03/
Trident/Dark Helmet, The
: The
 Civil War III v1.0:
in March,
, Civil War III v1.0
 is a later
of the Civil War
 The
at the top of
$the
, as
qby the DOS
@by 1,200
mby the
Civil War III
 v1.0 is
, it
-and .
for any reason.
pof 901
 the end of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all
 "Civil War III v1.0,"
 "(c) Dec
, [ DH / TridenT ]"
: The
 March,
 Civil War-282:
, 1994, Civil War-282 (or
 Navigator) is a 282
of the Civil War
 Civil War-282
vone .
ain the
by 282
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
 all Civil War-282
 "*.com"
 "The Navigator, (c)
Dark Helmet"
, 1994.
 Civil War-Lockjaw:
, Civil War-Lockjaw is
on the Proto-T
$.  Civil War-
 Lockjaw
at the top of
$the
, as
qby the DOS
@by 4,096
 by the
pof 1,053
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all
utilities,
utilities,
in the
Bd and the
to the
 Lokjaw
 Proto-T:
, Proto-T is
on the
 Civil War
, and
s to be an
 earlier
of the Civil War II v1.1
.  It
Nnot match the description of the rumored
 Proto-T
was circulated on BBSes starting in
.  Proto-T
 the top of
$the
 and
, as
qby the DOS
@by 1,280
mby Proto-T in
Proto-T is
, it
pof 695
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the
5in all Proto-T
is sick."
 "[PROTO-T by Dumbco, INC.]
 Proto-T
s access the
Kinstead
 of becoming
access ends, the
be inaccessible until the
is re
 Ritzen:
, 1994, Ritzen is
on the Civil
 War
.  It
at the top of
$the
 DOS
, as
qby the
 DOS
@by 1,536
mby the
, it
-and .
pof 1,087
at the end of the
 The
>and
in the DOS
to the
>and
.  The
in the
5in all
 "Dedicated to Ritzen, our Minister of Education and Science.
 We are getting sick of your budget cuts so we hope
 get sick of
.. (c) '93 by S.A.R. / TridenT"
s of
rby the Ritzen
may find
 the cursor
on the
M, and
fail to
Ming the
too big to fit in
 The Ritzen
is buggy, re
X.  As a
, the
eventually not be able to run any
since
 very little
, 1994.
 See:   Number 6   TPE
PZPAPN
Clone 2.0
:  Clone 2.0
H:
 Hidden .
`created;
executing .
; TSR
 Australia
R:  833
5:   SRsE - Spawning
30.00+,
\2.10g+,
V112+,
V113+,
1.25+,
6.64+
 The Clone 2.0
, and is
 Australia.  It is a
spawning or companion
bClone 2.0
as a low
TSR of 2,048
mby the
 One the
, it
by creating a hidden .
the same base
.  The hidden companion
of 833
)and its
>and
be the
>and
it was created.  The
can be
din all of the companion
 "Your PC is Cloned!!"
 "Clone
ver 2.0..(c) Cataclysm
Sydney,
 Australia
.To Create and Mutate..."
-LOVEV20.
jfrequently
PZPAPN
Clonewar
00Q    T
PTQ
:  Clonewar
H:
 Hidden .
`created;
WC failure
executing .
R:  247
5:   SNE - Spawning
8/93S+,
3.96+, NAV 3.0+,
8/93+,
1.0A06+
 The Clonewar
.  It
s to be
fthe
.  Clonewar is a
spawning or
 companion
the Clonewar
X, the
 Clonewar
wone .
in the
Eby creating a hidden, read-
the same
 base
.  The hidden, companion
 of 247
)and its
>and
be the
 and
it was created.  The
din all of the companion
 The
9the
of the companion
a, and the
Wextention.
Clonewar may receive the
WC failure"
, and are
ed to
 the DOS prompt.
 Clonewar
Nn't do
, but it
Ninterfer
operation.
of Clonewar are:
 Acme:
, Acme is a 923
 the Clonewar
.  The companion
 creates
of 923
the read-
 hidden attributes set.  The same
din the
s in
.  Acme
not always
X, but
s play a repeated a series of tones on the
 speaker while leaving the
Ospinning.
 Clonewar 2:
, Clonewar 2 is a 228
of the Clonewar
.  It
ain the
Xby creating a hidden 228
*companion .
 the same base
companion
 read-
and hidden attributes set, and the
.  The
in the
 Clonewar 2
Nnot
wpast the third .
ain any
 TrekWar:
in Septembe,
, TrekWar is
on the
 Clonewar 2
.  Its hidden companion
`are 546
, and
9the
 "Beyond"
 "The rim of the star-light"
 "My love"
 "Is wand'ring in star-flight"
 "I know"
 "He'll find in star-clustered r
 "Love"
 "Strange love a star woman t
Qes."
 "I know"
 "His journey ends never"
 "His star trek"
go on forever."
 "But tell him"
 "While he wanders his starry sea"
 "Remember, remember me."
 "[TrekWar]  *.
 The
the last
, are the words to
 the theme song
fthe
Star Trek television series.
PZPAPN
Close
:  Close
H:
&failure on C:
R:  662 - 672
5:   PRhE -
, NAV,
1.53S+,
 The Close
.  Its
.  Close is a
uof .
eventually corrupt one of the
`required
&the
fthe C:
 The
the Close
 Close
at the top of
$the
, as
qby the DOS
@by 784
the Close
, it
pof 662 to 672
at the end of the
a.  The
in the DOS
not be
.  Two
in the Close
 "C:\IO.SYS C:\IBMBIO.
 "Close .."
 The Close
was intermittently activate, at
Mthe
"Close .." on the
 corrupt either C:\IO.SYS or C:\IBMBIO.
-.  The
 be hung.
to re
&the
fthe C:
 fail as one of the hidden
`is corrupted.
sor replacing all
the Close
, the
should replace the hidden
`on the C:
Ousing the DOS SYS
PZPAPN
CLS-853
:  CLS-853
H:
; unexpected
clears
R:  853
5:   PRhAK -
3.96+, NAV 3.0+,
 The CLS-853
.  CLS-853 is a
uof .
-and .
bCLS-853
X, the CLS-853
at the top of
$the
'.  It
{08, 13, and 21.
|12's
not be
 moved.
, as
 the DOS
@by 1,120
the CLS-853
, it
 and .
pof 853
at the end of the
a.  The
>and
 the DOS
not be
.  No
 are
in the
the CLS-853
[the
#cleared unexpectedly
 The
, "CLS", refers to
symptom of the
PZPAPN
Cmdr Bomber
:  Cmdr Bomber
H:   May,
i; TSR
R:  4,096
5:   PRhC -
 The Cmdr Bomber
in May,
.  It
(, and is believed
!written by the same person
 whom wrote the
.  Cmdr Bomber is unusual in the
 method in
complicates the detection
 process for
using certain
s of
 technology.
the Cmdr Bomber
X, the Cmdr Bomber
 as a low
TSR of 2,752
mby the Cmdr Bomber
the Cmdr Bomber
, it
by 4,096
).  The
 the
la number of garbled
)at the
in the
Zof the
jumping to a location
 in the middle of the
awhere the
5.  In effect, the
in the middle of the
a.  The
>and
in the DOS
not be
 The
can be
in the
 Cmdr Bomber
-MANDER BOMBER WAS HERE"
 "[DAME]  [DAME]"
is not related the the Bomber
 Malaysia.
PZPAPN
Cobra
:  Cobra
H:
R:  400
5:   PNCK -
\2.10g+,
V111+,
/2.1+,
2.58+,
6.60+,
V111+,
.2.0+,
2.58+,
1.25+,
6.64+
 The Cobra
.  Its
.  Cobra is a
uof .
the Cobra
wone .
in the
pof 400
at the
"of the
a.  The
in the DOS
not be
.  The
can be
in the
5in all
 "Cobra"
 "*.exe"
 "*.com"
 It is
if Cobra
PZPAPN
Coffeeshop-1568
:  Coffeeshop-1568
 Coffeeshop 1
H:
 Sweden
R:  1,568
5:   PRhA -
n, NAV 3.0+,
/2.1+,
1.53S+,
1.22+,
.2.0+
 The Coffeeshop-1568
.  It is
 probably
fSweden.  Coffeeshop-1568 is a
 of .
-and .
, but not
,.  It is not
<Mutating Engine,
are two
as Coffeeshop and Coffeeshop 2
do use the mutating
 engine.  See the entry for  DAME  for
Coffeeshop
 The
the Coffeeshop-1568
X, Coffeeshop-1568
 the top of
$the
', not moving
|12's
 measured by the DOS
@by 1,824
mby Coffeeshop-1568 is
, Coffeeshop-1568
-and .
by 1,568
at the end of
 the
a.  The
>and
in the DOS
not be
.  One
in the
5in all
 "CoffeeShop"
 It is
if Coffeeshop-1568
 See:   DAME
PZPAPN
Collor de Mello
:  Collor de Mello
H:
=seconds = 62
R:  878
5:   PNCK -
6.64+,
6.64+
 The Collor de Mello
.  Its
.  Collor de Mello is a
uof .
the Collor de Mello
access the
Oand determine
 if the copy of
in the C:
Oroot
r.  If
copy of
,is not
r, the
wit at
has checked, and possibly
,, it
go on to
wone
on the C:
the Collor de Mello
pof 878
at the
 end of the
a.  The
>and
in the DOS
to be
the seconds
 field
!set to "62".  No
 the
5in Collor de Mello
 It is
what Collor de Mello
PZPAPN
H:   N/A
R:  N/A
5:   G - Generic
 The
is not actually a specific
, but a general
 category or group of
can be genericly detected by
software using
ner technology.  It was
 implemented by McAfee Associates in
 The
es detected by the
detection mechanism in
are generally
us.
es may be malicious.
 be detected as the
include:
 Friday The 13th
 Hastings
 Possum
 Revenge Attacker
 Thimble
 Violetta
 New
es may
be detected by
mechanism
are not
 documented in
.  If you detect a
, and it
 match one of the
es, please submit a sample to the
 author of
for analysis and inclusion in
PZPAPN
7wealth
7wealth
H:
-& .ESE
=seconds set to "58"; TSR
R:  800 - 815
5:   PRsA -
\2.10g+,
V112+,
6.60+,
2.58+,
2.11+,
2.58+,
V113+,
6.64+,
1.25+
 The
7wealth
.  Its
7wealth is a
uof .
-and .
, but not
7wealth
as a low
TSR of
 2,048
mby the
7wealth
, it
 and .
pof 800 to 815
at the end of the
a.  The
>and
in the
 DOS
to be
, but it
lthe seconds field set to "58".  The
in the
7wealth
7wealth of Independent States"
 It is
what
7wealth
PZPAPN
Commy
:  Commy
H:
=seconds
R:  998
5:   PNCK -
 NAV 3.0+,
 The Commy
.  It is
fthe
.  Commy is a
,.  It
 9PM (21:00).
the Commy
X, the
check the
.  If the
is before 9PM, the
pass control to the host
and not
.  If
 The
is 9PM or later, the
wone .
in the
Ebefore passing control to
 the host
the Commy
pof 998
at the end of the
a.  The
>and
in the DOS
to be
the seconds field
!set to 44, 46, 60, or 62.  The
in the
5in all Commy
 "The DIRTY
-MY said .."
 "PATH="
 It is
what Commy
PZPAPN
:  Como
 Como-Lake
H:
 Italy
R:  2,022 - 2,035
5:   PNE -
n, NAV,
3.96+,
8/93+,
 The Como, or Como-Lake,
, and
fItaly.  Como is a
uof .
the Como
 may
in the
about a 1 in 7 probability.
pof 2,022 to 2,035
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the
5in Como
is the"
-O-LAKE"
 "(rel. 1.1)"
 "I'm a non-destructive
 developed  to  study  the  worldwide"
 "diffusion rate. I  was  released in
by a software"
 "group
near Como lake (north Italy)."
 "Don't worry about your data on
K. My  activity is limited
 "to auto-transferring into
`. Perhaps you've got"
 "many
r. It's  your  task  to  find and
Bthem."
 "Best wishes."
 "Pres a key to
Ythe
PZPAPN
Copyright
00Q    U
PTQ
:  Copyright
 V1193
H:
R:  1,193 - 1,208
5:   PRhCK -
, NAV,
 The Copyright
.  It is
 the
.  Copyright is a
uof .
 The
the Copyright
X, the
at the
 top of
$the
, as
qby the DOS
@by 1,200
mby the Copyright
|12's
!moved.
the Copyright
, it
 1,193 to 1,208
at the end of
 the
`.  Copyright
>and
in the DOS
to the
>and
 The
can be
in the
 Copyright
 "(C) 1987 American Megatrends Inc.286-BIOS"
 "(C) 1989 American Megatrends Inc"
 "(c) COPYRIGHT 1984,1987 Award Software Inc."
 "ALL RIGHTS RESERVED"
 The
d due to the
fake copyright
.  American Megatrends and Award
 Software had nothing to do
' creation.
 It is
if Copyright
of Copyright are:
 Copyright-1205:
, Copyright-1205 is
 a 1,205
of the Copyright
 Its
is 1,216
), moving
|12's
.  Like the
, it hooks
it is
, Copyright-1205
X, adding 1,205 to 1,220
 to the
.  The
at the end of
 the
a.  The
>and
in the DOS
to the
>and
.  The
can be
in the Copyright-1205
5in all
 "(C)
Software Developed by Maxi"
 "Lena All Rights Reserved"
 "(c) COPYRIGHT 1984,1987 Award Software Inc."
 "ALL RIGHTS RESERVED"
 Ungame:
, Ungame is a 766
 of the Copyright
.  Its
 is 768
), and it hooks
{08 and 21.
, it
-and .
 of 766
at the end of the
lthe structure of .
t.  The
>and
in the
 DOS
to the
>and
.  The
can be
in the
5in all
 Ungame
 "Come On, no. 51, You
is up."
 "Ungame(C)Dr"
PZPAPN
Cossiga
:  Cossiga
H:
i; video mode
3to 40 columns;
don't
 Italy
R:  875 - 899
5:   PNE -
, NAV,
 The Cossiga
.  It is
fItaly.  Cossiga is a
the Cossiga
X, the
 Cossiga
search the
Efor the
.  If an
wit.
it has completed
, the
switch the
video mode to a
 40 column
M, and the
 block letters:
 "COSSIGA ?!  NO GRAZIE!
 By Amissi dee Panoce (c)
PADOVA"
 The host
 function, instead the
ed to the DOS prompt.
the Cossiga
pof 875 - 899
).  The
at the
 end of the
.  The
>and
in the
 DOS
not be
.  The
can be
in the
5in Cossiga
 "*.*"
 "*.exe"
 "AXI TY"
of Cossiga are:
 Cossiga-B:
on the Cossiga
adds 895 to 899
)to the .
v.  The
at the end of the
a.  The
 the Cossiga-B
 "COSSIGA ?!  NO GRAZIE!"
 "By Amissi dee Panoce (c)
PADOVA"
 "AEGE/B V1.2"
 "*.* *.exe"
 The
bthree
Las a
in 40 column mode,
a blank line between
ever an
:  Spain  May,
 See:   Friends
PZPAPN
Costeau
:  Costeau
H:
R:  512
5:   PRE -
3.96+, NAV 3.0+,
1.22+,
 The Costeau
.  Its
.  Costeau is a
 of .
bCosteau
X, the Costeau
in the DOS Data area in
, hooking
|21.
, as
qby the DOS
not be
the Costeau
, it
pof 512
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
 can be
in the
5in all Costeau
 "COSTEAU"
 "End.MZ"
 It is
what Costeau may do
PZPAPN
CPSU-2535
:  CPSU-2535
 Protecto-2535
H:
R:  2,535
5:   PRtA -
, NAV 3.0+,
 The CPSU-2535
, and is
is a
uof .
-and .
, but not
bCPSU-2535
X, the CPSU-2535
at the top of
$the
', moving
|12's
, as
qby the DOS
@by 3,088
mby CPSU-2535 in
the CPSU-2535
, it
pof 2,535
 the end of the
a.  The
>and
in the DOS
not be
.  No
in the
 It is
what CPSU-2535
 See:   Protecto
PZPAPN
:  CPW
H:
.Exe
interference
 Chile
R:  1,459
5:   PRhAK -
3.96+, NAV 3.0+,
/2.1+,
.2.0+,
 The CPW
.  It is
fChile.  CPW is a
uof .
-and .
bCPW
X, the CPW
at the top of
 but
$the
', hooking
{16 and 21.
, as
qby the DOS
@by 2,000
).  Interupt
 12's
not be moved.
, the copy of
in the C:
Oroot
 by the
if it was not
the CPW
, it
pof 1,459
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the
5in all CPW
 "Este
a fue hecho en Chile en
por CPW."
 "C:\
 "Feliz cumplea
os CPW"
 "You are here CPW!"
 "ULS"
the CPW
for awhile, it
 activate.  Upon
, it
Mthe
 at the DOS prompt, one character at a
.  The
4of the
replace the
4the
is typing on the
 "You are here CPW!"
 The character substitution continues until the
hits an ALT+key
 combination on the
, such as ALT+C.  An
effect
 of the
in the
.Exe
fthe
jmay
PZPAPN
Cracker Jack
:  Cracker Jack
 NeCrop
H:   May,
 Italy
R:  Varies
 The Cracker Jack, or NeCrop,
in May,
V.  Cracker Jack is an ICE
it has
release the 1963-B
into the
.  See
 the
entry for 1963 for a description of the dropped
 See:   1963
PZPAPN
Crash
:  Crash
 1075, Russ-1075, DBF blank
 Rumored
H:
R:  1,075
\, NAV,
 The Crash or 1075
has had many samples
over the last
 few months.  The
samples were
fthe
. All
samples of
" do not
on an
 XT or 386
personal computer.  Instead, the
crashes
 the sample
X.  It may
under
configurations.
PZPAPN
Crazy Eddie
:  Crazy Eddie
 England
H:
 England
R:  2,600 - 2,715
5:   PRtAKX -
W, &
, NAV,
/2.0+,
.2.0+,
 The Crazy Eddie
fEngland.
 Crazy Eddie is a
multi-partite
 the
-, and .
 The
the Crazy Eddie
wthe
 it was not
r.  The
locates a copy of
 its
5on the cylinder 0, side 0,
2-4, and
 alters the
.  The
Nn't
, and
r, the Crazy Eddie
&s the
 the
K.  At
, Crazy Eddie
at the top of
', moving
|12's
 and
, as
qby the DOS
@by 17,408
{00, 10, 14, and
mby the
Crazy Eddie is
, it
-and .
wone
in the
 a DOS DIR
6is performed.
Crazy Eddie
 of 2,600 to 2,715
at the end of
 the
.  The
>and
in the DOS
.  One
in the
5in all
 "Crazy Eddie"
 Crazy Eddie is a destructive
on Monday The
 28ths as well as on
28th.  On
>s, it
corrupt
 the
PZPAPN
Crazy Imp
:  Crazy Imp
H:
may dis
R:  1,445
5:   PRtCK -
, NAV,
 The Crazy Imp
.  Its
~are
.  Crazy Imp is a
 If the Crazy Imp
 not be able to detect it on
are read into
 The
the Crazy Imp
X, the Crazy Imp
 the top of
$the
 12's
!moved.
, as
qby the DOS
 by 4,096
{1C and 21
mby the
.  The
ed to by the
-SPEC en
 variable, usually
 if it was not
rby the Crazy Imp
the Crazy Imp
, it
lany
pas the
hides the
is not
pof 1,445
at the
 end of the
a.  The
can be
 in the
is not
 "Crazy imp"
 "v2.0"
qearlier, Crazy Imp is a
X, hides the
p, and dis
are read into
Zof an
is not aware of
in the
tof all .
on the
out any
#detected on the
 If you think you
, power off the
and re
fa write-protected,
J, and
check
 the
for the
 It is
if Crazy Imp
of Crazy Imp are:
 Crazy Imp-1402:
as Crazy Imp v1.5, Crazy Imp-1402
 is an earlier
of the Crazy Imp
.  Its
is 6,144
), hooking
{1C, 21, and 22.
 are
pof 1,402
at the
"of the
a.  The
p, however, is hidden by the
 it is
.  The
>and
in the
 DOS
to be un
 may "dis
".  The seconds field in the
!set to "62".  The
 are
in the Crazy Imp-1402
 "Crazy imp"
 "v1.5"
 Crazy Imp-B:
to the
Crazy Imp
has two
differ.
PZPAPN
Creeper
:  Creeper
 Creeping Tormentor
H:
R:  475
5:   PRhCK -
, NAV,
 The Creeper, or Creeping Tormentor,
.  Its
.  Creeper is a
 of .
 The
Creeper is
X, the
 Creeper
at the top of
$the
|12's
!moved.
, as
qby the DOS
 by 1,024
{1C and 21
mby the
the Creeper
, it
X.  If
X, it
r.  Creeper
pof 475
at the
"of the
.  The
>and
 the DOS
 The Creeper
looks for the Tormentor
, checking
 for the
"TORMENTOR".
 It is
if Creeper
of Creeper are:
 Creeper-B:
gequivalent to the
Creeper
has one
 May,
PZPAPN
Crew-2480
:  Crew-2480
 2480, V2480
H:
&s; graphic
 Finland
R:  2,480
5:   PNCK -
, NAV,
 The Crew-2480
.  It was
}in Finland.
is a non-
uof .
over 10K in
.  It
the Crew-2480
X, the
wone .
aover 10K in
if the
 month is
through May.
rby the
, the
by 2,480
at the end of the
.  The
>and
in the
to the
>and
%the
a Crew-2480
tmay
 Later
Zof the same
may be successful.
 During the months of
through
?, Crew-2480
Xduring
period,
 the
Ma formatted
making reference to the
Van Cracking Crew".
of Crew are:
 Crew-2480 B:
on the
Crew-2480
Nnot
Mthe graphic,
it is present
in the
.  Instead, a
hang
 upon
 Crew-2480 C:
on the
Crew-2480
minor
PZPAPN
:  CRF
H:
R:  270
5:   PNCK -
2.58+,
6.64+,
.2.0+,
6.64+,
1.25+
 The CRF
.  Its
Hare
.  CRF is a
uof .
the CRF
X, the
wall
`in the
Oand
E.  If
by 270
at the end of the
.  The
>and
in the DOS
to the
>and
.  Two
in the
`:  "OZR3" and "*.
 It is
if CRF
PZPAPN
Criminal
:  Criminal
H:
i; TSR;
R:  2,615
5:   PRsCK -
, NAV,
 The Criminal
.  Its
.  Criminal is a
uof .
 The
the Criminal
X, the Criminal
 a low
TSR of 480
{21, D0, and EA.  An
TSR of 3,712
zed,
many
, the Criminal
wthe
bthree .
`in the
sample of Criminal
by the author of
, it
Nnot
.  Further, it is
wious
fthe
 sample, not
d samples.
the Criminal
 by 2,615
).  The
at the end of the
.  The
>and
in the DOS
Criminal may notice
the DOS
indicate
,has a
s if the
 It is
if Criminal
of Criminal are:
 Criminal-B:
to the
 one .
Nnot
wmore
 three .
in a
E.  Its
 is 470
).  Nineteen
)differ
fthe
PZPAPN
Cruncher
:  Cruncher
 Cruncher 1.0
H:
 The
R:  N/A
5:   !RhC - Compressing
 The Cruncher, or Cruncher 1.0
 and is
fThe
.  Cruncher is a
compresses the
v.  As a
, most
, depending on the
acontent and
before the compression was applied by the
bCruncher
X, the Cruncher
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 2,352
|12's
!moved.
the Cruncher
, it
,and very small .
usually
were
smaller
 3K may show a slight
.  The
>and
 in the DOS
not be
.  The
in the
5in the Cruncher
`, and are not
since the
 compressed along
the host
 "[ MK / Trident ]"
 "Cruncher V1.0
 Cruncher
Nn't
to do
%compress .
its presence may
not functioning
of Cruncher are:
 Cruncher 2.0:
on the Cruncher
 Cruncher 2.0 is a later
of the
wand compress .
as well as
.  Its
is 4,256
 hooking
|21.  It
8the
are not
 "*** CRUNCHER V2.0 ***   Automatic
acompression
 utility"
 "Written by Masud Khafir of the TridenT group  (c)
 31/12/92"
 "Greetings to Fred Cohen, Light Avenger, and
 Teddy Matsumoto"
:  The
 Cruncher 2.1:
on the Cruncher 2.0
 Cruncher 2.1 asks the
's permission to
and start compressing
`.  Its
 Its
is 5,056
), hooking
8the
 not
 "*** CRUNCHER V2.1 ***   Automatic
acompression
 utility"
 "Written by Masud Khafir of the TridenT group  (c)
 23/8/93"
 "Greetings to Fred Cohen, Light Avenger, and
 Teddy Matsumoto"
:  The
PZPAPN
Crusher
:  Crusher
H:
; cross-linking of
 The
R:  2,048
5:   PRhEX -
6.64+,
6.64+
 The Crusher
.  It is
.  Crusher is a
uof the
) and .
.  It
 employs
techniques to avoid detection.
 The
the Crusher
 the Crusher
wthe
.  It writes an un
Scopy of the
5to Side 0,
 Cylinder 0,
2 thru 5, and
alters the
Xthe next
fthe
K.  It
Nnot
 The next
fthe
K, the
 Crusher
at the top of
 but
$the
, as
qby the DOS
 by 2,064
mby Crusher in
the Crusher
, it
pof 2,048
 be hidden
is active in
.  The
in the DOS
not be
.  The
in the
 "Crusher"
 "You are damned"
 "Bit Addict / Trident"
 The Crusher
Mthe
 it is
 cross-linking of
PZPAPN
:  CSL
 MicroElephant V6
i; "Bad
exist
 Eastern
R:  457
5:   PRtCK -
/, NAV,
 The CSL, or MicroElephant,
is a
uof .
bCSL
X, the
at the top of
 the
|12's
!moved,
 however
to be no
qby the DOS
CSL has
, it
X.  If
X, it
r.  CSL
pof 457
at the end of the
a.  The
>and
in a DOS
not be
.  The
can be
in the
 "Microelephant V6 by CSL"
CSL may
[the
 "Bad
", and a
to the DOS prompt,
 the
over
 64K in
.  The .
themselves
lnot
 but it is the
ing the
 CSL
Nn't do
and interfer
of CSL are:
 CSL Beta: CSL Beta, or MicroElephant Beta, is
to the CSL
, CSL Beta adds
 381
)to the .
 not restore the host
=in the DOS
, so a
be noted. It
8the
 "26.07.91.Pre-released Microelephant by CSL".
 CSL V4: CSL V4, or MicroElephant V4, is
to the CSL
, CSL V4 adds 517 to the .
v.  The
>and
in the DOS
.  The
ctwo
in the
 "Microelephant V4" and "by CSL".
 CSL V5: CSL V5, or MicroElephant V5, is
to the CSL
, CSL V5
adds 457
)to the .
v.  It
8the
in its
 "Microelephant V5 by CSL".
PZPAPN
Curse
:  Curse
 Smiley Worm
H:
corrupted
 Northern California,
R:  N/A
5:   BRt -
, NAV,
2.10+
:  CleanUp, or DOS SYS on
 The Curse
reported in
samples
did not
ing to be incomplete.
 The
bworking sample
of the Curse
 a public domain
tat a college in Northern California in
.  Curse
&is a
 360K 5.25 inch
, as well as
.  It is a
aling
it is
 The
 the Curse
, the Curse
wthe
.  The
lmarked
 four
bad in the
, and
transferred
 the
and three
 bad
.  The
rby the
.  At
the Curse
, allocating 4,096
fthe top of
$the
|12's
 moved.
, the Curse
w360K 5.25
 inch
are accessed for any reason.  As
K, the
marks four
bad, and places the
and three
vthe
Curse
&may notice
 upon
lthe hours set to zero, instead of the actual
 value stored in CMOS
for the
clock.  For example,
 if the
clock on
&is 21:30.00,
&ing
 Curse
K, the
read 0:30.00.
 Curse
&hides the
ton 360K 5.25"
Fing
to read
 the
to the
.  As a
not be able to detect the
Curse
.  It
Nnot,
 however, hide the
tof the
PZPAPN
:  CV4
1.0
H:
R:  321
5:   PNCK -
3.96+, NAV 3.0+,
n1.05+,
1.22+,
 The CV4
.  Its
.  CV4 is a
 of .
the CV4
X, the CV4
wone
in the
E.  If
 it may
the CV4
pof 321
at the end of the
a.  The
>and
in the DOS
not be
.  The
can be
din the
5in all CV4
-VIRUS 1.0"
 The
Lon the
 monitor
 CV4
Nn't do
Mits
PZPAPN
Cyber
:  Cyber
 Intrep-1092
H:
R:  1,092 - 1,106
5:   PNAK -
8/93S+,
3.96+, NAV 3.0+,
8/93+,
1.22+,
.2.0+
 The Cyber
.  It
s to be
fNorth America.  Cyber is a
 of .
-and .
the Cyber
X, the
 Cyber
search the
Eto locate an
.  If one is
d, the
vit, and
Yruns.  If an
awas not
d, the
search the
 for an
w, and
the Cyber
pof 1,092
).  .
pof 1,092 to 1,106
).  In both cases,
 the
at the end of the
a.  The
>and
in the DOS
not be
 The
can be
din the Cyber
 all
 "*.com *.exe"
 "A trip into the realm of intelligent replication..."
 The Cyber
Nn't do
of Cyber are:
 Cyber-946: A 946
of the Cyber
vone .
in the
pof 946
at the end of the
a.  The
>and
in the DOS
not be
.  The
can be
in the
5in all
 Cyber-946
 "*.com *.exe"
PZPAPN
Cybercide
:  Cybercide
 Cybercide-2299
H:
i; DOS
 DOS DIR
6performance slowed
R:  2,299
5:   PRhCK -
n1.04+,
6.60+,
2.58+,
2.58+,
6.64+
 The Cybercide
.  Its
.  Cybercide is a
bCybercide
X, the Cybercide
at the top of
$the
', not moving
|12's
, as
qby the
 DOS
@by 4,800
 09, 1C, and 21
mby Cybercide in
the Cybercide
, it
, as well as
 included as a part of the target of a DOS DIR
the Cybercide
 of 2,299
be hidden
 the
.  The
at the end
`.  The
>and
in the DOS
not be
.  The
 can be
in the
5in all Cybercide
 "... I SHALL FEAR NO EVIL ..."
 ">>>  A.N.O.I  <<<"
 "**CYBERCIDE** -- FLOATING THROUGH THE VOID"
 "iS AROUND!"
 "* *I* *h*e*r*e*b*y* *p*r*o*c*l*a*i*m* *t*h*i*s*
 *c*o*m*p*u*t*e*r* *a*s* *t*h*e* *p*r*o*p*e*r*t*y* *o*f*
 *A*.*N*.*O*.*I*"
 "*!*!* *A*L*L* *H*A*I*L* *D*A*R*T*H* *V*A*D*E*R*!*!*"
 "-=CYBERCIDE=- 01-30-
* COPYRIGHT (C)
 A.N.O.I DEVELOPMENT"
 The asterisks (*) in the fifth and sixth
are actually a
 character, or hex 0F.
s of
Cybercide may notice
 performance of the DOS DIR
6is sluggish due to the
`included in the
6output.
 the DOS
Ton all
Cybercide is
of Cybercide are:
 Cybercide-2299B:
, 1994, Cybercide-2299B is
to the Cybercide
 The
in the
1to the
 "... I SHALL FEAR NO EVIL ..."
 ">>>  A.N.O.I  <<<"
 "**CYBERCIDE** -- FLOATING THROUGH THE VOID"
 "iS AROUND!"
 "* *I* *h*e*r*e*b*y* *p*r*o*c*l*a*i*m* *t*h*i*s*
 *c*o*m*p*u*t*e*r* *a*s* *t*h*e* *p*r*o*p*e*r*t*y* *o*f*
 *N*A*Z*I*S*.* *"
 "*H*E*I*L* *H*I*T*L*E*R* *!*!*!*"
 "COPYRIGHT (C)
-93  A.N.O.I DEVELOPMENT"
 The asterisks (*) in the fifth and sixth
 actually a
 character, or hex 0F.
Cybercide-2299B
lthe
=seconds field in the DOS
1to "24".
:  Sweden
 MLP-1321:
, MLP-1321 is
on the
 Cybercide
.  MLP-1321's
 is 1,600
), hooking
|21.
 are
for any reason.
by 1,321
be hidden
 The
at the end of all
 The
>and
in the DOS
to the
 and
.  The
in the MLP-1321
 "simple simon met a pieman going to the fair
 said simple simon to the pieman let me take your ware"
 "- my little pony - copyright(c)
Cruel Entity and
 A.N.O.I. -"
 ">>> A.N.O.I <<<"
, the DOS
Ton all
in a
hang.
:  Sweden
 See:  DNR
PZPAPN
CyberTech
:  CyberTech
 CyberTech-A
H:
; removal of
 The
R:  1,066 or 1,076
5:   PNCK -
3.96+, NAV 3.0+,
8/93+,
1.22+,
 The CyberTech, or CyberTech-A,
 The
s to be The
.  CyberTech
 is a
uof .
the CyberTech
X, the
 CyberTech
wone .
in the
 1,066 or 1,076
at the end of the
pd in
by 1,066
 had 10
)of validation
by the
 removed.  The
>and
in the DOS
 The CyberTech
Mthe
 "CyberTech
- Strain A
 (C)
John Tardy of Trident"
?31,
, the
Mthe
and dis
wthe
athe
is executing
 "The previous year you
rby a
out knowing or removing it. To be gentle to you
 I decide to remove myself
fyour
. I suggest
 you better buy
of McAfee to ensure yourself
 complete security of your precious data. Next
 could be
a malevolent
 May I say goodbye to you now
 All of the
in the
, as is the
 "chklist.cps"
 CyberTech may
interfer
the functioning of the Central
Anti-
of CyberTech are:
 CyberTech-222:
on the CyberTech
vone .
pof 222
at the end of the
a.  The
>and
in the DOS
 not be
.  One tech
in the
:  The
 CyberTech-501:
as Ice Cream, CyberTech-501
in the
pof 501
at the end of the
a.  The
>and
in the DOS
 not be
the seconds field
 set to "02".  The
in the CyberTech-501
 "I scream, you scream, we both scream for an ice-cream!"
 "John Tardy"
:  The
 CyberTech-654: CyberTech-654
vone .
in the
pof 654
 the end of the
a.  The
>and
in the
 DOS
not be
 the seconds field
!set to "02".  The
in the
 CyberTech-654
 "(C)
John Tardy / Trident"
 "Satan Spawn, the Caco-Daemon - Mor(T)alities Death"
:  The
, 1994.
 CyberTech-B:
on the CyberTech
adds 1,205 or 1,215
)to the .
the exception of
,.  In the
 case of
,, it
part of the slack
 (hex 00) area in the
be no
p.  It
Ms the
 "CyberTech
- Strain B
 (C)
John Tardy of Trident"
 The
?31,
Mthe same
as the
 and dis
wthe
is executing.
:  The
(?)
PZPAPN
Cysta
:  Cysta
 Cysta-2711
H:
i; Hidden
`may
in DIR;
 Poland
R:  2,711 - 2,726
5:   PRhAK -
30.00+,
6.64+,
1.25+
 The Cysta, or Cysta-2711,
.  Cysta
 is a
uof .
-and .
,.  It is a fast
 are
for any reason.
bCysta
X, the Cysta
at the top of
 but
$the
', not moving
|12's
, as
qby the DOS
@by 2,736
mby the
, the
,if it was not
 the
the Cysta
, it
for any reason.
pof 2,711 to
 2,726
at the end of the
 The
>and
in the DOS
 not be
.  The
in the
5in all Cysta
 "(C)
Cysta Inc."
WIBMDOSIBMBIOMSDOSIOCONFIGCOUNTRYPSQVW"
 "GAME"
 "ENJO"
 "DZOJ"
 "DZOY"
 "PLAY"
 "FUCK"
 "DUPA"
 "PORNO"   "JOY"
 "GRY"
 "RETAL"   "GIER"
 "HUJ"
 "MKS"
 "VIRUS"   "WIRUS"   "SEX"
 "SONG"
 "GIF"
 "WOLF3D"  "F19 \"
 "Enter NEW Password :"
 "NEW Password
 "ERROR, Press Any Key
 "Use Maximum 6 ASCII
 "ESC:Exit"
 "Hit <ESC>, If you want to:
 It is
what Cysta may do
 alter the hidden
aattribute on
hidden
the DOS
of Cysta are:
 Cysta-2954: A 2,954
of the Cysta
is 2,976
 hooking
|21.  Cysta-2954 adds 2,954 to 2,969
)to the
v.  The
in the
WIBMDOSIBMBIOMSDOSIOCONFIGCOUNTRYPSQVW"
the Cysta
, the hidden attribute may be
 reset on
`, making the
in the
 DOS
:  Poland
 Cysta-8045: A 8,045
of the Cysta
is 8,064
 hooking
|21.  Cysta-8045 adds 8,045 to 8,060
)to the
v.  The
in the
 "(C) By Rycho Rak"
WIBMDOSIBMBIOMSDOSIOCONFIGCOUNTRY
-MAND"
 "MKS-VIRMKS_VIRMKSVIRMKS-DEMOMKS_DEMOMKSDEMOPSQVW"
the Cysta
, the hidden attribute may be
 reset on
`, making the
in the
 DOS
:  Poland
PZPAPN
:  Dad
H:
i; TSR;
 Argentina
R:  897
5:   PRsC -
, NAV,
 The Dad
Gin Argentina in May,
.  It is a
uof .
, but not
bDad
X, the Dad
as a low
TSR of
 1,232
).  It
hook
{21 and F8.
becoming
wany .
X, and
Mthe
on the
 "DAD WAS HERE"
the Dad
pof 897
).  The
at the
 of the
be no
3to the
>and
 in the DOS
is unable to
 determine
it has
a, so it
`, adding an
)for
 The
can be
din the
5in all
 Dad
 "Argentina!"
-MAND
-A:TMP$$TMP.
 "Que dia es hoy?"
 "PRIMERO DE ABRIL!!!"
 "(C) DAD  DAD WAS HERE"
PZPAPN
:  Dada
H:
may fail to
R:  1,358 - 1,372
5:   PRsE -
, NAV,
 The Dada
.  Its
~are
. Dada is a
 of .
 The
the Dada
as a low
TSR of 2,048
).  Most
mapping utilities
show it as an
 in the
of the in-
6interpretor.
 and 21
mby Dada in
.  The
alter
 the ceiling for conventional
, so
labout 64K of conventional
.  The remaining
 conventional
the Dada
, it
pof 1,358 to 1,372
at the
 end of the
.  The
>and
in the DOS
to the
>and
.  The
can be
in the
 "PATH=.
 As a
of the Dada
' alteration of conventional
Zof .
over 64K in
may not
Yin the
 way the
expects.  Unpredic
Tmay
PZPAPN
Damage
:  Damage
 Damage-B
H:   May,
effects; "
 Italy
R:  1,063
5:   PRhAK -
, NAV,
 The Damage
Vin May,
.  Damage is
on the Diamond
of V1024.  It is a
uof .
-and .
bDamage
Xon a
 Damage
at the top of
$the
, as measured by the DOS
 by 1,120
{08 and 21
mby the
Damage is
, it
-and .
over
1K in
X, it
by 1,063
at the end of the
a.  The
 however,
be hidden if Damage is
.  If the
in the
Ewas
 12:00a, its
be blank
Lif Damage is
 The DOS
not find
Tas it
Damage is
 Damage
is 14:59:53.  At
la large, multi-color diamond
in the center of
 the
M.  The diamond
break up into smaller
 diamonds
shoot around the
cleaning off
 the
 Occasionally, the Damage
format a section of the
formatting
to read a
amay
 damaged, or if the
to write to one of
areas.
Damage
lthe
near the end of the
 "DAMAGE
of Damage are:
 Damage-B: Damage-B is a 1,110
of Damage,
,.  The
be 1,152
 Two
can be
 "Jump for joy!!!"
 "DAMAGE-B!!"
 Damage-B may be detected as Lucifer by
as it is very
 See:   Alfa   Lucifer   V1024
PZPAPN
:  DAME
 Coffeeshop, Coffeeshop 2, CryptLab, DarkStar, Dedicated,
 Dedicated 2, Dedicated 3, Encroacher, Encroacher 2, Fear,
 MTE, MTE Spawn, MTE Spawn 2, PC Weevil, Questo
H:
Kwrite failures;
 warm re
R:  Over 3,000
5:   PNCK -
3.96+, NAV 3.0+,
 The DAME, or
<Mutating Engine, was
.  DAME is not actually a
, but rather a polymorphic
 encryption engine
is used as part of the
entry.  The encryption produced by the encryption engine is
 extremely complex,
no more
three
)remaining constant
d samples.  As a
 engine can
be identified by the presence of the encryption
 engine
.  One
has be included in
 separate entry
uses
engine:  Pogue .
e(s) using DAME are:
 Coffeeshop:
, Coffeeshop is a
uof .
uses a modified
of the
<Mutating Engine. It
at the top of
, as
qby the
 DOS
@by 12,288
), and
, it
X, adding 3,820 - 3,974
.  The
at the end of
`.  The
in the
it is not
 "Amsterdam - COFFEESHOP!"
:  Amsterdam, The
 Coffeeshop 2:
, Coffeeshop 2 is
on the Coffeeshop
.  Its
 usage of
is the same as for the Coffeeshop
, it
X, adding 3,845 - 3,977
.  The
at the end of
`.  The
in the
are not
in most
 "Amsterdam = COFFEESHOP!"
:  Amsterdam, The
 CryptLab: The CryptLab
s to be
fthe
.  CryptLab is a
uof .
 CryptLab
X, the
search the
Efor
w.  It may
wup to eight .
Zof an
the CryptLab
pof 2,982 to 3,227
at the end of the
a.  The
in the DOS
not be
.  The
in most
 samples of the
 "CryPtLAB:  THE SELECT CHOICE FOR ALL YOUR
 VIRUS AND TROJANRESEARCH NEEDS!"
 "-URNST KOUCH."
 DarkStar:  A
 DarkStar
wup to four .
in the
X.  If
E, it may
DarkStar
pof 2,971 to 3,235
).  The
at the end of the
a.  While
 usually be fully
9an un
Scopy of the
Ssamples
9the
 "NightMare Labs, United Kingdom"
 "- DarKStaR -"
:  England
 Dedicated:  A
 Dedicated
wup to four .
in the
X.  If
E, it may
DAME
pin excess of 3,100
).  The
 at the end of the
a.  While
usually
 be fully
9an un
Scopy of the
Ssamples
9the
 "We dedicate
little
to Sara Gordon who wanted to
her."
 Dedicated
Nnot do
 Dedicated 2:
, Dedicated 2 is
on the Dedicated
.  Unlike
 the Dedicated
, Dedicated 2 is a
 of .
.  It
at the top of
$the
, as
qby the DOS
@by 5,120
 Dedicated 2
 adding
3,582 to 3,758
 The
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
5, and
not be
in most
 "We dedicate
little
to Sara Gordon,"
 "who wanted to
lit corrected--"
 "learn to
before you touch M_t_e"
 Dedicated 3:
, Dedicated 3 is
 the Dedicated 2
.  Dedicated 3 is a
uof .
-and .
.  Its
is 5,120
), hooking
|21.  Dedicated 3
-and
 adding
3,539 to 3,717
 The
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5, and
not be
in most
 "We dedicate
little
to Sara Gordon,"
 "who wanted to
lit corrected--"
 "learn to
before you touch M_t_e"
 Encroacher: A
 Encroacher
wone .
in the
X.  If
E, it may
Encroacher
pof 3,227 to 3,483
at the end of the
be no
3to the
>and
in the DOS
.  The
are usually
in the
5in Encroacher
 "ENCROACHER is here"
-chklist.cps C:\
/\VSAFE.
 Encroacher may interfer
the functioning of Central
 anti-
it is
zed in its default
zation
 Encroacher 2:
to Encroacher,
 minor
 Fear: A
u, Fear
wup to four .
in the
X.  If
E, it may
Fear
pin excess
 of 3,000
at the end of the
be no
3to the
in the DOS
the Fear
Scopy of the Fear
 samples
9the
 "Fear
Created 2-5-92 by PkaHerONE"
-You
lnothing to fear except FEAR
the Fear
[warm
ring unexpectedly, or
general
 failure
Twriting to a non-existant
all the
`in the
hang
 March,
 MTE Spawn:
, MTE Spawn is a non-
spawning or companion
uses the Dark
 Avenger Mutating Engine for its encryption.
wone .
 in the
E, creating a 6,666 to 6,746
the same base
companion
lthe read-
, and hidden attributes set,
 and its
>and
be the
>and
.  The
not be
Zof an MTE Spawn
in a
hang
five .
`in the
 the companion
not be
Xunder
 of DOS due to a minor bug in
.  To dis
tof MTE Spawn, simply
Bthe hidden companion
 MTE Spawn 2:
, MTE Spawn 2 is a non-
spawning or companion
uses the Dark
 Avenger Mutating Engine for its encryption.
wone .
 in the
E, creating a 2,754 to 2,894
the same base
companion
lthe read-
, and hidden attributes set,
 and its
>and
be the
>and
.  The
not be
Zof an MTE Spawn 2
in a
hang
five .
`in the
 the companion
not be
Xunder
 of DOS due to a minor bug in
.  To dis
tof MTE Spawn 2, simply
Bthe hidden companion
 PC Weevil: A
 PC Weevil
wsix .
in the
X.  It
Nnot
PC Weevil
pof 3,139 to 3,299
at the end of the
be no
3to the
>and
in the DOS
.  The
are usually
in the
5in PC Weevil
 "PC Weevil: Still the select choice for your
 research needs"
 "MtE 0.90"
jfrequently
 Questo: A
 Questo
wfour .
in the
X.  If
E, it may
Questo
pof 2,971
 to 3,227
at the end of the
be no
3to the
in the DOS
.  The
are usually
in the
5in Questo
 "Questo sistema
 stato infettat*.
 "MtE 0.90"
 See:   Groove   Pogue
PZPAPN
PT`4
 Amilia, Black Avenger, Boroda, Eddie, Diana, Rabid Avenger,
 VAN Soft, PS!KO, Evil Men, Dark Quest
H:
, 1989
 TSR; .
W, .SYS
 Davis, California,
R:  1,800
5:   PRsAK -
, NAV,
:  CleanUp,
\, NAV or
<was
}in the
at the
 University of California at Davis.  It
W, and
 overlay
,.  The
 into
, becoming
, and is extremely prolific at
sany execu
for any reason.
includes using the DOS COPY and XCOPY
6s to copy
`, both the source and the target
end up
pd by
 1,800
 The
Nperform malicious damage.  The
 maintains a counter in the
Qsixteenth
r, the
randomly
on the
a portion of the
5.  If the randomly
 selected
is a portion of a
or data
a, the
 or data
be corrupted.
and data
!corrupted by a
are permanently damaged
 and cannot be repaired since the
is lost.
 If you are
<, shutdown your computer and
fa Write Protected
Jfor the
 carefully use a dis
call instructions. Be sure to
lfinished dis
 The
8the words: "The
 copyright 1988, 1989", as well as the
 written in the city of Sofia.  Eddie lives
where in
bears no resemblance or
ity to the
es, even
<are:
 Amilia:
on the
, Amilia adds 1,614
 to the .
-and .
v.  It
,.  The
at the end of
, as
qby the DOS
be 1,632
m.  The Amilia
^2nd, at
becoming
, and a
hang
 "AmiLiA I Virii - [NukE]
 Released Dec91 Montreal
 (C) NukE Development Software Inc."
%the
, the
can be
in the
 "antideb"
 "AmiLiA I Virii  -  [NukE] i99i  By Rock Steady/NukE"
:  Montreal, Canada
 Boroda:
<-D,
 one
: "B O R O D A".  It adds 1,800
)to the
v, and 1,800 to 1,814
)to the
, as
qby the DOS
be 3,696
{21 and 27
m.  As
<, it
 modify the
, and
of the
a copy of
, thus damaging
<.1E:
<-D,
 1,800
)to the .
v, and
 1,800 to 1,814
)to the
 In both cases, the
at the end of
 the
.  The
 "Eddie lives...
where in
 "Diana P."
was written in the city of Sofia"
 "(C) 1988-89
<.1E
notice
be slightly
, and
`may
 slowly corrupted.
,, the
>'s format may be
f"mm/dd/yy" to "
y#mm#dd", and the ":"
 character in the
1to "
<.Major:
on the
 adds 1,832
)to the .
v, and
 1,832 to 1,846
)to .
.  In both cases,
 the
at the end of the
 The
 "Written In turbo Assember v2.84"
 "(C)
MajorBBS Patch v1.0"
Was Written To Patch The Backdoor Of
 MajorBBS"
 "(C)
by Leroy Janowa"
<.Major
notice
be slightly
, and
`may
 slowly corrupted.
, 1994.
<.Shyster:
on the
is 3,712
), hooking
{21 and 27.  It adds 1,802
)to the .
v, and 1,802 to 1,816
)to .
.  In both cases, the
at the
 end of the
a.  One
can be
in the
 "Shyster"
<.Shyter
notice
be slightly
, and
`may
 slowly corrupted.
, 1994.
<-B: Very
to the
, the major
 difference is
be re
 adding 1,800
)to the
in high
instead of
 low
TSR.
din the
5include:
 "Eddie lives...
where in
 "Diana P."
was written in the city of Sofia"
 "(C)1988-1989
<-C: Very
to the
adds 1,800 to 1,814
 The copyright notice is
different, having
1to: "(C) 1988-89
<-D:
is very
 adding 1,800 to 1,814
`.  It
 has the same copyright notice as
<-Romanian:
fRomania.  The major
, adding 1,800 to 1,814
)to the
.  It
8the same
:  Romania
<1801:
to the
, the major
 difference is
has an effective
of 1,801
), one
*longer
.  Like
<-B, it
at the top of
 instead of
#a low
TSR.  It
 not, however, re
N.  The same
 and
<-1693: The
<-1693
is a 1,693
of the
.  Its
is 3,696
)at the top of
$the
', hooking
{21 and 27.  It adds 1,693
 the .
v, and 1,693 to 1,707
)to .
.  The
at the end of the
 and the
>and
in the DOS
not be
Nnot hide the
p.  The
as the
keeps a counter
. No
in the
frequently hang the
, 1994.
<.1797: The
<.1797
is a 1,797
of the
.  Its
is 3,696
)at the top of
$the
', hooking
{21 and 27.  It adds 1,797
 the .
v, and 1,797 to 1,811
)to .
.  The
at the end of the
 and the
>and
in the DOS
not be
Nnot hide the
p.  The
as the
keeps a counter
. The
in the
 "McAfee and Associated (C)
 "Diana P."
was written in the city of Sofia
 (C) 1988-89
, 1994.
<-1799: The
<-1799
is a 1,799
of the
.  Its
is 3,696
)at the top of
$the
', hooking
{21 and 27.  It adds 1,799
 the .
v, and 1,799 to 1,813
)to .
.  The
at the end of the
 and the
>and
in the DOS
not be
Nnot hide the
p.  The
as the
keeps a counter
. The
in the
 "Francis lives...in Hong Kong!"
 "Diana P."
was written in the city of Sofia
 (C) 1988-89
, 1994.
<.1800.Satan: The
<.1800.Satan
 1,800
of the
.  Its
is 3,696
)at the top of
', hooking
{21 and 27.  It adds 1,800
)to the .
v, and 1,800 to 1,814
 to .
.  The
at the end of the
a, and the
>and
in the DOS
not be
Nnot hide the
p.  The
as the
keeps a counter
. The
in the
 "Satan
* Satan Ver 2.09"
 "- Satan
- 1994 Written by Mad Satan in
 TAIWAN.  =Ver 2.09="
, 1994.
<-1813: The
<-1813
is a 1,813
of the
.  Its
is 3,696
)at the top of
$the
', hooking
{21 and 27.  It adds 1,813
 the .
v, and 1,813 to 1,827
)to .
.  The
at the end of the
 and the
>and
in the DOS
not be
.  The
<-1813
 hide the
pd in
by up to 16
 unable to determine
it has
a, so it ends up re
`.  Re
1,813
)to the
pis not
 hidden by the
.  The
as the
keeps a counter
. The
in the
 "Eddie lives...
where in
 "Diana P."
was written in the city of Sofia
 (C) 1988-89
, 1994.
 Dark Quest: The Dark Quest
is a 1,800
 the
.  Dark Quest's
is 3,696
)at the top of
$the
', hooking
{21, 22, and 27.  It adds 1,800
)to the .
v, and 1,800 to 1,815
)to .
.  The
at the end
 of the
a, and the
>and
in the DOS
not be
 hide the
p.  The
as the
keeps a counter
. The
can be
in the
5in all Dark Quest
 "Never buy Quest computers again!"
 "iana P."
is not dangerous stamp."
 "All new software seriosly danger"
 Evil Men:
<-D,
 "The evil
men do !"
was written in the city of Sofia"
 "(C) 1988-89
 "Diana P."
 Kang Yong: The Kang Yong
is a 1,947
of Dark
 Avenger.  Unlike
members of
group, it re
.  Kang Yong's
 3,984
)at the top of
$the
 DOS
', hooking
{21 and 27.  It adds 1,947
)to the .
v, and 1,947 to 1,961
)to .
.  Re
add an
 1,947
).  The
at the end of the
a, and the
>and
in the DOS
not be
Nnot hide the
p.  The
as the
keeps a counter
 The
can be
in the
 "If you are a thieve man ,
lives...
where always!"
 "You must
 good man!"
 "Kang Yong II"
was adjustted in 'Commputer Home' of KOREA"
 "(C) 1988-89 ,LSR+KYL
:  Korea
 Mercury: The Mercury
is a 2,829
of the Dark
 Avenger
.  Its
is 5,808
)at the top of
$the
', hooking
{08, 21 and 27.  It adds 2,829
)to the .
v, and 2,829 to 2,843
)to .
 Mercury hides
it is
.  The
at the end of the
 and the
>and
in the DOS
not be
.  The
 not be
. The
 the
 "If You Liked
, Call Asaf, At [phone]!"
 "Written by Jasper, and Dedicated to Freddie Mercury."
of a Mercury
tinclude a sluggish response to
 DOS DIR
6s, DOS
Ton all
, as well as random
 on the
, 1994.
 PS!KO: The PS!KO
<was
.  It is
fthe
.  It addes
 1,803 to 1,817
v.  The
can be
 "The Ps!ko
 "The Ps!ko
- Written in the USA,"
 "(C)
by SiTT and The Viola"
of an
tby PS!KO include .
 failing to
, and frequent
 PS!KO-1459: The PS!KO-1459
on the PS!KO-1687
$.  PS!KO-1459's
 3,040
)at the top of
$the
 DOS
', hooking
{21 and 27.  It adds 1,459
)to the .
v, and 1,459 to 1,473
)to .
.  In both cases, the
at the end of the
a, and the
>and
 in the DOS
not be
hides the
.  The DOS
Ton all
PS!KO-1459 is
are no
in the
 PS!KO-1687: The PS!KO-1687
on the PS!KO-1800
$.  PS!KO-1687's
 3,472
), hooking
{21 and 27.  It adds 1,687
)to the .
v, and 1,687 to 1,701
)to .
.  In both cases, the
at the end of the
a, and the
>and
 in the DOS
not be
Nnot hide the
it is
are no
in the
 PS!KO-1800: The PS!KO-1800
on the PS!KO
.  PS!KO-1800's
is 3,696
 hooking
{21 and 27.  It adds 1,800
)to the .
v, and 1,800 to 1,814
)to the .
v.  In both cases, the
 at the end of the
a, and the
>and
in the
 DOS
not be
Nnot hide the
it is
.  The
can be
 "The Ps!ko
 "SiTT"
 "The Ps!ko
- Written in the USA,
by SiTT and The
 Rabid Avenger: Rabid Avenger was
}in the
 the
.  Its
 portion is
at the top of
$the
', and is 3,696
{21 and 27 are
by 1,800
by 1,806 to
 1,823
).  In both cases, the
at the end of the
din the
5include:
 "<-
ks to the
 "Eat us!"
 "(C)
RABID International Development Corp!"
Killer Test"
so as to avoid
 detection by
utilities
are able to
 detect
 Sneaker: Sneaker was
.  Its
.  The
in the
 "Nadia FOTTIT!!...By the Sneaker"
 "Diana P."
was written in the city of Sofia
 (C) 1988-89
by 1,800
at the end of the
 by 1,800 to 1,814
at the end
 of the
 VAN Soft: VAN Soft was
Vin May,
(and is
on the
.  The major
 now:
 "V.A.N. Soft &
M PRESENT:SOFIA"
 "VAN&
by 1,800
at the end of the
 by 1,806 to 1,824
at the end
 of the
 See:   1963
 CB-1530   Jericho
 Outland   QP3
 V651
 V1024
 V2000
PZPAPN
Dark End
:  Dark End
H:
i; TSR;
"of C:;
 interfers
R:  1,188
5:   PRsAK -
3.96+, NAV 3.0+,
8/93+,
.2.0+
 The Dark End
.  Its
.  Dark End is a
uof .
-and .
bDark End
X, the Dark End
as a low
 TSR of
1,200
), hooking
|21.  It
as part of the
6interpretor in many
mapping
 utilities.
the Dark End
, it
 and .
pof 1,188
at the end of the
a.  The
>and
in the DOS
not be
.  The
can be
in the
5in all Dark End
 "(c) Dark End."
 The Dark End
15th of any year.  At
, the
of the C:
the Dark End
 interference
ounexpected clearing
 of the
and the cursor flickering.
jmay
unexpectedly.
PZPAPN
Dark Lord
:  Dark Lord
 Dark Lord-B, ManOWar, T
H:   May,
R:  923
5:   PRhAK -
, NAV,
 The Dark Lord
in May,
.  It is
(.  Dark Lord is a
uof .
 The
Dark Lord is
X, the
at the top of
$the
, as measured by the DOS
 by 1,616
{21 and 24
mby Dark Lord.
Dark Lord is
, it
-and .
by 923 to 936
 at the end of the
,is an exception,
p, the
 the stack space on the end of
Dark Lord
9the
 "Dark Lord, I summon thee! MANOWAR"
 The second
near the end of
 Dark Lord
Nnot
on 386-class
.  On those
Zof an
in a
hang.
 It is
if Dark Lord
of Dark Lord are:
 Dark Lord-B: Very
to Dark Lord,
fthe NCSA
collection
 differs in 1
*internally
fthe
 Lord
 the
goes
, if it was not already
the exception of
by 921 - 935
 See:   T
PZPAPN
Darkray
:  Darkray
H:
 The
R:  1,525
5:   PRhE -
6.55+,
\2.10g+,
n1.05+,
6.64+,
1.25+
 The Darkray
, and is
fThe
.  It is a
uof .
written by the Trident
writing group.
bDarkray
X, the Darkray
at the top of
$the
', not moving
|12's
, as
qby the
 DOS
@by 1,888
 13 and 21
mby the
the Darkray
, it
pof 1,525
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all Darkray
 It is
what Darkray
 See:   Flue   Trident
PZPAPN
Darth Vader
:  Darth Vader
 Darth-1, Darth-2, Darth-3, Darth-4, Darth-5
 Research
H:   May,
R:  200 - 345
5:   ORCK -
, NAV,
 The Darth Vader
es were
in May,
 Darth Vader is actually a
]of four
are very
.  All of
es are
are copied.
a Darth Vader
 Darth Vader
.  Latter, as .
are copied, the target .
 Depending on the particular Darth Vader
, the target
 may
leither the
"of the
, or an
 area of hex 00
by the
in the
E, and the
>and
not be
 Darth Vader
es do not perform any malicious damage,
are usually damaged and
<are:
 Darth-1: The
bDarth Vader
, Darth-1 is
 270
.  It
s the
b270
 of .
are copied
.  Darth-1
 The
can be
din the
-Darth Vad".
 Darth-2: Darth-2 is a 345
of Darth-1.  Unlike
 Darth-1, it
s 345
)of hex 00
 in copied .
 the
-Darth Vader".  Darth-2 and later
 Darth-3: Darth-3 is
to Darth-2, but it is 255
Darth-3
, it
s 255
)of hex 00
 the
: "Darth Vader".
 Darth-3B: Darth-3B is
to Darth-3, and is a very minor
.  Like Darth-3,
 the
: "Darth Vader".
, 1994.
 Darth-4: Darth-4 is a shorter
of Darth-4, it is 200
Nnot
9any
 Darth-5: Darth-5 is very
to Darth-4.  Like Darth-4, it
 is 200
Nnot
9any
.  Darth-5
 copied if the
9ed at least 200
)of hex 00
PZPAPN
Datacrime
:  Datacrime
 Extinct
H:
, 1989
i; floppy
Kaccess; formats
any day
fOct 13th to Dec 31st
R:  1,168
5:   PNC -
, NAV,
\, NAV, or
 The Datacrime
is a
, and is
as the
 1168
.  The Datacrime
is a
`.  The
Vshortly
its release in March, 1989.
 The
attach
to the end of a .
a, increasing
 the
by 1168
).  The
)of the host
are stored off in the
5and
replaced by a
 branch instruction so
Xbefore
 the host
.  In order to propagate, the
searches through
Fories for .
,and attaches to
 any
`(except for where the 7th letter is a D).
s are searched before the floppy
Os are checked.
 The
continue to propagate until the
 12th of any year,
.  The decrypted
thing like:
 "DATACRIME VIRUS"
 "RELEASED: 1 MARCH 1989"
 Note:
ASCII
 A low-level format of the
done.
Tin the
make .
random and
often make the
crash
 Unlike the
of Datacrime, the
Datacrime
Nnot
, or
`, until
1st of any
 year.
 Lastly, if the computer
is using an RLL, SCSI, or PC/AT
Kcontroller, all
of the Datacrime
are not
 able to successfully format the
K, according to Jan Terpstra
 of the
of Datacrime are:
 Datacrime-B: The Datacrime-B
is a
of the
 Datacrime
.  The differences are
the effective
of the
is 1,280
 and instead of
:  The
, 1989.
 Datacrime II: The Datacrime II is a
of the Datacrime
.  The major characteristic
2are
the effective
of the
 1,514
), and
it can now
wboth .
 an encryption mechanism in
.  Datacrime II
Nnot format
Ks on Mondays.
:  The
, 1989.
 Datacrime IIB: A
of the Datacrime II
 Datacrime IIB
vgeneric .
-and .
,, adding 1,917
)to the
.  The
differs
fDatacrime II in
 the encryption method used by the
to avoid
 detection has
:  The
, 1989.
 Datacrime IIC:
on the Datacrime IIB
vone .
Wor .
aon the C:
by 1,480
by 1,604 to 1,981
).  In both cases, the
 the end of the
PZPAPN
DataLock
:  DataLock
 DataLock 1.00, V920, DataLock-1043
2; "out of
 handles"
R:  920
5:   PRtEK -
Wand
\, NAV,
:  CleanUp, or
 The DataLock, or V920,
}in many locations in the
starting on
is a generic
uof .
`, but it
,if it is
 The
the DataLock
X, the
at the top
, but
$the
find
 2,048
)less
is expected.
 the
, any .
rby the
pof 920
), and
qin the
1to the
>and
.  The
at the end of
`. The
, indicating the
, can
dat the end of all
 "DataLock
1.00"
 DataLock
>, if DataLock
, it
prevent the
fopening
lan extension ending
"BF".
to open
`, such as .DBF
in an "out of
ahandles"
of DataLock are:
 DataLock-828:
of DataLock is a minor
of the
DataLock
.  It
`as well as
by 828 to 1,048
t, and 828
tof the
of DataLock
add up to
 256
)to .
Nnot
wthem.
>and
in the DOS
to the
>and
.  One
can be
dat the very end of
 all
 "*10-03(HM)*"
:  Calgary, Ontario, Canada
 DataLock-1043:
is a "bug-fixed"
of the
DataLock
.  It was
}in the Washington
 DC/Virginia area of the
by Brian Seborg in
 May,
.  DataLock-1043
-and .
 over 9K in
while the
pof 1,043
at the end of the
pof 1,043
tof the
a, and an
1,043
tof the
a.  The
 spread
`due to a bug in
.  The
din the
 removed.  DataLock-1043 is destructive.  It
for one hour.  At
, it
Os A:, B:, and the second physical
 if it exists.
:  USA
 DataLock-1740: DataLock-1740 is a later
of the
 DataLock
.  DataLock-1740
-and .
Xwhile the
pof 1,740
at the end of the
 The
p, however,
not be
 the DOS
.  The
in the
 all DataLock-1740
`are:
 "Hacker:  NGUYEN HIEU VINH"
 "22 / 1A  Truong Quoc Dung"
 "Phuong 10  Quan Ph Nhuan"
k Pho Ho Chi Minh"
 "South of Viet Nam"
lthe
in the DOS
set to
 "08-08-88 8:08a".  The DOS
Ton all
DataLock-1740 is
:  Viet Nam
 DataLock-D:
of DataLock is a minor
of the
DataLock
.  Like the
, it adds
 920
)to the .
v.  It
,if it is
X, but not
are 10
differ
fthe
.  Unlike the
, it
 May,
PZPAPN
Davis
:  Davis
G:  May,
i; beeping &
 Malaysia
R:  1,776 - 1,965
5:   PRhE -
 The Davis
fMalaysia in May,
.  Davis is
uof .
it has
for 15 to 30 minutes.
 The
the Davis
 the Davis
at the top of
$the
'.  It
Nnot move
|12's
qby the DOS
@by 1,776
{08 and 21
mby the Davis
Davis is
, it
pof 1,776 to 1,965
 the end of the
a.  The
>and
in the
 DOS
not be
15 to 30 minutes
the Davis
, it
start
Ming the
 accompanied by 3 beeps every few minutes:
 DAVIS
 V1.01
  Author
 : Davis
 : mm/dd/yy
  VIRUS STATION COPY
 Hi ! How are you today ?  Don't worry about !
 DAVIS VIRUS
follow you forever and ever !
 Don't care me!  I really do not damage your
Kor data.
.make Funny to you
 Davis
Nnot do
malicious
Ming its
 disruptive
PZPAPN
Day10
:  Day10
 Day/10, SYP
R:  674
5:   PNCK -
, NAV,
.2.0+,
 The Day10
.  Its
.  Day10 is a
uof .
,.  It is destructive
the Day10
X, the
wone .
in the
E.  If
in the
E, it may
r.  Day10
 of 674
).  The
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
can be
in the
 "DM?
 Day10
Xif the
>is evenly di
by 10 (day=10, 20, or 30).  On
days,
Zof an
in the Day10
of the
PZPAPN
dBASE
:  dBASE
 DBF
 Extinct
, 1988
-& .OVL
i; corrupt .DBF
`; TSR; FAT and root
 New York,
R:  1,864
5:   PRC -
-and Overlay
, NAV,
\, NAV or
 The dBASE
Gby Ross Greenberg of New York.
-& .OVL
`, and
corrupt data in DBF
 by randomly transposing
)in any open .DBF
a. It keeps track
`and
)were transposed in a hidden
a(BUG.DAT)
 in the same
Eas the .DBF
a(s). The
restores
)if the
ais read, so it
nothing is wrong.
the BUG.DAT
ais 90 days old or more, the
the FAT and root
Eon the
!detected, if you remove the
 dBASE
and replace it
a clean copy, your .DBF
were
during the period
you were
 useless since
are garbled on the
Keven
would
Las expected by the
rdBASE
PZPAPN
Dead-790
:  Dead-790
 Deaf
, 1994
R:  790
5:   PRhCK -
V112+,
2.11a+,
2.58+,
/2.1+,
\2.10g+,
n1.04+,
6.60+,
.2.0+,
1.22+,
V111+,
2.58+,
6.64+
 The Dead-790, or Deaf,
, 1994.  Dead-790
 is a
uof .
 It receives its
fthe combination of two
in the
bDead-790
at the top of
$the
 DOS
', not moving
|12's
, as
qby the DOS
@by 800
mby the
the Dead-790
, it
 any reason.
 790
at the end of the
a.  The
>and
in the DOS
not be
.  Two
can be
in Dead-790
 "DE"
 "AD"
 The
start in the fourth
*of the
awhile the last
be at the very end of the
PZPAPN
Death Dragon
:  Death Dragon
 Eddy'93
 Republic Of South Africa
R:  528
5:   PNCK -
6.60+,
\2.13+,
1.22+,
6.64+,
V117+
 The Death Dragon, or Eddy'93,
 It is
fthe Republic Of South Africa, where it was
 uploaded to at least one bulletin board
(BBS).  Death Dragon
 is a
uof .
the Death Dragon
wall of the .
in the
pof 528
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all Death Dragon
 "[DEATH DRAGON]"
 "@echo off"
 "echo Fuck you, arsehole!   You are a SHITTY
 "echo I hate you!"
 "echo."
 "pause"
 "Eddie has
ed on tour (
) - VMAG
 "press a key..."
 "*.com c:\autoexec.bat"
of any year,
Zof an
 the
Lon the
monitor:
 "Eddie has
ed on tour (
) - VMAG
PZPAPN
Define
:  Define
G:  May,
&failures
 Australia
R:  30
5:   ONAK -
, NAV 3.0+,
8/93+
 The Define
.  Its source
 distributed in a FidoNet echo in May,
. Define is a
uof .
-and .
, and may
Define is
X, Define
wthe
in the
a copy of
)of the
.  If the
r, it
simply
 previous
t.  Unless the
in the
Eis smaller
be no
.  The
in the
>and
in the
to the
>and
 The Define
corrupt
vthem since
s the
)of the host
no longer
function
 usually
ing the
to the DOS prompt.  If
r, the
fail to
 Define is
on the Mini-45
.  It
Nnot do
of Define are:
 Define-B:
to the Define
is a minor
several
 differ.
 Define-256: Define-256 is a 256
of the Define
.  Much of the
Nn't do
, and the base
5is very
in the
)of the
a Define-256
X, the
wthe
in the
E.  If
the previous
t.  The
>and
in the DOS
:  South Africa
 See:   Mini-45
PZPAPN
Deicide
:  Deicide
 Glenn, Deicide II
; FAT
R:  666
5:   ONC -
3.96+, NAV 3.0+,
8/93+,
.2.0+
 The Deicide
is a
`, but not
,.  Later
of Deicide
 are
es, and are
$under
Deicide is
X, the
 search the
Efor an
.  If an
d, the
b666
)of the
.  If
 the newly
was 666
 more,
show in the
was smaller
), its
now be 666
). The
may be
Lby the
 If the
Nnot find an
in the
E, it
Mthe
double spaced, and
of the
 "DEICIDE!
 Glenn (666) says : BYE BYE HARDDISK!!
 Next
be carufull
illegal stuff"
 The
can be
din all
`, along
 the
is not
experimental
was written by Glenn Benton
 to see if I can make a
while learning machine
 for 2,5 months. (C) 10-23-
by Glenn.
 I keep on going making
ses."
of Deicide are:
hood: Written by the same author as the Deicide
hood is a
 of .
,.  It
 one .
ain the
pof 477
at the
"of the
a.  The
>and
in the DOS
.  The
can be
in the
5in all Br
hood
hood...'
 'I am seeking my br
s "DEICIDE" and "MORGOTH"...'
dmy br
"MORGOTH"!!!'
dmy br
"DEICIDE"!!!'
 '*** Glenn Benton ***'
 Deicide 2:
as Deicide-1335, Deicide 2 is a 1,335
of the Deicide
.  It
vone .
in the
pof 1,335
at the
"of the
be no
3to the
>and
in the DOS
.  The
in the
5in all Deicide 2
 "Suck my dick, Steffie!"
:  The
 Deicide II.622: Deicide II.622 is a 622
of the Deicide
.  It
vone .
in the
pof 622
 the
at the
"of the
be no
3to the
>and
in the DOS
.  The
in the
5in all
Personal Computer has
!struck by the uncurable
 disease
 "called "The Doom of Morgoth"."
:  The
, 1994
 Deicide-2405:
on the Br
hood
of Deicide,
 Deicide-2405
vone .
X, adding 2,405
)to the
a, and
Ms a
on the
 The
at the
"of the
 and
be no
3to the
>and
 in the DOS
 different
may be
Lby the
, all of
.  Many of the
are insults to various
researchers.
:  The
 Deicide-2570:
on the Br
hood
of Deicide,
 Deicide-2570 is fairly
to the Deicide-2405
.  It adds 2,570
)to the .
v, the
at the
"of the
 are
9ed in the
, and one is
X.  Many of the mesages are
 of a sexual nature in
:  The
 Deicide-B:
on the Deicide
no longer
s the
 it has
rall of the .
`in a
 See:   Breeze
PZPAPN
Dejmi
:  Dejmi
 Susenka
, 1994
R:  862
5:   PRhCK -
\2.13+,
6.64+,
n1.05+,
1.25+,
6.64+
 The Dejmi
, 1994.  Its
.  Dejmi is a
uof .
bDejmi
at the top of
 the
', moving
|12's
, as
qby the DOS
@by 1,024
{09, 1C, and 21
mby the
, the Dejmi
pof 862
 at the end of the
a.  The
>and
in the DOS
to the
 and
.  No
 the
PZPAPN
Democracy
:  Democracy
i; TSR; DOS DIR
6output slowed/sluggish
R:  3,959 - 3,973
5:   PRsA -
\2.10g+,
/2.1+,
V112+,
2.58+,
6.60+,
2.11+,
2.58+,
.2.0+,
V113+,
6.64+
 The Democracy
.  Its
.  Democracy is a
uof .
-and .
, but not
bDemocracy
as a low
TSR of
 4,192
).  It
{01, 03 and 22.
the Democracy
, it
larger
pof 3,959 to 3,973
at the end of the
a.  The
>and
in the DOS
.  The
can be
dat the very end of
 all Democracy
 "Democracy"
s of
the Democracy
 slow or sluggish response to the DOS DIR
6.  It is
 what else
may do
PZPAPN
Demolition
:  Demolition
i; TSR;
R:  1,585
5:   PRsCK -
, NAV,
 The Demolition
.  Its
.  Demolition is a
uof .
bDemolition
X, the
 Demolition
as a low
TSR of 1,904
).  It
the Demolition
, it
pof 1,585
).  The
at the end of the
a.  The
>and
in the DOS
.  The
can be
in the
5in Demolition
 "UZD(T!EFNPMJUJPO"
 The Demolition
hang the
ais later
X, it
in a
hang.
 It is
if the Demolition
8any damage potential.
PZPAPN
Demon Viper
:  Demon Viper
G:  March,
fail to
 function
; jumbled
4may
R:  817
5:   PNCK -
30.00+, NAV 3.0+,
n1.04+,
6.64+
 The Demon Viper
in March,
.  Its
.  Demon Viper is a
uof .
the Demon Viper
X, the
 Demon Viper
wone .
in the
 or next higher level
pof 817
at the
 end of the
a.  The
>and
in the DOS
to the
 and
.  The
in the Demon Viper
5in all
 "May SATAN prevail on
 "I summon you!"
 "DEMON! ver"
 "by Viper!"
the Demon Viper
[unexpected
ogarbled
Lon the
monitor and
Zfailure.
PZPAPN
Den Zuk
:  Den Zuk
 Search, Venezuelan
, 1988
; floppy format; TSR; BSC
 Indonesia
R:  N/A
5:   RtF -
Floppy
, NAV,
K, CleanUp,
\, NAV, or DOS SYS
 The Den Zuk
is a
uof 360K
 5-1/4"
I.  The
wany
Jin a floppy
is accessed, even if the
Jis not
&able.  If an
 attempt is made to
&the
rnon-
 Den Zuk
into
even
 failed.
 purple "DEN ZUK" graphic
a CTL-ALT-DEL is
 performed if the
has a CGA, EGA, or VGA monitor.  While the
Den Zuk
did not cause any damage to the
maintain a counter of how many
s the
&ed, and
the counter r
Qes its limit, the floppy in the
Ois reformatted. The counter in
of the
is usually in the range of 5 to 10.
 The
can be
din the
the Den Zuk
 "Welcome to the
 C l u b
 --The HackerS--
 Hackin'
 All The
 The HackerS"
 The
Jvolume label of
Imay be
 Y.C.1.E.R.P.,
s if the Den Zuk
 removed a Pakistani Brain
tbefore
sthe
Den Zuk.  The Den Zuk
remove an Ohio
tbefore
sthe
Den Zuk.
 The Den Zuk
t to be written by the same person or
 persons as the Ohio
.  The "Y.C.1.E.R.P."
 the Ohio
, and the
in many respects.
of Den Zuk are:
 Den Zuk-RPKS: A minor
of Den Zuk,
of the
on track 40
 well as the
to avoid detection
Den Zuk detection
 May,
 See:   LZRQ
 Ohio
PZPAPN
Deranged
:  Deranged
i; beeping
speaker;
R:  419
5:   PNE -
8/93S+,
/2.1+,
1.22+,
.2.0+
 The Deranged
.  Its
.  Deranged is a
uof .
the Deranged
X, the
 Deranged
wall of the .
in the
E.  Beeping on the
speaker may
 and/or possibly a
hang.
the Deranged
pof 419
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in the
5in all Deranged
 "The Deranged
 "Criminal Behaviour"
PZPAPN
Desperado
:  Desperado
 Desperado.2403A, Desperado 1.0
^, 1994
moved;
 Sweden
R:  2,403 - 2,418
5:   PRtAK -
2.11a+,
\2.13+,
6.64+,
6.64+,
1.25+
 The Desperado
^, 1994, and is
 Sweden.  It is a
, fast
uof .
-and .
bDesperado
at the top of
$the
', moving
|12's
, as
qby the DOS
@by 6,144
mby the
, the
,if it was not
-and .
pof 2,403 to 2,418
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the Desperado
 "Dr White - Sweden
 "SCANCLEAVSHITOOL
/VSAFF-PRVIRSTBAVTBSCTBCLTBUT
 -V UTSCUT  CHKLIST.MS"
 "Desperado
- Written in Malmo..."
 The Desperado
included in many
 of the popular
utilities.
are identified
 by the
by comparing the
bfour
4of the
the contents of the second
 It is
what Desperado
of Desperado 1.0 are:
 Desperado.2403B: Desperado.2403B, or Desperado 1.1, is a later
of the Desperado
.  It is
to the
8the same
:  Sweden
^, 1994.
 Desperado.2403C: Desperado.2403C is a later
of the
 Desperado
.  It is
to the
8the same
:  Sweden  March, 1994.
PZPAPN
:  Dest
 Dest-1
R:  323
5:   PNCK -
3.96+, NAV 3.0+,
1.53S+,
1.22+,
 The Dest, or Dest-1,
.  Its
.  Dest is a
uof .
 two later
s of
, one of
is a
.  The later
s of the
$under
the Dest
X, the
 Dest
wone .
in the
pof 323
at the end of the
.  The
>and
in the DOS
to the
>and
.  One
in the
 "*.com"
 Dest-1
Nn't do
of Dest are:
 Dest-2: A later
of the Dest or Dest-1
adds 478
)to the .
v.  The
>and
in the DOS
not be
are no
in the
 Dest-3: A later
of Dest-2, Dest-3 is a
uof .
-progams.
X, it
at the
 top of
$the
 decreasing
by 2,192
{21 and 22
pof 491
at the end of the
 The
>and
in the DOS
to the
 and
.  Dest-3
Nn't do
PZPAPN
Destructor V4.00
:  Destructor V4.00
 Destructor
R:  1,150 - 1162
5:   PRtAK -
\, NAV,
 The Destructor V4.00
(, and is a
uof .
 and .
the Destructor V4.00
X, the
at the top
$the
|12's
is moved.
 be 1,216
)less
what is expected on the
, the
,if it is not
 already
Destructor V4.00 is
, it
pd in
by 1,150
).  .
by 1,154 to 1,162
). In both cases, the
at the end of the
Nnot alter
 the
=in the
E, and it
makes no
 attempt to hide the
 The
can be
 "DESTRUCTOR  V4.00  (c)
by ATA
 It is
what Destructor V4.00
N, if
PZPAPN
Devil's Dance
:  Devil's Dance
 Devil's Dance-B
?, 1989
i; FAT
:; TSR
 Mexico
R:  941
5:   PRsCKT -
, NAV,
:  NAV, or
 The Devil's Dance
?, 1989, by Mao
 Fragoso of Mexico City.  Devil's Dance is a
 of .
,.  It can be very destructive.
 The
Devil's Dance is
 Devil's Dance
as a low
 TSR of 1.2K.
{09 and 21
mby Devil's Dance
, Devil's Dance
wall .
in the
E.  If the
Devil's Dance, it
be re
Devil's Dance is
, it
wany
 the
Devil's Dance
by 941
Qlater re
ing in an
p.  The
 at the end of
>and
in the DOS
!run, any subsequent warm-re
 (CTL-ALT-DEL) may
in the
lyou ever danced
the devil under the week light of the moon?"
 PRAY FOR YOUR DISKS!!"
 The Devil's Dance
is destructive.
b2,000
 keystrokes, the
starts changing the colors of any
Lon the
monitor.  The changing of colors of
s start to
immediately
b5,000 keystrokes, the
erases the
bcopy
 of the FAT.  At
is re
&ed, it
Mthe
and again destroy the
bcopy of the
 FAT,
allow the
&to proceed.
of Devil's Dance are:
 Devil's Dance-B:
to the
Devil's Dance
.  The
 major difference is
 run very slowly,
&.  On
&, the
may receive the
 "Specified
-MAND search
Ebad".
PZPAPN
Devils & Evangels
:  Devils & Evangels
 Devils & Evangels.1456
, 1994
i; DOS
j; scrolling of
=seconds = "62"
R:  1,456
5:   PRTA -
clean cold
 The Devils & Evangels or Devils & Evangels.1456
, 1994.  Its
three
, all four
es are
-and .
, but not
bDevils & Evangels
at the top of
 but
$the
', moving
|12's
, as
qby the DOS
@by 2,976
mby the
the Devils & Evangels
, it
-and .
 1,456
be hidden
.  The
at the end of the
it cannot be
in the
as the
are read into
 The
>and
in the DOS
to be
the seconds field
!set to
 "62".  The
in the
 "Devils & Evangels, Inc."
jmay
 the
Mmay be scrolled upwards accompanied by a
 hang.
of Devils & Evangels are:
 Devils & Evangels.1526: A 1,526
of the Devils &
 Evangels
.  Its
 3,104
), hooking
|21.  It adds 1,526
 the .
-and .
not be
.  The
>and
othe seconds
 field,
not be
.  The
in the
 "Devils & Evangels, Inc."
 The
has symptions of
to the
, 1994.
 Devils & Evangels.1634: A 1,634
of the Devils &
 Evangels
.  Its
 3,328
), hooking
|21.  It adds 1,634
 the .
-and .
vupon
Z, open,
 or copy,
not be
.  The
>and
othe seconds field,
not be
.  The
in the
 "Devils & Evangels, Inc."
 The
has symptions of
to the
jdo not frequently
, 1994.
 Devils & Evangels.1792: A 1,792
of the Devils &
 Evangels
.  Its
 3,648
), hooking
{21, 24, and 48.  It adds 1,792
)to the .
-and .
vupon
 open, or copy,
not be
.  The
 and
othe seconds field,
not be
 The
in the
 "Devils & Evangels, Inc. [DEI] MnemoniX $ v2.00"
 The
has symptions of
to the
, 1994.
PZPAPN
Dewdz
:  Dewdz
&failure
R:  601
5:   PNCK -
, NAV,
 The Dewdz
is a
,.  It is
on the Burger
 group of
es, and
utilities
identify it
 as such.
Dewdz is
X, the
 search the C:
Oroot
Efor an
w.  If one is
d, it
r.  Dewdz
pof 601
at the
"of the
be no
3to the
>and
in the DOS
.  The
can be seen
 the
 "OUSE BBSTEMP"
 "*.com *"
Mthe
"Kewl Dewdz!"
 are
X, and the
to be hung.  If the
presses CTRL-C, processing
usually continue.
&failures
the Dewdz
,on the
 See:   Burger
PZPAPN
Diamond
:  Diamond
WC failure on
R:  Varies, depending on
present
5:   PRAK -
n, NAV 3.0+,
3.96+,
/2.1+,
1.53+,
 The Diamond entry in Hyper
actually represents several
 members of the group or
on the
 V1024
 The
$are
on the V1024
, and
 were
as part of a large library of
es.  As such,
Hare completely
.  The
es in
group are all
us of .
 and/or .
, and in most cases
not function
member(s) of the Diamond
]are:
 Diamond-444: A 444
on the V1024
.  It
-and .
by 444
 the
at the end of the
a.  The
>and
in the DOS
is not
.  Diamond-444 cannot determine
it has
a, so
 be re
r, adding an
t.  The
 the
5in all
 "9090909090"
Diamond-444
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.
 Diamond-465: A 465
on the V1024
.  It
-and .
by 465
 the
at the end of the
a.  The
>and
in the DOS
is not
.  Diamond-465 cannot determine
it has
a, so
 be re
r, adding an
t.  The
 the
5in all
 "9090909090"
Diamond-465
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.
 Diamond-485: A 485
on the V1024
.  It
-and .
by 485
 the
at the end of the
a.  The
>and
in the DOS
is not
.  Diamond-485 cannot determine
it has
a, so
 be re
r, adding an
t.  The
 the
5in all
 "7106286813"
Diamond-485
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.
 Diamond-584:
to the Diamond-485
 adds 584
)to the
t.  The
in the
5in all
 "7106286813"
Diamond-584
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.
 Diamond-594:
to the Diamond-584
 adds 594
)to the
t.  The
in the
5in all
 "7106286813"
Diamond-594
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.
 Diamond-602:
to the Diamond-594
 adds 602
)to the
of the
 The
in the
 in all
 "7106286813"
Diamond-602
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.
the DOS DIR
6is issued.
 Diamond-606:
to the Diamond-602
 adds 606
)to the
of the
 The
in the
 in all
 "7106286813"
Diamond-606
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.
the DOS DIR
6is issued.
 Diamond-607:
to the Diamond-607
 adds 607
)to the
of the
pis hidden
.  The
in the
5in all
 "7106286813"
Diamond-607
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.  The DOS DIR
Nnot hang the
 Diamond-608:
to the Diamond-606
 adds 608
)to the
of the
 The
in the
 in all
 "7106286813"
Diamond-608
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.
the DOS DIR
6is issued.
 Diamond-609:
to the Diamond-609
 adds 609
)to the
of the
 The
in the
 in all
 "7106286813"
Diamond-609
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.
the DOS DIR
6is issued.
 Diamond-614: A 614
of the Diamond
, it adds
 609
)to the
of the
 the
be hidden
.  The seconds field of the
=in the DOS
 to "60".  The
in the
5in all
 "7106286813"
Diamond-614
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.  The DOS DIR
Nnot produce a
 hang
 Diamond-620: A 620
of the Diamond
, it adds
 620
)to the
of the
 the
be hidden
.  The seconds field of the
=in the DOS
 to "60".  The
in the
5in all
 "7106286813"
Diamond-620
Zof any
in the
WC failure"
L, and the
ed to the DOS
 prompt.  The DOS DIR
hang the
 it is issued.
corrupt very small
vthem.
 Diamond-621: A 621
of the Diamond
, it adds
 621
)to the
of the
 the
be hidden
.  The seconds field of the
=in the DOS
 to "60".  The
in the
5in all
 "7106286813"
Diamond-621
 function
, as
the DOS DIR
6.  Its
is 5,376
), hooking
{08 and
 Diamond-624: A 624
of the Diamond
, it adds
 624
)to the
of the
 the
be hidden
.  The seconds field of the
=in the DOS
 to "60".  The
in the
5in all
 "7106286813"
Diamond-624
 function
, as
the DOS DIR
6.  Its
is 5,376
), hooking
{08 and
 Diamond-626: A 626
of the Diamond
, it adds
 626
)to the
of the
 the
be hidden
.  The seconds field of the
=in the DOS
 to "60".  The
in the
5in all
 "7106286813"
Diamond-626
 function
, as
the DOS DIR
6.  Its
is 5,376
), hooking
{08 and
 Diamond-891: A 891
of the Diamond
, it adds
 891
)to the
of the
 the
be hidden
.  The seconds field of the
=in the DOS
 to "60".  The
in the
5in all
 "7106286813"
Diamond-891
 function
, as
the DOS DIR
6.  Its
is 7,424
), hooking
{08 and
 Diamond-978: A 978
of the Diamond
, it adds
 978
)to the
of the
 the
be hidden
.  The seconds field of the
=in the DOS
 to "60".  The
in the
5in all
 "7106286813"
Diamond-978
 function
, as
the DOS DIR
6.  Its
is 1,024
), hooking
{08 and
 Diamond-1013: A 1,013
of the Diamond
, it adds
 1,013
)to the
of the
v, the
be hidden
.  The seconds field of the
=in the DOS
 to "60".  The
in the
5in all
 "7106286813"
Diamond-1013
function
, as
the DOS DIR
 Its
is 1,056
), hooking
 08 and 21.
 See:   Ah   Gremlin   Rocko   V1024
PZPAPN
:  Die
, 1994
 Republic Of South Africa
R:  4,000
5:   PRhAK -
6.64+,
n1.05+,
V117+,
6.64+,
V117+,
1.0A06+
:  See
 The Die
k2, or DH2,
, 1994.  It is
fJakarta in the Republic Of South Africa.  Die
k2 is a
full
-and .
bDie
at the top of
$the
'hooking
{10 and 21.
, as
qby the DOS
@by 4,000
, the Die
pof 4,000
at the
 end of the
a.  The
not be
in the DOS
, nor
in the
as Die
k2 is a full
, dis
 "on the fly".  The
>and
in the DOS
not be
.  The
in the
 "SW DIE HARD 2"
 The DOS
k2 in
 not indicate
k2 can be fairly easily manually
r.  The
should
to be
rin order to insure
.  All
 of the execu
on the
should
be archived
 using a
such as PKWare's PKZIP
.  The
must
 be cold
clean
out executing any
fthe
O, the archive
`created
 earlier should be used to replace the execu
on the
PZPAPN
Digger
:  Digger
:; unexpected
R:  1,475
5:   PNCK -
3.96+, NAV 3.0+,
8/93+,
 The Digger
.  It is
fthe
.  Digger is a
,.  It
corrupt .
the Digger
wone
on the C:
O.  It starts
in the C:
Oroot
E, and
 slow work its way down the
Estructure.  .
rby the Digger
 1,475
at the end of the
 The
>and
in the DOS
 not be
.  The
can be
in the
5in all
 "C) DIGGER"
 The Digger
corrupt .
it encounters
 it is searching for a .
corrupted
be completely
s to be
 It is
what Digger may do
and corrupt
PZPAPN
:  Dima
requiring
6line input may not function
Ms "9pm"
R:  1,024
5:   PNAK -
3.96+, NAV 3.0+,
/2.1+,
8/93+,
.2.0+
 The Dima
.  It is
fthe
 Dima is a
uof .
-and .
the Dima
wall of the .
-and .
in the
E.  If
E, it
the Dima
pof 1,024
 at the end of the
a.  The
>and
in the DOS
to the
 and
.  The
din all Dima
 "*.exe"
 "OMtE"
 "The -9pm-."
 "Call the Dima & Dima corporation if it
be difficult."
 The Dima
at 21:00 or 9PM, at
 of an
in the
Mof the
and a
hang
ring:
 "9pm"
the Dima
[problems
 executing
require
6line input,
 in the
not functioning
PZPAPN
:  Dir
i; TSR; sluggishness of DIR
R:  691
5:   PRsCK -
\, NAV,
 The Dir
.  It
ated in the
.  The Dir
is a
uof .
 The
the Dir
 the
as a low
 TSR of 1,008
mby the
.  If
,is not already
r, it
the Dir
, it
a DOS DIR
6is performed.  It
Nnot
Z, or
`are
a DIR
6is performed, the
din the
be a pause in the output of the DIR
 while the
the output
continue.
by 691
pcannot be seen
 performed if the
.  The
at the end of
>and
by the
the Dir
receive
the DOS
Xon a
.  If the
is not
not be
Zof the DOS
 the /F option
:of the
Nnot
9any
mechanism.
PZPAPN
Dir-2
:  Dir-2
 Creeping Death, FAT
 lost clusters;
acopy; cross linked
qby DOS
fclean
R:  N/A
5:   ZRAK -
8/93S+, NAV 3.0+,
.2.0+
:  CleanUp, or Low level format
 reformat
 The Dir-2, or FAT,
was reported in
(, Hungary, Poland,
 and Yugoslavia in
.  The copy analysed of
 was
fTamas Szalay of Budapest, Hungary.  The Dir-2
is a
uses a completely new
 technique for replicating, and moves very quickly through exposed
.  It is very difficult to detect, not having many
 or measurable
 The Dir-2
the computer
K, and a
X.  Since the
Ys the hidden
 the
X.  The
in low
, in the area where the
configuration
x(IO and MSDOS) is normally
&completes,
, by
be 1,552
)less
expected.  If the
views
mapping utilities.  The "CONFIG" area
be 1,552
 larger
expected.
 At the
of the
&, the
 by the
as well, if it was not already
Dir-2 is
, any non-write protected
 accessed on the
r.  The
places its
5in the last cluster of
I.  On the
K, the
in a
unused cluster.
 The
encrypts the
ers for the
 execu
`on the
K, and copies them to an unused area
 of the
E.  The
ers are
to the
5on the
 Viewing the
in a normal
E.  All execu
indicate
s and
=stamps.  In fact, the
lnot
at all.  If the
Ys one
 of the
, the
X(due to the
 the
E). Using the
ers to the
 actual location, the Dir-2
load the
Y, so
it is
 The major symptom of a Dir-2
tis the effect the
 has on the
powering off and
&ing
clean
 DOS
to copy
in the
`not
#copied
.  The newly
 copied
9the
in the
 last cluster of the
to use backup
.  Executing DOS
in a large number of lost clusters
ddue to the
3in the
E.  All execu
#cross-linked on the same
is the location of the
5on the
K.  If the /F
 parameter is used, permanent
:of all execu
be the
.  Note
Zof the DOS
not indicate any
or cross-linking of
due to the presence of the
 If you suspect you
la Dir-2
t, power off the
 and cold
-clean write-protected DOS
 and check for the
on the
K.  Be
 careful to not
Yany
fthe
Kas the
out an
utility to detect and remove Dir-2, it is
 possible to manually dis
by copying all execu
to non-execu
 The
should
be powered off and re
fa clean,
 write protected
out executing any
 the
K, backup the re
`and your data
 The
should
be low level formatted.
 reformatted, restore the backup and re
the re
of Dir-2 are:
 CD10:
gequivalent,
is a minor
 undetec
 CD11:
gequivalent to CD10 and the
is an
minor
 CD12:
gequivalent to the
members of
es, it is a minor
 Dir 2-910:
to the
members of
stores its
5on the last two
of the
O.  Executing the
in the
tof the C:
Oand
 root
Fories.  Its
is 1,632
PZPAPN
Dirty
:  Dirty
 Lavi
 Italy
R:  483
5:   PRhCK -
n1.04+,
2.58+,
6.60+,
V109+,
1.22+,
2.58+,
.2.0+,
6.64+
 The Dirty, or Lavi,
.  It
s to be
fItaly.  Dirty is a
bDirty
at the top of
 the
', not moving
|12's
, as
qby the DOS
@by 544
mby Dirty in
the Dirty
, it
pof 483
at the end of the
a.  The
>and
 the DOS
1to a random
 value, and the seconds field
!set to "62".  The
can be
in the
5in all
 Dirty
 "HI ! I'm The Dirty Fucker !!"
PZPAPN
Discom
:  Discom
 TSR; .
R:  2,053
5:   PRsA -
 NAV 3.0+,
:  CleanUp, or
 The Discom
.  The location
 where the sample was
.  Discom is a
uof .
-and .
`, and
on the
, and
fthe Sunday
.  As such,
utilities may
 identify
9ing both
 and Sunday.
Nnot exhibit
or the
 of either the
or Sunday
 The
the Discom
 the
as a 2,304
TSR.
{08 and 21
mby the
, the
-and .
 2,053
)and
lthe
at the
"of the
by 2,059
 to 2,068
at the end of the
 All
chex character
 11121704D0.
 Unlike many
Nnot exhibit a
 slowdown
for 30 minutes, and no "black
 window"
s.  Discom
, at random intervals, send random
4to the
-ports, as well as write portions of
to random
on the
PZPAPN
DisDev
:  DisDev
`corrupted; .
`truncated and/or dis
R:  6,144
5:   ONE -
, NAV 3.0+,
n1.04+,
6.60+,
V111+,
1.53S+,
V111+,
6.64+,
1.25+
 The DisDev
.  Its
.  DisDev is a
the DisDev
X, the
 DisDev
wall of the .
in the
of 6,144
), having
!replaced
a pure copy of the DisDev
>and
in the DOS
to the
>and
.  The
can be
in the DisDev
 "<*>-==>
 DisDev -Copyright (c) 1066 ScumSoft-   <==-<*"
 "disdev"
 "DisDev"
 "Fucking
 "Portions Copyright (c) 1066 ScumSoft!!"
DisDev has
rall of the .
`in the
E, executing an
in the
X"dis
ing"
fthe DOS
 The
lset the hidden attribute,
ing in
 effect.
to replace the
aby copying a clean copy of
 the
fail
acreation
 The DisDev
Mone of the
ctwo
 "DisDev"
 "Fucking
U 202 at
0:00F1"
PZPAPN
KKiller
KKiller
 Computer Ogre,
KOgre, Ogre
, 1989
 Bad blocks;
; BSC; TSR; encryption of
 Taiwan
 Milpitas, California,
R:  N/A
5:   BRtT -
, NAV,
K, CleanUp,
\, NAV, or DOS COPY & SYS
 The
KKiller
is a
spreads by
 writing copies of
to 3 blocks on either a floppy or
K.  The
Nnot care if
blocks are in use by an
or are part of a
blocks
be marked as
 bad in the FAT so
cannot be
. The
 is patched so
&ed, the
Xand it can attempt to
wany new
Ks exposed to the
 The
keeps track of the elapsed
Kusage
since initial
t, and
Nno harm until it has r
Qed a predetermined
 limit.  The predetermined limit is
48 hours.  (On most
KKiller
Qits limit
in 1 - 6 weeks of its
 initial
the limit is r
Qed or exceeded and the
is re
&ed, a
Lidentifying
-PUTER OGRE and a
 1st.  It
says to leave alone and proceeds to encrypt the
 by alternately XORing
Ah and 0
5h, effectively
 destroying the
xon the
K.  The
recourse
KKiller has activated and
Sthe entire
Kis to
 reformat.
 The
Lupon
, and can be
 in the
KKiller --
1.00 by
-PUTER OGRE 04/01/89
  Warning!!
 Don't turn off the power or remove the
Jwhile
KKiller
 is Processing!
  PROCESSING
 Now you can turn off the power.  I wish you Luck!"
 It is important to note
L, if the
is turned off immediately it may be possible to salvage
`on the
Kusing various utility
 destroys the
&, FAT, and
Eblocks.
KKiller can be removed by using McAfee Associate's M
 CleanUp utility, or the DOS SYS
6, to
Ks or
&able floppies.  On non-
floppies,
`can be copied to non-
rfloppies, followed by
 reformatting the
rfloppies.  Be sure to re
&the
fa write-protected
Jbefore
to remove
 the
bor you
be re
rby the
 Note:
KKiller may
ldamaged one or more
`on the
it wrote a portion of its
5to 3 blocks on the
 corrupted
`cannot re
wthe
, however
should be
 replaced
backup copies since the 3 blocks were
 Note: Do not use the DOS DISKCOPY
to backup
Ias the new backup
9the
as well.
PZPAPN
Dismember
:  Dismember
seconds = "62"
 Sweden
R:  288
5:   PNCK -
/2.0+,
 NAV 3.0+,
1.53S+,
.2.0+,
 The Dismember
.  It is
fSweden.  Dismember is a
the Dismember
wall .
`in the
 between 4,096 and 65,024
before
pof 288
at the end of the
a.  The seconds field of the
in the DOS
!set to "62", the
tmarker of the
.  One
 the
 Dismember
Nn't
to do
PZPAPN
Distrust
:  Distrust
, 1994
i; TSR;
As in 64K blocks
R:  1,588 - 1,604
5:   PRsA -
V116+,
\2.13+,
/2.1+,
2.58+,
6.64+,
.2.0+,
1.25+,
6.64+,
V116+,
2.58+
 The Distrust
, 1994, its
.  Distrust is a
-and .
`, but not
bDistrust
as a low
TSR of
 3,424
), hooking interupts 08, 21, and 24.
 the
allocate an
block of 64K,
actually
Aby more
3,424
the Distrust
, it
by 1,588
at the
"of the
a.  In the case of .
, the
by 1,594 to 1,604
 at the end of the
a.  In both cases, the
>and
 the DOS
not be
.  No
 are
in the
PZPAPN
:  DLSU
, 1994
R:  477
5:   PNC -
V112+,
2.11a+,
2.58+,
\2.10g+,
6.64+, NAV 3.0A06+,
n1.05+,
1.53s+,
V111+,
2.58+,
1.25+,
6.64+,
1.0A06+
 The DLSU
, 1994.  Its
.  DLSU is a
 of .
, but not
the DLSU
wone .
`in the
pof 477
at the
"of the
a.  The
>and
in the
 DOS
to the
>and
.  The
in the
5in all DLSU
 "*.com *.*"
PZPAPN
:  DM
 DM-400
j; write to
R:  400
5:   PRfCK -
, NAV,
.2.0+,
 The DM, or DM-400,
 It is
fthe
.  DM is a
DM is
X, the DM
in low
Fly remapping
{21 and 24.  It
place a
 portion of
video
, such as on a video card,
 if it is
qby the DOS
not be
the DM
, it
pof 400
at the end of the
be no
3to the
>and
in the DOS
.  The
can be
in all
 "(C)
 A symptom of a DM
fwrite protected
in a
hang
#left spinning.  The
write a copy of
to the
 It is
what DM
of DM are:
 DM-B:
referred to as DM 1.01, DM-B is a 400
 of the
.  It
Nnot
9the "(C)
9ed in the
 DM 1.01B:
on the DM-B
, DM 1.01B is
, and has
!modified to avoid
#detected by
 most
utilities familiar
group of
8the
: "(C)
1.01 DM."
 DM 1.04: DM 1.04 is a 400
of the
X.  It
Nnot
8the
: "GIiokMO".
 DM-330:
referred to as DM 1.05, DM-330 is a 330
 of the DM-B
.  It
.  It
Nnot
9any identifying
PZPAPN
:  DNR
ONot Ready
; TSR;
open a lot of
`may not function
R:  331
5:   PRsCK -
3.96+,
/2.1+,
2.58+,
6.60+,
2.11+,
n1.05+,
 NAV 3.0A06+,
2.58+,
1.25+,
6.64+,
1.0A06+
 The DNR, or
ONot Ready,
 Its
.  DNR is a
uof .
,.  It may
 be related to the  Cybercide
bDNR
X, the DNR
as a low
TSR of 2,048
), hooking
|21.  At
, the
Mthe
on the
monitor:
ONot Ready."
the DNR
, it
pof 331
at the end
 of the
a.  The
>and
in the DOS
to the
>and
.  The
 the
5in all DNR
ONot Ready"
 The DNR
uses one
ahandle
X.  As the number of
ahandles slowly
As, the
may find
 open a large number of
`may fail to function
of DNR are:
 DNR-ROM Bios:
, DNR-ROM Bios is a 397
of the DNR
.  Its
 usage of
is the
.  It
Ms the
 "ROM BIOS not compatible"
DNR-ROM Bios
pof 397
at the
 end of the
a.  The
, as well as
 the
, is
in the
 "WHY_ME"
 See:   Cybercide
PZPAPN
Do-Nothing
:  Do-Nothing
 The Stupid
, Nothing
 Extinct
, 1989
i; TSR (see
 Israel
R:  608
5:   PRfC -
, NAV,
\, NAV, or
breported by Yuval Tal of Israel in
 1989.  The
`, but
bone in
 the
E, whether it was
ror not.
 The Do-Nothing
, always
address 9800:100h, and can
. The
Nnot protect
area of
 any way, and
area
it in
, removing the
 The Do-Nothing
Nno apparent damage, nor
Nit affect
 operation of the
in any observable way, thus its
 See:   Saddam
PZPAPN
Doctor Qumak 2
:  Doctor Qumak 2
 Dr Qumak 2
:; "Write protect
 Krakow, Poland
R:  1,079
5:   PRtCK -
3.96+, NAV 3.0+,
 The Doctor Qumak 2
.  It is
fKrakow, Poland.  Doctor Qumak 2 is a
uof .
,.  It is a
 destructive
 The
the Doctor Qumak 2
at the top
$the
', moving
 12's
, as
 by the DOS
@by 2,064
{12, 13, and 21
mby Doctor Qumak 2 in
the Doctor Qumak 2
, it
for any reason.
pof 1,079
at the end of the
a.  The
>and
in the DOS
not be
 The Doctor Qumak 2
under two conditions, the
 condition
#very destructive, slowly corrupting
.  The
keeps track of how many
Kwrite
 operations
since it became
 100 write operations
, the
modify three
)in the next
written to
it has modified
manner, it
Mthe
 "The famous cooperation strikes again: IT IS DOCTOR QUMAK II!
 Watch out for the next
fKrak
w, Poland!"
is not
as it is
in the
 The second condition under
Doctor Qumak 2
activate is
 during the months of
thru
?of any year.  During
 months, on Sundays
the 9th of the month, the
 simulate a "Write protect
to write
 to a
PZPAPN
:  DoDo
 Birdie
R:  408
5:   PRbCK -
, NAV,
 The DoDo, or Birdie,
.  Its
~are
.  DoDo is a
uof .
,.  It is
 not related to the Dodo 2456
 The
the DoDo
 the DoDo
in video card
mby the
 the
|area.
the DoDo
, it
pof 408
 the end of the
a.  The
>and
in the
 DOS
not be
.  One
 can be
din the
 "Birdie Hop!"
 DoDo
Nn't do
of DoDo are:
 Pig: The Pig
is a 407
of the DoDo
#one
*shorter, the major difference
.  The
is: "GIP".
 Pig-B:
gequivalent to the Pig
 has three
differ.
PZPAPN
Dodo 2456
:  Dodo 2456
 The
R:  2,456
5:   PRsCK -
30.00+,
\2.10+,
6.64+
 The Dodo-2456
}in The
 It is a
uof .
,.  It is not released to the DoDo or Birdie
bDodo 2456
X, the Dodo
check the copy of
in the C:
 root
E.  If
copy of
,has not
rby the
, the
wit at
.  If
,is already
r, the
.  The Dodo 2456
 as a low
TSR of 2.4K, but in the process of it
 becoming
, it
actually end up keeping slightly
 over 100K of
mby Dodo2456 in
the Dodo 2456
, it
pof 2,456
 at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all Dodo 2456
 "DODO"
 "c:\
6.com"
 "Today we commemorate the DODO."
 "The bird who has
 the victim of human
 civilization
 "A:\ EST POC"
6com"
in the
5, the
 "DODO" can be
dstarting in the fourth
*of all
 It is
what Dodo 2456
PZPAPN
Doom II
:  Doom II
G:  May,
writes
 Taiwan
R:  1,252
5:   PRbAK -
, NAV,
 The Doom II
fthe NCSA.
 Doom II is a
-and .
 The
Doom II is
X, Doom
on the
's video card, along
a hook to
in low
{1C, 21, 24, and 98
mby the
lany
, Doom II
-and .
by 1,252
at the end of the
a.  The
Nnot hide
 the
p, nor is the
>and
in the
, a .
rby Doom
pslightly more in
, such as by 1,253 or 1,254.
s to be due to a bug in the
Doom II may
attempt to write to the
 due to the
in the video card
, thus
 making it un
, typically the
 monitor
be blanked and the
 locked out.
jare
prevalent
the Doom IIB
, but
more frequently
Doom II,
 the
switches
fa graphic to a
 It is
if Doom II
of Doom II are:
 Doom II-B: A re-engineered
of the Doom II
 Taiwan, Doom II-B is a
uof .
 and .
.  Doom II-B
-and .
 1,252
at the end of
 the
 May,
PZPAPN
:  DOS3
R:  661
5:   PNA -
3.96+,
 NAV 3.0+,
n1.04+,
2.58+
 The DOS3
.  Its
.  The DOS3
is a
uof .
-and .
, but not
the DOS3
X, the DOS3
wall of the .
-and .
 the
the exception of
pof 661
at the end of the
a.  The
in the DOS
not be
.  The
in the DOS3
 in all
 "Still using DOS 3?"
 "You need to upgrade, you loser!"
 The
btwo
may be
Las a
on the
monitor
Xon computer
uses Ms-Dos 3.0 to Ms-Dos 3.3.
PZPAPN
DOS-1
:  DOS-1
R:  184
5:   PNCK -
n1.04+,
, NAV 3.0A06+,
6.64+,
1.0A06+
 The DOS-1
.  Its
.  DOS-1 is a
uof .
the DOS-1
X, the DOS-1
wall of the .
in the
 184
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all DOS-1
 "DOS-1"
 DOS-1
Nn't
to do
PZPAPN
:  DOS7
R:  342
5:   PNCK -
/2.1+, NAV 3.0A02+,
6.60+,
2.58+,
n1.05+,
1.22+,
2.58+,
.2.0+,
6.64+,
1.0A06+
 The DOS7
.  Its
.  The DOS7
is a
uof .
the DOS7
X, the DOS7
wone .
in the
pof 342
 the
at the
"of the
a.  The
>and
in the DOS
to the
>and
.  The
can be
in the DOS7
 "W.C?M is
r!oy,re you ever dumb!"
 "MSDOS 7 (C)
ANARKICK SYSTEMS"
 "DOS 6 Anti
sucks. It missed
one!"
 It is
what DOS7
of DOS7 are:
 DOS7-B:
on the DOS7
, DOS7-B is a
 376
vone .
ain the
ever an
pof 376
at the
"of the
a.  The
>and
in the DOS
to the
 and
.  The
in the
5in all DOS7-B
 "W.C?M is
r!oy, are you ever dumb!"
 "MSDOS 7 (C)
ANARKICK SYSTEMS"
 "DOS 6 Anti
sucks. It missed
one!"
 DOS7-C:
on the DOS7
, DOS7-C is a
 419
vone .
ain the
ever an
pof 419
at the
"of the
a.  The
>and
in the DOS
to the
 and
.  The
in the
5in all DOS7-C
 "W.C?M is
r!oy, are you ever dumb!"
 "MSDOS 7 (C)
ANARKICK SYSTEMS"
 "DOS 6 Anti
sucks. It missed
one!"
PZPAPN
DOSHunter
:  DOSHunter
 The
R:  483
5:   PRhCK -
3.96+, NAV 3.0+,
/2.1+,
8/93+,
.2.0+
 The DOSHunter
.  It was
}in The
.  DOSHunter is a
uof .
the DOSHunter
at the top
$the
, as
qby the DOS
@by 1,408
mby the
the DOSHunter
, it
pof 483
at the
"of the
a.  The
>and
in the DOS
not be
.  No
in the
 The DOSHunter
26th of any year, at
trash the
b128
of the
PZPAPN
Dostepu
:  Dostepu
, 1994
2; TSR;
 unexpected access to
R:  1,942 - 1,967
5:   PRsCK -
\2.13+,
2.58+,
n1.05+,
6.64+,
1.25+,
6.64+,
2.58+
 The Dostepu
, 1994.  Its
.  Dostepu is a
uof .
,.  Its
TSR is not used
Fly to
bDostepu
as a low
TSR of 7,392
), hooking
|1C.
, the
 attempt to
in the root
Eof the
 two
Os immediately
Oletter.  For
 example, if the
Ois the A:
O, the
attempt
on the B: and C:
Os' root
Fories.
the Dostepu
pof 1,942 to 1,967
at the
 end of the
a.  The
>in the DOS
to "13-31-99" while the
 set to the
.  The
in the
5in all
 "Nie znaleziono pliku lub zla sciezka dostepu!"
 "raz23"
 "ARAZ23"
-AND.
PZPAPN
DOSVer
:  DOSVer
 2062
=seconds = 60;
 DOS
R:  2,062
5:   PRhAK -
, NAV 3.0+,
1.22+,
 The DOSVer
.  Its
.  DOSVer is a
-and .
the DOSVer
at the top of
$the
, as
qby the DOS
@by 3,072
mby the
the DOSHunter
, it
Wograms,
pof 1,666
at the end of the
a.  The
be hidden by the
it is
.  The
>and
in the DOS
the seconds field is set to "60".  As a
 the
may "dis
`in the DOS
.  No
in the
the DOSVer
may notice
the DOS
Ton all
PZPAPN
Dot Killer
:  Dot Killer
 944,
Killer, Dot Eater
i; removal of all dots (.)
 Koszalin, Poland
R:  944
5:   PNCK -
\, NAV,
 The Dot Killer
}in Koszalin, Poland in
. It is a
uof .
the Dot Killer
X, the
wone
ain the
by 944
).  The
at the end of
 While the Dot Killer
5to attempt to avoid
sthe
ed to by the
-SPEC en
mental
 parameter,
logic
8a bug and
Nnot function
.  If
,, or the
ed to by
-SPEC, is
in the
rjust like
 any
the Dot Killer
, it
remove all dots (.)
fthe
of Dot Killer are:
 Dot Killer B:
to Dot Killer, Dot Killer B's major
 difference is at
&ing
,, a happy face character
on the left side of the
line,
travel across the line to eat the period (.) the
attempted to
eating the period, the
 happy face
travel back across the
until the
period.
PZPAPN
Doubleheart
:  Doubleheart
 Doubleheart.452
, 1994
 unexpected access to
R:  452 - 466
5:   PNE -
\2.13+,
6.64+,
n1.05+,
6.64+
 The Doubleheart
, 1994.  Its
.  Doubleheart is a
uof .
a Doubleheart
X, the Doubleheart
wup to three .
`in the
E, as well as one .
in the C:
Oroot
 and attempt to
wone
on the B:
the Doubleheart
 of 452 to 466
at the end of the
a.  The
>and
in the DOS
to the
>and
.  One
in the
 in all Doubleheart
 "*.exe"
 It is
what Doubleheart may do
of Doubleheart are:
 Doubleheart.452.B:
, 1994, Doubleheart.452.B
 is a minor
of the Doubleheart
jmay
, 1994.
 Doubleheart.649:
, 1994, Doubleheart.649 is a
of the Doubleheart
.  It
vup to three .
`in the
E, as well as
wone
 on the B: and C:
Doubleheart.649
pof 649 to 660
at the end of the
a.  The
 and
in the DOS
to the
>and
.  The
 the
 "*.com"
-M M IBMBIO.
-IBMDOS.
fRussia
love!"
, 1994.
PZPAPN
Dreamer
:  Dreamer
 Hitler
G:  May,
; "Hitler!"
speaker;
 DOS
R:  4,808
5:   PRhCK -
8/93S+,
3.96+, NAV 3.0+,
n1.04+,
1.22+,
.2.0+
 The Dreamer, or Hitler,
in May,
.  Its
.  Dreamer is a
uof .
,, and is
as it hides the
bDreamer
X, the Dreamer
at the top of
$the
', hooking
{1C and
 21.
|12's
not be moved.
, as
qby the DOS
@by 5,072
the Dreamer
, it
by 4,808
be hidden by the
it is
.  The
at the end of the
.  The
>and
in the DOS
not be
.  The
 the Dreamer
 "Hitler
by Dreamer/DY"
15 minutes, the
 Dreamer
activate.  At
the word "Hitler!"
 be repeatedly emitted
fthe
speaker, and a
PZPAPN
:  Drop
R:  1,131 - 1,163
5:   PRhAK -
3.96+, NAV 3.0+,
/2.1+,
.2.0+
 The Drop
.  It is
fthe
 Drop is a
uof .
-and .
 The
the Drop
 Drop
at the top of
 but
$the
, as
qby the DOS
 by 3,600
mby the
the Drop
, it
for any reason.
pof 1,131
 1,153 to 1,163
).  In both cases the
at the
 end of the
a.  The
>and
in the DOS
to the
 and
.  No
 the
 It is
what Drop may do
PZPAPN
Druid
:  Druid
`corrupted;
fail to
Y; long
 accesses
R:  317
5:   ONC -
n1.05+,
 The Druid
.  It is a
uof .
, but not
,.  It
s the
"of the
v, permanently
 corrupting them.
the Druid
X, the Druid
wall of the .
in the
it has completed
sthe .
`in the
E, it
move up one
Eat a
in the
Estructure,
, until it finally
 the
Oroot
E.  It avoids
the Druid
normally not
.  The exception is
if the
was smaller
, the
 317
.  The
>and
in the DOS
not be
.  The
can be
 the
5in all
 "DRUID,
5d by Morbid Angel/Line Noise"
Druid
notice long
Kaccesses
X.  The long
Kaccess is due to the
in several
Fories.
not function
PZPAPN
Dutch 555
:  Dutch 555
 555, Quit-
R:  555
5:   PRhAK -
, NAV,
:  CleanUp, or
 The Dutch 555
 Zwienenberg of the
was accidentally
 released into the public domain by its author in
 It is a
uof .
-and .
 The
the Dutch 555
X, the
at the top
, but
$the
'.  The
is not moved,
the DOS
show a
of 560
mby the
the Dutch 555
, it
 and .
,, as
by 555
at the end of the
a.  The
 and
in the DOS
to the
>and
Nnot do
of Dutch 555 are:
 Dutch 555-B:
gequivalent to the
has four
differ
PZPAPN
Dutch
:  Dutch
2; write protect
R:  124 - 126
5:   PRAK -
/2.0+,
, NAV 3.0+,
.2.0+
 The three
comprise the Dutch
group were
fThe
.  All three are
techniques
 the
es in the
es.
 two
are included under  Mini-97
 are related to the Dutch
 The
Chere is the 126
 Dutch
-126.  The
, both of 124
), are
$in the
 The
Dutch
 the
in a DOS buffer
address
0:063A.
 by the
be no
 and
the Dutch
, it
X.   If
X, it
by 126
at the end of the
a.  The
>and
in the DOS
to the
>and
expect
6line input
, as
did not provide the
 input.
fwrite-protected
in a "write protect
fDOS.
Nnot do
of Dutch
 Dutch
.111:
, 1994, Dutch
.111 is a 111
.  It
wall .
`in the
pof 111
 the
at the end of the
a.  The
>and
in the DOS
to the
>and
.  One
can be
in the
, 1994.
 Dutch
-115:
, Dutch
-115 is a 115
.  It
wall .
`in the
pof 115
 the
at the end of the
a.  The
>and
in the DOS
to the
>and
.  Frequent
 Dutch
-117:
, Dutch
-117 is a
 117
.  It
wone .
 the
pof 117
 at the end of the
a.  The
in the DOS
to the
>and
.  One
can be
in the
:  The
 Dutch
-124: A later
of the
 Dutch
-124 is a 124
, frequent
and a .
a, or an
 already
a, is
Zof any
fthe A:
in a
hang has the
 is expecting
O.  Dutch
-124 is a poor replicator, and
wmost .
 Dutch
-124B: Dutch
-124B is a later
of Dutch
-124.  Unlike
members of
], it
wboth .
-and .
ts do not
very often.
be damaged, and later
Zof them
in a
hang in
 all cases.
 See:   Mini-97
PZPAPN
:  DWI
(in public domain)
G:  May,
Zfailures on large .
 WIN.
R:  1,051 - 1,065
5:   PRhE -
3.96+,
, NAV 3.0+,
/2.1+,
2.58+,
n1.05+,
2.58+,
.2.0+,
6.64+,
1.25+
 The DWI
in May,
.  It was written by a
 member of the Virulent Graffiti
writing group in the United
 States.  DWI is a
uof .
bDWI
at the top of
 the
', hooking
|21.
, as
qby the DOS
@by 1,296
|12's
not be
 moved.
the DWI
, it
pof 1,051 to 1,065
 at the end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the DWI
 "[DWI] AccuPunk/The Attitude Adjuster Virulent Graffiti"
 "WIN.
 "You've
!caught, you DWI!
 You're nothing but a Damn Windows Idiot!"
 "Well, we at Virulent Graffiti
lhad it...
 you're not going to be"
 "running
bullshit for a while, 'cuz, hey, friends
 don't let friends"
 "use Windows! (and you're damn right we're your friends!)"
larger
64K in
fail to
 are
 If the
YWIN.
, the
Lon the
 monitor, and WIN.
be corrupted by the
 "You've
!caught, you DWI! You're nothing but a Damn Windows Idiot!
 Well, we at Virulent Graffiti
lhad it... you're not going to be
 running
bullshit for a while, 'cuz, hey, friends don't let friends
 use Windows! (and you're damn right we're your friends!)"
PZPAPN
:  Dy
R:  278
5:   PNCK -
3.96+,
n1.04+,
6.60+,
2.58+,
2.58+,
.2.0+,
6.64+
 The Dy
.  Its
.  Dy is a
 of .
the Dy
wall of the .
in the
E.  If
,is in
E, it
the Dy
pof 278
at the
"of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all Dy
 "DY"
 The "DY"
s starting in the third
*of all
PZPAPN
:  Ear
G:  May,
Twriting to device AUX;
 Ear quiz played
R:  1,024
5:   PNAK -
/, NAV 3.0+,
 The Ear
Gin the
in May,
 It is a
uof .
-and .
the Ear
X, the Ear
check to determine if more
two sub
Fories
 exist on the
O.  If
are not at least two
Fories, the
attempt to write to device AUX,
 and
normally
in an
U.  No
 If two sub
Fories exist,
wall of the
-and .
in the
E, and the
the Ear
 of 1,024
at the end of the
a.  The
>and
in the DOS
not be
 The Ear
provide the
a quiz on a
 part of the human ear
X.  The
 "PHALCON/SKISM
[Ear-6] Alert!
 Where is the $
 1. External Ear
 2. Middle Ear
 3. Inner Ear"
 The "$"
in the second line
be replaced
one of the
c: "Auditory Canal", "Lobe", "Hammer", "Eustacian Tube",
 "Auditory Nerve", or "Cochlea".  If the
replies correctly,
 the
 "Wow, you know your ears! Please resume work."
 If the
replies incorrectly, the
 "You obviously no nothing about ears.
 Try again
study."
 The
in the
and are not
in the
 "[Ear-6] Dark Angel"
of Ear are:
 Anti-Print:
on the Ear
, Anti-Print is a
uof .
bAnti-
 Print
X, the Anti-Print
at the top of
$the
, as
qby the DOS
@by 1,248
, Anti-Print
pof 593
 the
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the Anti-Print
 "PRINT.
Wdetected in
 "=> Anti-PRINT
detonation <="
the Anti-Print
, it
trash
 the
Oif PRINT.
X, along
Ming the
as a
frequently
 Quake-O:
on the Ear
, Quake-O
vup to three
Wor .
in the
pof 960
at the end of the
be no
3to the
>and
in the DOS
.  The
in the Quake-O
 "[Quake-O]"
 "By Dark Angel of PHALCON/SKISM '92"
 "Assistance by Demogorgon on Quake-O routines"
 "Albeit"
 ".. *.exe *.com"
 Suicide:
on the Ear
, Suicide
vup to five
Wor .
in the
pof 2,048
at the end of the
be no
3to the
>and
in the DOS
.  The
in the Suicide
W.. [Suicide]"
 "Written by Dark Angel of PHALCON/SKISM"
 "Ross M. Greenberg blows goats."
 "Your PC has
rby the Suicide
 "I would dis
wmyself, but I despise DOS 2.X"
 "Upgrade now!"
 "Brought to you by PHALCON/SKISM"
now kill myself.  Press D to
 "PHALCON"
 "SKISM"
kat work to make your life"
 "living hell"
PZPAPN
Ebbelwoi
:  Ebbelwoi
^, 1994
=seconds set to 06;
 unexpected access to C:
 Germany
R:  402
5:   PNCK -
 The Ebbelwoi
^, 1994, and
s to be
fGermany.  Ebbelwoi is a
,.  It
on the C:
the Ebbelwoi
wone .
in the C:
pof 402
at the end of the
a.  The
>and
in the DOS
 to be un
, however the seconds field
!set to "06".
 The
in the Ebbelwoi
 "DK*.
-<< Ebbelwoi >> by (
)SiRiUS 10-93 D-63225"
PZPAPN
:  ECU
G:  March,
 England
R:  711
5:   PRhE -
3.96+,
 The ECU
in March,
, and is
 England.  ECU is a
uof .
.  It
 spreads quickly on
bECU
X, the ECU
at the top of
$the
', hooking
{01, 03, 08, and 21.
, as
qby the DOS
@by 1,488
|12's
not be moved.
the ECU
, it
for any reason.
pof 711
at the end of the
a.  The
in the DOS
not be
.  The
in the ECU
 "[ECU] So
is a Well
kECU!"
 "Apache Warrior, ARCV Pres."
 It is
what ECU
PZPAPN
:  Ed
 Finland
R:  779 - 794
5:   PRtAK -
8/93+,
.2.0+
 The Ed
.  It is
fFinland.  Ed is a
uof .
-and .
,.  It spreads quickly on
X, the Ed
at the top of
$the
', moving
|12's
, as
qby the DOS
@by 1,584
{12, 21,
 and 24
mby Ed in
the Ed
, it
-and .
for any reason.
pof 779
 the
at the
"of the
by 779 to 794
at the end of the
a.  The
in the DOS
not be
.  No
in the
 It is
what Ed
PZPAPN
:  Edcl
 Edct
R:  1,600 - 1,615
5:   PRhAK -
, NAV,
3.96+,
.2.0+
 The Edcl
.  It is
(, and is related to the CB-1530
.  Edcl is a
uof .
-and .
 and employs
techniques to avoid detection.
bEdcl
X, the Edcl
at the top of
 but
$the
, as
qby the DOS
@by 2,048
|12's
!moved.
{09, 13, and 21
mby Edcl in
the Edcl
 if it was not
the Edcl
, it
very small ones,
pof 1,600 to 1,615
 at the end of the
.  The
>and
in the
 DOS
not be
.  One
 can be
din the
 "EDCL"
 The
in the Edcl
WBACKUP.
 "Hi to Eastern Digital."
 "Greetings to Mister L."
 "Megafuck to Mihai Sirbu -- MicroTimSoft."
ners
the Edcl
in the
#noticed on .
`, but not on .
`.  .
`may
to be
, the
 same utility
be able to detect the
.  The
 interfer
the operation of the BACKUP.
of Edcl are:
 Edcl-B:
gequivalent to the Edcl
, Edcl-B is a minor
.  It has 21
 differ
fthe
 Edct:
to the Edcl
Nnot hook
|13.  Like Edcl, it adds 1,600 to
 1,615
)to the .
-and .
Zand
aopen.  Two
in the
WBACKUP.
 "Megafuck
fEastern Digital"
 The "EDCL"
in the
1to "edct".
 See:   CB-1530
PZPAPN
:  EDV
 Cursy,
G:  1988
 BSC;
:; unusual
crashes
 France
R:  N/A
5:   BRX -
, NAV,
K/P, CleanUp, or NAV
 The EDV, or Cursy,
Gin Le Havre, France in
 1988 by Jean-Luc Nail.  At
, it was
d the Cursy
 Later, in
, it was
}separately and
d the EDV
is a
uof floppy
the EDV
 the
at the top of high
.  The value
ed by
, any
Kaccessed by the
J, it moves
 the
to side 1, track 39,
 moving the
, it
copies the
 absolute
0, the
of the
 EDV
are accessed.  In
 the case of
Ks, the
move absolute
0 (the
) to side 1, track 39,
8 as
it were
 a 360K 5.25" floppy
moving the
rsix
, the
 EDV
activate.  Upon
, the
access the
|to disable the
 the
b3 tracks of
Kon the
, starting
Ks.
Ks, it
rings a bell, no?
fCursy"
 Upon
, the
must power off the machine and re
Jin order to regain any control over the machine.
 The
cidentification
s at the very end of the
rfloppy
Ks and the
it cannot be seen if the
is in
 "MSDOS Vers. E.D.V."
 Jean-Luc Nail has
the EDV or Cursy
is quite
7in the Le Havre area of France, al
it is
outside
 of France.
PZPAPN
Egg-1000
:  Egg-1000
R:  1,000 - 1,014
5:   PRhEK -
V112+,
 NAV 3.0+,
2.53+,
.2.0+,
V113+
 The Egg-1000, or Egg,
.  Its
.  Egg-1000 is a
uof .
`and
bEgg-1000
X, the Egg-1000
at the top of
$the
', hooking
{21 and
 6C.
, as
qby the
 DOS
@by 1,280
 12's
not be moved.
, the
,if it was not
the Egg-1000
, it
for any reason.
pof 1,000 to 1,014
at the end of the
a.  The
>and
in the DOS
not be
 The
in the
5in all
 Egg-1000
 "[EGG]-1000
 "eat cry sleep pizza cash getbackjack"
 "chickens are good"
 "ribbitribbitmefrogufrogwefrog"
 "egg"
 It is
what Egg-1000
PZPAPN
Eight Tunes
:  Eight Tunes
 1971
i; music;
 West Germany
R:  1,971
5:   PRsA -
, NAV,
:  NAV, or
 The Eight Tunes, or 1971,
by Fridrik Skulason of Iceland.
is a
generic
uof .
W, and overlay
 The
,, or .
 smaller
by between 1,971 - 1,985
Aby 1,984
 present.
Nnot cause
damage; however, it is disruptive.
, it
play 8 German folk songs
 at random intervals thirty minutes
of Eight Tunes are:
 Eight Tunes-Mod1:
to the
.  It has
to avoid detection by
utilities,
 and is not believed to be in the public domain.
PZPAPN
Ein Volk
:  Ein Volk
 West Germany
R:  474 - 559
5:   PNCK -
2.58+,
n1.05+,
2.58+,
6.64+,
1.25+
 The Ein Volk
, and
s to be
fGermany.  Ein Volk is a
the Ein Volk
wall of the .
in the
 of 474 to 559
at the end of the
a.  The
>and
in the DOS
not be
.  The
 the
5in all Ein Volk
 ".. *.
 "Ein volk, Ein reich, ein f
hrer! John.L.VF!93"
 It is
what Ein Volk
PZPAPN
Einstein
:  Einstein
i; TSR
R:  878 - 892
5:   PRsE -
 NAV,
6.64+
 The Einstein
.  Its
.  Einstein is a
uof .
bEinstein
X, the Einstein
as a low
 TSR of 1,136
).  The
hook
the Einstein
, it
pof 878 to 892
).  The
at the end of the
be no
 to the
>and
in a DOS
 Two
can be
in the
5in Einstein
 "exe
 "Einstein"
 It is
what Einstein
, or its
 damage potential.
PZPAPN
:  EkoT
=seconds = 62
R:  2,000
5:   PRtCKX -
, NAV 3.0+,
n1.05+,
8/93+,
K/P +
 The EkoT
.  Its
.  EkoT
Uis a multi-partite
vthe
) and .
bEkoT
X, the EkoT
wthe
.  A copy
 of the
be stored at Side 0,
 Cylinder 0,
5.  The EkoT
location (Side 0, Cylinder 0,
 and the
cthree
.  EkoT
 The next
&s the
fthe
 the EkoT
at the top of
$the
', moving
|12's
, as
qby the
 DOS
@by 2,048
mby the EkoT
the EkoT
, it
 target .
are copied.  It
Nnot
Zor open.
pof 2,000
 be hidden
.  The
 the
"of the
a.  The seconds field in the
 in the DOS
be set to "62".  The
 may not
Eis listed
in the
 The EkoT
is a full
, dis
are loaded into
.  As a
, checksumming
 and
are unaware of the
 detect its presence
it is
 It is
what EkoT
PZPAPN
Eliza
:  Eliza
R:  1,193 - 1,194
5:   PNCK -
, NAV,
 The Eliza
.  Its
.  Eliza is a
Eliza is
X, the
wone .
in the
Nnot always do
.  If
in the
E, it may
 Eliza
pof 1,193 or
 1,194
at the
"of the
,, however, is an exception as it
 not
lany
 had
>and
in a DOS
 The
can be
in the
 Eliza
W*.* MJ"
 It is
if Eliza
PZPAPN
Elvis-1250
:  Elvis-1250
i; TSR;
beeping
R:  1,250
5:   PRsC -
 The Elvis-1250
.  Its
.  Elvis-1250 is a
uof .
, but not
bElvis-1250
X, the Elvis-
 1250
as a low
TSR of 784
mby the
the Elvis-1250
, it
pof 1,250
at the end of the
a.  The
in the DOS
not be
.  The
in the Elvis-1250
5, and are not
 "ELVIS"
 "lives!"
 "is watching!"
 "DON_Maybe he lives here..."
 "Is he really dead? Or Here?"
 "Maybe he has a neighbour next door... (You can make up
 stories as you go along."
 "(C)
Elvis/VFriend, INC. All rights reserved."
 "<Congratulations, you are now
the Elvis
 The Elvis-1250
, accompanied
 by beeping on the
speaker,
it is
.  The
may be
L, along
 the
 "ELVIS lives!"
 "ELVIS is watching!"
 See:   Beta   Ministry
PZPAPN
:  Emf
G:  March,
 North America
R:  404
5:   PNCK -
, NAV,
1.53S+,
.2.0+
 The Emf
in March,
.  It is
fNorth
 America.  Emf is a
uof .
,.  It is possibly related to the
 Scream
the Emf
X, Emf
 search the
Eto locate an
w.  If one is
d, it
rby Emf.
in the
E, Emf may
the Emf
pof 404
at the end of
 the
a.  The
>and
in the DOS
.  The
in the Emf
-Screaming Fist (c)1"
 Emf
Nn't
to do
of Emf are:
 Emf-625: A 625
of the Emf
vone .
in the
pof 625
at the end of the
 The
>and
in the DOS
not be
.  The
in the
5in Emf-625
-Screaming Fist (c)10/91"
:  North America
 See:  Scream
PZPAPN
Emmie
:  Emmie
G:  May,
d on the
may be repeated,
 Israel
R:  2,702
5:   PRhCK -
/, NAV 3.0+,
.2.0+
 The Emmie
Gin Israel in May,
.  It is a
,, employing
techniques to avoid detection.
 The
the Emmie
 the Emmie
at the top of
$the
|12's
!moved.
, as
qby the DOS
 by 2,752
{01, 09, 10, 17, and 21
 by Emmie in
, if not
rby the
the Emmie
, it may
.  It
Nnot
the Emmie
pof 2,702
at the end of the
a.  The
if Emmie is
.  The
>and
 in the DOS
not be
 The
can be
in the
 Emmie
 "My
is Emmie, I am Eddie's sister."
 ".com .
 "It'll tire you too much."
the Emmie
notice
.  The
repeat a
 character entered on the
PZPAPN
Emo-899
:  Emo-899
jon Tuesdays
 Israel
R:  899
5:   PNCK -
8/93+, NAV 3.0A06+,
.2.0+,
1.0A06+
 The Emo-899
, and is
 Israel.  Emo-899 is a
the Emo-899
wall of the .
in the
 899
at the end of the
 The
>and
in the DOS
 not be
.  The
 the Emo-899
 "EMO"
 "\*.com"
 "*.*"
 "RB91"
 The Emo-899
destructive
5intended to format
 the C:
O, but due to a bug in the
5, it
Nn't work.
 Instead,
Zof an
on a Tuesday
 in a
hang.
PZPAPN
End Of
:  End Of
 Israel
R:  783
5:   PRhCK -
8/93S+, NAV 3.0+,
 The End Of
.  It is
fthe
.  End Of is a
uof .
bEnd Of
at the top of
$the
@by 800
), and
End Of is
, it
 a DOS DIR
6is issued.
pof 783
at the
 end of the
a.  The
>and
in the
 DOS
not be
.  The
can be
din the
5in all End Of
 "*.com"
 "end of"
 It is
what End Of may do
PZPAPN
Enemy
:  Enemy
G:  March,
R:  712 - 1,396
5:   PRhAK -
 NAV,
1.53S+,
.2.0+
 The Enemy
in March,
.  Its
.  Enemy is a
uof .
-and .
 The
an Enemy
X, the Enemy
at the top of
$the
, as
qby the DOS
@by 2,048
 by Enemy in
, the Enemy
on the
Oand C:
Oif it
 was not
the Enemy
, it
-and .
the Enemy
 712 - 1,396
at the end of the
a.  The
>and
in the DOS
 The Enemy
is an
, but the
can be
Snear the end of the
 "ENEMY"
 It is
if Enemy
of Enemy are:
 Stranger:
to the Enemy
, the Stranger
adds 746 - 1,435
)to the
-and .
v.  The
in the Stranger
 "I am a stranger in a strange land..."
 "C:\
 The
can be
Snear
 the end of the
 "ranger"
 See:  Scream
PZPAPN
Enemy
:  Enemy
 Keeper.Enemy
^, 1994
`may
to be 644
)too short;
 Canada
R:  644
5:   PRhE -
2.11a+,
V114+,
6.64+,
\2.13+,
V113+,
1.25+,
6.64+
 The Enemy
^, 1994.  It
fCanada.  Enemy
in is a
uof .
.  It is a fast
u, as well as a
 The
an Enemy
at the top of
$the
, as
qby the DOS
@by 1,040
 by the viris in
, it
, or copied.
the Enemy
 644
at the end of the
a.  The
p, however,
be hidden by the
it is
.  The
>and
in the DOS
.  The
in the Enemy
 "[Enemy
in] Crypt Keeper - Phalcon/Skism"
s of
the Enemy
may notice
to be 644
)shorter
normal in a
 DOS
effect
 is due to a bug in the
PZPAPN
Enigma
:  Enigma
 Cracker Jack
 Italy
R:  1,755
5:   PNE -
, NAV,
3.96+,
 The Enigma
, by Alberto Colusa
 of Italy.
is a
uof .
`.  The
sample of
was not a natural
 of the
#on a .
a, so the
may actually be a
 research
Enigma is
X, one .
 the
rby the
by 1,755
).  The
at the end of
9the
is the voice of the Enigma
 the spirits of the hell are coming back!"
 "(C)
by Cracker Jack * Italy * *.exe"
 "newenigmavir"
 It is not
if Enigma
 See:   Yankee 2   Bandit
PZPAPN
Enola
:  Enola
R:  1,864 - 1,878
5:   PRtA -
, NAV 3.0+,
8/93+,
 The Enola
.  It is
 Russia.  Enola is a
uof .
-and .
aopen,
Z, or copy.
the Enola
 the Enola
at the top of
$the
', moving
|12's
, as
qby the
 DOS
@by 2,048
 08 and 62
mby Enola in
the Enola
, it
wor alter
-and .
X, or copied.
 In the case of copying
`, both the source and target
.  Enola
Nnot always
`, it
s alter the
adding less
not function
, and may cause
&s or
the Enola
pof 1,864 to 1,878
 the end of the
a.  The
>and
in the DOS
not be
.  The
 can be
in the
in all Enola
 "comexe"
 "Enola Gay is now flying to SoftPanorama !"
 It is
what Enola may do
PZPAPN
 Argentina
R:  628 - 642
5:   PRhE -
 NAV,
n, NAV 3.0+,
2.58+,
2.58+,
 The
Gin Argentina in
 is a
uof .
 The
X, the
, hooking
|21.
, any attempt by the
 DOS
in an
L.  The
may be "Exec failure" or "Bad
ly, if the
 the Read-
attribute set, it
reset the attribute.
 the
, the
by 628 to 642
 the
at the end of the
a.  The
>and
in the DOS
 the
>and
.  No
in the
PZPAPN
R:  365
5:   PNCK -
30.00+,
2.58+,
.2.0+,
1.25+
 The
U412
.  Its
U412 is a
uof .
U412
wone .
in the
pof 365
 the
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the
5in all
U412
 "..\*.com"
 "ERun
U412 at 0697:4870"
 It is
what
U412
PZPAPN
Estepa
:  Estepa
R:  2,004 - 2,034
5:   PRhAK -
.2.0+,
1.25+
 The Estepa
.  Its
.  Estepa is a
-and .
,.  It
s to be
on the Cartuja
bEstepa
X, the Estepa
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 61,856
mby Estepa in
the Estepa
, it
pof 2,004 to
 2,034
at the end of the
 The
>and
in the DOS
 not be
.  No
in the
 in Estepa
 It is
what Estepa
 See:  Cartuja
PZPAPN
:  ETC
 E.T.C.
G:  May,
R:  700
5:   PRfCK -
, NAV,
 The ETC
(in May,
.  ETC is a
uof .
ETC is
X, the
in low
 hooking
|00.
be no
the DOS
 ETC
wthe
it finds in
 the
E.  If
,, it
by 700
at the end of
`.  The
>and
in the
to the
>and
 ETC
wone .
in the
9the
, (c) ETC"
 "E.T.C. VIRUS,
3.0, Copyright (c) 1989 by E.T.C. Co"
 The last
dnear the end of all
 ETC
Nnot do
PZPAPN
 E-92, Dutch 424,
V-92B,
i; TSR;
&failure;
 "Invalid
Ospecification"
; beeping
R:  421
5:   PRsCK -
, NAV,
 The
V-92
is a
uof .
V-92
as a low
TSR of
 420
mby the
becoming
V-92
by 421
 the end of the
`.   The process of
 in a
hang
tprocess is complete.
V-92
hang.
are expecting
6line
 input may
Mthe
"Invalid
Ospecification" and
 terminate
continue
 to function normally.
 In the year
V-92
.  In
Xthe
repeatedly issue the
accompanied by beeping, scrolling the
V/92 4EVER!"
in the
, and cannot be viewed
V-92 are:
V-92B:
as Dutch 424,
is three
 longer
V-92
PZPAPN
:  Evil
 P1, V1701New, Live
Death 3
failure;
,header
R:  1,701
5:   PRhCK -
, NAV,
:  NAV, or
 The Evil
is of
, and was
to the
 author of
document in
by Vesselin Bontchev.
is one of a
]of three
may be referred
 to as the P1 or Phoenix
es is
 documented separately due to
varying characteristics. The Evil
is a
, generic
uof .
`, and
,.  It is the most advanced of the three
es in
 the Phoenix
 The Evil, or V1701New,
is a later
of the PhoenixD
 The
the Evil
 the
ehigh
 reserving 8,192
mby the
Aby 8,192
 Evil
check to see if the
O's root
8a copy of
,.  If a copy of
rby Evil by
part of the binary zero
 portion of the
, and changing the
header
.  The
,residing in the C:
Oroot
becoming
, the
attempt to
X.  Evil is a better replicator
either the
Phoenix
or PhoenixD, and was successful in
`in all cases on the author's
by 1,701
 Evil is not able to recognize
it has
a, so it may re
`several
in an
1,701
#appended to
 the
 Like PhoenixD, Evil
for any
 reason, in addition to
X.  The simple act of
 copying a .
in both the source and target .
the Evil
[problems
 executing
in a warm re
&of the
ring.  The
, however,
not perform either a RAM
 check or request
>and
, if an autoexec.bat
ais not
 present.
is not related to the Cascade (1701/1704)
 The Evil
employs a complex encryption mechanism, and
ners
able to look for simple hex
 be able to detect it.
is no simple hex
7to all
rsamples.
of Evil are:
 Evil-B:
is an earlier
of Evil, and is a rather poor
 replicator.  It
was not too viable as
hang
the exception of the
 Runme.Exe
the author
.  The Runme.Exe
awas probably the
release
adistributed by
 the
's author.
listed in
9008 as V1701New-B)
 See:   Phoenix   PhoenixD   Proud
PZPAPN
Evil Empire
:  Evil Empire
 Evil Empire-A
 BSR;
 Alberta, Canada
R:  N/A
5:   BRtX -
, NAV,
:  CleanUp, or M-
 The Evil Empire
}in Alberta, Canada, in
is a
uof floppy
and the
).  It
on the
 The
 Evil Empire
 well as
wthe
.  The
at the top of
, but
$the
', and
|12's
be moved.
be 2,048
)less
expected.  The
 having moved the
to cylinder 0, side 0,
6, and
writing a copy of
to cylinder 0, side 0,
0 (the
location).
Evil Empire is
, it
Inon-
 write protected
are accessed on the
moved to
is part of the root
 The
AT", can be
dnear the end of the
 floppy
as well as in the
Imay be damaged
Evil Empire due
 to the
10 of the
E.  If root
Eentries were
be lost.
 A note on dis
sEvil Empire: copying the
6 to
in the
r, but it
now be a non-
K.  If
s, Norton
KDoctor can be used to correct the situation.
may detect Evil Empire as Azusa.
of Evil Empire are:
 Evil Empire-B:
on the Evil Empire
is 1,024
).  It
 moves the
to cylinder 0,
 side 0,
3, and
replaces the
a copy of
copy
extend to
2 as the
 longer
).  On
I, the
 move the
11.  Evil
 Empire-B is a fully
, no
.  The
, however, may be
AT LIVE F
 See:   Azusa
PZPAPN
Exebug
:  Exebug
 Swiss
 BSC;
; inability to access
 Switzerland
R:  N/A
5:   BRtX -
 NAV 3.0+,
:  Norton
KDoctor on
 The Exebug, or Swiss
 It is believed to be
fSwitzerland,
it has
 reported
fAustralia as well.  Exebug is a
and the
).  It uses
techniques to avoid
 detection on both the
Kand
 The
fan Exebug
 the Exebug
at the top of
$the
', moving
|12's
 by 1,024
, the
.  The
be moved to the last
of Side 0, Cylinder 0 of the
K.  The
s Side 0, Cylinder 0,
was the
location of the
the Exebug
, it
on non-write protected
 is accessed for any reason.  On 360K 5.25"
I, the
be moved to Side 0, Track 40,
1.  On 1.2M
 5.25"
I, the
be moved to Side 0,
 Track 80,
 The Exebug
uses
techniques to avoid detection by
software.
to access either the
or a
, the
present the
Exebug,
 access the
&ing
fa write-protected,
 DOS
in the
#inaccessible.
 The
receive the
"Invalid
Ospecification" due
 to the
having
the last 2
)of the
location.  Norton
KDoctor can successfully
 resolve
problem, rendering the
Kaccessible again.
PZPAPN
Experiments
:  Experiments
 Experiments-755
R:  755
5:   PNE -
3.96+, NAV 3.0+,
.2.0+,
1.25+
 The Experiments, or Experiments-755,
.  It is
fthe
.  Experiments is a
uof .
the Experiments
X, the
 Experiments
wall of the .
in the
wvery small .
pof 755
 the
at the end of the
a.  The
 and
in the DOS
not be
.  The
can be
in the
5in all
 Experiments
- Small experiments path 2.1
 It is
what Experiments may do
 See:  Experiments-416
PZPAPN
Experiments-416
:  Experiments-416
G:  March,
R:  416
5:   PNCK -
3.96+,
.2.0+,
1.25+
 The Experiments-416
in March,
, and is
 the
.  Experiments-416 is a
 of .
the Experiments-416
 the Experiments-416
wall of the .
 in the
pof 416
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
can be
 the
5in all Experiments-416
 It is
what Experiments-416 may do
 See:  Experiments
PZPAPN
Explode
:  Explode
G:  May,
Kcylinder 0;
&failure
R:  229
5:   ONCK -
, NAV,
3.96+, NAV 3.0+,
8/93+,
.2.0+
 The Explode
in May,
.  Its
.  Explode is a
 very destructive
the Explode
b229
)of all .
 in the
E.  It
access the
cylinder 0
binary zeros.
 process has completed, the
Land the
be hung:
 "Your
Ois about to explode!"
fthe
Kor an
fail.  If the
J, the
be successful, but the
be unaccessible.
the Explode
lthe
)of the host
the Explode
 The
>and
in the DOS
to the
>and
.  The
-Your
Ois about to explode!"
too big to fit in
 "UABBS -/\-] Ajax [-/\-"
PZPAPN
Explosion
:  Explosion
 Neznamy
R:  1,000
5:   PRhAK -
1.25+
 The Explosion
.  Its
.  Explosion is a
uof .
-and .
bExplosion
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 1,008
mby Explosion in
the Explosion
, it
 and .
pof 1,000
at the end of the
a.  The
>and
in the
 DOS
not be
.  No
 are
in the
 It is
what Explosion may do
PZPAPN
Exunt
:  Exunt
R:  148
5:   PNC -
2.58+,
2.11+,
\2.13+,
6.64+,
.2.0+,
6.64+,
1.25+
 The Exunt
.  Its
.  Exunt is a
uof .
Nnot
wall .
the Exunt
X, the
 Exunt
wone .
in the
 of 148
at the end of the
a.  The
>and
in the DOS
to the
.  The
in the Exunt
 Exunt
Nn't do
PZPAPN
Faerie
:  Faerie
 Faerie-276
R:  276
5:   PNCK -
/, NAV 3.0+,
n1.04+,
6.60+,
2.58+,
V109+,
2.58+,
.2.0+,
1.25+,
6.64+
 The Faerie
.  Its
.  Faerie is a
uof .
the Faerie
X, the
 Faerie
wone .
in the
E.  If
E, it may
the Faerie
pof 276
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
can be
in the
5in all Faerie
-MAND.*.
 "Faerie"
PZPAPN
Fairz
:  Fairz
 Khobar
R:  2,088 - 2,102
5:   PRhA -
n1.04+,
2.58+,
6.60+,
\2.13+, NAV 3.0A06+,
2.58+,
1.25+,
1.0A06+,
6.64+
 The Fairz, or Khobar,
.  Its
.  Fairz is a
uof .
-and .
, but not
bFairz
at the top of
 the
', not moving
|12's
, as
qby the DOS
@by 2,096
mby Fairz in
the Fairz
, it
, but not
 are copied.
2,088 to 2,102
 the end of the
a.  The
>and
in the DOS
to the
 and
.  The
in the Fairz
is an [ illegal copy ] of Keypress
remover"
Halted."
 "Eternal Fair"
 It is
what Fairz
PZPAPN
:  Fat
G:  March,
atruncation;
R:  6,540
5:   ONE -
30.00+,
V112+,
V113+
 The Fat
in March,
.  Its
.  Fat
is a
corrupts the .
the Fat
X, the
 Fat
wone .
in the
 and a filler of hex 00
usually
 not
, but instead may show a
A.  The
b6,540
)of the
be the
5.  The
>and
in the DOS
to the
>and
.  The
can be
 the
5in all Fat
 "hitohana"
 "karu ba"
 "rb C:\ * .* FAT TABLE E"
 "8RROR"
the Fat
not function
.  The DOS
Ton most, if not all,
PZPAPN
Father
:  Father
1to 11-08-91 4:15p
R:  1,449 - 1,463
5:   PRhAK -
, NAV 3.0+,
8/93S+,
.2.0+
 The Father
.  Its
.  Father is a
-and .
.  It is
on the
bFather
X, the Father
at the top of
$the
'.  It
Nnot move
 12's
, as
 by the DOS
@by 1,616
{1C, 21, and 27
mby the
, Father
,if it was not
the Father
, it
pof 1,449
pof 1,449 to 1,463
).  In both cases the
at the end of the
.  The
>and
in the DOS
1to 11-08-91 4:15p.  The
can be
in the
5in Father
 "In
of my father."
 "(C)Nduk '91"
 It is
what Father may do
 See:   CB-1530
PZPAPN
Father Christmas
:  Father Christmas
 Choinka
i; lost cluster; cross-linking of
`; graphic and
 Poland
R:  1,881
5:   PNCK -
, NAV,
 The Father Christmas, or Choinka,
Gin Poland in
on the
, and is a
uof .
the Father Christmas
 the
wone
ain the
 If no
`exist in the
E, the
follow the
path to find an
by 1,881
at the end of the
the Father Christmas
may notice
 cross-linking of
`and lost clusters.
 During the period
?19th-31st of any year,
activate.  On
 a christmas trees graphic is
Lon the
monitor
 the
 Merry Christmas
 a  Happy New Year
 for all my lovely friends
 FATHER CHRISTMAS
 If the graphic is
L, the
must strike a key in order to
lthe
Xfinish running.
of Father Christmas are:
 Father Christmas-B:
, Father Christmas-B
 is a minor
of the Father Christmas
.  It has
!modified to avoid
 detection by a particular
utilitie.  It is
 not in the public domain.
 See:
  NTKC
PZPAPN
:  FCB
R:  384
5:   ONAK -
P, NAV 3.0+,
8/93+,
.2.0+
 The FCB, or 384,
.  It is
is a
uof .
-and .
 It is unusual in
it uses
acontrol blocks (FCBs) instead
ahandles in the process of
the FCB
wone
in the
E.  The
select .
`before .
`for
t, and
E, it may
the FCB
lthe
b384
 of the host
the FCB
5.  The
>and
in the DOS
to the
>and
9the
 "401
vany .
-or .
aon any writeable Device"
 The FCB
Nn't do
are permanently corrupted and must be replaced
fclean,
 backup copies.
PZPAPN
FeelBad
:  FeelBad
, 1994
=seconds = "58"
R:  1,124
5:   PNCK -
V117+,
\2.13+,
6.64+,
n1.05+,
V117+,
1.25+,
6.64+
 The FeelBad
, 1994.  Its
.  FeelBad is a
uof .
the FeelBad
wall of the .
in the
 1,124
at the end of the
a.  The
>and
in the DOS
 to be un
, but the seconds field
!set to "58".
 The
in the
5in all
 "Hello..."
 "We're very sorry for disturbing your session."
 "We just wanted to state
we feel bad about Ritzen."
 "We
ltaken the utmost care to insure
nothing
 has
!damaged."
 "Please go on
whatever You were doing."
PZPAPN
Feist
:  Feist
2; unexpected
R:  670
5:   PRfAK -
, NAV,
 The Feist
.  Its
.  Feist is a
uof .
-and .
 The
the Feist
.  As such,
be no
mby the
the Feist
, it
pof 670
 at the end of the
a.  The
>and
 the DOS
to the
>and
.  The
can be
in the
5in all Feist
 "R.Feist"
the Feist
[unexpected
Tinclude,
 but are not limited to, divide overflow
Tand data
 reading or writing to the
PZPAPN
Fellowship
:  Fellowship
 1022, Better World, Fellow
 Australia
 TSR; .
 Malaysia
R:  1,019 - 1,027
5:   PRsE -
\, NAV,
:  CleanUp,
\, NAV, or
 The Fellowship or 1022
}in Australia in
 Fellowship is a
generic
uof .
`.  It
Nnot
-or overlay
 The
the Fellowship
X, the
as a 2,048
*TSR in low
@by a corresponding 2,048
 now be controlled by the
, the
 by between 1,019 and 1,027
).  The
 at the end of
9the
very close to
 the end of the
is dedicated to
 all fellow PC
s on Earth
 Toward A Better Tomorrow
 And A Better Place To Live In"
 "03/03/90 KV KL MAL"
is believed to
ated in Kuala Lumpur, Malaysia.
of Fellowship are:
 Fellowship-B:
on the Fellowship
adds 1,019 to 1,034
)to the .
v.  The
at the end of the
, and the
>and
in the DOS
to the
>and
.  The
din the
:  Malaysia
PZPAPN
:  FGT
i; loss of CMOS Setup
R:  651
5:   PNCK -
, NAV,
 The FGT
.  Its
.  FGT is a
uof .
the FGT
X, the FGT
search the
Efor up to two
`are
d, the
wthem.  The host
the FGT
pof 651
).  The
at the
 of the
.  The
>and
in the DOS
FGT can be easily identified as
 always start
cASCII
 "PSQRVW"
FGT may
[the machine loosing
of its CMOS setup
x.  In particular, the
 clock may
l"lost power",
ing to a default
>, and the
 invalid.
 setup
can be easily fixed
the Setup utility or
 firmware setup facility on the
PZPAPN
:  Fich
 FichV, CHV 2.1, 903
H:
i; TSR;
 France
R:  903
5:   PRsCK -
\, NAV,
 The Fich
GFrance in
 is not a particularly viable
since
d samples
 further
.  It is possible
sample is
 corrupted.
sample of Fich is
as a 1,216
*low
TSR.  It
hook
|21.  At
, it
 adding 903
)to the
"of the
.  The
 "Fichier introuvable"
wup to three .
in the
Eif the
sample is again
X.  Later
in the
spreading to
 The
the DOS COPY
 used, but
if the source and target
`are in the
pof 903
 the
at the
"of the
 The
>and
in the
not be
 the
 If Fich
sample,
.  The "Fichier
 introuvable"
is not
 sample.
may hang
 The Fich
during the month of March, at
 may
bsix
Qtrack of the
 "CHV 2.1 vous a eu"
translates
fFrench to English as "CHV 2.1 got you".
of Fich are:
 Fich-B:
to the
Fich
.  The
fthe
is never
L.  It has six
 different
fthe
 Fich-C:
to Fich-B,
as an
of Fich-B.
d samples of
are, however,
S.  The
difference
 the Fich-B
mby the
: France,
 Fich-897:
on the Fich
differs in
.  Its
TSR is
 2,256
), hooking
{21 and 24.  It
in the
X, and well as the target
 are copied.  It adds 897
)to the .
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "*.exe **F
W1.0 vous a eu **"
: France,
 See:   Fichv-896
PZPAPN
Fichv-896
:  Fichv-896
 Fich
i; TSR;
 France
R:  896
5:   PRsCK -
, NAV,
 The Fichv-896
}in France in
 Eric Richet.  Fichv-896 is a
uof .
,.  It is
on the  Fich
 The
the Fichv-896
X, the Fichv-896
 as a low
TSR of 1,200
{21, 24, and
mby the
.  If
,was not
rby the
, it
the Fichv-896
, it
in the
ly, it
wthe
Xif it is a .
larger
2K in
the Fichv-896
pof 896
).  The
at the
 of the
.  The
>and
in the DOS
not be
.  Fichv-896 is an
, and no
in the
d samples.
 Fichv-896
 See:   Fich
PZPAPN
:  Fil
G:  March,
:of data
R:  1,658
5:   PRhCK -
 NAV,
3.96+,
1.53S+,
 The Fil
in March,
.  Its
, or
~, is
.  Fil is a
uof .
bFil
X, the Fil
at the top of
 the
qby the DOS
@by 4,112
{09, 1C, and 21
mby the Fil
if it was
 not
the Fil
, it may
X.  Data and overlay
`may
 either
ror corrupted
are accessed.
 The Fil
adds 1,658
)to the .
v.  The
at the end of
rby the
be no
3to the
>and
in the DOS
 The
9ed in the Fil
are usually not
as the
encrypts them:
 "pCbYTE"
 "bANDIT"
 "dEMORALIZED yOUTH"
 "tHIS IS THY PRESENT WORLD"
 "SAID THE fLAME TO THE sPARK"
 "tHOU ART MYSELF"
 "MY IMAGE"
 "AND MY SHADOW"
 "i HAVE CLOTHED-*MYSELF IN THEE"
 "AND THOU ART MY VEHICLE TO THE DAY"
 "bE-*WITH US"
 "WHEN THOU SHALT RE"
-E MYSELF AND OTHERS"
 "THYSELF AND ME"
 The Fil
may corrupt data
`accessed
write intent on
PZPAPN
>11-537
>11-537
1to 8-17-88 2:08a
R:  537 - 553
5:   PNE -
, NAV,
3.96+,
 The
>11-537
.  Its
>11-537 is a
uof .
>11-537
wone .
in the
 537 to 553
at the end of the
.  The
>and
in the DOS
1to 8-17-88 2:08a.  One
in the
>11-537
Nn't
to do
PZPAPN
=seconds = 42
R:  512
5:   PNC -
3.96+,
, NAV 3.0+,
n1.05+,
1.25+
 The
.  Its
is a
uof .
`, but not
,.  It
 not
wvery small .
wone .
in the
pof 512
 the
at the
"of the
.  The
>and
in the DOS
the seconds field
!set to
 "42".  The
in the
 all
 It is
what
may do
PZPAPN
Filler
:  Filler
 BSC;
 Hungary
R:  N/A
5:   BRhX -
, NAV 3.0+
:  M-
K/P or DOS SYS for
 The Filler
.  It was
 reported in the public domain in Hungary in
.  Filler is a
and the
).  Filler is a
it is
not be able to
 detect its
tof the
, and
ldifficulty detecting its presence on
fa Filler
J, the
 Filler
at the top of
$the
A, but
qby the
 DOS
@by 8,192
).  The
, if it
 was not
Filler.
the Filler
, it
wnon-write
 protected
Iexposed to the
.  The
tof the
Jusually
is accessed for
 reason.  The Filler
write a copy of
to the last
 track of the
is not normally accessable by DOS.  It
store the
track.  The
alters the
to the
 The Filler
is a
it is
ning
not detect the presence of the
 Filler
using
ning technology.  CRC-
checking
may be able to determine
.  In the case of the
, if Filler
, neither CRC-
checking or
ning
be able to determine the Filler
's presence.  If you
 suspect you
la Filler
t, power down your
 and
, write protected
J, and
check the
software.
 It is
what Filler might do
PZPAPN
Fingers
:  Fingers
 V08-15, KEZB
G:  May
i; TSR;
 Germany
R:  1,322
5:   PRsAK -
, NAV,
 The Fingers
}in Germany in May,
.  Fingers is
uof .
-and .
 The
Fingers is
X, the
as a low
 of 1,728
).  It
hook 21.  If the
, the
hook
Fingers is
, it
-and .
X.  If
X, it
by 1,322 to 1,337
).  Fingers
dat the end of
.  The
>and
in the DOS
Fingers
9the
 "CRITICAL ERROR 08/15: TOO MANY FINGERS ON KEYBOARD ERROR."
 Fingers
 and the
has entered 3000
fthe
, the
Mthe second
 and the
be halted.
PZPAPN
Finnish-709
:  Finnish-709
 709, Swedish-709
 Finland
R:  709
5:   PRhCK -
, NAV,
 The Finnish-709
 Mikael Larsson of
Help Centre, Sweden.  It is
 Finland.  Finnish-709 is a
uof .
 The
Finnish-709 is
at the top of
$the
, as
qby the DOS
@by 2,560
|12's
 moved.
{1C and 21
mby the
, Finnish-709
by 709
).  The
at the end of
be no
 the
>and
in the DOS
 Finnish-709
Nn't do
of Finnish-709 are:
 Finnish-357:
on the Finnish-709
is a re-written, smaller
.  Its
is 2,048
), hooking
pof 357
at the end of the
a.  The
>and
in the DOS
to the
>and
 Like the
, it
Nn't do
:  Finland
PZPAPN
FireFly
:  FireFly
, 1994
Anti-
 VSAFE disabled in
 flashing of NumLock, CapsLock, and ScrollLock Keys;
R:  1,106
5:   PRhCK -
6.55+,
V112+,
2.58+,
2.11+,
\2.13+,
2.58+,
V113+,
1.25+
 The FireFly
, 1994.  Its
.  FireFly is a
 of .
bFireFly
X, the
 check to determine if VSAFE
s Central
 Software's
/and Microsoft Anti-
is active in
 If VSAFE is active, the
disable it in
.  The
at the top of
', hooking
{1C and 21.
the FireFly
, it
pof 1,106
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the
5in all FireFly
 "By Nikademus"
 "Greetings to Urnst Kouch and the CRYPT staff."
 "Psalm 69"
 "Every day is Halloween"
 "Happiness is Slavery"
 "The land of Rape and Honey"
 "Its Dead Jim"
 The FireFly
selected
utilities if
 the
Ythem
 The more noticeable effect of the
, however, is
 toggle the settings of the NumLock, CapsLock, and ScrollLock keys
 every few seconds
ing in a flashing effect on the
of FireFly are:
 FireFly.1087:
, 1994, FireFly.1087 is a 1,087
of the FireFly
.  Its
is 1,087
), hooking
{1C and 21.
, it
pof 1,087
at the end of the
 The
>and
in the DOS
not be
.  The
in the
 "[FireFly] By Nikademus"
 "Greetings to Urnst Kouch and the CRYPT staff."
 "American Jesus"
 "Dont Pray On Me"
 "Recipe for HAte"
 "Atomic Garden"
 "Its Dead Jim"
effects of
tare
to the
:  Sweden
, 1994.
PZPAPN
:  Fish
Van Fish
es, Fish 6,
G:  May
i; monitor/
Mflickering;
 West Germany
R:  3,584
5:   PRsAK -
\, NAV,
:  CleanUp, NAV, or
 The Fish
}in May
.  At the
 it was reported to be widespread in
V, and it is
ated in West Germany.  It is a generic
u, and
remain
through a warm re
&(CTRL-ALT-DEL).  The
can be
dby searching for
 the
"FISH FI"
ing near the end of the
 The "FISH FI"
may later dis
fthe
 The
the Fish
 the
zing
into the low
.  If
|13 has not
, it
hook
|13.  If it can hook
|13, it
take up 8,192
.  If the
 cannot hook
|13 because an
is already using
 it, it
be 4,096
|13 is not
m, and the
 the
cause a random warm re
&, thus allowing it to
,and hook
|13.  Warm re
&s do not
to randomly
|13 has
, all .
-and .
 are
for any reason
by 3,584
).  The
 cannot be seen by
Eif the
is in
, if a
6is run on an
detect
`.  If
 run
the /F option, it
in lost clusters and
 cross-linking of
 The
slows down video writes, and flickering of the monitor
Mcan be noticed on an
perform CRC checking cannot detect the
tof the
by the Fish
if the
bypass software write-protect
 mechanisms used to protect a
 The Fish
is a modified
of the 4096
it is
 more sophisticated in
it constantly re-encrypts
.  Viewing
 show
s of several fish are present.
 It is
what the Fish
to check to determine if the year of the
of Fish are:
 Fish F: A
of the Fish
 has
to avoid detection by
 utilities.  Its
is 4,096
), hooking
|21.  It adds 3,584
)to the .
-and .
pis hidden
Fish F is
.  The Fish F
 the
in the
 "FISH VIRUS #6 - EACH DIFF - BONN 2/90"
 "TROUT3"
 "MUSKY2"
 "SOLE"
 "PIKE3"
 "MACKEREL"
 "FISH F"
 The "FISH F"
usually
 near the end of
`.  The
Lby the
it is
 Fish II:
on the Fish
is 4,096
Fly hooking
mapping utilities
not indicate
 any
{are
, it
-and .
pof 3,584
be hidden
.  Fish II is polymorphic, and no
in the
5.  The
 encryption is
fthe
in order to
 avoid detection by
familiar
 but not
 Kradee 1.0: A
of the Fish
to avoid detection by
 utilities.  Its
is 4,096
), it
 hooks
mapping utilities
 indicate
{are
m.  It adds 3,584
 to the .
-and .
pis hidden
Kradee 1.0 is
.  The
 Kradee 1.0
8the
in the
 "FISH"
 "COD"
 "SHARK"
 "CARP"
 "BASS"
 "KRADEE VIRUS VERSION 1.00 By Metsys RetupMoc D&R"
 "TROUT"
 "FIN"
 "MUSKYZ"
 "DOLR"
 "PIKE3"
 "MACKEREL"
 "TUNA"
 The
"FISH"
s near the end of all
-and .
`.  The "KRADEE VIRUS"
Lby the
output
be sluggish
Kradee 1.0 is
, and the DOS
indicate
Ton all
 March 1994.
 See:   Revelation
PZPAPN
Fish
:  Fish
 Chinese Fish
G:  March,
Zfailures
 Taiwan
 Eastern
R:  N/A
5:   BRaX -
, NAV,
K/P or DOS 5.0 F
K/MBR on
 DOS SYS on
 The Fish
}in the Eastern
 March
.  The
s to
fTaiwan.
 Fish
&is a
 and the
 The
 the Fish
, the
wthe
 The Fish
vthe
bwriting a copy of the
starting at Side 0, Cylinder
8.  The
5is two
long.  The
copied to Side 0, Cylinder 0,
 The
vthe
at Side 0,
 Cylinder 0,
Fish
, it
wany non-write
 protected
is accessed on the
.  On double
 density 5.25 inch
I, the
at Side 0, Cylinder 39,
3.  The Fish
in the
location, as well
 as at Side 0, Cylinder 39,
1 and 2.  On high density
 5.25 inch
I, the
 Side 0, Cylinder 79,
 in the
location and Side 0, Cylinder 79,
1 and 2.
the Fish
notice
no longer function
, hanging the
Y.  At
s, the
may be
 "Hello! I am FISH, please don't kill me.
 Congratulation 80th year of the Republic Of
 China Building, Fish
help to kill stone
 Written by Fish in NTIT. TAIWAIN  80.10.18"
can be
in the
outside of the
location.
 See:   Generic
PZPAPN
Fisher
:  Fisher
 Fisher-1100
G:  March,
i; DOS
R:  1,100
5:   PRhCK -
3.96+, NAV 3.0+,
.2.0+
 The Fisher, or Fisher-1100,
in March,
 Fisher is a
uof .
should be considered a
bFisher
at the top of
 the
', not moving
|12's
, as
qby the DOS
@by 2,208
mby Fisher in
rby the
if it was not
Fisher is
, it
for any reason.
pof 1,100
be hidden
.  The
in the middle of
`.  The
 and
in the DOS
to be
the seconds field
!set to "62".  The
in the
5in all
 Fisher
 "com
 "(c) Copyright
by Fisher.
 "PUNK-ROCK & BEER FOREVER !"
the Fisher
[the DOS
detecting
Ton all
of Fisher are:
 Fisher-2420: Possibly an earlier
of the Fisher
 are
.  Its
is 2,432
), hooking
{17 and 21.
pof 2,420
 the
pis hidden
Fisher-2420 is
.  The
at the end
 of the
a.  The
in the
5in all Fisher-2420
 "com
 "(c) Copyright
-92 by Fisher.
 March,
PZPAPN
Flagyll
:  Flagyll
`corrupted; .
fail to function
R:  318
5:   ORhE -
8/93S+, NAV 3.0+,
30.00+,
n1.05+,
2.58+,
.2.0+,
1.25+,
6.64+
 The Flagyll
.  Its
.  Flagyll is a
bFlagyll
X, the Flagyll
at the top of
$the
', not moving
|12's
, as
 the DOS
@by 4,096
mby Flagyll in
the Flagyll
, it
b318
by the Flagyll
.  The
>and
to the
 and
.  The
in the
5in all Flagyll
 "-=[Crypt Newsletter 13]=-"
 "Flagyll"
 Flagyll
Nn't
to do
 it corrupts the
of Flagyll are:
 Flagyll-Z:
gvery
to the Flagyll
, the primarily difference is
s the
b371
)of the host .
, and the
>and
in the DOS
not be
.  The
can be
in the
 "-=[Crypt Newsletter 13]=-"
 "Flagyll-Z"
PZPAPN
Flash
:  Flash
; video
flicker
 West Germany
R:  688
5:   PRfA -
, NAV,
:  NAV, or
 The Flash
in West Germany.  Flash
 is a
generic
u, and
`, but not
 The
the Flash
 the
.  976
in high
, and
 a corresponding 976
).  A mapping of
indicate
Flash is
{00, 23, 24, 30,
 ED, F5, and FB are now in
reported
 by DOS, as well as low
used by the operating
and TSRs
Flash is
-or .
Xit is a candi
>for
t.  An
always be
rupon
`are
are greater
always
 688
a graphics capable monitor may
 notice a
flicker
ring at
seven minute
 intervals. The
causes
effect by manipulating
 blanking bits every seven minutes.
PZPAPN
:  Flex
; write protect
 North America
R:  491
5:   PRhCK -
, NAV 3.0+,
n1.04+,
6.64+,
6.64+
 The Flex
.  Flex is a
uof .
,.  It is
fNorth America.
bFlex
X, the Flex
at the top of
$the
, as
qby the DOS
 by 1,008
{09 and 21
mby the Flex
the Flex
, it
pof 491
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the
5in all Flex
 "[FLEX]"
 The Flex
Mthe
 the
monitor:
 "Flex-It-Up gal!"
lsex!"
 "Admiral Bailey"
in the
PZPAPN
:  Flip
 Flip-2343
 West Germany
T; possible
 Switzerland
R:  2,343
5:   PRhABKX -
\, NAV,
:  CleanUp, or
 The Flip, or Flip-2343,
Gin West Germany in
.  It is a generic
u, and
W, and overlay
 as well as alter the
) and
Ks.  It is important to note
the Flip
 is not
wive
 The
the Flip
X, it
in high
as reported by the
6as well as
@by 3,064
).  At
, the copy of
in the C:
Oroot
be apparent
.  The
be slightly modified.  If the
fa floppy,
,on the floppy
 the
be noticeable.
Flip
, any .
-or .
show a
pof 2,343
).  If a
uses an
 overlay
a, the overlay
Flip may
ing in
alinkage
data
`may
 corrupted.
 On the second of any month,
were
Kand
lan EGA or VGA capable
Madapter
 may
[the
Mon the
monitor
#horizontally
 "flipped" between 16:00 and 16:59.
 greater
32 mega
:of the
Klogical
ing.
s, a
 larger
32 mega
)may be
to be slightly less
 32 mega
 Flip can
be passed between
`, and
floppy
do not transfer
 the
of Flip are:
 Flip-2153:
to the
Flip
 an effective
of 2,153
).  Its
 portion at the top of
is 2,672
).  The
 major difference between
and the
Flip-2153 can
fthe
 Flip-2153B:
to Flip-2153,
's major
can now
becoming
 Flip-2153C:
to Flip-2153B,
 has
to avoid detection by
 utilities.
 Flip-2343B:
to the
Flip
is 2,864
), hooking
|21.
a, it is able to
 both .
-and .
out the
needing to be
fthe
 Prism:
to Flip-2153,
to avoid detection by most
utilities
were aware of the Flip
.  Like Flip-2153, it
 adds 2,153
)to the .
-and .
X.  As
members of
], it
vthe
 Raistlin:
to Flip-2153B,
 has
to avoid detection by
 utilities.  Like Flip-2153B, it adds 2,153
)to the .
 and .
Z.  The
in the
 "RAISTLIN I
fSpain"
 "MADRID a favor del consumo de costo!"
Flip
8the
:  Spain
^, 1994.
PZPAPN
Flower
:  Flower
G:  May,
R:  883 - 897
5:   PNE -
3.96+, NAV 3.0+,
8/93+,
:  CleanUp, or
 The Flower, or 880,
in May,
.  Its
.  Flower is a
 of .
the Flower
search the
Efor an
d, the
wit.
it has completed
sthe
 or if no
awas
d, the host
 was
now run.
the Flower
pof 883 to 897
).  The
at the
 end of the
.  The
>and
in the DOS
not be
 The
in the Flower
 "FLOWER"
 "Support the power of women
 Use the power of man
 Support the flower of woman
 Use the word
 FUCK
 The word is love"
released 7
W\* \"
 Flower
11th of any year, at
a trojan
.  The trojan
Mthe
PZPAPN
:  Flue
image may be reversed
 The
R:  1,209 - 2,193
5:   PNCK -
2.58+,
\2.13+,
2.58+,
6.64+
 The Flue
, and is
fThe
.  Flue is a
uof .
the Flue
fone to six .
in the
1,209 to 2,193
 the end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the Flue
 "Hatsjeee!! (C)
by TridenT / [D
RkReY]"
 "Oh, BTW it's
fHolland, and is called.. THE FLUE"
 "For those who are interested
lthe
chex
at the
 very end of the
a: "4975F7C3".
 The Flue
may reverse the
image while it is
 See:   Darkray   Trident
PZPAPN
Fly 1.1
:  Fly 1.1
i; write protect
R:  1,771 - 1,786
5:   PRhAK -
, NAV 3.0+,
n1.04+,
6.60+,
6.64+
 The Fly 1.1
.  Its
.  Fly 1.1 is a
 of .
-and .
bFly 1.1
X, the Fly 1.1
at the top of
$the
', not moving
|12's
, as
qby the
 DOS
@by 3,200
mby Fly 1.1 in
the Fly 1.1
, it
pof 1,771 to
 1,786
at the end of the
 The
>and
in the DOS
 not be
.  The
in the
 Fly 1.1
 "Fly 1.1"
 "Sp-5.0"
the Fly 1.1
[write
 protect
 write protected
PZPAPN
Foetus 1.1
:  Foetus 1.1
 Greece
R:  1,561
5:   PRhAK -
V111+,
V111+
 The Foetus 1.1
.  It is
 Greece and
s to be related to the  A
and its
 Trojector
.  Foetus 1.1 is a
-and .
bFoetus 1.1
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 3,776
mby the Foetus 1.1
Foetus 1.1 is
, it
-and .
 for any reason.
by 1,561
not be
.  The
at the end of
`.  The
>and
in the DOS
not be
.  The
in the
5in all Foetus 1.1
 "FOETUS
1.1 A
 The Foetus 1.1
not allow the
5to be viewed in
to view or list a
in the
substituting hex 00
4for the
utilities
in a
hang.  The
 DOS
any indication of
PZPAPN
FoneSex
:  FoneSex
to dial modem
R:  688
5:   ONA -
n1.04+,
30.00+, NAV 3.0+,
6.64+
 The FoneSex
.  Its
.  FoneSex is a
-and .
the FoneSex
X, the
 FoneSex
wall of the .
-and .
 in the
unless
were
smaller
case
 688
.  The
>and
in the DOS
not be
has completed
sall of the .
-and .
in the
E, it
Mone of the
to the DOS prompt:
 "Out of
too big to fit in
 The FoneSex
8the
in its
 "*.* *.exe \ \dos *.com d"
 "Out of
 "9034600"
 "4545388"
 "2888100"
 "6809100"
 "9038181"
 "4540759"
 "8840758"
 "8965581"
 "6804900"
 "4075240"
 "9038700"
 "7868482"
 The
seven digit numeric
are interpretted as
 phone numbers by the
, and the
attempt
 to send a dialing
6sequence to the
-ports in order
 to activate a modem.
PZPAPN
Forger
:  Forger
i; TSR
R:  1,000
5:   PRsE -
, NAV,
1.53S+,
 The Forger
.  Its
.  Forger is a
uof .
bForger
X, the Forger
as a low
 TSR of 3,376
).  It
{13, 21, and
 CC.  At
, it
search the
 locate two
, and
 them.
the Forger
, it
X.  It
wone .
the Forger
rall .
on the
O, it
start
on the C:
the Forger
pof 1,000
).  The
at the end
 of the
be no
3to the
>and
in the DOS
 Forger is an
.  One
 the
 "*.exe"
 The
in the
 "Socha dsk"
 It is
what Forger
PZPAPN
FORM-
:  FORM-
 Form, Form
&, FORM-18
 BSC; clicking noise
speaker
 Switzerland
R:  N/A
5:   BR -
\, NAV,
:  CleanUp, M
K, NAV, or DOS SYS
 The FORM-
, or Form
&, is a
 floppy and
.  It was
 Switzerland.
 FORM-
, the
as well as seek out
 and
wthe
K.  The floppy
&may or may not
 be successful, on the author's test
ffloppy
FORM-
never succeeded, instead the
 would hang.  It should be noted
by the
 author of
document as a binary
a, and it may
 damaged in
 The
9ed in the FORM-
 binary
by the author of
document:
 "The FORM-
sends greetings to everyone who's reading
.FORM
Nn't destroy data! Don't panic! Fuckings
 go to Corinne."
, however, may not
in all cases.  For example,
 I did not find
anywhere on a
 Form
the FORM-
may notice
 clicking noise may be emitted
fthe
speaker on the 24th
 day of any month.
can be removed
the same technique as used
us.
b, power off the
clean write-protected
J.  The DOS SYS
6can
be used to recreate the
.  Alternately,
fMcAfee Associates may be used to recreate the
of the FORM-
 Form II:
on FORM-18,
in May
.  It is
gequivalent
 to FORM-18,
to avoid detection by most anti-
utilities.
 May,
 FORM-18:
to the FORM-
, FORM-18
on the 18th
 day of the month, at
clicking
be heard
 the
speaker on
clock and
 CMOS.
out a
clock
most likely not
lthe clicking
 FORM-Canada:
to the FORM-18
 a minor alteration.  On
I, it locates the
 remainder of the
5and
 the
btwo
, unused
on the
 marking them as bad
:  Canada
PZPAPN
Frajer-649
:  Frajer-649
 Poland
R:  649
5:   PNCK -
.2.0+,
6.64+,
1.25+
 The Frajer-649
, and is
fPoland.  Frajer-649 is a
 of .
,.  It
Nnot
wvery
 small .
the Frajer-649
wall of the .
in the
are larger
2K.
pof 649
at the end of the
.  The
>and
in the
 DOS
not be
.  One
in the
5in all Frajer-649
 It is
what Frajer-649 may do
of Frajer-649 are:
 Frajer.524:
in March, 1994,
is a 524
of the Frajer-649
.  It
 in low
, not reserving
area.
mby the
, it
pof 524
at the end of the
a.  The
in the DOS
to the
>and
.  No
 the
,  March, 1994.
PZPAPN
Fratricide
:  Fratricide
fail to
 North America
R:  647
5:   ONA -
\, NAV 3.0+,
n1.04+,
30.00+,
6.60+,
6.64+
 The Fratricide
, and
 to be
fNorth America.  Fratricide is a
.  It permanently corrupts the .
the Fratricide
X, the
 Fratricide
wfour .
Wor .
 in the
preference for .
`.  It
 not
it has completed
sfour
 the
either be
ed to the DOS prompt, or the
may be
too big to fit in
the Fratricide
lthe
)of the host
by the
, permanently
 corrupting the
since the
"of the
ais not saved
 by the
.  The
>and
in the DOS
not be
%the
, the
in the
 "Oh, life. I apologize for
terrible thing."
 "It is
for a chance. I'm a person
 "Fratricide - Murders a br
 "-- By Cone -- be ready to see more"
 Under
conditions, the
bfour
 may be
Las a
by the
PZPAPN
Freak
:  Freak
 Turkey
R:  942 - 947
5:   PNCK -
30.00+,
n1.04+,
6.64+,
V117+
 The Freak
.  It
s to be
fIstanbul, Turkey.  Freak is a
uof .
the Freak
X, the Freak
wone .
in the
E.  The next
a Freak
E, the
remove
a.  It alternates between
 and dis
 and
    s by the
may be accompanied by
ance of
 one of the two
 942 to 949
at the end of the
 The
>and
in the DOS
 not be
.  The
can be
in the
5in all Freak
 "Freak"
 "YOUR SYSTEM HAVE A HARMFULL VIRUS : FREAK !!!"
was written in the city of Istanbul by
 Freakeinstein,(c)
 "Press any key to
to DOS"
 "Any key to continue"
 "(Freakeinstein 92-93
 "Killing"
 "Fuck of Armenian Slaughters"
 "Press any key to continue"
 "***.com"
 "$#%#@!@!.gg
 "Freak Was Here..."
rby the Freak
pof 2 to 17
), and
9part of the
at the end of the
 "Freak Was Here..."
 The Freak
Mthe
, where <
.com> is the
of the
 "(Freakeinstein 92-93
 Killing <
.com>
 Any key to continue"
 It may
Mthe
 "YOUR SYSTEM HAVE A HARMFULL VIRUS : FREAK !!!"
was written in the city of Istanbul by
 Freakeinstein,(c)
 "Press any key to
to DOS"
 "Fuck of Armenian Slaughters"
 "Any key to continue"
all of the .
in the
rand dis
rby the Freak
, executing an
in a
hang.
PZPAPN
Freddy
:  Freddy
i; TSR
 Brazil
R:  1,870 - 1,884
5:   PRsAK -
3.96+, NAV 3.0+,
8/93+,
.2.0+,
V116+
 The Freddy
and is
fBrazil.  Freddy is a
uof .
 and overlay
`.  It
,.  It is
 on the
, and
may identify
 it as such.
bFreddy
X, the Freddy
as a low
 TSR of 2,912
), hooking
|21.  It
 one .
in the
the Freddy
, it
Xby the
, plus one
in the
pof 1,870
by a much smaller amount as the
of the slack (hex 00) area at the end of
 of 1,870 to 1,884
).  In all cases, the
 the end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the
5in all Freddy
 "$322/vv"
ly, the
in the
 "Freddy Krg"
 It is
what Freddy
, but it
9destructive
of Freddy are:
 Freddy 2.1: A later
of the Freddy
at the top of
$the
', hooking
 21.
, as
 by the DOS
@by 5,120
).  It
if it was not
, it
-and .
 are
X, as well as
sone
ain the
a DOS DIR
6is issued.
by 2,345 to 2,394
 the
at the end of the
, however,
 as the
part of the hex 00
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the Freddy 2.1
 "Freddy KRueGer 2.1"
:  Brazil  May
 See:
PZPAPN
ew-692
ew-692
R:  692 - 1,362
5:   PNC -
, NAV,
1.53S+,
 The
ew-692
.  Its
~, is
ew-692 is a
uof .
.  It
Nnot
ew-692 is
wall
in the
it completes
sall of the .
in the
E, it
start
sthe .
on the C:
the root
E.  Needless to say,
process
s in a very long
Kaccess.
ew-692
normally
by 692
at the
 of the
a.  The exception is
in the case where the
 host
was less
), the
 1,364
be no
3to the
>and
in the DOS
 The
can be
in the
 all
ew-692
 maa"
 "*.* *.com"
-MAND.MKS_VIR"
 It is
ew-692
PZPAPN
Frere Jacques
:  Frere Jacques
 Frere
, Frere Jacques-B, Frere Jacques-C,
 Frere Jacques-D, Two Tigers
G:  May
 music (Frere Jacques) on Fridays
 California,
R:  1,808 - 1,822
5:   PRA -
\, NAV,
:  NAV, or
 The Frere Jacques
}in May,
.  It is a
generic
W, and Overlay
`.  It
Nnot
on the
 The
X, the
in low
. The
occupies 2,064
), and attaches
|21.
becoming
, Frere Jacques
wany
by between 1,808
)and 1,822
`always
by 1,813
Frere Jacques
, as well as execu
`increasing in
intermittently
, thus
ing in the possible loss of
data.
 On Fridays, the Frere Jacques
, and
play the
 tune "Frere Jacques" on the
speaker.
of Frere Jacques are:
 Frere Jacques-B:
to Frere Jacques,
 play the tune "Frere Jacques" on the
speaker
 every few minutes on Fridays.  On Fridays, it
la 2,112
*TSR in
 08, 21, and 22
 Frere Jacques-C: Frere Jacques-C differs
fFrere Jacques-C
 by two
in its
5.  Unlike the
Frere Jacques,
play music
 every few minutes on any day of the week.  Its
TSR is always 2,064
{08 and 21
 Frere Jacques-D: Frere Jacques-D is
to Frere Jacques-C,
 however it
play music on Fridays, and the
 delay before the music starts is longer.  On
 Fridays, its
TSR is 2,064
{08 and 21
see:
PZPAPN
Friday 13th
:  Friday 13th
 Friday The 13th
-, South African,
, 1987
i; floppy
Kaccess;
adeletion
 Republic of South Africa
R:  512
5:   PNC -
, NAV,
\, NAV, or
 The
Friday 13th
ed in South
 Africa in 1987.  Unlike the
(Friday the 13th)
es, it
 is not
, nor
Nit hook any
`, but not
,.  On
a, the
looks for two
`on the C:
Oand one on the A:
O, if
is extremely fast, and the
indication of propagation
ring is the access light
#on for the A:
O, if the
;default
Ois C:.  The
.  The
t, must be less
64K in
 On every Friday the 13th, if the host
X, it is
of Friday 13th
-are:
 Edge:
to the QFresh
 Edge has three
differ. It
8the
 "v w x".
 Friday 13th-540C:
, Friday 13th-540C
 is a modified
of the
 It has
to avoid
#detected by a specific
utility, and is not believed to be in the public
 domain.
 Friday 13th-978:
, Friday 13th-978
 is a modified
of the
 It has
to avoid
#detected by a specific
utility, and is not believed to be in the public
 domain.  Friday 13th-978 adds 978
)to .
 Friday 13th-B: same, except
wevery
 the
Eor in the
path if
 the
is in the
path.
 Friday 13th-C: same as Friday 13th-B, except
"We hope we
ln't inconvenienced you"
ever the
 Friday 13th-D: Friday 13th-D was
fthe NCSA.
adds 418 to
 432
v.  It
 all .
, except
 the
ever an
lhad
>and
in the
to the
>and
.  The
be be
at the end of the
a.  On
 Friday The 13ths, the
 Friday 13th-NZ:
fDr. Henry Wolfe of New Zealand
, Friday 13th-NZ is a minor
of the Friday 13th
.  It
`in the
X, adding 623 to 634
)to the
.  The actual
of the
 however, is 350
).  The
 the end of the
a.  It
Nnot
on Friday The 13ths.
 QFresh:
fSweden in
, QFresh is a 615
of the Friday 13th
.  It
vall .
 in the
 of 615 to 628
at the end
 of the
a.  The
>and
in the DOS
not be
9the
in the
 QFresh
 "ENET_INF"
:  Sweden
-B: A 542
of Friday 13th,
 of the .
in the
X, along
Ming the
 "WARNING
!  THIS PROGRAM IS INFECTED WITH VIRUS-B!
 IT WILL INFECT EVERY .
-FILE IN THE CURRENT SUBDIRECTORY!"
pof 542 to
 555
at the end of the
a.  The
>and
in the DOS
not be
%the
, the
can be
in the
 1988.
PZPAPN
Friends
:  Friends
R:  1,362 - 1,377
5:   PRtE -
 NAV,
1.53S+,
 The Friends
.  Its
.  Friends is a
uof .
and spreads very quickly.
bFriends
at the top of
 but
$the
', moving
|12's
, as
qby the DOS
@by 2,096
 21 and 24
mby Friends in
, the Friends
wone .
 in the
the Friends
, it
or batch
 a DIR
6is performed, or
 any reason.  In the case of the DOS COPY
6, the target
rif it is an .
the Friends
pof 1,362 to 1,377
).  The
 the end of the
.  The
>and
in the DOS
not be
.  Three
in the
5in Friends
 "GSJFOET!PG!NBJT!boe!DMBVEJB!TDIJGGFS"
 The
S, but un
 the
gets its
 "FRIENDS!OF!MAIS!and!CLAUDIA!SAHIFFER"
 It is
if Friends
 See:   Cossiga
PZPAPN
Frodo Soft
:  Frodo Soft
 Warsaw, Poland
R:  563
5:   PNCK -
3.96+, NAV 3.0+,
 The Frodo Soft
.  It is
fWarsaw, Poland.  Frodo Soft is a
uof .
,.  It should not be
 confused
the  4096  or Frodo
are not related.
the Frodo Soft
wone .
in the
E, it may
the Frodo Soft
pof 563
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in the
5, and hence not
 "*.com"
 "Gmks*.exe"
 "(c) Frodo Soft"
 It is
what Frodo Soft
of Frodo Soft are:
 Frodo Soft-458: An earlier
of the Frodo Soft
vone .
pof 458
 the
at the end of the
a.  The
in the
?com"
 "mks
?.exe"
 "(c) Frodo Soft"
:  Warsaw, Poland
PZPAPN
Frogs
:  Frogs
 Frog's Alley
G:  March,
; FAT &
Edamage;
Kvolume label
3; long
Kaccess
R:  1,500
5:   PRCK -
, NAV,
 The Frogs, or Frog's Alley,
in March,
 David Grant of the
is a
uof .
Frogs is
in low, unreserved
{09, 20, 21, and 2F
mby the
, Frogs
,and one
ain the
becoming
, Frogs
wone .
Xor a DIR
 performed.  In either case, long
Kaccesses
be noticeable
 either
X, or as the DIR
6completes.  .
`are
was 1,500 or more
Frogs
 1,500
), and the
>and
in the
to the
>and
.  The
at the
 Frogs
on the 5th day of any month.
Xon the 5th, the
 "(V) AIDS R.2A - Welcome to Frog's Alley !, (c) STPII Laboratory - Jan
again be
ever a DIR
 performed.  The
L, the
 remove the
`and
fthe
still be accessible until
removed, or
 the
is no longer in
is no longer in
, the
Mthe volume label "s Alley !" and
a DIR
6is performed.  The
K's FAT and
 root
 multiple
symptom's of Frogs are long
Kaccess
executing
or performing DIR
6s, as well as occasional unexpected
 accesses to the B:
intensive applications
hang
Frogs is active in
of Frogs are:
 Frogs-B:
to the
 the
"Diabolik!" near the end of the
 in all
PZPAPN
Fu Manchu
:  Fu Manchu
 2080, 2086, Fu Manchu-B
G:  March, 1988
 .SYS, .BIN, .
-, & .
R:  2,086 (.
`) & 2,080 (.
5:   PRsA -
, NAV,
, NAV, or
 The Fu Manchu
attaches
to the
"of .
 or the end of .
wany execu
ooverlay, .SYS, and .BIN
`as well.  It
s to be a rewritten
of the
 possible creation
>of 3/10/88.
 A marker or id
usually
is 'sAXrEMHOr',
uses the 'rEMHOr' portion of the
 identify
 One out of sixteen
in a
zed, and
a random amount of
, the
, "The
 world
hear
fme again!" is
Land the
&s.
Lon an
a warm re
Nn't survive in
1, 1989, the
monitor the
buffer,
 and
add derogatory comments to the
s of various
 politicians.
comments go to the
buffer, so
 effect is not limited to the
M.  The
in the
 are
is very
in the
of Fu Manchu are:
 Fu Manchu-B:
gthe same as Fu Manchu,
 seven
in order to avoid detection by
products.
see:
 Taiwan 3
PZPAPN
Funeral
:  Funeral
i; music;
 Eastern
R:  921
5:   PRhAK -
 NAV 3.0+,
30.00+,
 The Funeral
.  It is
fEastern
V.  Funeral is a
-and .
bFuneral
X, the Funeral
at the top of
$the
, as
qby the DOS
@by 976
{08 and 21
 by the
, the
 the
© of
,if it was not
the Funeral
, it
pof 921
at the end of the
a.  The
>and
 the DOS
to the
>and
the Funeral
for 1 hour, it
play a short funeral march on the
speaker, and
.  The funeral march is the same as the
 tune played by the ZK900
PZPAPN
Fungus
:  Fungus
 X-Fungus
G:  May,
 Australia
R:  1,422
5:   PRhAK -
, NAV 3.0+,
.2.0+
 The Fungus
Gin Australia in May,
.  It is
uof .
-and .
,, and employs
techniques.
bFungus
X, the Fungus
at the top of
$the
, as
qby the DOS
 by 2,048
{08 and 21
mby the
|12's
!moved.
 the
,, if it was not
the Fungus
, it
 intermittently
-and .
 of 1,422
not be
 if the
.  The
 the end of the
a.  The
>and
in the DOS
 Several
can be
in the
5in Fungus
 "*X-Fungus by Harry McBungus*"
 "*Nugga!*"
 "*Greets SCP*"
 "*Greets RABID*"
 "* Patricia: Grow
ming knowledge *"
 "*Grease me!*"
 "*Epileptic Downer*"
%the
the Fungus
the DOS
PZPAPN
Fuse Box Dwarf
:  Fuse Box Dwarf
`created
R:  23,656
)And Over
5:   SNE - Spawning
3.96+,
/2.0+,
V112+,
V113+
 The Fuse Box Dwarf
spawning or companion
by creating a corresponding .
.  Not all of the
 companion .
`created by the
, however,
actually
9the
the Fuse Box Dwarf
wone .
ain the
 creating a .
the same base
companion
be 23,656 or more
 actual
5, and
lthe
>and
.  The
in the
 last
#repeated multiple
WPATH"
-SPEC
-SPEC"
 "Dreeb! Dreeb! I am the fuse box dwarf!"
 For
btwo .
`in any
E, the
 companion
`created by the
be 41 or more
and do not
9the actual
simply
 the
repeated a random number of
 "Dreeb! Dreeb! I am the fuse box dwarf!"
PZPAPN
FWord-383
:  FWord-383
R:  383
5:   PNCK -
30.00+,
3.96+,
n1.04+,
n1.05+,
.2.0+,
6.64+
 The FWord-383
.  Its
.  FWord-383 is a
uof .
the FWord-383
wone .
in the
pof 383
 the
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the
5in all
 FWord-383
 "FUCK YOU"
PZPAPN
:  G2
H:
 Depends on
present
R:  Depends on
present
5:   PONRAK -
&/or
, NAV 3.0+,
1.25+
 The G2
is not actually a
, but rather a group or
were generated
the G2
generator.
 particular
generator is a modified
of the
generator, the major
#in the encryption mechanism.
 The
es listed
$are G2 generated
es.
using
ning technologies may identify them as
 G2,
, or by the actual
G2 generated
(es) are:
 G2-A429: The G2-A429
.  It is
uof .
 but not
,.  It
`in the
pof 429
at the end of the
 The
>and
in the DOS
not be
.  The
in the G2-A429
 "[PS/G
] Testing [G2 A] *.
advanced
ts of G2-A429 may find
to "dis
fthe
 G2-A438: The G2-A438
.  It is
uof .
 G2-A438
in 2,480
at the top
$the
', hooking
|21.
, it
pof 438
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
 all
 "[PS/G
] Testing [G2 A2]"
 G2-A615: The G2-A615
.  It is
uof .
-and .
,.  It
vall of the
-and .
`in the
pof 615
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the G2-A615
 "[PS/G
] Testing [G2 A] *.
jfrequently
 G2-Celeste: The G2-Celeste
 It is a
uof .
, but not
,.  It
vup to five .
`in the
pof 310
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
can be
in the
5in all
 G2-Celeste
 "[PS/G
] Straylight ][ Celeste
 G2-D598: The G2-D598
.  It is
uof .
-and .
bG2-D598
 in 9,984
at the top of
$the
', hooking
|21.
, it
-and .
 are
pof 598
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
 all
 "[PS/G
] Captain [G2 D]"
 G2-E513: The G2-E513
.  It is a
uof .
.  It
vup to five .
`in the
pof 513
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the
5in all G2-E513
 "[PS/G
] Captain [G2 E] *.
 G2-Mudshark: The G2-Mudshark
, 1994.
 It is a
uof .
,.  It
vone .
ain the
pof 314
at the end of the
 The
>and
in the DOS
not be
.  The
in the
5in all G2-Mudshark
 "[PS/G
] pentagrame mudshark *.
, 1994.
 G2.Punisher: The G2.Punisher
^, 1994.
 It is a
uof .
-and .
bG2.Punisher
at the top of
$the
 DOS
', hooking
|21.
, as
qby the DOS
@by 1.2K.  The
 bug, so it
in increments of 1.2K as
 well.
, it
pof 602
at the end
 of the
a.  The
>and
in the DOS
not be
.  The
in the G2.Punisher
 "[PS/G
] Punisher Death Destruction Mayhem"
^, 1994.
 See:
PZPAPN
:  Geek
H:
R:  450 - 466
5:   PRfAK -
, NAV,
3.96+,
.2.0+
 The Geek
.  It is
 the
.  Geek is a
uof .
bGeek
X, the Geek
.  It
Fly hooks
{, and no
to the
 Geek
to map
various
 utilities.
the Geek
, it
by 450
by 456 to 466
).  In both
 cases the
at the end of the
a.  The
>and
in the DOS
.  One
in the Geek
 "GEEK"
 Geek
on the 29th day of any month, at
a random
on the
PZPAPN
Generic
:  Generic
H:   N/A
R:  N/A
5:   G - Generic
 The Generic
is not actually a specific
, but a general
 category or group of
can be genericly detected by
software using
ner technology.  It was
 implemented by McAfee Associates in
 The
es detected by the Generic
detection mechanism in
are generally
on the
not all
 of them are related to
es may
`, or both .
-and .
 be malicious.  While most of the
es are
 them are
us.
may be
 detected as the Generic
include:
 Beast-N-Black
 Father Christmas
 Ghostballs
 Grither
 Infinity
 Iraqui Warrior
 Lisbon
 MSTU
 NTKC
 Polish 217
 Polish 583
 R-10
 Socha
 Traveller
 VHP2
 Viperize
 New
es may
be detected by
mechanism
are not
 documented in
.  If you detect a Generic
, and it
 not match one of the
es, please submit a sample to the
 author of
for analysis and inclusion in
PZPAPN
Generic
:  Generic
G:  N/A
R:  N/A
5:   GBX - Generic
:  DOS SYS or M
may detect
es using techniques
look for
functions or characteristics
in the
may identify such
es as "generic
may be identified by
as Generic
&, and are identified in separate entries in
 Fish
 Guillon
 Keydrop
 Queens
 Tony
 Windmill
 If you
detected as a generic
 not match one of the
, please submit a copy of it on
 to the author of
for inclusion in the next release.
PZPAPN
Genesis
:  Genesis
 Genesis.217
, 1994
fail to
Moutput;
R:  217
5:   PNCK -
 The Genesis or Genesis.217
, 1994.
is a
uof .
the Genesis
wall of the .
in the
pof 217
 the
at the end of the
a.  The
 and
in the DOS
 the
>and
.  The
in the
 "[Genesis 1.0]Thor*.
in the
ed to the DOS prompt, rather
having the expected
 of the
of Genesis are:
 Genesis.226: A later
of the Genesis
adds 226
)to the .
v.  Unlike the
 not
,.  The
in the DOS
not be
 The
in the
 "[Genesis 2.0]Thor*.
Genesis.226
function
1994.
 Genesis.238: A later
of the Genesis.226
adds 238
)to the .
v.  The
in the
 "[Genesis 3.0]*THOR.
Genesis.238
function
1994.
 Genesis.295: A later
of the Genesis.238
adds 295
)to the .
v.  The
>and
in the DOS
to the
>and
.  The
in the
 "[Genesis 4.0]*THOR.
Genesis.295
function
1994.
PZPAPN
Geodesic 2.0
:  Geodesic 2.0
^, 1994
=seconds
1to 8:58:08a
R:  666
5:   PRhAK -
6.64+,
6.64+
 The Geodesic 2.0
^, 1994.  Its
is a
uof .
-and .
bGeodesic 2.0
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 1,632
mby the
, the Geodesic 2.0
pof 666
at the
 end of the
a.  The
>in the DOS
not be
, but the
stamp
 to 8:58:08a.  The
in the
 Geodesic 2.0
 "Geodesic Propagation v2.0"
 "Copyright (c)
by Cerebral Quantas, T.O.C."
 It is
what Geodesic 2.0
PZPAPN
Gergana
:  Gergana
 Gergana II, Gergana III, Gergana IV, Gergana-222, Gergana-300,
 Gergana-450, Gergana-512, Gergana-182B
G:  May,
R:  182
5:   PNCK -
, NAV,
 The Gergana
in May,
.  It is
 Gergana is a
uof .
Gergana is
X, Gergana
wthe
in the
E.  If
Gergana, it
be re
 The
search the currect
Oand
Efor an
one is
, the
wit, increasing the
by 182
).  The
at the end of the
.  The
>and
in the
to the
>and
 Gergana may
wthe .
in the
all .
in the
to be a bug
in the
 Gergana
Nnot do
of Gergana are:
 Gergana-182B:
on the
*Gergana
has one
differs.  It
 Gergana-222: A 222
of Gergana,
 not re
`.  Like Gergana,
lhad
>and
1to the
>and
.  It
wvery small
`.  The
 can be
`: "Gergana II -BUL3" and
-".  The
at the
 Gergana-300: A 300
of Gergana,
lhad
in the DOS
E.  It
wvery small .
`.  The
can be
`: "Gergana /",
 "III", and "*.
-".  The
at the
 Gergana-450: A 450
of Gergana,
to Gergana-300.  It
at the
-", "GERGANA", "-IV
e", and
r. Press [Enter] to continue."
 Gergana-512: A 512
of Gergana,
wtwo .
`(but not
 in the
by 512
 at the
"of the
be no
 in the
>and
in a DOS
.  The
can be
 "Gergana V"
 "For nice
call [359][032] 557-643."
 "[Enter] to continue."
 Typically,
fail to
Ming random
PZPAPN
Ghostballs
:  Ghostballs
 Ghost
&, Ghost
-, Ghostballs.1
 Extinct
, 1989
 Moving graphic
:; BSC
 Iceland
R:  2,351
5:   PNCB -
, NAV,
: CleanUp,
, NAV, or
`& DOS SYS
 The Ghostball,  Ghost
&, and Ghost
es were
, 1989 by Fridrik Skulason of Iceland.  The Ghostballs
vgeneric .
`, as well as altering
Ghostballs is
X, Ghostballs
 search the
Efor an
 If an
d, it
r, the
 increasing the
by 2,351
). The
 at the end of
Ghostballs
9the
 "GhostBalls, Product of Iceland
 Copyright (c) 1989, 4418 and 5F10
 MSDOS 3.2"
 Ghostballs
alters the
, replacing it
to the Ping Pong
 however,
are very
to the Ping Pong
, and
 random
:may
 The Ghostballs
was the
could
 both
case) and
 the
r, the
[s the bouncing
 ball effect of the Ping Pong
.  If the
to remove the
t, it
again
 corrupted the next
 The Ghostballs
on the
5of two
 The .
uportion consists of a modified
of the
.  The
portion of the
on the
 Ping Pong
 To remove
, turn off the computer and re
fa write
 protected
Jfor the
use either M
 the DOS SYS
6to replace the
on the
K.  Any
`must
be erased and
 replaced
clean copies
fyour
distribution
of Ghostballs are:
 Ghostballs.1:
gidentical to the
Ghostballs
differs by 4
PZPAPN
Gidra-469
:  Gidra-469
=seconds set to "62"
R:  469
5:   PNCK -
V111+,
/2.1+,
2.58+,
n1.05+,
6.64+,
1.22+,
V111+,
.2.0+,
2.58+,
6.64+
 The Gidra-469
.  Gidra-469
 is a
uof .
the Gidra-469
wall of the .
in the
the exception of
pof 469
).  In the case of
be no
pas the
)of hex 00
at the end of the
a.  In both cases, the
at the end of the
a.  The
>and
in the DOS
to be
the seconds field
 set to "62".  The
in the
5in all Gidra-469
 "I'm GIDRA v1.6:   Life is Good, But Good Life Better Yet."
-MAND"
 "GD"
 The last
, "GD",
s at the very end of all
PZPAPN
Gingerbread Man
:  Gingerbread Man
 Bad Seed
7- Australia
G:  March,
=seconds = 60
 Australia
R:  2,774
5:   PRatAX -
W, &
n, NAV 3.0+,
`& replace
 The Gingerbread Man, or Bad Seed,
Gin Australia
 in March,
.  Gingerbread Man is a
multi-
 partite
-and .
as well
 as the
.  Its
ing mechanisms are
 very advanced, and it is
bGingerbread Man
X, the
 Gingerbread Man
, hooking
{13 and 21.
, as
qby the DOS
not be
.  It
wthe
), altering two
)and
writing a copy of the
5starting at side 0,
 cylinder 0,
2.  The alteration to the
is hidden
as the
 present an
copy of the
ever it is
 attempted to be accessed.
 Later,
fthe
K, the
 Gingerbread Man
at the top of
, but
$the
', moving
 12's
, as
qby the DOS
not be
@by 3,072
the Gingerbread Man
, it
-and .
ed to by the
-SPEC en
mental variable (usually
 are
, or copied.  In the case of
copies,
 both the source and target
the Gingerbread Man
pof 2,774
at the end
 of the
a.  The
pis not
as the
hides the
p, as well as
ever
are accessed.  The
 and
in the DOS
seconds field
 to 60, the
tmarker for the
 The
are un
in the
 and may be viewed in
`, and on cylinder 0 of
is not
 "PTT (You can't catch the Gingerbread Man!"
 "Bad Seed - Made in OZ!"
-SPEC="
 "MEM"
 "10/23/92"
 Since the Gingerbread Man
is a full
, dis
"on the fly", checksumming
be unable to detect
 the
it is
.  The
lock up
 the
if the
determines
a debugger is in
 use.
PZPAPN
Gippo
:  Gippo
i; beep emitted
speaker
R:  661 - 671
5:   PNE -
V112+,
2.11a+,
6.64+,
\2.13+,
V111+,
.2.0+,
6.64+,
1.25+
 The Gippo
.  Its
.  Gippo is a
uof .
the Gippo
X, the Gippo
wone .
ain the
O's root
ts usually
fa sub-
fthe root
 in very advanced cases.
the Gippo
pof 661 to 671
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the
5in all Gippo
 "BABE BABE"
 "G.I.P.P.O. is here!"
 "*.* *.
 A beep may be emitted
fthe
speaker
 are
of Gippo are:
 Gippo.Bumpy:
, 1994, Gippo.Bumpy is a 1,045
of the Gippo
 Its
is 1,200
), hooking
|21 at
 the top of
$the
, it
 of 1,045 to 1,055
at the
 end of the
a.  The
>and
in the DOS
to be un
 seconds field
!set to "02".  The
in the
5in all
 "Bumpy  (R) Ghost Player"
:  Italy
, 1994.
 Gippo.Earthquake:
in March, 1994, Gippo.Earthquake is a
 883
of the Gippo
.  It
vone .
in the
pof 883 to 893
at the end of the
a.  The
in the DOS
is set to 4:08AM.  The
in the
5in all
 "Earthquake"
 "*.e?e"
 "*.*"
 It is
what Gippo.Earthquake may do
:  Bologna, Italy  March, 1994.
 Gippo.JumpingJack:
in May, 1994, Gippo.JumpingJack is a
 907
of the Gippo
.  It
vone .
in the
pof 907 to 917
at the end of the
a.  The
in the DOS
is set to 4:08AM.  The
in the
5in all
 "JumpingJack"
 "*.e?e \"
 "G *.* smartc*.cps"
 It is
what Gippo.JumpingJack may do
:  Italy  May, 1994.
 Sunrise:
, 1994, Sunrise is a 1,036
of the Gippo
.  It
in the
X.  Sunrise
pof 1,036 to 1,046
at the end of the
a.  The
in the DOS
not be
 The
in the
 in all Sunrise
 "* Sunrise * EpidemicWare"
 "G.I.P.Po. oct-93"
 "sunrise"
 "*.exe \ *.* smartc*.cp?"
 Sunrise may interfer
the functioning of
 of the
/and
, 1994.
 Gippo.Stunning:
in March, 1994, Gippo.Stunning is a
 1,240
of the Gippo
.  Its
is 1,392
), hooking
|21 at the top of
$the
 DOS
, it
, or copied.
pof 1,240 to 1,250
 the
at the end of the
a.  The
>and
in the DOS
to be un
the seconds field
!set to "02".  The
in the
5in all
 "Stunning Blow (R) Ghost Player Italy"
 "*.CPS"
may interfer
the functioning of
 of the
/and
:  Italy  March, 1994.
PZPAPN
Gipsy-304
:  Gipsy-304
=month = "13"
R:  304
5:   PNCK -
30.00+, NAV 3.0+,
1.53S+,
1.25+
 The Gipsy-304
.  Its
.  Gipsy-304 is a
uof .
,.  It is
 related to the  W13  group of
the Gipsy-304
wone .
in the
pof 304
 the
at the end of the
a.  The
 in the DOS
 month field is now equal to "13", the
tmarker.  The
in the
5in all
-GIPSY"
 See:  W13
PZPAPN
Gliss
:  Gliss
 Germany
R:  1,247
5:   PNCK -
, NAV,
 The Gliss
fGermany in
.  Gliss
 is a
uof .
the Gliss
X, the
search the
Efor an
w.  If one is
d, it
wit, and
placement not exact
$, and "
as the base
of the .
has just
 "Dies ist ein Demonstrations-Computer
 So gerade eben wurde das
 von diesem
befallen. Der VIRUS hangt
 sich an alle
`- in Laufwerk A - mit der
 Extention .
-an. Die
me bleiben
 aber ablauffahig.
 Falls Sie Fragen zu Computerviren oder
>nsicherheit und
>nschutz beim Einsatz von Personal Computer haben, fordern
 Sie unsere
xsbroschure :
 - Der sichere und kontrollierbare PC - an.
 Gliss & Herweg GmbH
inusstrabe 7-11
 D-5020 Frechen-Konigsdorf"
 If an
ais not
d, the
placement not exact
 "Alle Com -
me in Laufwerk A sind mit diesem
 VIRUS schon infiziert!
 Falls Sie Fragen zu Computerviren oder
>nsicherheit und
>nschutz beim Einsatz von Personal Computer haben, fordern
 Sie unsere
xsbroschure :
 - Der sichere und kontrollierbare PC - an.
 Gliss & Herweg GmbH
inusstrabe 7-11
 D-5020 Frechen-Konigsdorf"
the Gliss
pof 1,247
at the end
 of the
a.  The
>and
in the DOS
.  All of the
can be viewed in
 Gliss
Nnot do
PZPAPN
Globe
:  Globe
 Read-
, Hidden .
R:  6,610
5:   SNE - Spawning
, NAV 3.0+,
n1.05+,
1.25+
 The Globe
.  It is a
 spawning or companion
.  Its
the Globe
X, the Globe
wone .
in the
E.  It
by creating a .
the same
 base
9the
5, and
 be 6,610
the Read-
and Hidden attributes set.  It
8the
 "Glo"
3 M.00"
 "PATH"
WKCO"
fBorland's Turbo C compiler.
the Globe
of Globe are:
 Globe 3.0
, Globe 3.0 is a non-
uof .
-and .
, but not
,.  It
vone .
 or .
in the
pof 5,150
at the
"of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all
 "MAND"
 "HELLO!!"
 "GlobeViru"
 "V3.00"
Globe 3.0 may
decreasing by
5K of RAM
PZPAPN
Gnose
:  Gnose
 Irish3, V-20
G:  May,
i; hidden .
`; write protect
 on write protected
I; TSR
 Ireland
R:  1,164
5:   SPRsAK -
& Spawning
, NAV 3.0+,
.2.0+,
1.25+
 The Gnose, Irish3, or V-20,
Gin Ireland in May,
is a
uof .
-and .
uses two different mechanisms to
`.  It
 is both
and spawning.
 The
the Gnose
as a low
TSR of 2,608
).  It
{03, 1C,
 and 21.
, it
wone .
 in the
the Gnose
, it
X.  .
rin a
manner by the Gnose
pof 1,164
at the
"of the
a.  The
in the DOS
not be
rin a spawning manner,
companion
 hidden .
`created by the
.  The companion .
be 1,164
lthe same base
 the .
.  The companion
>and
be the
>and
tof the .
 The companion, hidden .
9a copy of the Gnose
 Gnose is an
, and no
 the
`.  The
in the
 "GNOSE.
Wexe"
V2.0 [FrIEND]S"
the Gnose
may notice
receive
 write protect
on write-
 protected
PZPAPN
Godoy
:  Godoy
 Godoy Dropper
i; "Invalid
OSpecification"
&Record (
, possibly China
R:  1,792 - 1,806
5:   PRhAX -
W, & MBR
n1.04+,
, NAV 3.0+,
V114+,
V116+
`& Replace MBR
 The Godoy
.  Its
.  Godoy is a
 of the
&record (
 as well as .
-and .
`, but not
bGodoy
X, the Godoy
wthe
&record (the
9ing the
).  The
, and
Nnot
 The next
&s the
fthe
 the Godoy
at the top of
$the
, as
qby the DOS
@by 4,096
mby Godoy in
the Godoy
, the Godoy
-and .
for any reason.
pof 1,792
at the
"of the
pof 1,792 to
 1,806
at the end of the
 In both cases, the
>and
in the DOS
not be
.  The
in the Godoy
 "Invalid
ULoading Operating
 "Missing Operating
 "Welcome!"
 "Auto-Copy Deluxe R3.00"
 "(C) Copyright
. Mr. YaQi. C
jha China"
 "No one can Beyond me!"
 be successful, however the
not be able to access the
K.  The
receive the
to read the
 "Invalid
OSpecification"
PZPAPN
GoldGeld
:  GoldGeld
 Germany
R:  612
5:   PRtAK -
3.96+,
1.25+
 The GoldGeld
, and
fGermany.  GoldGeld is a
uof .
 and .
 may identify it as a
since it uses a
 encryption mechanism.
bGoldGeld
X, the GoldGeld
at the top of
$the
', moving
|12's
, as
qby the
 DOS
@by 2,048
mby GoldGeld in
the GoldGeld
, it
 and .
pof 612
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the GoldGeld
 "Es ist nicht alles Gold, was gl
 The
"EEK" can be
in the
5in all
 It is
what GoldGeld
PZPAPN
Golgi
:  Golgi
 Golgi 1.0, Golgi Testicles
=seconds = "08"
R:  465
5:   PRhCK -
n1.04+,
V112+,
6.60+,
2.58+, NAV 3.0A06+,
\2.13+,
2.58+,
.2.0+,
V113+,
1.25+,
6.64+,
1.0A06+
 The Golgi, Golgi Testicles or Golgi 1.0,
, along
two later
s of
 Golgi is a
.  The two later
bGolgi
X, the Golgi
at the top of
 but
$the
', not moving
|12's
, as
qby the DOS
@by 752
{03 and
mby Golgi in
the Golgi
, it
pof 465
not be
the Golgi
.  The
>and
in the DOS
 seconds field set to "08", the
's mechanism to determine if the
r.  The
is un
 the Golgi
 "[Golgi Testicles] v1.0 Copyright (c)
Lapse"
 It is
what Golgi
of Golgi are:
 Golgi 2.0:
, Golgi 2.0 is a later
of the Golgi
.  Its
is 912
), hooking
|21.  It
-and .
 are
 605
be hidden
Golgi 2.0 is
.  The
in the DOS
the seconds field is set to "08", as
 the
.  The
in Golgi 2.0
 "[Golgi Testicles] v2.0 Copyright (c)
Lapse"
 Golgi 3.0:
, Golgi 3.0 is a later
of the Golgi 2.0
.  Its
 1,120
), hooking
|21.  It
 are
wone or two
 in a root
 820
be hidden
Golgi 3.0 is
.  The
in the DOS
the seconds field is set to "08", as
 the
.  The
in Golgi 3.0
 "[Golgi Testicles] v3.0 Copyright (c)
Lapse"
 Unlike Golgi and Golgi 2.0, Golgi 3.0 is a full
, dis
are read into
 As a
ning
and checksumming
not be able to detect the
it is
 Golgi.1173:
, 1994, Golgi.1173 is a 1,173
 of the Golgi
.  Its
 2,336
), hooking
|21.  It
by 1,173
be hidden
 Golgi.1173 is
.  The
>and
 the DOS
to be
the seconds field
!set to
 "62".  The
in the
5in all
 "SCAN.
 "SCAN"
 "[Diabolical Ingenuity] by MnemoniX"
 The DOS
indicate
 on all
in various operational problems,
jand unexpected
&s.
© of
r, the
may fail to
, 1994.
 Golgi.DEI:
, 1994, Golgi.DEI is a later
 the Golgi
.  Its
 3,952
), hooking
{21 and 24.  It
-and .
 are
for any reason.
by 1,948
be hidden
Golgi.DEI is
 The
>and
in the DOS
not be
.  The
in the
5in all
 "Devils & Evangels, Inc. [DEI] MnemoniX $ v2.50"
 "ANTI-VIR.DAT C:\
-MAND.
-\DEI.
 The DOS
indicate
 on all
 Golgi.DEI dis
are accessed, as
do not take
 account
be unable to locate the
, 1994.
 Golgi.Oracle:
in March, 1994, Golgi.Oracle is a later
of the Golgi
.  Its
is 1,024
), hooking
|21.  It
-and .
 are
 997
be hidden
Golgi.Oracle is
.  The
in the DOS
the seconds field is set to "62".
 The
is un
in the
5in all
 "[Oracle] by MnemoniX"
 While the Golgi.Oracle
`, the
are unable to function
 The
be spread
 March, 1994.
PZPAPN
Gorlovka
:  Gorlovka
G:  March,
R:  1,022 - 1,038
5:   PRhA -
 NAV 3.0+,
1.25+
 The Gorlovka
in March,
.  Its
.  Gorlovka is a
 fast
uof .
-and .
, but not
,.  It
s corrupt the
bGorlovka
X, the Gorlovka
at the top of
$the
'.  It
Nnot move
 12's
, as
 the DOS
@by 3,008
mby Gorlovka in
, the Gorlovka
-and .
for any reason.
pof 1,022
).  .
pof 1,024 to 1,038
 In both cases, the
at the end of the
 the
>and
in the DOS
s, Gorlovka
a portion of the
 host
.  In
cases,
be no
pand the
 corrupted, thus not functioning
 The
in the
 Gorlovka
 "EeCcXxOoEeMm"
 "9101"
PZPAPN
Gosia
:  Gosia
 Poland
R:  466
5:   PRCK -
, NAV,
 The Gosia
.  It is
fPoland.  Gosia is a
uof .
 The
Gosia is
X, the
 Gosia
in a "hole" in
be no
.  At
, the
wall .
in the
Gosia is
, it
wany .
has not
rby the
 Gosia
 466
at the
"of the
be no
3to the
>and
 DOS
.  The
can be
in the
 "Gosia"
 The Gosia
Nnot do
PZPAPN
Got-You
:  Got-You
i; hidden
`created;
2printer setup;
 cancels network printer re
Fion; unexpected printing of
Mcontents; last
Ocan't be accessed
 Belgium
R:  3,052 - 3,067
5:   PNE -
, NAV,
 The Got-You
fBelgium.
 Got-You is a
uof .
s on
Os C: through Z: during the
bhalf
 of the year.  During the second half of the year, it
Got-You is
X, the
 check the
>to determine what the
;month is.  If
 the
;month is
thru
, the
randomly
 select a
fC: thru Z: where it
search for
 an .
w.  The
searches down through the
Estructure, and
vthe
 it locates.
Got-You
by 3,052 to
 3,067
at the end of the
a.  The
>and
in the
not be
9the
 "G OT YOU"
through
?, Got-You
.  During
 period, the
, performing any one of five different
 behaviors.
behaviors
s is randomly selected by
 the
.  The five behaviors are:
 1. The
check to see if the computer is on a network and
 has access to a network printer.  If the computer has access to
 the network printer, it
3its setup.
 2. The
check to see if the computer is on a network, and
cancel any re
Fion
allows access to a network
 printer.
 3. The
print the computer's
Mcontents to the
 printer,
to the
having pressed the print
 key.
 4. The
determine what
Os are
by using the
 DOS list of lists
x, and disable the last
Oso it
 is not accessible.
 5. The
create a hidden, 10,240
aon a randomly
 selected
d "G OT YOU. x ", and
9random data
5exists in the
for deleting
it is not
 called
in the
 Got-You
5to check if
monitoring packages are
, and
if it thinks one is present.
 To do
, the
checks for
7ly monitored to be
 in the same segment of
.  It
5to try to
 determine if a debugger is
#used, and if
.  Lastly,
5to keep the
 searching too long for a
PZPAPN
Gotcha
:  Gotcha
; write protect
 The
R:  879
5:   PRhAK -
, NAV 3.0A06+,
 The Gotcha
fThe
 Gotcha is a
uof .
-and .
 The
Gotcha is
X, Gotcha
at the top of
$the
Aby 1,136
 by the
Gotcha is
, it
-and .
very small ones,
rby Gotacha
 879
), and
lthe
at the end of the
 The
can be
din all
 the Gotcha
 "GOTCHA!"
 It is
if Gotcha
of Gotcha are:
 Gotcha-627: Gotcha-627 is a 627
of the Gotcha
 It adds 627
.  The
at the end of the
a.  The
portion of Gotcha-627 requires 912
at the top of
 but
$the
, as
qby the DOS
amount.
 Gotcha-732: Gotcha-732 is a 732
of the Gotcha
 It adds 732
)to the .
v.  The
at the end of the
 The
portion of Gotcha-732 requires 992
at the top of
$the
, as
qby the
 DOS
amount,
 and
m.  The
 "GOTCHA!" can be
dat the end of all
 Gotcha-906: Gotcha-906 is a 906
of Gotcha, adding
 906
`.  The
 at the end of
uses 1,168
at the top of
$the
'.  One
symptom
 of Gotcha
 corrupted
is no space
on the
 Gotcha-A2:
gequivalent to the
has two
differ.  Like the
 it adds 879
`.  The
at the end of
`.  Gotcha-A2
[write protect
fwrite protected
 Gotcha-B: Gotcha-B is a 881
of Gotcha, adding 881
`.  As
at the end of
Nn't
[write protect
 accessing
on write protected
 Gotcha-E: Gotcha-E is a 607
of the Gotcha
.  It
 adds 607
)to the .
v.  The
"GOTCHA!" can be
dat the end of all
`.  Gotcha-E
8hex character
 several
oDatacrime, Datacrime II-B,
 Yankee 2, Syslock, and
 included
in the
for the purpose of confusing
 various
ners as to
is present on the
by having the
ner detect
ts on
while missing the
entirely on
 May,
 Gotcha-Mut1: Gotcha-Mut1 is a 459
of the Gotcha
.  It adds 459
.  The
at the end of the
 The
portion of Gotcha-Mut1 requires 1,024
at the top of
$the
, as
qby the
 DOS
amount.
 The
in the
5in all Gotcha-Mut1
 "MUTAtOR (C) Mutation Inc."
 May,
 Gotcha-Mut2: Gotcha-Mut2 is a 307
of the Gotcha
.  It adds 307
)to the .
-and .
v.  The
at the end of the
a.  The
>and
in the DOS
to the
>and
 The
portion of Gotcha-Mut2 requires
 1,024
at the top of
$the
, as
qby the
 DOS
amount.
 The
in the
5in all Gotcha-Mut2
 "Mutator v2.0b"
 May,
 Gotcha-Mut3: Gotcha-Mut3 is a 304
of the Gotcha
.  It adds 304
)to the .
-and .
v.  The
at the end of the
a.  The
>and
in the DOS
not be
.  The
portion of Gotcha-Mut3 requires 1,024
at the top of
 but
$the
, as
qby the DOS
amount.  No
in the Gotcha-Mut3
 Gotcha-Mut3
usually hang the
X.  Due to a serious bug in the
never
 a major problem.
 May,
 Gotcha-Mut4: Gotcha-Mut4 is a 780
of the Gotcha
.  It adds 780
 The
at the end of the
a.  The
>and
not be
 The
portion of Gotcha-Mut4 requires 1,024
at the top of
$the
, as
qby the
 DOS
amount.
 The
in the
 Gotcha-Mut4
 "Fuck you, asshole!!! You're using a Debugger!!!"
 "Hey! Holloween almost here!"
 "Better be good, or the demon's
get you!"
 "[Mutator] C/B: MainFrame [Mutation INc."
 The second and third
 of any year
hang the
 May,
 See:   Legalize   Tchantches
PZPAPN
Granada
:  Granada
i; TSR; beeping & scrolling
 The
R:  2,765
5:   PRsC -
n1.04+,
\2.13+,
1.25+
 The Granada
.  Its
.  Granada is a
, but not
bGranada
as a low
TSR of 3,072
), hooking
{08 and 21.
the Granada
, it
pof 2,765
at the
"of the
a.  The
 and
in the DOS
not be
.  One
in the
 It is
what Granada
, executing an
in beeping and
 a scrolling
fthe
5on the
monitor.
PZPAPN
Grapje
:  Grapje
 1012 + 27, 1039, Dutch 1039
Mscrolling;
 long
loads
 The
R:  1,039
5:   PNCK -
, NAV,
 The Grapje, 1012 + 127, 1039, or Dutch 1039
 Jan Terpstra of The
.  Grapje is a
uof .
Grapje is
X, the
 search the
Elooking for an
w.  If an
d, it
r.  If
,exists in the
E, it may
Grapje.  If an
awas not
 in the
Grapje
search the
Estructure looking for an
Grapje
by 1,039
).  The
at the
"of the
be no
3to the
>and
in the DOS
E.  The
can be
 the Grapje
 "*.com"
 "GRAPJE!!"
in a
hang.
hang
s, two .
rby Grapje, instead of the usual one.
, Grapje
effect
X.  Randomly, Grapje
fill the
buffer
random data
, scrolling the
s, the
way to stop it is to re
&the
ly, the
Mthe "GRAPJE!!"
repeatedly, scrolling the
30 days
lelasped
 since the
started to
Ythe
.  Unless the
started to
Ythe
right before midnight on the
 last day of a month, and at exactly the right split second,
never be seen.
PZPAPN
Graveyard-479
:  Graveyard-479
 Norway
R:  479
5:   PRtCK -
\2.13+,
 The Graveyard-479
fNorway in
 It is a
uof .
bGraveyard-479
X, the
 Graveyard-479
at the
 top of
$the
', moving
|12's
qby the DOS
 1,024
Fly hooks
|21,
mapping
not show the
having
the Graveyard-479
, it
pof 479
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 Graveyard-479
 "Graveyard!"
 "TCP1/X"
 It is
what Graveyard-479 may do
PZPAPN
Green Caterpillar-1989
:  Green Caterpillar-1989
 Thriller
^, 1994
R:  1,991 - 2,005
5:   PRhAK -
V112+,
2.11a+,
/2.1+,
\2.10g+,
6.64+, NAV 3.0A06+,
n1.05+,
V111+,
.2.0+,
1.22+,
6.64+,
1.0A06+
 The Green Caterpillar-1989
^, 1994.  Its
is a
uof .
-and .
 It is
on the  1575  or Green Caterpillar
bGreen Caterpillar-1989
at the top of
 but
$the
', not moving
|12's
, as
qby the DOS
@by 2,256
mby the
, the
wthe copy of
in the C:
Oroot
 if it was not
, the Green Caterpillar-1989
-and .
X, as well as one
 included in the target
Eof DOS DIR
6s.
pof 1,991 to
 2,005
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all Green Caterpillar-1989
 "/t/h/e/ /e/y/e/s/,/y/o/u/'/r/e/ /p/a/r/a/l/y/z"
 "It's close to midnight and
thing,
 evil's lurking in the dark."
 "Under the moonlight you see a sight,
almost stops your heart."
 "You try to scream but t
 takes the sound before you make it."
 "You start to
eze as horror looks."
 "You right between the eyes,you're paralyzed."
 "Cause
is thriller,thriller night,
 and no one's gonna save you
fthe beast about to strike."
 "You know it's thriller night.
 You're fighting for your life!...(LHB)?!"
 It is
what Green Caterpillar-1989
 See:   1575
PZPAPN
Green Joker
:  Green Joker
 Green
; beeping
R:  743
5:   PNCK -
, NAV 3.0+,
1.53S+,
 The Green Joker, or Green,
.  Its
.  Green Joker is a non-
uof .
,.  It may be related to the Ash
the Green Joker
wall of the .
in the
E.  If
E, it
the Green Joker
pof 743
at the end of the
a.  The
>and
in the
 DOS
to the
>and
 The Green Joker
usually
on the
, the
be accompanied by beeping on the
speaker.  The
may be
Lby the
 "Fail on INT 24"
 "Impotence
Ureading
's dick
 Abort, Retry, Ignore, Fail?"
too big to fit in
 "JOKER!"
 "Cannot load
-MAND,
halted"
 The
can be
in the
, along
ctwo
 "Joker!"
 Green Joker
Nn't do
Mits
 See:   Ash
PZPAPN
Green Peace
:  Green Peace
R:  15,022
5:   ONE -
 The Green Peace
fa United
 States source.
is a
.  It is a research
, its
source,
 as well as an
aarrived as the
submission.
Green Peace is
r, the
wall .
in the
b15,022
.  If the .
smaller
15,022
), its
be 15,022
).  Larger
lany
p.  The
>and
 to the
>and
.  All
9the
near the
"of the
 "Green PeaceGreen Peace"
sall of the .
`in the
E, the
scroll the
Mand
Mthe
 "Green Peace" in the middle of the
.  The
to be hung until CTRL-C is hit several
 Two
`can be
Fories
Green Peace.
`are
d INH and
W.  The INH
8a list of all
`in the
r.  7.
8a pure copy of the
 Green Peace
 The
sample
is a .
 "drops" the Green Peace
.  It
Nnot
9the
, but instead
8the
"GREEN".
 Green Peace
Nnot do
 host) and
Ming its
PZPAPN
Gremlin
:  Gremlin
 Greemlin
G:  May,
slowdown;
>s may dis
R:  1,146
5:   PRhAK -
\, NAV,
 The Gremlin, or Greemlin,
in May,
by the
 PCVRF.
is a
uof .
-and .
,.  Its
 The
Gremlin is
X, the
at the top of
$the
|12's
 not moved.  The
hook
{08 and 21.
Gremlin is
, it
-and .
X.  If
X, it
by 1,146
at the end of the
.  The
be hidden by the
if Gremlin is
 The
in the
if it was
12:00A.
 The
"greemlin" can be
din all
may notice a slight slowdown in speed of
 Gremlin is a destructive
.  It
on the A:, B:, and C:
Os on
14th of any year.
 See:   Alfa
PZPAPN
Grither
:  Grither
i; C: & D:
R:  774
5:   PNCK -
\, NAV,
 The Grither
, by Paul Ferguson
 of the
is a
uof .
Grither is
X, the
wone .
ain the
rif it exists in the
Grither
by 774
), the
at the end of the
 The
>and
in the
not be
 by the
 The Grither
can be extremely destructive.
a probability
one out of every eight
s an
X, the
may activate.  On
, Grither
"of the C: and D:
Os of the
K. Effectively,
corrupts the
s, and
E, as well as the
 Grither is roughly
on the
PZPAPN
Groen Links
:  Groen Links
 Green Left
G:  March,
i; TSR; music
 Amsterdam, Holland
R:  1,888
5:   PRsA -
\, NAV,
 The Groen Links
reported in Amsterdam, Holland,
 in March
is a
uof .
`.  It
Nnot
,.  It is a
of the
is listed separately here as it is a
 different
and exhibits different characteristics.
 The
the Groen Links
X, the
as a low
TSR of 1,872
{21 and CE
mby the
, it
-and .
by 1,893
at the
 of the
a.  .
by 1,888 to 1,902
at the end of
`.  As
 many of the
pby 1,888
)on subsequent
ts.
: "GRLKDOS".
for 30 minutes, it may play "Stem
 op Groen Links" every 30 minutes.  The
of the tune translates
 to "Vote Green Left", Green Left
#a political party in Holland.
 See:
PZPAPN
Grog 3.1
!PTKC
:  Grog 3.1
 Italy
R:  1,200
5:   PRhCK -
2.58+,
6.60+,
2.58+,
6.64+
 The Grog 3.1
, and is
fItaly.
 Grog 3.1 is a
uof .
,, but
Nnot
`smaller
bGrog 3.1
X, the Grog 3.1
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 4,800
|12's
!moved.
, the
 the copy of
in the C:
Oroot
Eif it
 was not
the Grog 3.1
, it
larger
2K in
for any reason.
pof 1,200
at the
 of the
a.  The
>and
in the DOS
not be
.  The
in the Grog 3.1
 "GROG 4EVER!"
 "GROG v3.1 (C) '93 by GROG - Italy"
 "Microsoft C:\
 It is
what Grog 3.1
of Grog 3.1 are:
 E-Riluttanza: E-Riluttanza was
, and
 is a
uof .
,.  It
vall of the .
 in the
pof 689
at the end of the
 The
>and
in the DOS
not be
.  The
in the
5in all E-Riluttanza
 "E-RILUTTANZA (C) '92 by GROG - Italy"
 "Sebbene suo marito andasse spesso in viaggio per affari,
 ella odiava star sola."
 ""Ho risolto il nostro problema", disse egli."
 ""Ti ho comprato un San Bernardo.
 Si chiama Estrema Riluttanza.""
 ""Adesso, quando vado via,
 sai che ti lascio con Estreme Riluttanza!"
 "Ella lo colpi' con un mestolo."
 It is
what E-Riluttanza
:  Italy
 Grog 3.0: An earlier
of Grog 3.1
is 3,952
), hooking
 as well as
in the C:
Oroot
pof 990
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the Grog 3.0
 "GROG 4EVER!"
 "GROG v3.0 (C) '93 by GROG - Italy"
 "Microsoft C:\
:  Italy
 Grog.202: The Grog.202
, 1994, and is
.  It
 the
btwo .
`in the
lthe
 202
by the
5.  The
in the DOS
not be
 The
in the
 all
 "TRUMPERY (c) '93 by GROG"
 "ATD02
:  Italy
, 1994
 Grog.324: The Grog.324
, 1994, and is
.  It
ain the
 of 324
at the end of the
a.  The
>and
in the DOS
to the
.  The
in the
5in all
 "Vi E' Mai Venuto In Mente Che Potreste Aver Torto ?"
 "[ Aver torto (C) '93 by Grog - Italy ]"
 "*.?O?"
in a
hang or
failure of the
:  Italy
, 1994
 Grog.377: The Grog.377
, 1994, and is
.  It
 zero to many .
`in the
lthe
 377
by the
5.  The
in the DOS
not be
.  The
 ""Il nostro amore durera' per sempre", disse lui.
 "Oh, si, si, si", esclamo 'lei.
 "Intendendo 'sempre' in senso relativo, pero'", disse lui.
 Lei lo colpi' con una racchetta da sci."
 The
, along
in the
5in all
 "Sempre_(C)_'93_by_Grog_Italy_"
jmay
:  Italy
, 1994
 Grog.566: The Grog.566
, 1994, and is
.  It
 of the .
`in the
pof 566
at the end
 of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all
 "*.cOm"
 "}}}- LaTraviata (C) '93 by GROG - Italy -{{{"
 "Il suo vero nome era Lavinia Traviata"
 "Ma tutti i suoi amici la chaimavano "La""
 "Per cui, spesso veniva indicata come "La Traviata""
:  Italy
, 1994
 Grog.798: The Grog.798
, 1994, and is
.  It
 of the .
`in the
pof 798
at the end
 of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all
 "[ WE ARE BACK! ]"
 "[o1/o3]"
 "Grog.Crackers.Wild_Cards (c)
by GROG"
 "*.?Om"
:  Italy
, 1994
 Grog.800: The Grog.800
, 1994, and is
.  It
 of the .
`in the
pof 800
at the end
 of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all
 "Grog.Crackers.Public_Enemy (c)
by GROG"
 "*.?Om"
:  Italy
, 1994
 Grog.801: The Grog.801
, 1994, and is
.  It
 of the .
`in the
pof 801
at the end
 of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all
 "Grog.Crackers.Razor (c)
by GROG"
 "*.?Om"
:  Italy
, 1994
 Grog.903: Grog.903 was
, 1994, and is a
uof .
,.  It
vall of the .
 in the
E, as well as the C:
Oroot
pof 903
 the
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all Grog.903
 "TorneoDiGolf (C) '93 by GROG - Italy"
-*.DL"
 "Subito dopo aver vinto il torneo di golf, egli fu
 intervistato alla TV."
 ""Questo e'' il momento piu'' emozionante della mia
 vita!", disse."
 ""Ti ho visto in TV", gli disse sua moglie"
 ""Credevo che il momento piu'' emozionante della tua vita fosse
 stato quando ci"
 "siamo sposati.""
 "Al torneo successivo, egli non riusci'' a qualificarsi."
 It is
what Grog.903
:  Italy
, 1994.
 Grog.926: Grog.926 was
, 1994, and is a
uof .
,.  It
vall of the .
 in the
E, as well as the C:
Oroot
pof 926
 the
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all Grog.926
 "Mi Ami (C) '93 by GROG - iTALY"
 "*.?OM"
 ""Mi ami?" chiese lei."
 ""Ma certo", rispose lui."
 ""Mi ami davvero?" chiese lei."
 ""Ma certo", rispose lui."
 ""Mi ami davvero davvero?" chiese lei."
 ""No", rispose lui."
 ""Mi ami?" chiese lei."
 ""Ma certo", rispose lui."
 ""lei non chiese piu" altro."
 "GPE#02"
 "FGHKIJMu"
 It is
what Grog.926
:  Italy
, 1994.
 Grog.2825:
, 1994, Grog.2825 is a later
 of the Grog 3.1
.  It is a
-and .
for any reason.
 hides the
.  Its
is 5,712
), hooking
{20 and 21.  At the
, it
wthe copies of
in the C:
Oroot
 and \DOS
Fories if
were not
 2,825
at the
 the
a.  .
 3,097
at the end of the
a.  The
>and
in the DOS
to be
, but the seconds field
!set to 34.  The
in the
 "GROG v5.0 (C) '93 by GROG - Italy"
 "C:\
,C:\DOS\
,*.*"
 "IBMBIOIBMDOSSCAN  CLEAN F-PROT
 NAV"
 "ANTI-VIR.DAT CHKLIST.* \NAV_._NO"
may fail to function
 the
:  Italy
, 1994.
 Grog.Dream: The Grog.Dream
, 1994,
 and is a
.  It
vall of the .
`in the
pof 757
 at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
 "THE"
 "TEAM"
 "Grog.Crackers.The_Dream_Team (c)
by GROG"
 "*.?Om"
:  Italy
, 1994
 Grog.Gonfie: The Grog.Gonfie
, 1994.
 It is a
is 928
), hooking
|21.  It
or copied.
pof 902
at the end of the
a.  The
>and
 the DOS
not be
.  The
in the
 ".oO( GonfieVele (C) '93 by GROG - Italy )Oo."
 "Sua moglie aveva sempre odiato il lavoro di lui."
 ""Non farai mai soldi costruendo modellini di velieri", si
 lagnava."
 ""Al contrario", dichiaro' lui."
 "I miei affari vanno a gonfie vele!"
 "Lei lo inceneri' col tostapane elettrico."
 "80?86
:  Italy
, 1994.
 Grog.Hop: The Grog.Hop
, 1994, and is
.  It may
 one .
-and .
in the
l480
near the end of the
by the
 The
>and
in the DOS
 not be
.  The
in the
 "HopHopHop (c) '93 By GROG - Italy"
 ""Guida alla Corsa""
 "Capitolo primo"
 "Come correre al modo dei conigli."
 "Hop Hop Hop"
 "Hop Hop Hop"
may take an extended
to issue output,
 and often hang the
:  Italy
, 1994.
 Grog.Il_Mostro: The Grog.Il_Mostro
, 1994, and is a
.  It may
wone .
ain the
pof 330
at the end of the
a.  The
>and
 the DOS
to the
>and
.  The
in the
 "Il Mostro e i Coniglietti"
 "Storia di t
Ue e di ansia"
 ""Boo!", disse il Mostro."
 "-=< Il Mostro (C) '93 by Grog - Italy >=-"
 "*.??M"
usually hang the
:  Italy
, 1994
 Grog.IlCuoco: The Grog.IlCuoco
 1994.  It is a
u.  It's
is 2,208
), hooking
|21.  It may
pof 1,007
at the end of the
a.  The
>and
 the DOS
to the
>and
.  The
in the
Cuoco
GROG"
 "Il Cuoco, vedendosi scoperto, impallidi'."
 ""Siete in arrosto", intimo' il poliziotto."
 "Ho un mandato di cottura!"
Cuoco
GROG"
/SCANCLEA"
 "Il Cuoco (C) '93 by GROG - Italy"
 "GROG
EVER"
 Grog.IlCuoco
Nnot
wvery small .
:  Italy
, 1994.
 Grog.Inc: The Grog.Inc
, 1994, and is
.  It
 the
ain the
X.  If the
awas
r, a
hang may
pof 774
at the end of the
a.  The
>and
 the DOS
to the
>and
.  The
in the
 "inc"
 "Grog.Crackers.INC (c)
by GROG"
 "*.?Om"
:  Italy
, 1994
 Grog.N
male: Grog.N
male was
, 1994, and is
.  It
`in the
X.  It
create the
a"KEYB.
-" in the C:
Oroot
9g a copy of the
pof 796
at the end of the
a.  The
 and
in the DOS
not be
 The
in the
 "/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\"
 "\  "Non so dirti quanto tiamo", disse lui. /"
 "/  "Prova", disse lei."
 "\  "Ti voglio molto bene", disse lui."
 "/  "Non c' e' male", disse lei.
 "\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/"
 "*.COm"
 "<->  NonCEMale (C) '93 by GROG - Iltay  <->"
:  Italy
, 1994
 Grog.NTA: The Grog.NTA
, 1994, and is
.  It
 of the .
`in the
pof 1,016
at the end
 of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all
 "$*BR*$"
 "The Nokturnal"
 "Trading Alliance"
 "Grog.Crackers.NTA (c)
by GROG"
 "*.?Om"
:  Italy
, 1994
 Grog.Ovile: The Grog.Ovile
, 1994.
 It is a
-and .
is 1,440
), hooking
|21.  It
-and .
pof 1,417
at the end of the
a.  The
>and
in the DOS
 not be
.  The
 the
 "OVILE"
 "Grog"
 "GROG4EVER"
 ">-> Ovile (C) '93 by GROG - Italy <-<"
 "C'erano una volta due topi che vivevano in un museo."
 "Una sera, dopo la chiusura, il primo topo si infilo' nella
 vetrina contenente"
 "le uova di uccelli rari."
 "Prima di accorgersene, si era gia' perso."
 ""Aiuto!", grido' al suo amico."
 ""Aiutami a uscire dall'ovile!""
:  Italy
, 1994.
 GSav 1.0: GSav 1.0 was
, and is a
uof .
,.  It
vall of the .
 the
pof 794
at the end of the
 The
>and
in the DOS
not be
.  The
in the
5in all GSav 1.0
 "G*SAV v1.0 (C) '93 by GROG - Italy"
 "*.*"
 "Grog*Soft Anti-
v1.0 (C) '93 by GROG - Italy"
 "Self Integrity Check warning -
awas
 "Chose an option:"
 "[R] Self Reconstruction."
 "[C] Continue
 "[E] Exit to DOS"
 "Press R, C, or E:"
:  Italy
 GSav 1.1: GSav 1.1 was
, and is a
uof .
-and .
,.  It
vall of the .
-and .
in the
pof 1,082
)while .
 1,215
).  In both cases, the
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all GSav 1.1
 "G*SAV v1.1 (C) '93 by GROG - Italy"
 "*.*"
 "Grog*Soft Anti-
v1.1 (C) '93 by GROG - Italy"
 "Self Integrity Check warning -
awas
 "Chose an option:"
 "[R] Self Reconstruction."
 "[C] Continue
 "[E] Exit to DOS"
 "Press R, C, or E:"
ning
may detect
of Vacsina since it uses Vacsina's technique to
 convert .
astructures before
:  Italy
 Lor: The most advanced member of the Grog
]as of
, Lor was
.  Unlike
hides the
.  Its
 704
), hooking
|21.  It
-and .
pof 666
at the end of the
a.  The
>and
 in the DOS
to be
, but the seconds field
!set to 60.  The
in the Lor
 "LOR
Italy"
:  Italy
 Mila: The Mila
, and is
.  It
 all of the .
-and .
in the
 the
b557
by the Mila
5.  The
>and
in the DOS
to the
>and
.  The
in the
5in all Mila
 ">>1/92<<"
 "MILA (c)
by GROG - Italy"
-"  -or-  "*.
:  Italy
 Mormorio: The Mormorio
 and is a
.  It
vall of the .
in the
 the
b456
by the Mormorio
 The
>and
in the DOS
to the
>and
.  The
occasionally
five to seven beeps,
 "Joe Mormorio e i suoi fratelli erano borsaioli.
 Battevano tutte le fiere della contea.
 Come faceva la gente a accorgersi di essere stata borseggoata?
 Quando un Mormorio correva tra la folla."
L, a
hang may
 The
in the
 all Mormorio
, as are the
 comprising the
 "Mormorio (C) '92 by GROG - Italy"
 "GROG"
 "GROG*.com GROG"
:  Italy
 Nocciola: Nocciola was
, and is a
uof .
,.  It
vall of the .
 the
pof 283
at the
"of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all Nocciola 1.0
 "Nocciola Vildibranda Crapomena"
 "NOCCIOLA (C) '93 by Grog - Italy"
:  Italy
 Woodstock: The Woodstock
 and is a
is 1,248
), hooking
|21.  It
pof 1,219
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the Woodstock
 "Provero Woodstock... Se vola piu' alto di tre metri,
 gli esce sangue dal becco."
 The
in the
    -|---|---|--|
 "|Woodstock|(C)|'93|by|GROG|Italy|"
    -|---|---|--|
 "*.HLP"
:  Italy
PZPAPN
Groove
:  Groove
Bs/corrupts
data
don't function
&failures
 Germany
R:  3,646 - 3,708
5:   PRhAK -
n, NAV 3.0+,
1.25+
 The Groove
.  It was
}in Germany, where it is reported to be in the public
 domain.  Groove is a
uof .
-and .
uses a slightly modified
of the Dark
 Avenger Mutation Engine (DAME) for encryption.
the Groove
 Groove
at the top of
$the
'.  It
the Groove
, it
X.  It
, but
very small ones.
pof 3,646 to 3,708
 The
at the end of the
a.  The
 and
in the DOS
 the
>and
 The Groove
8the
 are usually
are not
 "Dont wory, you are not alone at
hour...
is NOT dedicated to Sara
 its dedicated to her Groove (...
s my
a test
 be ready for my   Next  Test
 "C:\NAV_._NO C:\NOVIRCVR.CTS C:\NOVIPERF.DAT
/\CHKLIST.CPS C:\TOOLKIT\FILES.LST
 C:\UNTOUCH\UT.UT1 C:\UNTOUCH\UT.UT2 C:\VS.VS"
 The second set of
are the
s of data
`for the
utilities
!targetted by the
 author of
:  Symantec's Norton Anti-
, Certus' Novi,
 Central
Anti-
, Dr. Solomon's Anti-
Toolkit,
 Fifth Generation
' Untouchable, and XTree's ViruSafe.  The
attempt to corrupt or
 are present.
%the deletion or
:of the
 data
the Groove
 difficulty executing
 usually not function
, giving unpredic
s.  If
&failures may
 See:   DAME   Pogue
PZPAPN
Groove OW
:  Groove OW
& truncated;
 graphic
M; lost clusters; C:\
,replaced;
&failures;
fail to function
R:  1,214
5:   PNEK -
30.00+,
8/93S+, NAV 3.0+,
8/93+,
.2.0+
 The Groove OW
.  Its
.  Groove OW is a
and the copy
in the C:
Oroot
E.  It is not
 related to the  Groove
the Groove OW
wthe copy of
in the C:
 root
Eas well as one .
in the
E.  It
Ma graphic
 the
"Sara's Groove".
the Groove OW
 of 1,214
)and
9pure
5.  The
 and
in the DOS
be the
 and
.  The
in the
5in all Groove OW
 "*.exe c:\
6.com .. Darkest avenger"
 "Isnt dedicated to Sara Gordon"
 "Its dedicated to her GROOVE!"
rby the Groove OW
la large number of
 lost clusters.  The
creates three
lost clusters
&failures
fthe
PZPAPN
Growing Block
:  Growing Block
-1361,
-Yellow
 TSR; .
i; gradual
As in
 Australia
R:  1,363
5:   PRsAK -
, NAV,
 The Growing Block
}in Australia in
 It is a
uof .
-and .
,.  The
a graphic effect
was produced
}sample.
 samples do not produce the same "growing block" graphic effect.
 The
Growing Block is
 the
in low
{08, 09, and 21
mby the
's 1,632
 TSR.  The
allocate a 4,096
*block of low
as well,
be marked as
-MAND Data.
Growing Block is
, it
-and .
by 1,363
at the
"of the
 by 1,361 to 1,375
at the end of
 the
a.  The
>and
in the
to the
>and
Growing Block
[a gradual
 decreasing of
Growing Block is
X, the
allocate an
 4096
*block of low
, slowly eating away
.  An
symptom is
the DOS
 fail to
it is
ing in the
"Invalid
", and EDLIN ending
 See:
PZPAPN
Groz-999
:  Groz-999
R:  999 - 1,096
5:   PRhAK -
6.60+,
2.58+,
V122+,
2.11+,
2.58+,
V113+,
6.64+
 The Groz-999
.  Its
.  Groz-999 is a
uof .
-and .
bGroz-999
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 4,096
{24 and 81
mby the
, the Groz-999
-and .
 by 999 to 1,096
at the end of the
a.  The
>and
in the DOS
not be
.  One
in the
 "AIDSTEST"
 It is
what Groz-999
PZPAPN
Grunt-1
:  Grunt-1
H:
R:  344
5:   PNCK -
, NAV 3.0+,
n1.05+,
1.53S+,
1.25+
 The Grunt-1
.  It is
fthe
.  The Grunt-1
is a
uof .
the Grunt-1
X, the
 Grunt-1
wone .
in the
 of 344
at the end of the
 The
>and
in the DOS
 not be
.  The
in the
5, and is not
 "[GRUNT-1] -=> Agent Orange '92 <=- *.com .."
 The Grunt-1
.  At
, the
 random
on the
O(C:, D:, and E:).
of Grunt-1 are:
 Grunt-1B:
, Grunt-1B is
gvery
8the same
.  Grunt-1B adds 346
)to the
 Grunt-3:
, Grunt-3 is a later
 of the Grunt-1
.  It
vone .
 in the
;or a higher
pof 473
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the Grunt-3
 "[GRUNT-3] -=> Agent Orange `92 <=-"
is a hot LZ ... Eradicating the Enemy!"
 Grunt-4:
^, 1994, Grunt-4 is a later
 of the Grunt-1
.  It
vone .
 in the
 of 529
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the Grunt-4
 "[GRUNT-4] *.
-TBFIL.XXX .. -=> Agent Orange `92 <=-"
 "Nothing like the smell of napalm in the morning!"
^, 1994.
PZPAPN
Guillon
:  Guillon
 BSC;
; possible FAT damage; internal stack
 overflow
 Buenos Aires, Argentina
R:  N/A
5:   BRX -
2.53+, NAV 3.0+,
:  M-
K/P, or DOS SYS on
 The Guillon
Gin Buenos Aires, Argentina in
.  Guillon is a
uof the
) and the
I.  It
it has
fthe
J, but not
it is
the Guillon
, Guillon
, as well as
, as measured by the DOS
 by 4,096
, the Guillon
wany non-write
 protected
Jexposed to the
.  The Guillon
 expects
Ito be 360K double density
I, and any
and format may
in damage to the
, corrupting
and data
is later
fthe
K, the
 Guillon
as well, however it
 not
Iaccessed on the
.  At
@by 6,144 plus
), the number increasing by
%the
, and
Guillon
[internal
 stack overflow
hang.
PZPAPN
Guppy
:  Guppy
 TSR; .
&failures
R:  152
5:   PRsCK -
\, NAV,
 The Guppy
in late
by Paul Ferguson
 of Washington, DC.  Guppy is a
uof .
 The
the Guppy
 the
as a low
 TSR
 by 720
, any .
 of at least 100
Guppy.
by 152
to the
"of the .
a, and
 150
to the end of the
=stamps in the
to the
>and
Guppy
, it
r.  If the
is later
 Guppy
,, the
fail and a "Bad or Missing
6Interpreter"
fail to
 Guppy.  For example,
YEDLIN.
it was
Xon my
ed in a consistent "Invalid
, and EDLIN ending
`can be identified as
 hex character
: 3ECD211F5A5B58EA
of Guppy are:
 Guppy-B: Almost identical to Guppy,
are a few
PZPAPN
:  Gyro
&failure
R:  512
5:   ONCK -
3.96+, NAV 3.0+,
8/93+,
.2.0+
 The Gyro
.  Gyro is a non-
the Gyro
X, the
 Gyro
wone
 The
search the
O, the
O, and
the B:
Olooking for a
it has
, it
either
to the DOS prompt or
Mthe
ing the
to the DOS prompt:
 "Bad
the Gyro
lthe
)of the host
by the Gyro
 The host
is permanently corrupted as the
 save the
b512
)of the
punless the host
 smaller
, in
case the
 512
.  The
in the DOS
not be
%the
, the
in the
 "*.com *"
 "GYROzs"
rby the Gyro
&failures
PZPAPN
:  Ha
 Warsaw, Poland
R:  1,458 - 1,472
5:   PRhAK -
 NAV 3.0+,
 The Ha
.  It is
fWarsaw, Poland.  Ha is a
uof .
 and .
X, the Ha
at the top of
$the
, as
qby the DOS
 by 1,456
mby Ha in
, the Ha
-and .
pof 1,458 to 1,472
at the end of the
a.  The
in the
, and hence not
 "ha!
 It is
what Ha may do
PZPAPN
Hacktic
:  Hacktic
truncated to 83
 hidden;
`fail to
 The
R:  83
5:   ONE -
30.00+, NAV 3.0+,
8/93+,
1.25+
 The Hacktic
fThe
 Hacktic is a
is a later
 Hacktic 2,
is a
the Hacktic
X, the
 Hacktic
wone .
in the
be truncated to
), and
9the Hacktic
5.  The .
fthe
Eas it
lthe hidden
 attribute
*set.  The
>and
in the DOS
be set to the
>and
 Hacktic
Nn't do
, destroying the
of Hacktic are:
 Hacktic 2:
, Hacktic 2 is a non-
uof .
,.  It
wone .
in the
pof 93
at the
"of the
a.  The
>and
in the DOS
1to the
>and
.  Hacktic 2
Nn't do
, and
Nn't
to be in the public domain.
:  The
PZPAPN
Hafenstrass
:  Hafenstrass
 Hafen
 Germany
R:  809
5:   PNE -
/, NAV,
.2.0+
 The Hafenstrass, or Hafen,
 Hafenstrass is a
uof .
.  It is
fGermany.
the Hafenstrass
wone .
in the
 on the
O.  It
Nnot always
wan .
X, so the
tprocess is
what sporatic.
the Hafenstrass
pof 809
).  The
at the end of the
be no
3to the
>and
 in the DOS
.  No
 the
the Hafenstrass
s the
 The Hafenstrass
create 22
*hidden
hidden
are four
#lower case.  The
9the
 "Hafensta
e bleibt!"
of Hafenstrass are:
 Hafenstrass-1191:
on the
Hafenstrass
, and
 Hafenstrass 2 ,
adds 1,191
)to the .
X, it
Ma graphic ambulance car moving
 across the bottom of the
fleft to right.
Qes the right side of the
, it
Mthe word "BOOM!" in graphic block letters
 "No more RedX !!!"
$it in normal
Mfont, bright
:  Germany
 Hafenstrass-1191B:
gequivalent to Hafenstrass-1191,
has one
differs.
:  Germany
 Hafenstrass-D:
on the
Hafenstrass
intermittently
wone .
 in the
Eor a higher
Eon the
 781
at the end of
 the
a.  The
>and
in the
 DOS
 Hafenstrass-D
Nnot create hidden
 See:   Hafenstrass 2
PZPAPN
Hafenstrass 2
:  Hafenstrass 2
i; ambulance car graphic
siren
R:  796
-), 1,641
5:   PNA -
, NAV,
 The Hafenstrass 2
location.
, like the
Hafenstrass, is
uof .
.  A major
 distinction is
Hafenstrass 2 is actually a
, Ambulance Car.  The Ambulance Car
Hafenstrass 2 is
X, the
 Hafenstrass 2
wone .
and one .
in the
later
Ys one of the
, one or two .
in the
 Of the .
-and .
rby the Hafenstrass 2
the .
9the full Hafenstrass 2
.  The
were
ras a
of executing a
 Hafenstrass 2
 Ambulance Car
is dropped by Hafenstrass 2.
Hafenstrass 2
pof 1,641
).  The
at the end of
 the
be no
3to the
 and
in the DOS
.  No
in the
ras a
of a Hafenstrass 2
pof 796
)due to the presence
 of the Ambulance Car
.  Ambulance Car
at the
 end of the
Hafenstrass 2 may
[unexpected
Zof an Ambulance Car
amay
in a graphic ambulance
#run
fleft to
 right along the bottom of the
, accompanied
a "siren"
 noise on the
speaker.
 See:   Ambulance Car   Hafenstrass
PZPAPN
Haifa
:  Haifa
i; TSR;
 Israel
R:  2,351 - 2,372
5:   PRsAK -
, NAV,
3.96+,
 The Haifa
Gin Israel in
.  Haifa
 is a
uof .
-and .
 The
Haifa is
Xon a
 Haifa
as a low
 of 2,512
{09 and 21
mby the Haifa
' TSR.  At
, the
ed to by the
-SPEC
mental variable
r, as well as the copy of
in the C:
Oroot
E.  On 386
hang
hang usually
on 8088 processor
Haifa is
wthe
btwo
in the
by 2,351 to 2,372
at the end of the
3to the
>and
in the DOS
 Haifa employs a complex encryption mechanism to complicate
 disassembly of the
and determination of
identification
encryption mechanism
s in copies of the
 same
having different
t, such as
 duplicate copies of
on C: and A:
 different
 The Haifa
adds the
ctwo lines of ASCII
to the
 end of .DOC
two lines are
in the
and not
 "OOPS!  Hope I didn't ruin
 Well, nobody reads
stupied DOCS anyway!"
of Haifa are:
 Mozkin:
Gin Israel in May,
, Mozkin is
 the Haifa
the encryption has
can recognize Haifa may not be able to
 detect Mozkin.  On 80286
Zof a
 Mozkin
in the
,and the
 "KIRYAT MOZKIN!!!
 LOCAL PROCESS INDUSTRY.
 VIRUS DONE BY:
 SIBEL ,TEACHES
 HOW TO MANAGE SHEEP?
ks for using Turbo Anti
 PLEASE JMP FE00:0"
Lthe
be hung.
 On 8088
, Mozkin
 in low
X, hooking
|21.
becoming
, it
-and .
by 2,358 to 2,373
at the end of the
 See:
-Haifa
PZPAPN
Hallo-496
:  Hallo-496
 Hallo
G:  March,
R:  496
5:   PNCK -
30.00+,
 The Hallo-496
in March,
.  Its
.  Hallo-496 is a
uof .
the Hallo-496
wone .
in the
it has
a, it
Mthe
on the
Mand a
hang
 "Hallo! I
lgot a
for you!"
the Hallo-496
pof 496
at the end of
 the
a.  The
>and
in the DOS
to the
>and
.  The
 the
5in all Hallo-496
`, as is the
 "$DSB"
of Hallo-496 are:
 Hallo-751: Hallo-751 was
.  Like the
, its
.  Hallo-751
vone .
 the
E, and
Ms the
ever an
 "Hallo! I
lgot a
for you!"
 Miscellaneous
may be
cthe
pof 751 to 766
at the end of the
a.  The
 and
in the DOS
to the
>and
%the
, the
can be
in the
 in all
 "*.com"
 Hallo-759: Hallo-759 was
.  Like the
, its
.  Hallo-759
vone .
 the
E, and
Ms the
ever an
 "Hallo! I
lgot a
for you!"
pof 759
 to 774
at the end of the
a.  The
>and
in the DOS
to the
>and
, the
can be
in the
5in all
 ".com"
 See:
PZPAPN
Halloechen
:  Halloechen
 Hallo
, 1989
 TSR; .
i; garbled
input
 West Germany
R:  2,011
5:   PRsA -
, NAV,
:  NAV, or
 The Halloechen
was reported by Christoff Fischer of the
 University of Karlsruhe in West Germany.  The
is a
generic .
is reported to be
 widespread in West Germany.
 The Halloechen
, the
 any .
Wor .
is run unless the
awould be greater
64K in
, or the
>falls
in the
;month and year.
!determined to be a candi
>for
t, and is less
62K in
as well as having a
>outside of the
;month and year, it is
r. In the process of
 the
a, the
pd so
it is a multiple
 of 16 (ends on a paragraph
the 2,011
5are
`are run, input
fthe
is garbled.
PZPAPN
Halloween
:  Halloween
 Happy Halloween
i; very slow
loads; Run
R:  10,000
5:   PNAK -
, NAV,
1.25+
 The Halloween, or Happy Halloween,
.  Its
, or
~, is
 Halloween is a
uof .
-and .
the Halloween
X, the
search the
Efor an
 over
10K in
w.  If one is
d, the
 Halloween
wit.  If an
ais not
d, the
search the
Efor an
over
10K in
 If an
d, it
 If all of the candi
-and .
over 10K in
r, the
may receive the
, and be
ed to the DOS prompt:
 "Run
U002 at
0:0511"
 Halloween
 10,000
).  The
at the
"of the
a.  The
>and
in the DOS
.  The
 can be
in the
5of Halloween
 "*.*"
 "ALL   GONE"
 "Happy Halloween"
 The Halloween
31st.  At
a 10,000
a blank
be created in the
>and
9pure
5.  The
receive the
 "Run
U150 at
0:0AC8"
 Halloween
[extremely slow
 loads
X.  It is not unusual for
loads to last 2 to 5 minutes.
PZPAPN
Hambone
:  Hambone
^, 1994
R:  2,316
5:   PNAK -
V112+,
6.60+,
V113+
 The Hambone
^, 1994.  Its
it is probably
.  Hambone is a
 of .
-and .
the Hambone
check to determine if
are any
 in the
E.  If
are, the
wthem.
 If the
determines
all of the .
`were
r, it
wany
it finds
 in the
the Hambone
pof 2,316
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in the
5in all Hambone
 "(C) Martin Luther King Jr. 1994Fuhrer"
 "Hambone, Hambone,
lyou heard?"
 "Lawd
lmussy"
 "Hambone, Hambone,
lyou heard?"
 "Oh Dem's Golden Slippers"
 "Hambone, Hambone,
lyou heard?"
 "Mammy!"
 "Hambone, Hambone,
lyou heard?"
 "I don't know nuttin' bout birthin' no babies,Miss Scarlett"
 "Hambone, Hambone,
lyou heard?"
 "Feets do yo'
 "Hambone, Hambone,
lyou heard?"
 "I gots dem ol' Kozmic Blues again, Mama"
 "Hambone, Hambone,
lyou heard?"
 "Mammies lil' baby loves shortin'bread."
 "Hambone, Hambone,
lyou heard?"
 "Nobody know de troubles I seen"
 "Hambone, Hambone,
lyou heard?"
 "I gots a bad case o' de miseries today"
 "Hambone, Hambone,
lyou heard?"
 "In de sweet bye-de-bye"
 "Hambone, Hambone,
lyou heard?"
 "I lo-o-o-o-o-o-oves watermelon!"
 "Hambone, Hambone,
lyou heard?"
 "Great day in de mownin'"
 "*.com *.exe .."
the Hambone
on the
monitor
PZPAPN
Hamster
:  Hamster
 Turbo Hamster
G:  March,
=may
R:  546
5:   PNCK -
30.00+, NAV 3.0A06+,
.2.0+,
1.25+,
1.0A06+
 The Hamster, or Turbo Hamster,
in March,
 Its
it was provided
 by an individual in North America.  Hamster is a
uof .
the Hamster
X, the
 Hamster
wone
in the
;or a higher
 546
at the end of the
 The
>and
in the DOS
 usually not be
in the case of
,, it may
to a
>in the future.  The
 are
in the
5in all Hamster
 "..\*.
 "Turbo Hamster
 It is
what Hamster may do
PZPAPN
Handi-215
:  Handi-215
R:  215
5:   PNC -
n1.04+,
6.64+,
\2.13+,
.2.0+,
1.25+,
6.64+
 The Handi-215
.  Its
.  Handi-215 is a
uof .
, but not
the Handi-215
wall of the .
`in the
the exception of
pof 215
 the
"of the
a.  The
>and
to the
>and
.  The
in the
5in all Handi-215
 Handi-215
Nn't do
PZPAPN
Happy
:  Happy
R:  412
5:   PNCK -
, NAV 3.0+,
30.00+,
 The Happy
.  Its
.  Happy is a
uof .
the Happy
X, the Happy
wone .
ain the
E, as well
 as one .
ain the C:\DOS
E.  The
k you for running the Happy
 Warning !!!
 and C:\DOS might be
the Happy
pof 412
at the end of
 the
a.  The
>and
in the DOS
to the
>and
.  The
can be
 seen
in the
5in all Happy
.  The
*of Happy
be a hex "FF" character,
is the
tmarker.
PZPAPN
Happy New Year
:  Happy New Year
 Happy N.Y., V1600, 1600, Dear Nina
?, 1989
 TSR; .
i; floppy
&failures; bad or missing
6interpreter
R:  1,600
5:   PRsAK -
\, NAV,
 The Happy New Year, or V1600,
(, and is a
uof .
-and .
`.  It
 The
the Happy New Year
X, the
as a 2,432
)low
TSR.
mby the
.  At
, the
make a slight alteration
 to the floppy
, and
not show a
pas the
a portion of the hex 00 section of the
a.  The
floppy
Nnot
9a copy of the
, and
 is not
wious.
Happy New Year is
, it
-and .
by 1,600
)and
lthe
at the end of the
 The
can be
 "Dear Nina, you make me write
; Happy new year!"
 "1989"
is not
Lby the
the Happy New Year
may fail to
 receiving a "Bad or missing
6interpreter"
ron the
 It is
if Happy New Year carries any destructive capabilities.
of Happy New Year are:
 Happy New Year B:
to Happy New Year,
has five
differ
fthe
.  Unlike
 Happy New Year,
 if it is
Xfor
reason.
PZPAPN
Harakiri
:  Harakiri
G:  May,
 Sweden
R:  5,488
5:   ONAK -
, NAV,
.2.0+,
1.25+
 The Harakiri
in May,
.  It
s to be
fSweden due to the
in the
.  Harakiri is a
vboth .
-and .
Harakiri is
X, the Harakiri
search the
Efor
w.  Assuming
the .
`in the
 are
, and
W, B.
W, C.
W, and D.
W, the
Mthe
 "--> \A.
 Ej Infekterad...!
 --> \B.
 Ej Infekterad...!
 --> \C.
 Ej Infekterad...!
 --> \D.
 Ej Infekterad...!
too big to fit in
 The "Ej Infekterad...!"
translates
fSwedish to
 English as "Not
r...!".
 If the
finds less
four .
it can
start
`until it has
rfour
Z.  If the
encounters an already
it is searching for
w, it
Mthe
aAlready
all of the .
-and .
`in the
r, the
Mthe
 "Your PC is alive and
the HARAKIRI
 All of the
can be seen
in the
 Harakiri
PZPAPN
kDays
kDays
R:  662
5:   PRhCK -
3.96+, NAV 3.0+,
8/93+,
 The
kDays
.  Its
kDays is a
uof .
,.  It bears
ity to the  Red Diavolyata
kDays
X, the
kDays
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 960
|12's
!moved.
kDays
, it
pof 662
at the end of the
a.  The
in the DOS
to the
>and
.  The
can be
in the
5in all
kDays
 "It's
kdays night!"
PZPAPN
Harm-1082
:  Harm-1082
R:  1,082 - 1,098
5:   PRhE -
3.96+,
30.00+,
1.25+
 The Harm-1082
.  It
s to be
fthe
.  Harm-1082 is a
uof .
Nnot
wvery small
bHarm-1082
X, the Harm-1082
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 1,472
|12's
!moved.
kDays
, it
pof 1,082 to 1,098
 at the end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the
5in all Harm-1082
 "Eat me Lozinsky!"
 "Harmless v1.0, 10/06/92 Tyumen"
 It is
what Harm-1082
PZPAPN
Hary Anto
:  Hary Anto
 Hary
i; TSR;
R:  983 - 997
5:   PRsCK -
, NAV,
 The Hary Anto
.  Its
~are
.  Hary Anto is a
uof .
 The
Hary Anto is
X, Hary
 Anto
as a low
TSR of
 1,328
).  The
Hary Anto is
, it
pof 983 to 997
at the end of
`.  The
>and
in the DOS
 the
>and
.  The
can be
Hary Anto:
 "HWI_Tm"
 Occasionally, the Hary Anto
at the top
 of the
 starts
 "WeLcOmE tO hArY aNtO"
not be
`as it is
PZPAPN
Hastings
:  Hastings
 longer function
R:  200
5:   ONCK -
P, NAV 3.0+,
8/93+,
.2.0+
 The Hastings
}in the
.  Hastings is a
uof the
ain a
E.  It may
Hastings is
X, the
 find the
ain the
E.  If
 has not
rby the Hastings
, it
wit.  Hastings
lthe
)of the host
5.  The
3unless the
 was smaller
), in
case the
 200
).  The
>and
in the DOS
to the
>and
 The
can be
in the
Hastings:
 "AKA Nick Haflinger... Zopy me I want to travel"
 "I can now
in assembler"
was written in the town of Hastings hehehehe!"
 The Hastings
Nnot do
%replicating and
 destroying those
 See:   Possum
PZPAPN
Hates-213
:  Hates-213
G:  May,
R:  213
5:   PNCK -
 The Hates-213
in May,
.  Its
.  Hates-213 is a
uof .
the Hates-213
wone .
in the
pof 213
 the
at the end of the
a.  The
 and
in the DOS
 the
>and
.  The
in the
5in all Hates-213
 "Jesus Hates You*.cOm"
 Hates-213
Nn't
to do
PZPAPN
:  Hell
 Year-6545, Hell-892, Pixel-897, Pixel-899, Pixel-899B,
 Pixel-905
G:  May,
R:  936
5:   PNCK -
, NAV,
 The Hell
Vin May,
.  Hell is a
uof .
Hell is
X, the
 search the
Eand
wall .
,is present in the
E, it
r.  A portion of the
remain in
, hooking the
clock.
Hell
by 936
), the
at the
.  The
>and
in the DOS
to the
>and
Hell
9the
 "WBO"
 "Fucking Hell:What a smelly ass hole!!Do you want to fuck!!!
 HaHaHa... What a Good Friday!!"
 Hell is actually shorter in
), the
by the
fa previous
is a
of the Amstrad
es, and
may detect it as such.
 Hell and its
can be destructive
activate,
 formatting the
btrack of the
of Hell are:
 Hell-892:
gequivalent to the
adds 892
 Pixel-897: Pixel-897 is an 897
of the Hell
vall .
,in the
 of 897
), and
>and
in the DOS
`are:
 "WBO"
 "Fucking Hell: What a smelly ass hole!!"
 "Do you want to fuck it!!!"
Pixel-897
, it
Ms the last two
as a
, and
s the
btrack
 of the
O, formatting it.
 Pixel-899:
gequivalent to Pixel-897,
 adds 897
 Pixel-899B: Pixel-899B is
to Pixel-899,
 exception
, it
Ms its
 but
Nnot format the
btrack of the
 Pixel-905: Pixel-905 is an 905
of Pixel-897
gequivalent,
the exception
pd in
by 905
 See:   Amstrad   Pixel   Silly   Silly-365
PZPAPN
Hellraiser
:  Hellraiser
G:  May,
fail to
 Canada
R:  1,580
5:   ONE -
3.96+, NAV 3.0+,
1.53S+,
 The Hellraiser
in May,
.  It is
fCanada.
is a
 of .
the Hellraiser
X, the
check the
Oto determine if more
Fories exist.  If more
two sub
Fories exist, the
start in the third sub
Eand check for two
 Hellraiser
lthe
b1,580
 of the host
the Hellraiser
5, permanently damaging them.
be no
3to the
unless the
awas
smaller
1,580
.  In the case of the host
 smaller
1,580
, it
 1,580
.  The
>and
in the DOS
smaller
the Hellraiser
to the DOS prompt
Ythem.
are larger
receive
too big to fit in
Ythem.
PZPAPN
Hellween
:  Hellween
 1376
H:
R:  1,376
5:   PRhA -
, NAV,
 The Hellween
.  Its
~are
.  Hellween is a
uof .
-and .
, but
Nnot
 The
Hellween is
X, the
 Hellween
at the top of
$the
|12's
!moved.
, as
qby the DOS
 by 1,904
mby the
the Hellween
, it
pof 1,376
).  The
 at the end of the
a.  The
>and
 the DOS
not be
 The
in the Hellween
5, and are not
 "HELLWEEN???!!"
 It is
what Hellween
of Hellween are:
 Hellween-1182:
on the Hellween
is 1,696
).  It
 hooks
{08, 13, and 21.  Like Hellween,
-and .
pof 1,182
at the end of the
a.  The
 and
in the DOS
.  It
Nnot
9the "HELLWEEN"
 Hellween.1684:
on the Hellween
is 2,208
).  It
 hooks
{08 and 21.  It
pof 1,684
at the end of the
a.  The
>and
in the DOS
 not be
.  The
in the
5in all
 "Do you work
 "Do you like
 "Do you like space on
 "YOUR
 SOLUTION
 "The Volkov
 "You can
Oit like Norton
6er 4.0"
 "The SIZE of Volkov
6er is ONLY 62KB!"
 "The VC brings many new functions!"
 "All
    s of VC are very quick!"
 "The VC is ShareWare but"
 "please"
 "don''t make black copies, it's not fair."
, 1994.
 Zak2:
on the Hellween
is 2,608
), hooking
|21.  Zak2
-and .
X, adding
 1,839
)to the
.  The
>and
 in the DOS
not be
, and the
at the end of the
a.  The
in the Zak2
 "zak2"
 May,
PZPAPN
:  Hero
 Hero-506
G:  May,
 Italy
R:  506
5:   PRA -
, NAV,
, NAV,
 The Hero
in May,
.  Its
is believed
 to be Italy.  Hero is a
generic
uof .
 and .
bHero
X, Hero
it is
, it
X.  The
usually
 be hung
Hero
pof 506
).  .
by 506 to 509
).  The marker of
 all
is 24 hex FF (h'FF')
4at the
"of the
 the
)of the
, permanently damaging
 the host
 Hero is not a viable
due to the bugs
in its
5, and is
 a very poor replicator since
s in a
 hang.
of Hero are:
 Hero-506B:
on the Hero
 has had
of the
ming
Tin the
 corrected.  It no longer
jthe
 are
pd in
by 509
at the
 end of the
a.  The
>and
in the
 DOS
to the
>and
 See:   Hero-394
PZPAPN
Hero-394
:  Hero-394
 Hero-B
Mof random
R:  394
5:   PRfE -
/, NAV,
 The Hero-394
.  Its
is a
uof .
`, and
on the Hero
 The
Hero-394 is
X, the
 Hero-394
.  Hero-394 hooks many
{in the
|area,
Hero-394 is
, it
pof 394
at the end of
 the
a.  The
>and
in the DOS
to the
>and
of a Hero-394
random
may be
X, as well
 as the
ing to be hung.  Usually, if the
presses
 "enter", the
continue processing.
 See:   Hero
PZPAPN
Hexametricx
:  Hexametricx
^, 1994
=seconds = 12
 Germany
R:  545
5:   PNCK -
6.60+,
 The Hexametricx
^, 1994.  It
fGermany.
is a
 of .
in the
Oroot
E.  In its
;state, it
Nnot
Fories, or on
the Hexametricx
wone .
in the C:
Oroot
 545
at the end of the
a.  The
>and
in the DOS
to be un
the seconds field
 set to "12".  The
in the
 Hexametricx
 "*.CoM"
 "Hello
, You
lgot The HEXAMETRICX
 "Today is the month's B i r t h d a y !"
 "I was written in the City of Langen(Hessen), Germany"
 "by SuIgImErIuS"
v1.3"
 "GREETINGS TO ALL OTHER VIRUS WRITERS!"
 It is
what Hexametricx
PZPAPN
:  HH&H
 Gomb, GMB
R:  4,091
5:   PRhCK -
, NAV,
1.53S+,
 The HH&H
.  Its
.  HH&H is a
uof .
bHH&H
X, the HH&H
at the top of
 but
$the
, as
qby the DOS
 by 6,144
{1C and 21
mby HH&H in
the HH&H
, it
over
8K in
X, it
the HH&H
 4,091
).  The
at the end of the
.  The
>and
in the DOS
to the
>and
 The
in the HH&H
5, and hence are not
 "HARD HIT & HEAVY HATE the HUMANS!!"
 "[ H.H.& H.H. ]"
 It is
what HH&H
PZPAPN
:  Hi
 Eastern
R:  460
5:   PRtE -
, NAV 3.0+,
8/93+,
.2.0+
 The Hi
.  It is
fEastern
V.  Hi is a
uof .
X, the Hi
at the top of
$the
', moving
|12's
, as
 by the DOS
@by 1,024
mby the
the Hi
, it
pof 460
 at the end of the
a.  The
>and
in the
 DOS
to the
>and
.  The
can be
dnear the end of all
 "Hi"
PZPAPN
HiDos
:  HiDos
 BSC;
Jroot
 England
R:  N/A
5:   BRtX -
n, NAV 2.1.4+,
/2.0+,
 The HiDos
.  It is
 England.  HiDos is a
and the
).  It is roughly
on the
 The
 the HiDos
, the HiDos
wthe
, as
qby the DOS
@by 2,048
).  On the
K, the
!moved to Side 0, Cylinder 0,
 7, and a copy of the
5written to the
location.
the HiDos
, it
wthe
of non-write protected
 accessed on the
.  The
talways
fthe
Kto the
hang
ing.  Any attempt to
Fly access
 the
or the
in a
hang.
 The
r360K 5.25"
!copied to
11.  On 1.2M 5.25"
I, it
be at
17.  As both of
are part of the root
:may
9ed entries.
PZPAPN
Highlander
:  Highlander
i; TSR
R:  477
5:   PRsC -
3.96+, NAV 3.0+,
1.53S+,
.2.0+
 The Highlander
.  It is
fthe
, and is by the same author as
 the Geek
.  Highlander is a
uof .
, but not
bHighlander
X, the
 Highlander
as a low
TSR of 1,280
).  It hooks
{21 and 22.
, the Highlander
pof 477
at the
"of the
a.  The
>and
in the DOS
not be
 The
in the
 all Highlander
 "Highlander 1 RULES!"
 "v05"
 Highlander
on the 29th day of any month, at
Mthe "Highlander 1 RULES!"
s and
 hang the
PZPAPN
Hiperion
:  Hiperion
G:  May,
R:  254
5:   PRaCK -
3.96+,
30.00+, NAV 3.0+,
6.60+,
1.25+,
6.64+
 The Hiperion
in May,
.  Its
.  Hiperion is a
bHiperion
X, the Hiperion
in a "hole" in al
, hooking
|21.
, as
qby the DOS
not be
the Hiperion
, it
pof 254
at the end of the
a.  The
in the DOS
to the
>and
.  No
in the
5in Hiperion
 It is
what Hiperion may do
of Hiperion are:
 Hiperion.249:
, 1994, Hiperion.249 is a 249
of the Hiperion
pof 249
at the end of the
 The
>and
in the DOS
to the
>and
.  The
in the
 "C:\
, 1994.
PZPAPN
Hitchcock
:  Hitchcock
i; TSR; I/O
; music;
R:  1,247
5:   PRsCK -
, NAV,
 The Hitchcock
.  Its
.  Hitchcock is a
uof .
 The
Hitchcock is
 Hitchcock
as a low
TSR of 4,196
mapping utilities
 not show the TSR, but instead
the in-
6interpretor
 is 4,196
)larger
expected.
mby the
becoming
, Hitchcock
 over
3K in
X.  If
X, it
be 1,247
)larger
 The
at the end of the
fwrite-protected
in a DOS "Write protect
Uwriting
 Hitchcock
Nnot trap
X, later
fthe
in Hitchcock becoming
at the top of
$the
 DOS
@by 4,096
{1C and 21
now be
on the
may now get the
, "I/O
UF0, PC=3FAB", and the
be aborted.
five to ten minutes
&ing the
 a Hitchcock
,, the
play music on
 the
speaker.  The music is the theme song
fthe Alfred
 Hitchcock television
, and
continue to play at
 intervals until the
is re
of Hitchcock are:
 Hitchcock-1238:
, Hitchcock-1238 is
 a 1,238
of the Hitchcock
.  Its
is 4,112
), hooking
{1C and 21.  It adds 1,238
)to the
v.  The
 at the end of the
a.  The
>and
 in the DOS
not be
Hitchcock-1238
 the theme song
fthe Alfred Hitchcock television
#played on the
speaker.  As
 the
, the tune
be played at
 intervals until the
is re
PZPAPN
:  HLLS
^, 1994
`created
correspond to .
R:  4,768
)& More
5:   PNS - Spawning or Companion
 HLLS is a category of
includes spawning or companion
are written in a high-level language, such as C, C++,
 or Pascal.
es in
category
 creating a corresponding or companion .
has the
 same base
.  As a
Ythe .
, DOS
Ythe .
 instead.
 The companion .
`created by HLLS
es may be
in the DOS
E, or not
due to the settings of
aattributes.  The
`may
lthe
>and
set to
 the
>and
, a specific
 and
unique to the
, or the
>and
of the
 corresponding .
 Companion or spawning
es can generally be dis
 deleting the .
9the
HLLS
es include:
 HLLS.Linda Lou:
^, 1994, HLLS.Linda Lou is
, 4,768 spawning or companion
.  It
 up to three .
in the
 and
X.  The companion .
 created by HLLS.Linda Lou are at least 4,768
, and
 are
in the DOS
>and
match the
>and
on the
 corresponding .
a.  The
can be
in HLLS.Linda Lou companion .
*.exe
^, 1994.
PZPAPN
Hobbit
:  Hobbit
; TSR
R:  505
5:   ORsE -
\2.10g+,
V112+,
6.60+,
2.58+,
2.58+,
V113+,
6.64+
 The Hobbit
.  Its
.  Hobbit is a
 of .
, and should be considered a
bHobbit
as a low
TSR of 1,440
).  No
Fly mapped to the
 as it
Fly hooks the
{via the
|chain.
, the Hobbit
.  Hobbit
as the
s 505
)of the .
 header.  The
>and
in the DOS
not be
.  One
in the
5in all Hobbit
 "HOBIT"
 It is
what Hobbit
PZPAPN
Holiday
:  Holiday
 Indonesia
R:  2,900 - 2,916
5:   PRhAK -
2.11+,
6.60+,
\2.13+,
6.64+,
1.25+
 The Holiday
, and is
 Indonesia.  Holiday is a
uof .
-and .
bHoliday
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 2,912
mby Holiday in
the Holiday
, it
by 2,900
)while .
pof 2,906 to 2,916
).  In both cases, the
at the end of the
a.  The
 are
in the
5in all Holiday
 "ATTENTION!"
 "I'm very sorry, today is my holiday."
 "So, I can't serve you, cause I want to play on your computers."
 "DON'T TURN OFF YOUR
-PUTER UNTIL TOMORROW,"
 "OR YOUR DATA WILL BE LOST!!!"
 "I'll be back to serve you tomorrow."
k You,"
 "AAA"
k You for playing, see you..."
 "Please, hit ENTER!"
jmay
PZPAPN
Holocaust
:  Holocaust
, Holo
 Barcelona, Spain
R:  3,784
5:   PRhCK -
, NAV,
 The Holocaust
by David Llamas
 of Barcelona, Spain.  Holocaust is a self-encrypting
uof .
 qualifies as a
as it hides the
`as well as
aopen and
 The
the Holocaust
X, the
.  It
 reserve 4,080
)of high
$the
be marked as
6Data, and
mapping utilities
show the
6interpreter to
lgrown by the 4,080
it is actually in high
instead of low
Holocaust is
, it
for any reason.
, however,
wvery small .
`of less
1K in
by 3,784
not be seen in a
 the
.   The
 the end of
 If the Holocaust
and the DOS
qas having a
Zof the
the /F parameter on
in the
`becoming damaged.  The
Tdo not
 the
is not in
since at
match the
in the FAT.
 The Holocaust
is a self-encrypting
, and
 occasionally produce an
Sdifferently
fits
encryption mechanism.
9the
at the end of the
, while
 samples
Anti - C.T.N.E. v2.10a. (c)
Grupo Holokausto.
 Kampanya Anti-Telefonica. Menos tarifas y mas servicio.
med in Barcelona (Spain). 23-8-90.
 - 666 -"
 Holocaust is reported by David Llamas to be widespread in Barcelona
 as of
.  It is not
, and
 what it
 See:   Telecom
PZPAPN
Hominy
:  Hominy
 Australia
R:  1,589
5:   PNCK -
, NAV,
1.53S+,
 The Hominy
.  It is
 Australia.  Hominy is a
uof .
the Hominy
wone .
in the
 1,589
at the end of the
 The
>and
in the DOS
 not be
can be identified manually
 by checking to determine if the
bthree
)of the
 match the last three
)of the
 The
in the
5in Hominy
 "GAMES
 "RASTAN  RJ"
 "WORLDALC.DN1"
 "ZEPFIGHT.MS3"
 "*.*"
 "\  S S\DR SS"
 It is
what Hominy
of Hominy are:
 Hominy-B:
gequivalent to the
Hominy
 the
 "CINACT.LOG P"
 "CARTOONS.000"
 "\ TRIP ARK"
:  Australia  May,
 See:  P
PZPAPN
Honey
:  Honey
R:  666
5:   PNCK -
30.00+,
3.96+,
1.25+
 The Honey
.  Its
, but it is probably
fthe
.  Honey is a
uof .
the Honey
X, the Honey
wone .
in the
pof 666
 the
at the end of the
a.  The
 and
in the DOS
 the
>and
.  The
in the
5in all Honey
-C:\ . ANTI-VIR.DAT .. DOS"
 "Honey, I'm home . . ."
 "Earl Sinclair"
 "\CODE\WORK"
 "TSTS"
 The "Honey, I'm home . . ."
is the greeting used by the
 "Earl Sinclair" character in the "Dinosaurs" television
.  The
 as a
PZPAPN
Horror
:  Horror
R:  2,319
5:   PRsAK -
, NAV,
 The Horror
.  Its
.  Horror is a
-and .
 The
the Horror
 the Horror
at the top of
$the
, as
qby the DOS
@by 3,744
|12's
not be
 moved.
{13 and 21
mby the Horror
, the Horror
 the copy of
ed to by the
-SPEC en
mental
 variable if it was not
the Horror
, it
pof 2,319
 at the end of the
a.  The
>and
in the DOS
not be
.  The Horror
 unable to determine if it has
 the
, adding an
2,319
 Horror is an
.  While it
8the
in its
cannot be viewed in
is HORROR !"
-SPECS"
 It is
what Horror
[frequent
 are
of Horror are:
 Horror-1112:
on the Horror
adds 1,112
)to the .
-and .
 the end of the
a.  It
Nnot re
.  Its
is 1,792
), hooking
{13 and
 21.  The
 locked
 out
.  The
in the
 Horror-1137:
on the Horror
adds 1,137
)to the .
-and .
 the end of the
a.  It
Nnot re
.  Its
is 1,856
), hooking
|21.  The
 locked out
.  The
in the
 Horror-1137B:
gequivalent to Horror-1137,
 very minor
PZPAPN
Horse
:  Horse
 Horse
&Dropper
G:  May,
 BSC;
; high density
R:  N/A
5:   BRhX -
, NAV,
K/P, or DOS SYS on
 The Horse
in May,
in the form of a
 "dropper"
zs the
on a 360K
 Horse
"dropped" by the
, is a
and the
).  It is
on the
rby the Horse
, the
at the top
, but
$the
|12's
not be moved.
Aby 2,048
)as measured by the DOS
.  The
access the
K, and
wthe
a copy of the
&has completed, the
find
OC:, and not
Horse
, it
wnon-write
 protected
are exposed to the
 360K low density 5.25"
Horse
moved to the last
on the
lthe
moved
 to cylinder 0, side 0,
 Horse
&treats high density
Ias low density
 If a high density
Horse
&, data on
 the
be damaged.
of Horse
&are:
 Horse
&Dropper: A small .
 drops the Horse
 See:
PZPAPN
House
:  House
fail to
 unexpected access to A: and B:
R:  11,636
5:   ONE -
\2.09+, NAV 3.0+,
2.10+,
V112+,
V113+,
1.25+
 The House
.  Its
.  House is a
on the A:
 and B:
the House
X, the
 House
wall .
in the
Fories on the A: and B:
are larger
11,636
lthe
b11,636
)over-
 written by the House
, permanently corrupting them.  The
>and
in the DOS
not be
, and the
not be
1.  The
can be
din the House
5in all
 "*.exe"
 "*HOUSEVIRUS*"
 "*.exe rb rb rb+"
the House
not function
 and
either
to the DOS prompt, or unexpected
s may
PZPAPN
Hungarian
:  Hungarian
 Hungary
R:  695
5:   PRhAK -
, NAV,
1.53S+,
 The Hungarian
}in Hungary in
is a
uof .
-and .
bHungarian
Xon a
 the Hungarian
at the top
$the
|12's
!moved.
, as
qby the DOS
 by 1,024
).  The
is actually 1,008
, and can be easily seen
mapping utilities.
the Hungarian
, it
 and .
pof 695
at the end of the
a.  The
>and
in the DOS
 It is
if the Hungarian
of Hungarian are:
 Gyorgyi: A 749
of the Hungarian
, Gyorgyi
-and .
pof 749
at the end of the
a.  The
>and
in the DOS
not be
.  The
dnear the end of all Gyorgyi
 "I LOVE   GY
RGYI"
:  Hungary  May,
 Hungarian-B:
gequivalent to the Hungarian
has three
 differ.
:  Hungary
PZPAPN
Hungarian 482
:  Hungarian 482
i; TSR; no
 Hungary
R:  482
5:   PRsCK -
, NAV,
 The Hungarian 482
}in Hungary in
 Dr. Szegedi Imre.
is a
 The
Hungarian 482 is
 the
as a low
TSR, hooking
|21.  Unlike
most
use TSRs for
 residency, the DOS
report no
.  However,
|12's
!moved.  The TSR is in low
, and the
prevent its TSR
Hungarian 482 is
, it
very small ones, as
X.  If
X, it
by 482
at the end of the
be no
 in the
>and
in the
 Due to a bug in the Hungarian 482
5, it is possible
happen very
 Hungarian 482
Nnot do
 See:   Zu1
PZPAPN
Hybryd
:  Hybryd
 Hybrid
 Poland
R:  1,306
5:   PNCK -
\, NAV,
 The Hybryd
, and is
fPoland.
is a
uof .
Hybryd is
X, the
 for an
in the
E.  If an
d, the
wit.
pof 1,306
), the
at the end of the
alters the
the seconds field in the
is 62, the indicator
r.  Just viewing
 the
, it
>and
 not
 The
in the Hybryd
cannot be viewed in
 "(C) Hybryd Soft
 Specjalne podziekowania dla
 Andrzeja Kadlofa i Mariusza Deca
 za artykuly w Komputerze 11/88"
 In the
sample, the one
is not
 is the
d samples:
 "Copyright IBM Corp 1981,1987
 Licensed Material -
Property of IBM"
should not be taken to indicate
IBM necessarily had
to do
the creation of
 On Friday the 13th starting in
 It may
corrupt
PZPAPN
Hydra
:  Hydra
 Hydra, Hydra-0, Hydra-1, Hydra-2, Hydra-3, Hydra-4, Hydra-5,
 Hydra-6, Hydra-7, Hydra-8, Hydra-8 Trojan
 unexpected
Zfailure;
truncated
R:  340 - 736
), depending on
present
5:   PNCK -
, NAV,
 The Hydra
es was
.  Its
.  The Hydra
8nine closely related
es, and one trojan
 dropped by one of the
es.  All of the
es are
us of .
.  The earliest
 Hydra-0, is
eight later
 and the trojan included in "
Hydra-0 is
X, the Hydra-0
search the
Efor one non-
w.  If one is
d, Hydra-0
 Hydra-0
 736
), the
at the
"of the
a.  The
>and
in the DOS
to the
>and
 If Hydra-0
Nnot find an
ain the
E, it
activate.  At
, it
, and
to the DOS
 prompt:
 "HYDRA"
 "Watch for the many heads.
 The
beight are easy to find and kill.
replacements
be more sophisticated."
 "(c)
 -  C. A. V. E."
 The
, along
$can be
din all Hydra-0
 "HyDra"
 "Beta - Not For Release. *.CO?"
 "Copyright (c) by C.A.V.E."
 "Coalition  of   American
  Engineers"
 "  -=-=-  "
 "Dedicated  to  supporting  the   anti-
 industry
out recognition or reward."
 Hydra-0
Nnot do
members of the Hydra
%Hydra-0, are:
 Hydra-1: Hydra-1 is
to the Hydra-0
.  It adds 403
)to the .
all the .
`in the
r, it
Mthe
, and the
 hung:
 "HYDRA"
 "Copyright (c)
by C.A.V.E."
 The
din all Hydra-1
along
 "YD  HyDra-1   Beta - Not For Release. *.CO?"
 Hydra-2:
on Hydra-1, Hydra-2 is a 343
.  It
 adds 343
)to the .
all the
`in the
r, it
Many
, and no
hang
.  It
8the
 "YD  HyDra-2   Beta - Not For Release. *.CO?"
 "Copyright (c)
by C.A.V.E"
 Hydra-3:
on Hydra-2, Hydra-3 is one
*smaller.  It adds
 342
)to the .
all the .
`in the
r, the
not be able to successfully
Yany
in the
ed to the DOS prompt.
in unexpected
.  For
 example,
Zof the DOS
typically
in a
indicating the
 is bad, even
it is actually undamaged.
Hydra-3 are:
 "YD  HyDra-3   Beta - Not For Release. *.CO?"
 "Copyright (c)
by C.A.V.E."
 Unlike
members of the Hydra
], Hydra-3
walready
, adding
)to the
 Hydra-4:
on Hydra-3, Hydra-2 is two
)smaller.  It adds
 340
)to the .
all the .
`in the
Zof any
in the DOS
: "General Failur
Ureading
O".  The
is receiving the
Uis actually ok, and
 accessible
&ing the
and dis
in Hydra-4
 are:
 "YD  HyDra-4   Beta - Not For Release. *.CO?"
 "Copyright (c)
by C.A.V.E."
 Hydra-4
Nnot re
`as Hydra-3
 Hydra-5: The Hydra-5
on the Hydra-4
.  It
 adds 391
)to the .
all the
`in the
Zof the next
in all
in the
in Hydra-5
 "YD  HyDra-5   Beta - Not For Release. *.CO?"
 "Copyright (c)
by C.A.V.E."
 Hydra-6: The Hydra-6
on the Hydra-5
.  It
 adds 372
)to the .
all the
`in the
Zof the next
 any
ain the
the base
-MAND (ie
-MAND.*)
#truncated to zero
in Hydra-6
 "YD  HyDra-6   Beta - Not For Release. *.CO?"
 "Copyright (c)
by C.A.V.E.
-MAND.*"
 Hydra-7: The Hydra-7
on the Hydra-6
.  It
 adds 368
)to the .
all the
`in the
Zof the next
in all
in the
 truncated to zero
in Hydra-7
`are:
 "YD  HyDra-7   Beta - Not For Release. *.CO?"
 "Copyright (c)
by C.A.V.E.  *.
 Hydra-8: The Hydra-8
on the Hydra-7
.  It
 adds 495
)to the .
all the
`in the
Zof the next
 four .
`in the
#replaced by
 a 90
*trojan
(see
$as Hydra-8 Trojan).
in Hydra-8
 "YD  HyDra-8   Beta - Not For Release. *.CO?"
 "Copyright (c)
by C.A.V.E.  *.
 Hydra-8 Trojan: The Hydra-8 Trojan is a 90
 the Hydra-8
replace four .
 the
 Hydra-8
are later
X, it
in the middle of the
 and
to the DOS prompt:
 "Who is John Gait?"
is not
in the trojan
PZPAPN
:  Hymn
R:  1,865 - 1,883
5:   PRhAK -
\, NAV,
 The Hymn
, and
ated in
 the
is a
uof .
-and .
`, and
 The
the Hymn
 the
at the top of
$the
'.  The DOS
 show
@by 3,712
Nnot move the
Hymn is
, it
-and .
are over
2K in
for any reason.
 by 1,865
pof 1,869 to 1,883
).  In both cases the
at the end of the
9two
in the
5: "ibm@SNS" "@ussr@"
 It is not
what Hymn
, but it is assumed
fthe
under
conditions it may play music.
PZPAPN
:  I-B
 BadGuy, BadGuy 2, Crackpot, Demon, Exterminator
G:  May,
 Italy
R:  265, 272, or 451
5:   ONCK -
, NAV,
 The I-B
is actually a group of three
Vin May,
ated in
 Italy, and are very closely related.  All of them are
an I-B
X, it
wall .
 the
lthe
"of the
 The number of
vary, depending on
is present.
 and
in the
to the
>and
.  See
$for specifics of
 I-B
es activate
on the day of the week.  If all of the
in the
Eare
r, and the
 day of the week is the day
#checked for by the
 activate.  Two of the
b160
 of the C:
O, the third
just hang the
of I-B are:
 BadGuy: BadGuy is a 265
of I-B.  It
s the
b265
>and
in the
to the
>and
 BadGuy
on Mondays,
hang the
the BadGuy
of I-B are:
 "BadGuy
(c) by Cracker Jack
(IVRL)"
 "Italian
Research Laboratory (C)
 "IVRL Head Quarter, Milan Italy"
 BadGuy 2: BadGuy 2, or Crackpot 208,
is a 208
 of I-B.  Basically, it is a bug-fix
of BadGuy,
 having had the bug fixed
s in a
BadGuy
.  BadGuy 2
vall .
 the
b208
).  The
 and
in the
to the
>and
t.  On Mondays, BadGuy 2
Mthe
 "New BadGuy
- (c) by Cracker Jack
 IVRL Head Quarter Milan Italy"
cannot be
as it
:  Italy,
 Demon: Demon is a 272
of I-B, and is the most
 advanced of the
].  It
 the
b272
>and
in the
 DOS
E.  Demon
on Tuesday, at
Mthe
 the
b160
of the
Ueating
can be
Demon are:
 "Demonhyak Viri X.X (c) by Cracker Jack
(IVRL)
 Demon-B: Demon-B is a minor
of the Demon
 I-B.  It has five
differ
fthe
 Demon
 Demon-C: Demon is a 263
of I-B, and is
on the
 Demon
.  It
s the
b263
)of all .
in the
X.  Demon-C
8the
in its
Ureading
 "BillMeTuesday!"
WC failure"
-MAND.C0M"
 Exterminator: Exterminator is a 451
of I-B, and
s to be the earliest
 Exterminator
s the
b451
>and
to the
>and
.  Exterminator
 on Mondays,
Mthe
b160
of the
 "Exterminator
1.0 (c) by Cracker Jack
(IVRL)
 No panic...
is a Harmless
can be
 Exterminator
 "Exterminator 1.0 - (c) by Cracker Jack
(IVRL)"
 "Italian
Research Laboratory (C)
Researchers:
 Non rompetemi le palle o mi arrabbio...
 non so se sono stato abbastanza chiaro
PZPAPN
Ice 9
:  Ice 9
 ARCV93
i; TSR; hidden
`are no longer hidden
 England
R:  639
5:   PRsC -
3.96+,
1.25+
 The Ice 9
}in England in
.  Ice 9
 is a
uof .
, but not
 The
the Ice 9
 the Ice 9
as a low
TSR of 1,136
mby the
, Ice 9
for any reason.
pof 639
at the end of the
a.  The
>and
in the DOS
not be
 The
can be
dat the very end of
Ice 9:
 "r51xP"
 A symptom of an Ice 9
hidden
no longer be hidden, and
in the DOS
of Ice 9:
 Ice 9-159: Probably an earlier
of the Ice 9
 Ice 9-159 is a
uof .
,.  It
vone .
in the
 159
at the end of the
a.  The seconds field in the
>and
in the
 DOS
!set to "00", and
cases, the
fthe
as a
.  The
in the
-[159] ICE-9"
 Ice 9-159
Nn't
to do
:  England  March,
 Ice 9-199: A later
of the Ice 9-159
,.  It
vone .
in the
 199
at the end of the
a.  The
>and
in the DOS
to be
, but the seconds field
!set to "62".  The
in the
 "[199] ICE-9"
 Ice 9-199
Nn't
to do
:  England  March,
 Ice 9-224: A later
of the Ice 9-199
,.  It
vone .
in the
 224
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[224] ICE-9 *.com"
jmay
:  England  March,
 Ice 9-250: A later
of the Ice 9-224
,.  It
vone .
in the
 250
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[250] ICE-9*.
 "arCv"
 The second
, "arCv" can be
dat the end of all
:  England  March,
 Ice 9B:
to the
 one
differs.
:  England
PZPAPN
Icelandic
:  Icelandic
 656, One In Ten,
KCrunching
, Saratoga 2, Iceland
 Extinct
, 1989
-TOM; bad
; FAT
 Iceland
R:  656
5:   PRfE -
, NAV,
\, NAV, or
 The Icelandic, or
KCrunching
, was
 Iceland in
1989.  Icelandic is a
`, and
wevery tenth .
 The
Icelandic is
X, the
at the top of
$the
, as
qby the DOS
 by 2,048
mby the
`growing in
between 656 and 671
 always be a multiple of 16.  The
attaches
to the end of
 the
v, and
always end
 hex '4418,5F19'.
 The Icelandic
to avoid detection by
utilities by checking to see if
has "
|13.  If
|13 was
mbefore
 the
bIcelandic
X, the
not proceed
.  If
|13 has not
attempt to
wevery 10th
floppy
Os, or 10 MB
Ks, the
not cause any damage.  However, on
 larger
10 MB, the
select one unused FAT entry and
 mark the entry as a bad
of Icelandic are:
 Icelandic.655: Icelandic.655 is a modified
of the
 Icelandic
.  Its
 is 2,048
), and it
Fly hooks
{, so
be mapped to the
, it
wevery tenth
X, provided
is an .
by 655 to
 669
at the end of
 the
a.  The
>and
in the DOS
to the
>and
jmay
, 1994.
 Icelandic-IB:
gequivalent to Icelandic,
differs by one by
fthe
 Icelandic-IC:
gequivalent to Icelandic,
differs by one by
fthe
 and Icelandic-IB.
 Icelandic-ID:
 very minor
of Icelandic.  It has
 to avoid
#detected by a specific
 utility.
 Icelandic-IE:
 very minor
of Icelandic.  It has
 to avoid
#detected by a specific
 utility.
 Icelandic-II: Icelandic-II is a modified
of the
 Icelandic
.  Its
is 632
the Icelandic-II
, it
modify the
>and
 the DOS
E.  It
removes the
 read-
attribute
fread-
`.  On
Ks larger
10MB,
are no bad
 marked in the FAT as
the Icelandic
}: Iceland
, 1989.
 Icelandic-III: Icelandic-III is a modified
of the
 Icelandic
.  Before Icelandic-III
, it checks to see if the
Icelandic or Icelandic-II,
 if it has, it
Nnot
wthe
the Icelandic-III
pd by 848 to 863
).  If an
is run on
?24th of any year,
subsequently run
be stopped, later
Ming the
"Gledileg jol" ("Merry
 Christmas" in Icelandic) instead.  The
's id
in the last two words of the
 hex '1844,195F', the
Qword
 reversed
fthe id
ending the Icelandic and
 Icelandic-II
}: Iceland
?, 1989.
 Saratoga:
on the Icelandic
, the Saratoga
 main difference is
it copies
, it modifies the
block so
 to belong to the operating
, thus avoiding
reusing the block.  It is 642
}: Saratoga, California, USA
, 1989.
 See:   Mix1
PZPAPN
:  Idle
j; unexpected
R:  2,332 or 2,859
5:   PRhA -
, NAV,
 The Idle
.  Its
.  Idle is a
-and .
.  It
Nnot
 The
the Idle
at the top of
$the
|12's
!moved.
qby the DOS
 3K.
{08, 21, and 28
mby Idle in
the Idle
, it
-and .
for any reason.  .
by 2,332
at the
"of the
a.  .
by 2,859
at the
 end of the
a.  In both cases,
be no
 to the
>and
in the DOS
 The
can be
in the
 all
 "PATH=
-MAND
W*.*"
the Idle
[unexpected
jand warm re
PZPAPN
Ieronim
:  Ieronim
 Ieronim-570
R:  570
5:   PRtC -
3.96+, NAV 3.0+,
8/93+,
 The Ieronim, or Ieronim-570,
 It is
fthe
.  Ieronim is a
uof .
, but not
 The
the Ieronim
 the Ieronim
at the top of
$the
', moving
|12's
, as
qby the
 DOS
@by 576
 08 and 21
mby Ieronim in
, the Ieronim
pof 570
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
 the
5in all Ieronim
 "com
 "Mulier pulchra est janua diaboli"
 "via iniquitatis,scorpionis percussio."
 "St. Ieronim"
 The Ieronim
Mthe follwoing
it is
, usually accompanied by a
hang:
 "Mulier pulchra est janua diaboli
 via iniquitatis,scorpionis percussio.
 "St. Ieronim"
of Ieronim are:
 Ieronim-512: A 512
of the Ieronim
 1K.  It hooks
{08, 20, and 21.
 Ieronim-512
, but not
pof 512 to 1,023
at the
"of the
 512
)of the
pis the actual
5, the remainder of the
 is padding at the end of the
a portion of the
 host
ahas
!initially
Ieronim-512, its
 multiple of 1,024
).  The
>and
 the DOS
 the
>and
.  Ieronim-512 is not
 able to determine
rby the
, so
may be re
 adding an
 The
in the
5in Ieronim-512
 "Mulier pulchra est janua diaboli,"
 "via inquitatis,scorpionis percussio."
 "St. Ieronim"
 The
Mthe last three
as a
, accompanied by beeping,
 Ieronim-560: A 560
of the Ieronim
 1K.  It hooks
{08, 20, and 21.
 Ieronim-560
, but not
pof 560 to 1,119
at the
"of the
 560
)of the
pis the actual
5, the remainder of the
 is padding at the end of the
a portion of the
 host
ahas
!initially
Ieronim-560, its
 multiple of 560
).  The
>and
 the DOS
not be
 Ieronim-560 is not able to determine
rby the
, so
 be re
r, adding an
t.  The
in the
5in Ieronim-560
 "Mulier pulchra est janua diaboli,"
 "via inquitatis,scorpionis percussio."
 "St. Ieronim"
 The
Mthe last three
as a
, accompanied by beeping,
 Ieronim-600:
on the Ieronim
is 608
), hooking
{08 and 21.  It
X, adding 600
.  The
 the end of the
a.  The
>and
 the DOS
not be
8the same
as the
, and
 like the
Mthe
 Ieronim-1581:
on the Ieronim
is 1,584
), hooking
{08 and 21.  It
X, adding 1,581
.  The
 the end of the
a.  The
>and
 the DOS
 to the
>and
.  The
can be
in the
5in all
 Ieronim-1581
 "Le voyage de condom"
Ieronim-1581 has
for awhile,
scroll the
Mand emit an
 occassional beep until the
is reset.  No
PZPAPN
Ignorant
:  Ignorant
, 1994
KMBR
R:  1,979
5:   PRhAKX -
W, and MBR
V116+,
\2.13+,
2.58+,
n1.05+,
6.64+,
1.25+,
6.64+,
V116+,
2.58+
`& DOS 5.0+ F-
K/MBR
 The Ignorant
, 1994.  Its
.  Ignorant is a
 fast
uof .
-and .
vthe
&Record (
), thus it is a multi-partite
.  Ignorant is
, hiding the
bIgnorant
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 5,120
mby the
, the
wthe
&record if it was not
, the Ignorant
W, .BIN, and .OVL
for any reason.
pof 1,979
 hidden
.  The
in the DOS
not be
.  The
in the Ignorant
 "Ignorance is Strength"
edom is Slavery"
 "War is Peace"
WBINOVLSYSSCCLVSF"
 "[1984] bY [T
] '93!"
 "THiS iZ iNFiON #"
 "Greetz RS/NuK
 It is
what Ignorant
PZPAPN
IKV 528
:  IKV 528
 IKV-512,
R:  528
5:   PNCK -
, NAV,
 The IKV 528
, its
is a
 of .
`.  It
IKV 528 is
X, the
wtwo .
in the
E.  .
are smaller
not be
by 528
).  The
at the end of
.  The
>and
 in the
not be
by the
Nnot do
PZPAPN
Ilja-1704
:  Ilja-1704
, 1994
R:  1,704
5:   PRaCK -
\2.10+,
V112+,
2.58+,
n 1.05+,
1.22+,
2.58+,
V113+,
6.64+
 The Ilja-1704
, 1994.  Its
.  Ilja-1704 is a
uof .
bIlja-1704
X, it
 8E00:
{16, 21, and 4C
mby the
the Ilja-1704
, it
pof 1,704
at the end of the
a.  The
in the DOS
to the
>and
.  The
in the Ilja-1704
ly, the
"CR" can be
dstarting in the
 fourth
*of all
PZPAPN
:  Ill
& beeping
R:  1,016
5:   PNCK -
, NAV,
 The Ill
.  Its
.  Ill is a
uof .
the Ill
X, the
search the
Eto find the
has not
d, it
r, and the
usually
 continue
Z.  If an
is not
d, the
usually continue
the Ill
pof 1,016
).  The
at the end of
 the
a.  The
>and
in the DOS
.  No
in the
X, the
Lalong
a series of beeps
 emitted
fthe
speaker:
 "WARNING : USE ONLY ORIGINAL PROGRAMS
 DON'T COPY IT
 and now .. I AM ILL !!"
in the
PZPAPN
:  Imi
 Imi.A
, 1994
i; TSR;
R:  1,536 - 1,550
5:   PRsE -
\2.13+
 The Imi or Imi.A
, 1994.  Its
.  A
of six
es in the Imi
]were
initially,
five
listed
$as Imi.B, Imi.C, Imi.D, Imi.E, and Imi.F.  While Imi
bImi
as a low
TSR of 1,856
{21 and 22
mby the
the Imi
, it
pof 1,536 to 1,550
 at the end of the
a.  The
>and
in the DOS
to the
 and
.  The
 are
in the
5in all Imi
 "Hello!
is IMI 1.0b.
you see
words,"
 "you
rthe IMI 1.0b
is just"
 "for experiment.Please contact me immediately for cure."
 "Fu-Jen U. E.E. Wilbur Dam.
.4.8"
 "WIMI 1.0b,"
 "Wilbur,"
 It is
what Imi may do
of Imi are:
 Imi.B:
, 1994, Imi.B is
on the Imi
.  Imi.B
in addition
 to .
pof 1,536
at the
"of the
pof 1,536 to 1,550
at the end of the
a.  The
in the
5in all
 "Hello!
is IMI 1.0b
 "OIMI 1.0b"
, 1994.
 Imi.C:
, 1994, Imi.C is
on the Imi.B
.  Imi.C
-and .
 but not
,.  Its in
TSR is 1,840
), hooking
{21 and 22.
pof 1,536
at the
"of the
pof 1,536 to 1,550
at the end of the
a.  The
in the
5in all
-MAND"
 "Hello!
is IMI 1.0b
 "OIMI 1.0b"
, 1994.
 Imi.D:
on Imi.C,
is a
the exception
its in
TSR is 1,856
).  It
8the same
, 1994.
 Imi.E:
on Imi.D,
 the exception
>and
in the DOS
, 1994.
 Imi.F:
on Imi.E,
, 1994.
PZPAPN
Immolation
:  Immolation
G:  May,
`corrupted;
to 64K;
fail to function
R:  663
5:   ONE -
 The Immolation
in May,
.  Its
.  Immolation is a
the Immolation
wtwo .
larger
in the
Eor along the
 path.  A
hang may
 function
the Immolation
lthe
 663
)of the host
by the Immolation
5, permanently corrupting them.  The
>and
in the
 DOS
not be
.  One
in the Immolation
 The Immolation
on any Monday before 9:00 AM, at
be re
X.  On Fridays
12:00 noon, the
 the amount of
to 64K
X.  Finally, one all of the .
in the
Eand along the
path
r, the
lockup the
the next
PZPAPN
Incest
:  Incest
, 1994
i; DOS
 Queensland, Australia
R:  1,117
5:   PRhAK -
 The Incest
, 1994,
 in Australia.  Incest is a
-and .
bIncest
at the top of
 the
', not moving
|12's
 and
@by 2,400
), and
mby the
the Incest
, it
-and .
 copied.
pof 1,117
be hidden
.  The
at the end of the
 The
>in the DOS
not be
 however, the
field
.  The
in the
 "[Incest Daddy] by VLAD - Brisbane, OZ"
 "ANTI-VIR.DAT
 CHKLIST.CPS  CHKLIST.MS"
interfers
the Microsoft Anti-
and Central
Anti-
, deleting the
 the
require in order to be able to detect
PZPAPN
Incom
:  Incom
G:  May,
R:  648
5:   PNC -
, NAV,
 The Incom
in May,
V.  Incom is
uof .
.  It
Incom is
X, the Incom
wall
, except
in the
by 648
at the
 end of the
a.  The
>and
 the DOS
to the
 and
 Incom
9one
: "IN
derives its
 Incom is
on the
unlike
, it
 not damage any
 See:
PZPAPN
R:  822 - 837
5:   PNCK -
3.96+,
8/93+
 The
.  It is
fthe
uis a
X, the
wone .
in the
 822 - 837
at the end of the
 The
>and
in the DOS
to the
>and
.  The
can be
din all
[frequent
uare:
 AReg-822:
, AReg-822 is
on the
.  It
vone .
 in the
E, plus the copy of
ed to by the
-SPEC en
mental variable if not
by 822 to
 837
at the end of the
a.  The
>and
in the DOS
to the
 and
.  The
in the AReg-822
 "*.com OMSPEC"
 ".com"
 "(C)
AREG Soft"
 See:  Hallo-496
PZPAPN
Infinity
:  Infinity
 Canada
R:  732
5:   PNCK -
, NAV,
 The Infinity
.  It is
 Canada.  Infinity is a
Infinity is
X, the Infinity
search the
Efor the
a.  If an
d, the
 Infinity
 732
).  The
at the end of the
a.  The
>and
in the DOS
not be
 The
can be
in the
 Infinity
 "SKISM ReplicatoR"
 "FiRe is a LAMER... destroy InFiniTy!"
 "PATH=*.
 It is
if Infinity
PZPAPN
:  Inky
 Inky Ghost
H:
&Failure
R:  N/A
5:   PRB -
V112+
:  DOS SYS
I, M-
 The Inky, or Inky Ghost,
 and is one of three related
fthe popular Pac-Man video game.  Inky is a
.  It is "dropped"
 by the  Blinky
Cin its own entry.
&the
the Inky
, the Inky
be read into
, and the
receive the
on the
 "Non-
 Replace and press any key
ready..."
replaces the
an unwrite protected
J, the Inky
be transferred to the
on the newly inserted
K, and the
again
process continues until
 the
powers off the
fa clean
J, or
 the
 The Inky
s the
K.  The
is not saved.
9the
 "[-Inky!-]"
 "[INKY Ghost] by PacMan and Associates Inc."
 "Non-
 "Replace and press any key
ready..."
 The Inky
can be removed
Ks by performing the
 DOS SYS
ca clean
&.  On data, or non-
0 should be
using a
 editor, or the
`on the
Kcopied to a new,
 and the
Kreformatted.  Note
DOS 5+
s should
 use the /U option to ensure the
Jis actually
 See:   Blinky   Pinky
PZPAPN
Interceptor
:  Interceptor
 1014
 Italy
R:  1,014
5:   PNCK -
, NAV,
 The Interceptor
, and is
fMilan, Italy.  Interceptor is
on the
, and like
, is a
uof .
Interceptor is
X, Interceptor
search the
Eto locate the
btwo
r.  If an
das one of the
`, it
Interceptor
by 1,014
).  Interceptor
at the end of the
.  The
can be
dnear the end
 of all
 "Interceptor - by Cracker Jack
IVRL Milan, Italy"
 "*.com"
 It is
if Interceptor
s to be a research
at the
of its
 submission.
 See:
PZPAPN
Internal
:  Internal
 1381
H:
i; cascade of
contents;
R:  1,381 - 1,395
5:   PNE -
, NAV,
 The Internal, or 1381,
.  It is a
generic .
the Internal
 the
attempt to
wone
aon the
Nnot always
pd in
by between 1,381 and 1,395
 The
can be
dat the end of
9the
 "INTERNAL ERROR 02CH.
 PLEASE CONTACT YOUR HARDWARE MANUFACTURER IMMEDIATELY !
 DO NOT FORGET TO REPORT THE ERROR CODE !"
 The Internal
 days
>.  At
, the
produce a cascade of the contents of the
Mto the
 bottom of the
, and
Mthe
.  The
remove
fthe
of 1381 are:
 1381-B: (Internal-B)
to the
Internal
is a minor
 Internal-1459:
on the Internal
adds 1,459 to 1,473
)to the .
v.  The
in the
5, and not
 "INTERNAL ERROR 02EH.
 PLEASE CONTACT YOUR HARDWARE MANUFACTURER IMMEDIATELY !
 DO NOT FORGET TO REPORT THE ERROR CODE !"
in the same manner as the
 the cascading effect of the
contents,
, and
tof the
was executing.
PZPAPN
Intruder
:  Intruder
G:  March,
R:  1,319 - 1,333
5:   PNE -
 NAV,
 The Intruder
 source
5was published in "The Little Black Book of Computer
es" by Ludwig in the
.  It is a
uof .
the Intruder
wone .
in the
E.  The
pof 1,319 to
 1,333
the Intruder
to the end
 of the host
.  The
>and
in the DOS
not be
.  The
 can be
din the
 "\*.
W\*.*"
the Intruder
of Intruder are:
 Bell:
on the Intruder
ly, and has
to avoid detection by
familiar
 Like the
, it addes 1,326 to 1,340
)to the
v, and
8the
 "\*.
W\*.* \"
 Intruder-1326: A 1,326
of Intruder,
vone .
ain the
pof 1,326 to 1,340
at the end of the
 The
>and
in the DOS
not be
.  The
 can be
in the
5in all Intruder-1326
 "\*.
W\*.* \"
 Intruder-1326
corrupt
instead of
sthem.
 Intruder-1440: A 1,440
of Intruder,
vone .
ain the
pof 1,440 to 1,456
at the end of the
 The
>and
in the DOS
not be
.  The
 can be
in the
5in all Intruder-1440
 "\*.
W\*.* \"
 Intruder-1440
bthree or four
in the
Zof the next
in either a
hang, or the playing of a
 warbling sound on the
speaker accompanied by a
hang.
 Intruder.1555: A 1,555
of Intruder,
vone .
ain the
pof 1,555 to 1,567
at the end of the
 The
>and
in the DOS
not be
.  The
 can be
in the
5in all Intruder.1555
 "\*.
W\*.* \"
, 1994.
 Intruder-1967: A 1,967
of Intruder,
vone .
ain the
pof 1,967 to 1,981
at the end of the
 The
>and
in the DOS
not be
.  The
 can be
in the
5in all Intruder-1967
 "\*.
W\*.* \"
 Intruder-1988: A 1,988
of Intruder,
vone .
ain the
pof 1,988 to 2,002
at the end of the
 The
>and
in the DOS
not be
.  The
 can be
in the
5in all Intruder-1988
 "\*.
W\*.* \"
 Intruder-1988
bfour .
in the
Zof the next
 either a
hang, or the playing of a melody on the
speaker accompanied by a
hang.
 Intruder-2336: A 2,336
of Intruder,
vone .
ain the
pof 2,336 to 2,350
at the end of the
 The
>and
in the DOS
not be
.  The
 can be
in the
5in all Intruder-2336
 Intruder-B:
gequivalent to the
has six
differ.  As
jmay
PZPAPN
Invader
:  Invader
 Plastique
&, Anticad 4
 TSR; .
i; BSC; music; track 1 of
 may be
 Taiwan/China
R:  4,096
5:   PRsAB -
W, &
\, NAV,
:  CleanUp, or
 The Invader
in China.
is a later
of the Plastique-B or Plastique 5.21
.  It is a
uof .
-and .
`, but
 not
,.  It
.  In
 many reports of
ts of
s to
lspread very rapidly.
 The
the Invader
X, the
as a low
TSR.  The TSR is 5,120
)and
{08, 09,
 13, and 21
, the
wthe
of the
Owhere the
X.  The new
 is an MS-DOS 3.30
, and can be easily identified because
 the normal DOS
din the
are now at
 the
"of the
instead of the end.
, any .
-or .
the exception of
rby the
by 4,096
at the
"of the
a.  .
between 4,096 and 4,110
at the end of the
ly, any non-write protected
are exposed to
 the
 The Invader
for 30
 minutes.  At
, a melody may be played on the
 speaker.  On
play the melody, it
continue until
 the
is re
&ed.  If the
presses CTL-ALT-DEL to re
 the
, the
btrack of the
an un
Scopy of the
.  The melody
 isn't played on all
as it is configuration dependent.  The
 melody was
composed by Mozart.
of Invader are:
 Chinese Invader: A
of the Invader
fChina.  It
8the
"PC Tools"
 in the
5.  It is
what music, if
 any
plays.
:  China
 Danube: A
of the Invader
addes 4,096
)to the .
v, and 4,096 - 5,111
)to .
at the
 end of the
a.  Like
members of the Invader
.  It
 the
in the
 "ACAD.
 "by Invader, Feng Chia U., Warning: Don't run ACAD.
 Mozart: Playing the same melody as the Invader
Nnot continue to play the melody
 until the
is re
&ed, but
continues for a
 few minutes.
 Sledge Hammer:
to the
Invader
}in Morgan Hill, California
.  Its major
fthe
it plays a different melody
for 30 minutes.  The tune is the
 theme song to the television
Sledge Hammer.
 See:   Plastique   Plastique-B
PZPAPN
:  In
Man I
G:  May,
 Italy
R:  2,926
5:   PRhAKX -
W, & MBR
, NAV 3.0+,
6.64+
:  See
 The In
in May,
, and is
 Italy.  In
Man is a
uof .
-and .
,, and
vthe
).  It is a fast
are accessed for any reason.
X, the
wthe
), and
, as
qby the DOS
@by 3,456
), and
|12's
not be moved.
the In
, it
 and .
Xor accessed for any reason.
pof 2,926
at the end of the
a.  The
>and
in the DOS
not be
 The
in the In
5, and are not
 "The In
Man - Written in SALERNO (ITALY),
 "Dedicated to Ester:"
 "I don't know either how or
, but I
hold you in my
 arms again."
 It is
what In
of In
Man are:
Man II:
in May,
Man II
 is a later
of the
.  Its
 is 3,504
), hooking
|21.  It adds 3,223
)to the .
-and .
v, and
 like the
vthe
).  The
in the
5in all In
Man II
 "The In
Man II - Written in SALERNO (ITALY),
 "Dedicated to E.F.:"
 "I don't know either how or
, but I
hold you
 in my arms again."
:  Italy  May,
PZPAPN
Invol
:  Invol
W& .SYS
 write protect
executing .
fwrite-
 protected
R:  1,409 - 1,421
W); 2,832
)(.SYS)
5:   PRsE -
W& .SYS
 The Invol
.  Its
~was in the
. Invol is a
uof .
Wand .SYS
 The Invol
rby the Invol
may be a .SYS
has a device entry in the CONFIG.SYS
a, or an .
&has completed.  In either case,
 if the DOS
X, it
indicate
has 2,832
)less
is expected.
mby the
mapping
 utilities
most likely indicate
's config.sys has
pd in
by 2,832
Invol is
, it
attempt to
wthe
 .SYS
qin the
's CONFIG.SYS
a.  The .SYS
pof 2,832
at the
"of the
a.  The
 and
in the DOS
to the
>and
.  The
can be
r.SYS
 "You
lhelped spread
is a
fyour friendly
 neighborhood
tservice.
k you for your involuntary cooperation."
 "c:\config.sys EVICE C:\vansi.sys device=vansi.sys"
rby the Invol
it is
.  In the case of .
pof 1,409 to 1,421
at the end of the
a.  The
to the
>and
.  The
not be
 It is
what Invol
 Invol-B:
Gin the
in May,
, Invol-B
 is a smaller
of the Invol
 Its encryption has
to avoid detection.  It
 adds 2,720
)to the .SYS
v, and 1,348
 to 1,365
)to .
`.  The last
in the
 "c:\config.sys EVICE C:\vansi.sys
 vansi"
 May,
PZPAPN
Ionkin
:  Ionkin
 Ionkin-231
R:  231
5:   PNCK -
3.96+, NAV 3.0+,
8/93+,
 The Ionkin, or Ionkin-231,
 It is
fthe
.  Ionkin-231 is a
uof .
Nn't
smaller
the Ionkin
X, the
 Ionkin
wup to two .
in the
pof 231
at the end
 of the
a.  The
>and
in the DOS
to the
>and
 The
in all Ionkin
of Ionkin are:
 Ionkin-2372:
, Ionkin-2372 is
 a 2,372
of the Ionkin
.  It may
wone .
larger
 2,372
at the end of
 the
a.  The
>and
in the DOS
to the
>and
.  The
in the
 "IONKIN.
PZPAPN
:  Iper
R:  1,062
5:   PNCK -
3.96+, NAV 3.0+,
 The Iper
.  Its
.  Iper is a
uof .
the Iper
X, the Iper
wone
amay be
in the C:
ODOS
E, the C:
 root
O, or on the
O.  Iper
Nn't
wmore
 five .
`in any given
Eon the
K, and
 no more
three .
pof 1,062
at the end of the
a.  The
>and
in the
 DOS
not be
.  Two
 are
in the
 "IPER"
 The "IPER"
s very close to the end of the
 It is
what Iper
PZPAPN
Iranian
:  Iranian
R:  1,320
5:   PRhAK -
30.00+,
 NAV 3.0+,
.2.0+
 The Iranian
.  Its
.  Iranian is a
 of .
-and .
bIranian
X, the Iranian
at the top of
$the
', hooking
{09 and
 21.
, as
qby the
 DOS
@by 1,328
 12's
not be moved.
the Iranian
, it
pof 1,320
at the end of the
a.  The
>and
in the DOS
not be
 The
in the Iranian
5and are thus not
 "IRANIAN VIRUS W.by ABBAS KUHKAN ALIABADI"
ANTI VIRUS Writen By ABBAS KUKAN"
 It is
what Iranian
PZPAPN
Iraqui Warrior
:  Iraqui Warrior
 Iraqui,
-Iraqui
i; closely spaced beeps
speaker;
&failures
R:  777
5:   PNCK -
, NAV,
 The Iraqui Warrior
in the
is a non-
uof .
,.  It is
on the
the Iraqui Warrior
 the
wone of the
bfour .
 the
Oand
pof 777
at the end of the
 The
can be
`, the
 two
ring near the
"of the
, and the last
very near the end of the
 "I come to you
fThe Ayatollah!"
 "(c)
 "An Iraqui Warrior is in your computer..."
 None of
Lby the
the Iraqui Warrior
may occasionally
[the
speaker issuing a series of closely spaced
 beeps
s, the
hang and
lto be re
&ed.  The beeps continue until
 the re
&ing
Kwhere
,has
 in a "
U, Cannot start
-MAND, exiting"
 The Iraqui Warrior
Nnot
to do
else
 See:
PZPAPN
Iron Umbrella
:  Iron Umbrella
 Germany
R:  359
5:   PNCK -
8/93S+,
30.00+,
, NAV 3.0A06+,
.2.0+,
1.25+,
1.0A06+
 The Iron Umbrella
, and
fGermany.  Iron Umbrella is a
uof .
the Iron Umbrella
wone .
in the
 359
at the end of the
a.  The
>and
in the DOS
.  The
in the
5in all Iron Umbrella
 "G+ALLERBMU NORI+"
 "(C)
by SMAUG in M
NCHEN, DEUTSCHLAND!"
 ".. *.com"
 The
, read backwards,
8the
PZPAPN
:  It
 Coahuila
 Mexico
R:  454
5:   PNCK -
30.00+,
 NAV 3.0+,
n1.04+,
6.60+,
.2.0+,
1.25+,
6.64+
 The It
}in Mexico in
 is a
uof .
the It
wone
in the
it has completed
sall .
in the
E, it
start
on the
path.
pof 454
 the end of the
.  The
>and
in the
 DOS
not be
.  The
can be
in the
5in all It
 "(C) ITV85020203 PATH=*.
Nn't
to do
of It are:
 It-457:
fMexico in
, It-457 is a
 457
of the It
gvery
to the
, the major difference
It-457 adds 457
)to the .
v.  The same
as the
:  Mexico
 Viva Mexico:
Gin Morelia City, Mexico, in
, Viva Mexico is a 449
of the It
vone .
ain the
pof 449
 the
at the end of the
a.  The
>and
in the DOS
to be
, but the seconds field
!set to "60".  The
 the
5in all Viva Mexico
 "ITV85020203
 "Viva M
xico!"
 "PATH=*.
 Viva Mexico
16th, Mexico's Independence Day.  At
 the
Lon the
 monitor and the
Viva M
xico!"
:  Mexico
PZPAPN
Italian 803
:  Italian 803
 Italian
a, V817, Sept 18
G:  March,
 Italy
R:  803
5:   PNAK -
, NAV,
 The Italian 803
in March,
uof .
-and .
`.  It
Italian 803 is
X, the
 look for an
ain the
 If one is
d, it
r.  If an
Nnot exist in the
E, the
 look for an
ain the
E.  If an
d, it
Italian 803
 of 803 to 817
at the end of the
Nnot alter the
>and
 the
 The Italian 803
may re
already
.  The re
 copied, and
X.  Re
 of Italian 803
in an
 the
 Italian 803
Nnot do
of Italian 803 are:
 Italian 803-B:
to Italian 803,
differs by
PZPAPN
Italian Boy
:  Italian Boy
 578, Ital Boy
:; Italian flag
 Italy
R:  578
5:   PRhCK -
30.00+, NAV 3.0+,
.2.0+,
1.25+
 The Italian Boy
, and is
 Italy.  Italian Boy is a
uof .
,.  It is a destructive
bItalian Boy
X, the Italian Boy
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 896
the Italian Boy
, it
pof 578
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the
5in all Italian Boy
 "ITALY IS THE BEST COUNTRY IN THE WORLD"
 "Fucks to Italian
Killers"
 The Italian Boy
3rd of any year.  At
, the
 an Italian flag on the
M, along
, and may trash the
PZPAPN
Itavir
:  Itavir
 3880
 Endangered
G:  March,
 Italy
R:  3,880
5:   PNE -
\, NAV,
 The Itavir
}in March
by a group of students
 at the Milan Politechnic in Milan, Italy.  The Itavir
generic .
by 3,880
%having
pd in
usually
where on the
K.  The
bcharacter of
is an unprin
character.  The
 pure
5and is used for appending to
 The Itavir
period
!running for more
24 hours.
, the
is corrupted, rendering the
&able.  The
Ms a
in Italian and writes ANSI values
 through 255 to all
I/O ports, thus confusing any attached
 peripheral devices.
monitors may show a flickering effect
s, while
VGA monitors may actually "hiss".
PZPAPN
:  Itti
 Itti-A
&failures; "
WC failure"
R:  161
5:   ONCK -
/, NAV 3.0+,
1.53S+,
.2.0+
 The Itti
.  Its
 Itti is a
Itti is
X, the Itti
wone .
in the
Eby over-
 writing the host
b161
be no
3to the
unless it was
smaller
 161
).  In the case of .
`smaller
be no
3to the
>and
in the DOS
the Itti
has completed
a, it
 the
to the DOS prompt:
WC failure"
 The
, plus the
-", can be
 the
b161
the Itti
&failures
 if the copy of
in the root
Eof the
&able
of the
if the Itti
cannot find an
of Itti are:
 Itti-B: A 99
of Itti,
Mthe "
WC failure"
, and the
is not
in the
>and
in the DOS
to the
>and
PZPAPN
:  IVP
 Bubbles
R:  684
5:   PNA -
6.60+,
2.58+,
n1.05+,
2.58+,
6.64+
 The IVP
generation
 along
the Bubbles
was generated by the
 IVP is not a
, but a generator of
-and/or .
`, as well as
 possibly
,.  While the
was intended to
 able to generate
function
 produce working
5.  The IVP
can produce
a random number of NOP instructions placed in two
 areas of the decryption routine in an attempt to elude simple
 search
ning techniques.  The NOPs aren't a real problem,
 and it is very simple to generate a generic detection
es created
IVP.  The
$is for the Bubbles
the IVP
.  It may not match
 copies of the Bubbles
are regenerated
 The Bubbles
is a
 of .
-and .
, but not
,.  It
 of the .
-and .
in the
X.  It
 to move up one
Ein the
Estructure.
the Bubbles
 684
at the end of the
a.  The
>and
in the DOS
Estructure
 not be
.  The
 the
 "Bubbles
 "Admiral Bailey"
 "[IVP]"
 "*.com *.exe .."
 The
bthree of
Lby the
X.  Bubbles
Nn't do
Mits
(es) created
IVP are:
 Crystal:
, Crystal is a 699
s to
!created
the IVP
 Crystal is a
uof .
 and .
,.  It
vone to
 many .
-and .
in the
pof 699
at the end of the
a.  The
>and
 in the DOS
not be
.  The
Mthe
X, however it usually
 jumbled
4accompanied by beeping on most
 "CrystalSoso ManLove is for suckers"
 "[IVP]"
 The
in the
5, as is the
 "*.com *.exe .."
:  Oklahoma, USA
 IVP Example 1:
, IVP Example 1 is a 351
was created
the IVP
.  It is a
uof .
, but not
,.  It
vall of the .
 the
pof 351
at the end of the
 The
>and
in the DOS
not be
.  The
Ms the
 "Test Tim"
beeping on the
speaker.  The
in the
5in all
 "Test"
 "Tim"
 "[IVP]"
 "*.com .."
 IVP Example 2:
, IVP Example 2 is a 544
was created
the IVP
.  It is a
uof .
.  It
vall of the .
in the
pof 544
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
Ms the
"Test Tim [IVP".
 The
in the
5in all
 "Test"
 "Tim"
 "*.exe .."
Kfull!"
 IVP.Angry Samoans:
, 1994, IVP.Angry Samoans is a
 668
was created
the IVP
.  It is
uof .
`.  It
vall of the .
in the
pof 668
at the end of the
a.  The
in the DOS
not be
 The
in the
 "tHE aNGrY SaMoANs !!!"
 "RiverBoTToM"
 "*.exe .."
1994.
 IVP.
Showers:
, 1994, IVP.
Showers is a
 1,676
was created
the IVP
.  It is
uof .
-and .
,.  It
vall of the .
in the
X.  If all of the .
were
r, it
proceed to
wall of the .
 the
pof 1,676
 the end of the
a.  The
>and
in the DOS
not be
.  The
it usually
s in the
.  The
in the
 "Virii Production by a MoM Personell"
-Showers"
 Appends *.Com *.Exe"
 "Created:  03-08-1994"
 "Effect:   Destroys data"
 Enlarges
`by 1.6k"
1994.
 IVP.Taselhoff:
, 1994, IVP.Taselhoff is a 375
was created
the IVP
.  It is a
uof .
,.  It
vall of the .
in the
 of 375
at the end of the
a.  The
>and
in the DOS
not be
.  The
beeping on the
speaker,
it usually
s in the
.  The
in the
5in all
 "Eddie has
ed on tour (
 "Author : Taselhoff"
 "Fuck you arsehole c:\
6.con *.com"
create a
-MAND.CON" in the C:
Oroot
be 21
 and
9the
 "c:\
6.con *.com"
1994.
 IVP-Ozzy:
, 1994, IVP-Ozzy is a 426
s to
!created
the IVP
 IVP-Ozzy is a
uof .
,.  It
vall of the .
in the
 of 426
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the IVP-Ozzy
 "*^ OZZY ^*^ -- Yeew duh-meE iTs ReeEl!! [kR]*.com"
1994.
 IVP.Walky:
, 1994, IVP.Walky is a 324
s to
!created
the IVP
 IVP.Walky is a
uof .
, but not
,.  It
vall of the .
in the
 of 324
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all
 "Walky
Replicom Edition"
 "Italian
Labs"
 "[IVLK]"
 "*.com"
in the
bthree
Las a
 the
:  Italy
1994.
 IVP-S2DD:
in May,
, IVP-S2DD is a 763
s to
!created
the IVP
 IVP-S2DD is a
uof .
 and .
,.  It
vall of
 the .
-and .
in the
pof 763
at the end of the
a.  The
>and
 in the DOS
not be
.  The
 IVP-S2DD
Mthe
, along
 three beeps on the
speaker,
 "Enjoy The Most Advanced
To Man
 "[IVP]"
, the
trash the
bfew cylinders
 of the
K.  The
 the
5, as are the
 "Slut2Death Dealer"
 "*.com *.exe .."
 May
 IVP-Tuesday:
, IVP-Tuesday is an 822
s to
!created
the IVP
.  IVP-Tuesday is a
uof .
-and .
,.  It
vall of the .
-and .
in the
pof 822
at the end of the
 The
>and
in the DOS
not be
.  The
 however it usually
Mjumbled
4on most
 "GOOD BYE RUBY TUESDAY, WHO COULD HANG A FAX ON YOU?"
 "[IVP]"
 The
in the
5, as are the
 "Tuesday Jesus"
 "*JESUS* MAKER OF FINE VIRII
 MEMBER OF JDIV (JESUS DIED IN VAIN)"
 "*.com *.exe .."
 Kubla Kahn:
, 1994, Kubla Kahn is a 644
was created
the IVP
.  It is a
uof .
-and .
 but not
,.  It
vall of the .
-and .
in the
pof 644
at the end
 of the
a.  The
>and
in the DOS
not be
.  The
, accompanied by beeping on the
 speaker,
to the DOS prompt, or receive
 the
a.  The
in the
5in all
 "*.com *.exe .."
1994.
 SiloDeath:
, SiloDeath is a 734
s to
!created
the IVP
 SiloDeath is a
uof .
 and .
,.  It
vseveral
-and .
in the
pof 734
at the end of the
a.  The
>and
 in the DOS
not be
.  The
 SiloDeath
attempt to
Mthe
 followed by a
hang,
 "Legalize Today-Get High Tonight"
 "[IVP]"
, the
trash the
bfew cylinders
 of the
%the
, the
can be
in the
 SiloDeath
 "SiloDeath Dealer"
 "*.com *.exe .."
 Sleeper:
, Sleeper is a 1,017
s to
!created
the IVP
 Sleeper is a
uof .
 and .
,.  It
vall of
 the .
-and .
in the
pof 1,017
at the end of the
a.  The
in the DOS
not be
 The
in the
 "Sleeper"
 "Dark Lord"
 "I Just Fucked Your
OOver!!"
 "Yet An
Victim Of The Sleeper!!"
 "It is Amazing What a Student Of The
<Can Do!!"
 "Made In The City Of Sofia.  An
Fine DOOM Product!!!"
 "Amy Sucks My Dick Twice A Day!!"
 "Erv Is a Pimp!"
 "Stay Tuned Untill The Next Release By DOOM!!"
 "Bye Bye!!"
 "[DOOM]"
 "*.com *.exe .."
 Swank:
, Swank is a 789
s to
!created
the IVP
 Swank is a
uof .
,.  It
vall of the
-and .
in the
pof 789
at the end of the
a.  The
>and
 in the DOS
not be
.  The
 Swank
attempt to
Mthe
 followed by a
hang,
 "Slut3Death Dealer"
 "Enjoy The Most Advanced
To Man
 "[IVP]"
 The
in the
5, as is the
 "*.com *.exe .."
 Yeah:
, Yeah is a 663
s to
!created
the IVP
.  Yeah is
uof .
-and .
,.  It
vall of the .
 and .
in the
pof 663
at the end of the
a.  The
>and
 in the DOS
not be
.  The
 Yeah
Mthe
 "POOP"
 "YEAH RIGHT"
 "[IVP]"
 The
in the
5, as is the
 "*.com *.exe .."
Yeah may not function
PZPAPN
James Bond
:  James Bond
H:   May,
i; DOS
+lost clusters;
=seconds set to 62
 The
R:  356
5:   PRaCK -
30.00+,
1.25+
 The James Bond
in May,
, and is
.  James Bond is a
bJames Bond
X, the James
 Bond
in a "hole" in al
, hooking
|21.
, as
qby the DOS
not be
, James Bond
for any reason.
pof 356
 the
at the end of the
a.  The
be hidden by the
`, and
`.  The
>and
in the DOS
to be
, but the seconds field
!set to "62".  The
s very near to the end of all
 "James Bond is Alive!"
the James Bond
find
the DOS
report a very high number of lost clusters
 it is
PZPAPN
Japanese Christmas
:  Japanese Christmas
 Christmas In Japan, Japan
H:
, 1989
 Japan
R:  600
5:   PNCK -
\, NAV,
 The Japanese Christmas
breported in Japan in
, 1989.  It was later
}in Japan in late
.  As of
, it was reported to be
 widespread in Japan.
is a 600
generic
uof .
`.  It
the Japanese Christmas
X, the
wzero to one
ain the
E.  If a
r, it
by 600
at the end of the
?25th, if an
X, the
Lin the center of the
 "A merry christmas to you"
 The
flash and
be underlined for
 the
it is
L.  If left alone, the
go away
a little while and the
Ynormally, but the
Nnot
to do any malicious damage.
of Japanese Christmas are:
 Japanese-709:
, Japanese-709 or
 DAPDM-13 is a 709
of the Japanese Christmas
.  It
vone .
pof 709
at the end of the
a.  The
>and
not be
.  Two
can be
 the
 "*.*"
 "PATH=*.
:  Japan
 Japanese Christmas-B:
to the
 Japanese Christmas-B is a minor
 modifications.
:  Japan
 Japanese Christmas-C:
to the
 Japanese Christmas-C is a minor
 modifications.
:  Japan
 Japanese Christmas-D:
to the
 Japanese Christmas-D is a minor
 modifications.
:  Japan
 Japanese Cookie:
 one .
in the
ever an
pof 653
at the end of the
a.  The
>and
 in the DOS
.  The
in the
is "*.com".
:  Japan
PZPAPN
Jason
:  Jason
H:
, 1994
Lbefore
 expected
output
R:  609
5:   PNC -
V112+,
/2.1+,
6.2+,
\2.13+,
6.64+,
.2.0+,
V111+,
6.64+
 The Jason
, 1994.  Its
.  Jason is a
uof .
, but not
the Jason
wone .
in the
the Jason
pof 609
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the Jason
 "Jason
 "You've
rby the JASON
. . ."
a test
 "So Dont Worry. . . .MAYB
 "*.com"
ly, the
"AD" can be
dstarting in the
 fourth
*of all
the Jason
X, followed by the
Mof the
 expected
output.
PZPAPN
:  JD
 JD-158, JD-276, JD-356, JD-392
R:  158 - 392
)(depending on
5:   PRaCK -
n, NAV,
 The JD
]was
.  Its
]is a group of four closely related
es, the larger of
hide the
 The entry
$describes
]in general,
 specific
qunder
a JD
X, the
in a "hole" in al
.  As such,
be no
 as well as possibly
{13 or 1E, depending on the
 present.
a JD
, it
X.  If
X, it
r.  The
at the
 end of the
 of 158 to 392
 The JD
es don't do
member(s) of the JD
es are:
 JD-158: The smallest member of the JD
 158
)to the .
v.  The
>and
in the DOS
.  It hooks
|13 in addition to
|21 in
 JD-276:
member of the JD
]adds 276
)to the .
be no
3to the
>and
in the DOS
hooks
|21 in
 JD-356: JD-356 adds 356
)to the .
 however the
not be
if the
.  It hooks
|1E in addition
|21.
be no
3to the
>and
in the DOS
 JD-392:
in behavior to JD-356,
adds 392
)to the .
PZPAPN
:  Jeff
R:  814
5:   PNCK -
P, NAV 3.0+,
.2.0+
 The Jeff
}in the
is a
uof .
the Jeff
X, the
attempt to
wone .
aon the C:
O, starting in
 the root
 814 to 828
at the end of the
 The Jeff
fthe
Sin the
 "Jeff is visiting your
 While Jeff is visiting your
K, it
occasionally write
of random
contents to the
K.  If
are written to the
, or FAT,
 the contents of the
Kmay
 inaccessible or produce
 unexpected
PZPAPN
Jericho
:  Jericho
<.Jericho
 Calgary, Alberta, Canada
R:  1,365 - 1,379
5:   PRhAK -
30.00+,
3.96+,
6.60+,
.2.0+,
6.64+
 The Jericho
, and
fthe Calgary area of Canada.  Jericho is a
uof .
-and .
bJericho
X, the Jericho
at the top of
$the
', not moving
|12's
, as
 the DOS
@by 2,832
{21 and 27
mby Jericho in
the Jericho
, it
for any reason.
pof 1,365
)while .
by 1,365 to 1,379
).  In both cases, the
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
5in all Jericho
 "JERICHO by Eurystheus<FoG>"
 "Calgary"
 It is
what Jericho
of Jericho are:
<.Jericho.1000: Probably an earlier
of the
 Jericho
is 2,112
), hooking
|21.  It
 or copied.
 of 1,000
at the end
 of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all
 "JERICHO
Eurystheus
Calgary AB"
:  Canada
1994.
 See:
PZPAPN
:  Jerk
 Talentless Jerk, SuperHacker, 1077, Jerk-B
G:  March,
; unexpected access to C:
R:  1,077
5:   PNAK -
, NAV,
 The Jerk, Talentless Jerk, or SuperHacker
 March,
.  Its
is a
uof .
-and .
, and it
the Jerk
search the
Estructure of the C:
Oto find a
w.  If the
Xthe
J, an unexpected access to the
has selected a .
-or .
w, it
alter the
bnine
)of the candi
a, and
 append the
to the end of the newly
.  The
Lon the
monitor,
Nnot always
 "Craig Murphy calls himself SUPERHACKER but he's just a talentless
 jerk!"
cannot be seen
as it is
in the
the Jerk
pof 1,077
).  The
"MURPHY"
dstarting at the fourth
*of the
a.  The
can be
WBad
 The Jerk
Nnot do
of Jerk include:
 Jerk-B:
gequivalent to Jerk,
differs
 by three
PZPAPN
PTM9
 PLO, Israeli, Friday 13th, Russian, 1813(
-), 1808(
 Arab Star, Black Box, Black Window, Hebrew University
, 1987
 Israel
 TSR; .
slowdown;
 on Friday 13th; "black window"
 Italy
R:  1,808 - 1,822
5:   PRsA -
Generic
, NAV,
:  CleanUp,
, NAV, or
 The
}at Hebrew University in
 Israel in the Fall of 1987.  As of
, it is
lnow
ated in Italy.
is a
 generic
 .SYS, .BIN, .PIF, and overlay
`may be re
rby the
 to a bug in the
5.  The
 many
s, and many
on its
5.  The
 description
$is for a standard
, or members of
], are
 The
X, the
 as a low
TSR of 1,792
{08 and 21
mby the
, it
X.  .
by 1,813
at the
"of the
a.  .
by 1,808 to 1,822
at the
 end of the
a.  Later,
rby the
are again
add an
1,808
)to the
in the DOS
|8, and 1/2 hour
Zof the
slow down by a factor of 10.
la "black
 window" or "black box"
on the lower left side of the
scroll up the
as the
scrolls.
 The
 Friday the 13ths.  At
, it
Bany
 The identifier for most
strains is "sUMsDos", however,
 identifier may not be
din the newer
 The
t to
on the Suriv 3.00
the Suriv 3.00
members(s) of the
]are:
 A-204:
the sUMsDos
1to *A-204*,
 and a couple of instructions
1in order to avoid
 detection.
slow down the
for 30 minutes, as well as having a black box
:  Delft, The
 Anarkia:
r delay set to slow down the
to a greater degree,
effect
Nn't show
 until a much longer
has elapsed.  No Black Box is ever
L.  The sUMsDos id-
1to ANARKIA.
 Lastly, the
>has
1to Tuesday
 the 13th, instead of Friday the 13th.
:  Spain
 Anarkia-B:
to Anarkia,
the exception
 now
on any
12th instead of on Tuesday
 the 13ths.
 Antiviru:
B, the Antiviru
differs in
8two
," and
 "ANTIVIRU".  Like
, it
Ma "black box"
 accompanied by a
slowdown 30 minutes
becoming
 Friday the 13ths, any
 Apocalypse: The Apocalypse
Vin May,
.  It
ated in Italy.
X.  .
by 1,813
).  .
by 1,808 to 1,822
t, and 1,808
)on later re
ts.  The MsDos
tmarker in the
to "C.J**".
can be
din Apocalypse
 are:
 "Apocalypse!!!"
 "**C.J**"
 The last
is what has replaced the sUMsDos
in the
.  Apocalypse
lthe characteristic "black
 box"
on the lower left hand side of the
 has
for 30 minutes.  It
Nnot, however,
on Friday the 13ths.
:  Italy  May,
 Bogota: The Bogota
Gin Bogota, Columbia in
 May,
.  Its low
TSR is 2,048+
 hooking
{16 and 21.  It adds 1,813
)to the .
r.  .
by 1,808
 to 1,822
t, and 1,808
t.  Bogota
truncate .
to zero
 Captain Trips: The Captain Trips
in March,
, and is
fthe
.  Its
comes
"Captain Trips X."
in the
5.  Unlike most
Ma black window
for 30
 minutes, nor
Nit slow down the
.  On Friday the
 13th, it
Nnot
.  The
"MsDos"
Nnot
by 1,813
).  .
by 1,808 to 1,822
 the
a, and
by 1,808
subsequent
 March,
 Captain Trips 2: Captain Trips 2 was
 It is a
of the Captain Trips
to avoid detection.  The major difference is
ts of .
pof 1,813
 Czech: The Czech
the Czech
zs a 1,984
*TSR in
{08, 21,
 and F8
it is
, it
X.  .
 1,735
at the
 of the
a.  .
 by 1,735 to 1,749
at the
 end of the
Nnot re
the Czech
 for 30 minutes, it
Ma reverse video box in the
 upper left hand corner of the
8the
 "Ha!Ha!".  It
Nnot
on Friday The 13ths.
may detect
as the
 Sunday
 Dragon: The Dragon
to the
.  It
"BDH  B T".  The MsDos identifier has
1to a hex character
.  It
 on Friday The 13ths.
 Get Password 1: Get Password 1 is a
Gin the
bhalf of
's TSR is 1,840
.  Get Password 1 is
 a Novell network specific
, it won't
unless the
 Novell Netware
Ors are present in
.  The
intended to capture the logon
logs onto the network, however
Nnot function
and so
is no threat.  Get Password 1 is 1,914
25TH:
B, the major difference
activate on
25TH, at
Bany
25TH
Nn't re
for 30 minutes, it
lthe "black
 box"
effect
7to many
.  The
 "sUMsDos"
!replaced
hex 00
25TH-B:
gequivalent to the
25TH,
slight
5modifications.
to the
Nnot re
:  Israel
, 1988.
out the
r delay to slow down the
 processor.
destroy both copies of the FAT
 on any Friday the 13th
has the sUMsDos
1to 00h
for 30 minutes, the
slow down by 30% and
 the
7"black window"
on the lower left side of
 the
. Like
, it
`multiple
Nnot carry an
`, it
s for all intents to be "defanged".
:  Washington, DC,
D but the
is in
-Polish:
on the
slightly so
the "black box"
effect
Nnot
:  Poland
-PLO:
on the
Xduring the
 secondd half of the year.  It
during the
 half of the year.
 for 30 minutes, a
slowdown
, but the
 characteristic
black box
.  The
 "sUMsDos"
in the
 "sU?sDos".
by 1,813
by 1,808 - 1,822
t, and 1,808
.2389:
on the
.2389 is
 a 2,389
.  Its
TSR is 2,640
 and hooks
{1C and 21.  It adds 2,389
)to the
at the
"of the
a.  It adds 2,389 to 2,404
)to .
at the end of the
are re
rby the
, adding an
 2,389
t.  The
 are
in the
 "AYTUBA=19722191!!"
.2389
may find
|ed while
X, and a
scrolling on
 the
fright to left in a non-english language.
 "NICE FROM FAR FAR FROM NICE" is the
english
 the scrolling
, 1994.
.Suselfo:
has the
 sUMsDos
1to "sUSelFo", as well as having
to avoid detection by
utilities.
:  Spain  March, 1994.
17TH:
on the
17TH is a 1,530
.  Its
TSR is 1,792
), hooking
|21.  .
by 1,535
 while .
by 1,530 to 1,544
, the
at the
 of the
, the
at the
 end of the
a.  .
are not re
 is between
17TH and
?31st of any year, at
Bany
 JVT1:
to the
, the JVT1
 major differences are
 30 minutes, a vertical black box consisting of two
in the very upper left hand corner of the
M.  An
difference is
instead of deleting
on Friday the 13ths, it
Bs them on Tuesday the
 1st.  The "sUMsDos"
in the
1to "sUMsDns".  Like
, it
 JVT1-B:
gequivalent to JVT1,
 slightly modified
 Mendoza:
on the
`.  It is
missing the black box effect.
 Mendoza
in the second half of the year (
?), at
any day
la 10% chance of
 having all
: Argentina
 Messina:
to the
, Messina's
 major difference is
the "sUMsDos"
1to "Messina".
 by 1,813
by 1,808
 to 1,822
t, and 1,808
 Nemesis:
to the
 major difference is in the area of
in the
.  The characteristic "sUMsDos"
 "UM Do ".  Two
can be
`: "NEMESIS.
-" and "NOKEY".
 New
: The New
is a
was uploaded to several BBSes in The
14, 1989.  It was modified to be undetec
utilities
were widely distributed at
:  The
, 1989.
 Oscar: The Oscar
 equivalent to the
.  It
8three
: "sUMsDos", "
,, and "OSCAR NU".
be re
 On Friday the 13ths, it
 Payday: The Payday
}in The
 Jan Terpstra in
, 1989.  A major behavioral
Payday
activate on all Fridays except Friday the 13th.
 Upon
, it
Bs all
:  The
, 1989.
 Park ESS:
in Happy Camp, California,
is very
by 1,813
), and
by 1,808 to 1,822
t, and 1,808 on later subsequent
ts.
,.  The
major difference
fthe "normal"
 "sUMsDos"
!replaced.  The
"PARK ESS" can
din the
in all
slows down the
20 percent and
 a "black window"
for 30 minutes.
 Phenome: The Phenome
B was
at the
 same
as the Apocalypse
 in behavior to Apocalypse,
the exception
X.  The
 "MsDos"
 "PHENOME.
 "*-*-*-*"
 Phenome
becoming
on Saturdays.
 On Saturdays,
Y, but simply
to the DOS prompt.
:  Italy  May,
 Puerto:
in Puerto Rico,
 very
to the Mendoza
, the
 sUMsDos id-
`may be
rmultiple
:  Puerto Rico
 Skism:
to the Skism-1
, the Skism
's major difference is
the "SKISM-1"
1to " SKISM ".
g, it is
 equivalent to Skism-1.
:  Canada
 Skism-1:
in New York State,
to many
s except
 regards to
and what it
Nupon
.  Rather
 activate on Friday the 13ths and
in the years
and later on any Friday
the 15th of the month.  On
 truncates any
is attempted to be
Xto zero
).  .
upon
 1,808
pby 1,808 to 1,822
be re
rby the
.  The "sUMsDos"
in the
is now "SKISM-1".  Like
produces a "black window" 30 minutes
becoming
, and
slows down the
:  Canada
 Soy Un:
on the
, Soy Un is a 2,064
fPeru.  Its
TSR is 2,336
 and hooks
|21.  Soy Un adds 2,069
)to the .
at the
"of the
a.  It adds 2,064 to 2,078
)to .
at the end of the
are not re
r.  Most of the
usually not be
 the
as it
attempt to hide all by
 1 to 16
)of the
p.  The
in the
 "HACK1"
 "CHKLIST.CPS"
 "Soy un
y mi nombre es - THE HACKER -  Lima - Per
:  Peru
 Spanish JB: (
, it re
`.  The
`is always
 1,808
).  On .
`, the
may be
 either 1,808 or 1,813,
talways adding 1,808
)to the already
a.  No "Black Box"
 The characteristic "sUMsDos" id-
Nnot
in the
s identified as
:  Spain
 Sub-Zero:
, Sub-Zero is a modified
Nnot
Mthe characteristic
 "black box"
for 30 minutes, nor
slowdown
.  Sub-Zero
: "LORD SKISM", "Sub-Zero NYHC", and
 "ED EL".
:  Canada
 Sub-Zero B:
in May,
, Sub-Zero B is a slightly
 modified
of the Sub-Zero
.  On the last Friday
 of any month
truncate
X, and
attempt to format the
 minutes
becoming
 May,
 Sub-Zero C:
^1994, Sub-Zero C is a modified
of the Sub-Zero
.  It has
to avoid detection by
utilities.
^, 1994.
 Swiss 1813:
fSwitzerland,
Nnot exhibit the "black window"
for 30 minutes, nor
Nit slow down
 the
. It
Nnot
on Friday the
 13th, or any
Friday.  The "sUMsDos"
1to binary zeros.
:  Switzerland
 Triple:
, Triple is a
to avoid detection by
ning
g, it is
to the
.  One
can be
din the
-MAND".
 Ucender:
in March,
to avoid detection by
 The "sUMsDos"
1to "UCNDER".  The
 characteristic
"black box"
 has
for 30 minutes, and a
slow-
 down
.  Ucender
`, like the
 on Friday The 13ths, at
:  Argentina  March,
 See:  1605
 China
 Discom
 Freddy
 Frere Jacques   Fu Manchu
 Groen Links
 Growing Block
11-30
1663
 Mule
 RAM
 Slow
 Sunday
 Sunday-2
 Suriv 3.00
 Westwood
 Barcelona
     Poison
 Moctezumas Revenge
 1244
 Timor
 Totoro
PZPAPN
11-30
11-30
 1130
i; TSR;
R:  2,000 - 2,014
5:   PRsA -
 NAV,
 The
11-30, or 1130,
 Its
11-30 is a
 of .
W, and overlay
`.  It
, as the
implies, is a
of the
it is
#documented separately due to its different
 behaviour.
 The
11-30 is
 the
11-30
 low
TSR of 2,288
).  On
 30th, the
hook
{20, 21, and 27.  On
 30th, it
hook
11-30 is
, it
pof 2,000
at the
"of the
pof 2,000 to 2,014
at the end of the
a.  Unlike several
not re
`.  All
lhad
>and
in the
 DOS
to the
>and
.  The
can be
in the
5of all
11-30
11-30
it has
30th of any year.  It
intermittently flash a reverse
 video block in the upper right hand corner of the
says "1130" while the
is at a DOS prompt.
 See:
PZPAPN
i; TSR
R:  1,663
5:   PRsAK -
3.96+,
8/93+
 The
1663
.  Its
1663 is a
uof .
-and .
 The
1663
X, the Jersalem 1663
 as a low
TSR of 2,432
{13 and 21
, Jersalem 1663
X.  Both .
-and .
by 1,663
 at the end of the
a.  The
cannot recognize a previous
ton a
a.  Both .
-and .
r, adding 1,663
t.  The
>and
in the DOS
not be
.  No
in the
 It is
what
1663
 See:
PZPAPN
 Research
 TSR; .
 New Zealand
R:  1,767 - 1,779
5:   PRsAK -
8/93+
 The
1767
 Henry Wolfe of New Zealand whom
he has had
 on a
Jfor over one year.  The
source of the
1767 is a
of the
characteristic
2in its behavior.
 The
1767 is
as a low
TSR of 2,048
), hooking
{08 and 21.
1767 is
, it
-and .
X.  If
X, it
by 1,767
at the
"of the
a.  The exception
#at the end
 of the
by 1,767 to 1,779
 the
at the end of the
a.  .
not be re
related
 In both cases,
be no
3to the
>and
 in the DOS
E.  Two
can be
in the
5, the
#the
tmarker for
 "** INFECTED BY FRIDAY 13th **"
1767
Nnot exhibit the typical
 "black box"
for 30 minutes.  A
 slowdown
Nnot
 See:
PZPAPN
-Haifa
-Haifa
i; TSR
 Israel
R:  1,960 - 2,178
5:   PRsA -
8/93S+,
30.00+,
n1.04+,
6.64+,
1.25+
 The
-Haifa
, and is
 Israel.
-Haifa is a
uof .
, but not
-Haifa
as a low
 TSR of 2,048
), hooking
{08 and 21.
-Haifa
-and .
pof 2,178
at the
"of the
pof 1,960 to 1,974
 the end of the
a.  In both cases, the
>and
in the
 DOS
not be
.  The
in the
-Haifa
 "a:\at_286"
 "04-764768"
 The
8the Hebrew
4for the word "Haifa".
 The "
in all
 It is
what
-Haifa
 See:   Haifa
PZPAPN
Joanna
:  Joanna
 England
R:  986
5:   PRhCK -
3.96+,
n, NAV 3.0+,
1.25+
 The Joanna
Gin Lancs, England, in
.  Joanna is a
uof .
bJoanna
X, the Joanna
at the top of
$the
, as
qby the DOS
@by 3,008
mby the
, the Joanna
,if it was not
the Joanna
, it
for any reason.
pof 986
at the end of the
a.  The
 and
in the DOS
not be
 Hidden
`, however,
lhad the hidden attribute removed.
 The
in the Joanna
 and are not
is Dedicated To the Girl I Love, Joanna Dicks."
 "Made in England by Apache Warrior, ARCV Pres."
 "Jo Ver. 1.01 (c) Apache Warrior 92"
 "I Love You Joanna, Apache.."
 "[JO] By Apache Warrior, ARCV Pres."
of the
lines of
 by the
while it is in
of Joanna are:
 Joanna 1.11:
fManchester, England in
 Joanna 1.11 is a 916
of the Joanna
 Its
, and use of
{, is the same
 as the
.  Joanna 1.11
pof 916
 the end of the
be no
3to the
>and
in the DOS
 The
in the
 "Looking Good Slimline Joanna."
 "Made in England by Apache Warrior, ARCV Pres."
 "Jo Ver. 1.11 (c) Apache Warrior 92."
 "I Love You Joanna, Apache..."
 "[JO] By Apache Warrior, ARCV Pres."
:  Manchester, England
 Joanna-911: A 911
of Joanna,
is very
to Joanna 1.11.  Its
is 3,018
), hooking
|21.
, Joanna-911
pof 911
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the Joanna-911
 "Looking Good Slimline Joanna"
 "Made in England by Apache Warrior, ARCV Pres."
 "Jo Ver. 1.11 (c) Apache Warrior 92"
 "I Love You Joanna, Apache."
 "[JO]"
 "Apache Warrior, ARCV Pres"
 Joanna-911
8destructive
Eand
:  England
 Joanna-911B:
on the Joanna-911
is 3,008
), hooking
 Like the Joanna-911
, it
 It is unable to distinquish
, so
be repeatedly
tof the
aadds 911
 the
at the end of the
hide the
tof the
a, but not
ts.  The
 seconds field in the
=in the DOS
be set to 54 on all
`.  The same
in the
 Joanna-911
, the DOS
, plus .BAT and data
`, but not .
Wor .SYS
:  England  March,
fEngland in
, Jo
Wis a
 916
of Joanna
`.  Its
, and use of
{, is the same as the
.  Jo
 are
for any reason.
pof 916
be hidden
.  The Jo
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "Jo Exersiser
. Apache Warrior, ARCV Pres. [JO
 The DOS
, as well as
data
 the Jo
:  England
PZPAPN
:  JoJo
G:  May,
j; graphic
 Israel
R:  1,701
5:   PRaC -
\, NAV,
\, or
 The JoJo
Gin Israel in May,
.  The
comes
in the
 "Welcome to the JOJO
 One
in the
, indicating
it was
 written in
is: "Fuck the
(c) -
 Both
in the
5are never
the JoJo
Xon a
, the
.  The method
 used is to alter the
6interpreter in
, expanding its
.  As an example, on my test
, the
6interpreter in
pd in
f3,536
)to 5,504
).  One block
 of 48
reserved in
.  The
be a net
Aof 2,048
 The JoJo
|13 is in use by
 any
.  Instead the
clear the
, and the
be hung.  If the
performs a warm re
 (CTRL-ALT-DEL), the
remain in
is able to
m, any .
rby the
by 1,701
 JoJo is
on the Cascade
Nnot make use of
 the encryption mechanism in Cascade.
 JoJo produces a
Mof multicolored diamonds
on graphic
JoJo is
of JoJo are:
 JoJo-B: A minor
of the JoJo
, JoJo-B's encryption
 has
!slightly modified.
 JoJo-C:
, JoJo-C is an
minor
of the
to avoid
#detected by a particular
.  It is
 not believed to be in the public domain.
 See:   Cascade   Cascade-B   JoJo 2
PZPAPN
JoJo 2
:  JoJo 2
; "Not enough
j; cursor position off 1 character
R:  1,703
5:   PRaCK -
, NAV 3.0+,
 The JoJo 2
, by David Grant of
 the
on the JoJo
as well as
9ing part of the decryption
for the Cascade
.  It
 is a
uof .
 The
the JoJo 2
 the
by altering the
6interpreter in
.  The
6interpreter in
pof 1,904
is an
is reserved by the
as well,
to JoJo.
, it
 are
X.  If
Xfor any reason, it
pof 1,703
at the end of
 the
can be
the JoJo 2
 "The JOJO
strikes again.
x zzz"
 "Fuck the
- (c)"
 "141$FLu"
the JoJo 2
Mthe "Fuck the
- (c)"
, or a
 garbage
 may
fail due to "Not enough
T.  Lastly,
for awhile, the
may notice
 cursor on the
monitor is off by one position to the right
fwhere it should be.
 JoJo 2 may be detected by
utilities as an
 of JoJo and Cascade/1701/1704.
 See:   JoJo
PZPAPN
Joker
:  Joker
 Jocker
 Extinct
?, 1989
Wand .DBF
 Poland
R:  ???
5:   PNE -
, NAV,
1.25+
 The Joker
}in Poland in
?, 1989.
 is a generic .
u, and is a poor replicator (i.e., it
Nnot quickly
the Joker
Mbogus
and comments.
and comments can be
din the
`at the
"of the
 Here are
of the
and comments
may be
 "Incorrect DOS
 "Invalid Volume ID Format failure"
 "Please put a new
Kinto
 "End of input
 "END OF WORKTIME.  TURN SYSTEM OFF!"
 "Divide Overflow"
 "Water detect in Co-processor"
 "I am hungry! Insert HAMBURGER into
 "NO SMOKING, PLEASE!"
 "Don't beat me !!"
 "Don't drink and
cup of cofee ?"
 " OH, YES!"
Khead has
!destroyed. Can you borow me your one?"
 "Missing light magenta ribbon in printer!"
 "In case mistake, call GHOST BUSTERS"
 "Insert tractor toilet paper into printer."
alter .DBF
`, adding
to them.
 The sample in the author of
possession
on an 8088
entry has
!included
 since the sample may
!damaged before its receipt by the
 author.  At best,
is a serious bug in the replication portion
prevents it
freplicating.
PZPAPN
Joker 2
:  Joker 2
 Joker-01
G:  May,
i; TSR;
R:  29,233
5:   PRsA -
, NAV,
 The Joker 2, or Joker-01,
in May,
, by the
 PCVRF.  Its
is a
uof .
-and .
, and
 The
Joker 2 is
X, Joker 2
as a low
TSR of 29,
 568
mby the
include 09, 1C, and 21.
becoming
, Joker 2
-and .
`whose
was less
larger
9K are never
always
by 29,233
by 29,233 to 29,372
).  In both
 cases the
at the end of the
 The
"JOKER-01" can be
din all
Joker 2 may
[the
#cleared, followed by a
hang
ring.
 happens, a few spurious
4may
on the
 well.  If ANSI.SYS is loaded before Joker 2
effect
be produced.
 Joker 2 may be an incomplete
is a large area of 00h
in the
5, implying
thing else may
later.
PZPAPN
Joker-1602
:  Joker-1602
G:  March,
s to be empty;
or jumbled
beeping;
R:  1,602
5:   PRaCK -
.2.0+
 The Joker-1602
in March,
.  Its
.  Joker-1602 is a
uof .
bJoker-1602
, hooking
{25, B4, B6, B8, BA, and BB.
, as
qby the DOS
not be
, Joker-1602
 are
 1,602
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
 Joker-1602
 "I'm hungry! Insert PIZZA & BEER into
OA: and"
 "Strike any key
ready..."
 "Abort, Retry, Ignore, Fail?"
 "Fail on INT 24"
 "Impotence
Ureading
's dick"
too big to fit in
 "Cannot load
-MAND,
halted"
 "I'm sorry, Dave
. but I'm afraid I can't do
 "Format an
? (Y/N)?"
 "Damn it! I told you not to touch
 "Suck me!"
 "Cocksucker At
Ureading device CON:"
 "I'm sorry, but your call cannot be completed as dialed."
 "Please hang up & try your call again."
 "No!"
 "Panic kernal mode
 "CONNECT 1200."
 "Okey, okay! Be patient!..."
 "And if I refuse?"
 "Fuck the world and its followers!"
 "You are pathetic, man... you know
Joker-1602
[frequent
j.  If the
&the
 copy of
,, issuing a DOS DIR
#listed as present in the
 the
Mof one of the
or garbled
 accompanied by beeping may
PZPAPN
:  Jos
i; TSR
 Romania
R:  1,000
5:   PRsC -
3.96+, NAV 3.0+,
1.25+
 The Jos
.  It is
fRomania.  Jos is a
uof .
 but not
bJos
X, the Jos
as a low
TSR of 1,312
{09 and 21
mby Jos in
the Jos
, it
pof 1,000
at the
 of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all Jos
 "JABBERWOCKY
 , the
bRomanian Political
sian"
 "DhoE1"
 "Dhohoho"
 "Release
>12-22-
 Jos is not related to the JW2 or Jabberwocky
 It is
what Jos
PZPAPN
Joshi
:  Joshi
 Happy Birthday Joshi,
 BSC; machine
jand
 India
R:  N/A
5:   BRX -
, NAV,
:  CleanUp, NAV, or M-
 The Joshi
}in India in
.  At the
 was
}, it was reported to be widespread in India as well as
 portions of the continent of Africa.  Joshi is a
Iand the
fa Joshi-
J, the
.  Joshi takes up
, and
show
is 6K less
zed if the DOS
 run.
 Joshi has
ities to two
 Like the
, it
vthe
to the Brain
's method of re
Fing all
to read the
to the
, Joshi
5th of any year, the Joshi
.  At
, the
hang the
while
Ming the
Happy Birthday Joshi"
 If the
s "Happy Birthday Joshi", the
again be usable.
may be recognized on
by powering off
 the
&ing
-clean, write-protected DOS
J.  Using a
editor or viewer to look at the
of suspect
I, if the
btwo
)of the
are hex EB 1F,
r.  The EB 1F is a
 jump instruction to the rest of the
5. The remainder of
 the
is stored on track 40,
1 through 5 on 360K 5.25
 inch
I.  For 1.2M 5.25 inch
I, the
at track 80,
1 through 5.  It
 on the last track of 3.5"
 To determine if a
r, you must look at
 the
.  If the
btwo
)of the
are EB 1F hex,
 The remainder of the
can be
dat cylinder 0, side 0,
2 through 6. The
 at cylinder 0, side 0,
 The Joshi
can be manually removed
bpowering off the
, and
&ing
-clean,
 write-protected
J.  If the
has a
K, the
Kshould
ldata and
`backed up,
 and the
copied back to cylinder 0, side
Iare easier to remove Joshi
f, the DOS SYS
6can be used.
several
Joshi may
[problems
 to access
or data
`on write protected
of Joshi are:
 Joshi-B:
to behavior to the
Joshi
, the
 major
&ed on
5, the
hang
L.  If the
s "Happy Birthday Joshi",
 the
proceed.
 May,
PZPAPN
Joshua
:  Joshua
R:  965
5:   PNA -
3.96+,
n, NAV 3.0+,
 The Joshua
.  Its
.  Joshua is a
uof .
-and .
, but not
the Joshua
wtwo
in the
E.  It
 prefers .
.  If it could not
 two
in the
E, it
move upwards in
 the
Estructure looking for
the Joshua
pof 965
at the end of
 the
a.  The
>and
in the DOS
not be
, the Joshua
Mthe
 Guess what ???
 You
!victimized by a
!!! Do not
 try to re
&your computer or even turn it
 off.  You might as well read
and weep!
 The
in the
5, as is the
 "*.com *.exe .."
 See:
PZPAPN
Julia-1000
:  Julia-1000
R:  1,000
5:   PRhAK -
\2.10g+,
/2.1+,
V112+,
2.58+,
2.11+,
6.64+,
2.58+,
V113+,
6.64+,
1.25+
 The Julia-1000
.  Its
.  Julia-1000 is a
uof .
-and .
bJulia-1000
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 2,080
mby the
Julia-1000 is
, it
-and .
pof 1,000
).  In the case of .
, the
at the
"of the
a, while for .
, the
be at the end of the
a.  The
>and
in the DOS
not be
 The
in the Julia-1000
 "Julia L."
 "Today is May Day ! Ver 3"
jmay
Julia-1000
of Julia-1000 are:
 Julia-1027:
, Julia-1027 is a 1,027
of the Julia-1000
PZPAPN
 Endangered
effects on
 Madrid, Spain
R:  1,201
5:   PNE -
\, NAV,
\, or
 The
13TH
}in Madrid, Spain, in
 Guillermo Gonzalez Garcia.
is a generic .
u, and is not
13TH
X, the
attempt to
`are
are greater in
1,201
by 1,201 to 1,209
 The
13TH
13TH of any year.  At
, a bouncing ball effect
s on the
monitor's
to the bouncing ball effect of the Ping Pong
.  While
is disruptive, it
Nnot cause any overt damage to
sthem.  The bouncing ball effect created
occasionally leave dots on the
where it
 was passing if the
!scrolled for any reason.
13TH are:
13TH-B:
to the
to avoid detection
are aware of the
.  It
vone .
ain the
X, adding
 1,199 to 1,213
)to the
a.  The
at the end of the
.  The
 and
in the DOS
.  The
in the
W\*.V"
13TH-B
13th of any year, at
a bouncing ball
on the
 March,
13TH-C:
to the
, it
vone .
ain the
X, adding
 1,201 to 1,215
)to the
a.  The
at the end of the
.  The
 and
in the DOS
.  The
in the
W\*."
13TH-C
in the
a root
, 1994.
PZPAPN
 Italy
R:  205
5:   PNCK -
.2.0+,
1.25+
 The
26TH
submission, it
s to
}in Italy.
is a
uof .
,.  It is destructive
26th of any year.
26TH
wall of the .
in the
E.  If
E, it
26TH
pof 205
at the end of the
a.  The
>and
 the DOS
to the
>and
.  One
in the
 The
26TH
26th of any year.  At
, the
 the
O, rendering it inaccessible.
PZPAPN
i; graphic
& music on
12th;
 Philipines
R:  2,660 - 2,687
5:   PRsA -
30.00+,
n1.04+,
6.64+
 The
12TH
.  It
fThe Philipines.
12TH is a
-and .
, but not
,.  It
 12th of any year.
12TH
X, the
12TH
as a low
TSR of 2,672
12TH
, it
for any reason.
 2,675 to 2,687
), while .
pby 2,660 to
 2,674
).  In both cases the
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
can be
in the
5in all
12TH
 "VDSFSCAN"
 The
12TH
it has
12th of any year.
, it
Mthe
 three lines of
on the
a graphic of the
 Philipine flag
bline of
, and before the second
 line:
12 - the Independence Day of the Philippines."
 "MABUHAY ANG PILIPINAS!"
 "Dedicated to Manong Eddie."
 A song is played on the
speaker while the
and flag
.  At the completion of the song, the
is cleared and
 the
 The
fthe graphic
Mare
in the
and are not
PZPAPN
 Pretoria,
 Endangered
i; long
Kaccesses;
16th FAT
 alteration
 Republic of South Africa
R:  879
5:   PNCK -
\, NAV,
:  NAV, or
 The
16TH, or Pretoria,
is a
generic .
u, and is
S.  The
X, the
search the
O(all
Fories) and
wall .
d.  The search period can be quite long, and it is very
 obvious on
is taking too
 long to load.
16TH of any year, the
Xthe
activate.  On
, the
3all entries in the root
Eand the
to "ZAPPED".
 The
16TH
t to
ated in South Africa.
PZPAPN
Junior
:  Junior
R:  234
5:   PRaCK -
3.96+, NAV 3.0+,
 The Junior
.  It is
(.  Junior is a
uof .
bJunior
X, the Junior
in a "hole" in al
0:0500.
, as
qby the DOS
not be
.  No
{are
mby the
the Junior
, it
pof 234
at the end of the
a.  The
in the DOS
not be
.  One
in the
5in Junior
 "Jr"
s at or very near the end of the
PZPAPN
:  JW2
 812, Jabberwocky
i; TSR
R:  812
5:   PRsAK -
, NAV,
 The JW2, or 812,
.  Its
, or
~, is
.  JW2 is a
uof .
-and .
 The
JW2 is
X, JW2
as a low
TSR of 1,136
mby JW2 in
JW2 is
, it
-and .
by 812
at the
 end of the
be no
3in the
>and
in the DOS
9the
"JW2" in
 the fourth through sixth
4of the
is the
tmarker.
 It is
if JW2
of JW2 are:
 Jabberwocky: A
of JW2, it has six
differ
fthe
 occasionally
Mthe
X:  "BEWARE THE JABBERWOCK!".  The
cannot be seen in
`as it is
 Jabberwocky.615:
, 1994, Jabberwocky.615 is a 615
of the
.  Its low
TSR is 944
), hooking
pof 615
at the end of the
a.  The
in the DOS
not be
.  The
 all
starting at the 4th
*of the
 "JW1"
, 1994.
 Jabberwocky-B:
to Jabberwocky, Jabberwocky-B
 is an
minor
differ.
PZPAPN
:  K-4B
 Sweden or The
R:  687
5:   PRfCK -
30.00+,
n1.04+,
2.58+,
6.60+,
2.58+,
6.64+,
1.25+
 The K-4B
, and is
feither
 Sweden or The
.  K-4B is a
vvia
    .  The
portion of the
5to make it resistant to the use of debuggers
 to analyse the
bK-4B
X, the K-4B
, hooking
|03.
5is not used for the
, but
 rather to thwart analysing the
.  The
 one .
in the
E.  Later,
Ys an
K-4B
, the
5is not re
, but an
the K-4B
pof 687
at the end of
 the
a.  The
>and
not be
.  The
in the K-4B
 "EAF0FF00F0"
 K-4B
Nn't
to do
interesting
 anti-debugger
 See:   K-4C   Kohntark
PZPAPN
:  K-4C
 Sweden or The
R:  737
5:   PRfCK -
n1.04+,
2.58+,
6.60+,
2.58+,
.2.0+,
1.25+,
6.64+
 The K-4C
, and is
feither
 Sweden or The
.  K-4C is a
vvia
    .  The
portion of the
5to make it resistant to the use of debuggers
 to analyse the
bK-4C
X, the K-4C
, hooking
|03.
5is not used for the
, but
 rather to thwart analysing the
.  The
 to five .
`in the
E.  Later,
Ys an
K-4C
, the
5is not re
, but up to five more .
r.  The
wmore
sixteen
`in a given
the K-4C
pof 737
at the end of
 the
a.  The
>and
not be
.  The
in the K-4C
 "K-4C VIRUS by K
hntark*.
 K-4C is a later
of the K-4B
 See:   K-4B   Kohntark
PZPAPN
K-Hate
:  K-Hate
R:  1,237 - 1,304
5:   PNCK -
 The K-Hate
.  Its
Hare
.  K-Hate is a
uof .
the K-Hate
wall of the .
in the
 1,237 to 1,304
at the end of the
a.  The
>and
in the DOS
not be
.  The
 the K-Hate
 "CRYPT INFO"
 "KDG 0.5 / K
hntark3"
 "*, K-HATE / K
hntark*.
PZPAPN
Kalah
:  Kalah
 Hamburg, Germany
R:  390
5:   PRCK -
/, NAV,
 The Kalah
}in Hamburg, Germany, in
is a
uof .
 The
Kalah is
X, the
 Kalah
in a "hole" in
 very low
, hooking
|21.
be no
the Kalah
, it
the exception of those
 of less
by 390
).  If
 the
was less
), the
be 780
).  The
at the
"of the
a, and the
b390
4of the
!moved to
 the end of the
be no
3to the
>and
in the DOS
in the Kalah
s Kalah
Nn't do
of Kalah are:
 Kalah-499:
, Kalah-499 is a
of the
.  It
vtwo .
pof 499
at the
"of the
a.  In the case of .
were
 smaller
of 998
t.  The
in the DOS
not be
.  The
can be
din all
 Kalah-499
 "I don't like mondays ..."
 Kalah-499
5to low-level format the
Xon any
 Monday.
PZPAPN
Kamikazi
:  Kamikazi
 Kamikaze
R:  4,031
5:   ONE -
, NAV,
1.25+
 The Kamikazi
by Vesselin Bontchev of
is a
, and
the Kamikazi
X, the
ain the
 the .
is greater
4,031
).  Kamikazi
 simply
s the
b4,031
)of the candi
5, thus permanently damaging the candi
r.  The
4,031
5is not
 stored at any
location.
`do not
, the
 the
)of the
 "kamikazi", thus the
.  At
, one of several
: the
may be re
&ed by the
 of the contents of
may get
Lon the
, or the
may complete
Zhaving
ed to
ldone nothing
 at all.  In any event, the
never run
 successfully, doing what the
expects.
 If the
Xa second
, it
hang the
since it is no longer an execu
.  The .
 header has
!permanently damaged due to the
 having
1to "kamikazi" by the
it was
PZPAPN
Karin
:  Karin
 RedStar
 Germany
R:  1,090 or 1,134
5:   PNCK -
, NAV,
 The Karin, or RedStar,
fGermany.  Karin is a
uof .
a Karin
X, the Karin
 search the
Efor an
.  If one
d, the
wit.  If
 in the
E, it may
ras a
the Karin
pof either 1,090 or 1,134
).  In either case, the
at the
"of the
be no
3to the
>and
in a DOS
 The
can be
in the
 "REDSTAR"
 "!Bad copy"
 The Karin
23rd.  On
is run the
Mthe
 repeatedly:
 "Karin hat GEBURTSTAG"
roughly translates to "Karin's Birthday".  The
be stuck in a
loop during the
M, and the
need to be re
&ed to end the
&ing
rcopy of
in the
 and the
&failing to proceed.
PZPAPN
Karlik
:  Karlik
R:  1,666
5:   PRhAK -
30.00+,
 NAV 3.0+,
6.64+,
.2.0+,
1.25+,
6.64+
 The Karlik
.  Its
.  Karlik is a
-and .
bKarlik
at the top of
 the
', not moving
|12's
, as
qby the DOS
@by 1,808
{08 and 21
mby Karlik in
, the Karlik
`, and
pof 1,666
 at the end of the
a.  The
>and
in the DOS
not be
.  No
in the
 It is
what Karlik
PZPAPN
Keeper
:  Keeper
 Keeper.Acid, Acid Trip
^, 1994
`may
 North America
R:  694
5:   PRhE -
2.11a+,
V114+,
\1.25+,
6.64+,
n1.05+,
V113+,
1.25+,
6.64+
 The Keeper, Keeper.Acid or Acid Trip,
^, 1994 and is
fNorth America.  Keeper is a
uof .
bKeeper
at the top of
 but
$the
', hooking
|21.
, as
qby the DOS
@by 1,264
|12's
not be moved.
the Keeper
, it
pof 694
be hidden by the
it is
.  The
at the end of all
.  The
>and
in the DOS
not be
 The
in the
5in all
 Keeper
 "Crypt Keeper P/SG"
 "Your PC is on an [Acid Trip]... Try again later..."
the Keeper
, the DOS
may indicate
are 694
)smaller
 expected.
effect
s due to the
ing mechanism
 employed by the
PZPAPN
Kemerovo
:  Kemerovo
257, Kemerovo-B, Keme,
-257, Kemerovo-C, V257,
 Kemerov
-Path not
R:  257
5:   PNCK -
\, NAV,
 The Kemerovo
and is
is a
uof .
the Kemerovo
X, the
search the
Oand
Efor a .
w.  If an
d, the
wit, adding its
5to the end of the
.  The newly
>and
 the
to the
>and
by 257
 If an
awas not
din the
 the
-Path not
d" may be
Land the
be terminated.
 Kemerovo
Nnot do
of Kemerovo are:
 Kemerovo-B:
to Kemerovo,
fthe United
 States and has
to avoid detection by
.  Its major distinction
wfive .
in the
 Kemerovo-C: Very
to Kemerovo-B,
differs
 by a couple of
PZPAPN
Bug-1596, Kbug
interference
R:  1,598 - 1,620
5:   PRhA -
, NAV 3.0+,
 The
Bug, or
Bug-1596,
.  Its
Bug is a
uof .
-and .
, but
Nnot
 The
Bug is
 the
at the
 top of
$the
 12's
!moved.
, as
qby the DOS
@by 1,616
{01, 03, 1C, and AC
mby the
, it
-and .
X.  .
pof 1,620
).  .
pof 1,598 to
 1,612
.  In both cases, the
 at the end of the
.  The
>and
 the DOS
 intermittent interference
input due to the
 adding bursts of random
4to the
buffer.
jmay
, in particular if the
to copy
using the DOS COPY
Bug are:
Bug-914: A 914
of the
in 1,328
 at the top of
$the
', hooking
{08, 1C, AA, and AC.
 Bug-914
pof 914
at the end of the
a.  The
in the DOS
not be
.  One
in the
-MAND"
 March,
Bug-1720: A larger
of the
in 1,728
 at the top of
$the
', as well as
la 448
*TSR.
 01, 03, 1C, and AC
min high
, and
mby the TSR.
pof 1,744
).  .
 1,722 to 1,734
Bug-1724: An
of the
what
Bug-1720.
-and .
 adding 1,724 to 1,759
.  The
at the end of
PZPAPN
Keydrop
:  Keydrop
 Keydrop Dropper
G:  May,
 BSC;
4dropped
buffer;
; possible
adamage
R:  N/A
5:   BRtX -
, NAV,
.2.0+
:  M-
K/P, DOS SYS on
 The Keydrop
in May,
V.  Keydrop
 is a
and the
).  The
Keydrop
 sample
9ed in a .
"dropped"
 the
.  The .
-dropper
is not
 its behavior is not
to the
, and the
 naturally
the Keydrop
, the
at the top of
$the
Aby 5,120
|12's
!moved.  At
, the
wthe
.  The
l6K in bad
Keydrop is
, it
w360K
are accessed on an
.  High density
not be
 3,072
)in bad
, and the
.  The
, and the
Nnot fit in the
din the bad
l6K in bad
.  The bad
9the
and the remainder of
 the
 Keydrop's
comes
fthe copyright notice
din the
in the bad
 "(c) Copyright
 Keydrop inc."
 Keydrop
on a random basis, at
 occasionally drop a character
fthe
buffer, making the
think
missed a keystroke on the
may damage
Iand the
K.  It
Nnot check to see if the
it is
 going to mark as bad are in use, so
may be in the middle of
or data
of Keydrop are:
 Keydrop Dropper: A small
X, drops the
 Keydrop
PZPAPN
Keypress
:  Keypress
Q, SamSoft, St. Leos, Turku, Keypress-Viring, Viring
 keystrokes repeated unexpectedly;
R:  1,232
5:   PRhAK -
\, NAV,
:  CleanUp, or
 The Keypress
was reported and
}in many locations in
 the
in late
is a
uof .
-and .
 The
the Keypress
X, the
at the
 top of
, but
$the
{1C and 21
mby the
on the
@by 1,232
, any
Xmay
rby the
.  In the case of .
was greater
1,232
`of any
r, as
 it is
1to the
>and
 between 1,234 and 1,248
)upon
t.  .
pby 1,472 to 1,486
)upon
t.  In either case,
 the
at the end of the
 The Keypress
for 30
 minutes.  Upon
, the
may interfere
 input by repeating keystrokes.  For example, if "a" is entered on
 the
, it may be
1to "
a" by the
`can be identified by
9ing the
near the end of the
: 4333C98E1E2901CD21.
of Keypress are:
 Keypress-1232X: Keypress-1232X is a modified
of the
 Keypress
and is
to the
.  It
8the
^, 1994.
 Keypress-1238: Keypress-1238 is a modified
of the
 Keypress
at the
of its submission was
 undetec
ning
.  Its
is 1,328
), hooking
{1C and 21.  It adds
 1,238 to 1,252
)to the .
v, and
 1,492 to 1,506
)to .
.  In both cases, the
at the end of the
a, and the
>and
in the DOS
 to the
>and
 Keypress-1238B:
gequivalent to Keypress-1238,
 is a minor
 Keypress-1238C:
to Keypress-1238,
is 1,328
), hooking
{1C and 21.  It
 adds 1,238 to 1,251
)to the .
v, and
 1,492 to 1,507
)to .
`.  The
 at the end of the
a.  The
>and
in the
 DOS
to the
>and
 Keypress-1268: (MuBark)
on the Keypress
is 1,744
), hooking
 09, 1C, and 21.  It
-and .
 are
pof 1,268 to 1,282
).  .
by 1,506 to 1,520
).  The
 at the end of the
a.  The
>and
in the
 DOS
to the
>and
.  The
in the
5in all
 "M u b a r k   i s   c a w"
Lon the
 monitor
 Keypress.2728:
on the Keypress
is 3,968
), hooking
{13, 1C, and 21.  It
-and .
 or copied.
pof 2,730 to 2,744
).  .
by 2,984 to 2,998
).  The
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The
can be
in the
5in all
 It is
what Keypress.2728
, 1994.
 Keypress-B: Keypress-B is very
to the
Keypress
it is four
)shorter in
Aby 1,216
Keypress-B.
by between 1,228
 and 1,243
).  .
by 1,468 to
 1,482
).  Keypress-B
on a random basis, at
interfere
input by repeating
 keystrokes.
 Keypress-Chaos:
on the Keypress
is 1,328
), hooking
{1C and 21.  It
-and .
 1,238 to 1,251
).  .
 1,492 to 1,506
).  The
at the end of
 the
a.  The
>and
in the DOS
to the
>and
.  The
 the
 "SADDAM - the inferiority of the chaos"
Lon the
 monitor
:  Malaysia
 Keypress-E: Keypress-E is very
to the
Keypress
.  Its major differences are
 is 1,232
).  It adds 1,234 to 1,247
)to the .
v, and 1,472 to 1,486
)to the .
v.  The
>and
 the DOS
to the
>and
 Keypress-Freddy Soft: Keypress-Freddy Soft is a modified
 the Keypress
and is
to the
.  It
8the
 "FRED"
 "FREDDY_SOFT FREDDY_SOFT FREDDY_SOFT FREDDY_SOFT FREDDY_SOFT"
blank out the
it to its
contents
may be re
rby the
^, 1994.
 Keypress-UFO:
on the Keypress
is 3,968
), hooking
{13, 1C and 21.
-and .
 2,725 to 2,738
).  .
 2,979 to 2,994
).  The
at the end of
 the
a.  The
>and
in the DOS
not be
 Keypress-Viring:
on the Turku
of Keypress,
's major difference
fTurku is
the beeping,
, and
jdo not
:  Italy
on the
Keypress
 Singapore is much smaller in
, it
by 896
 889 to 902
pof 1,143 to 1,157
).  The
can be
in the
5in all
 "Roy CuatroNo"
 "2 P
QGargenMeyer Rd. Spore 1543"
 "chklist.cps"
Nnot
to interfer
input
of the Keypress group do.  It is targetted at
 Central
Anti-
, looking for the CHKLIST.CPS
 created by the Central
package.
:  Singapore
 SamSoft:
to the
Keypress,
 1,232 - 1,248
)to the .
v, and
 1,472 - 1,487
)to .
`.  The
>and
 in the DOS
to the
>and
.  Unlike the
, it
Nnot repeat
4entered on the
.  It
8one
 May,
 SamSoft-B:
to the SamSoft
is has
minor alterations.
 St Leos:
to the
Keypress,
gequivalent.  It has
!slightly
 Turku:
to the
Keypress
, Turku adds
 1,234 to 1,247
)to the .
v.  .
by 1,472 to 1,486
).  The
din the
5of all
`: ".
W".  The sticky key or repeated keystroke
 effect in the
!replaced by a series of
 beeps
#emitted on
speaker, the
 halted, and the
 "Internal stack overflow
halted"
s, the
must be powered off to
 be re
PZPAPN
Kiev 483
:  Kiev 483
 483, Kiev
G:  May,
R:  483
5:   PNCK -
, NAV,
 The Kiev 483
in May,
.  It is
fthe
.  Kiev 483 is a
 of .
Kiev 483 is
X, the
 search the
Oand
E, and
wthe
it locates.
Kiev 483
by 483
), the
at the
 end of
`.  The
>and
in the
 DOS
not be
9three
 "Kiev
 Kiev 483
Nnot do
PZPAPN
Kiev 2049
:  Kiev 2049
; C:
; lost cluster or '.SYS
ain C:\
R:  2,049
5:   PRsEB -
V112+
`& DOS SYS on C:
 The Kiev 2049
.  It is
.  Kiev 2049 is a
uof the C:
and .
bKiev 2049
X, the Kiev 2049
on the C:
, and create
d '.SYS in the C:
Oroot
 not usually
in the
E, but
be a lost cluster on
 the
O.  The
aor lost cluster
9a pure copy of the
 Kiev 2049
5.  The
not be
, and
not start
 The next
fthe
K, the
 Kiev 2049
as a device
Or in
 low
.  The device
Or is 3,152
), hooking
|21, and
be labelled
"NUL".
the Kiev 2049
, it may
it is
what sporatic about
pof 2,051 to 2,064
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
5in all Kiev 2049
 "KIEV"
 "c:\'.sys"
 "SYS CONFIG  SYS"
 "IBM  3.2"
 "CONFIG  SYS3"
 "Non-
K. Replace and press key"
 The last three
9ed in the
 imbedded
in the
 It is
what Kiev 2049
PZPAPN
:  Kit
R:  2,383 - 2,446
5:   PRhAK -
, NAV,
 The Kit
.  Its
 It is a
uof .
-and .
 The
a Kit
X, the Kit
at the top of
 but
$the
, as
qby the DOS
@by 2,400
{1C and 21
the Kit
, it
X.  If
the Kit
pof 2,383 to 2,384
)on initial
t.  Kit
`, adding an
2,384
t.  The
at the
"of the
the Kit
pof 2,416 to 2,446
the initial
t.  As
`, Kit re
adding 2,416
t.  Kit
at the end of the
Nnot alter the
>and
in the DOS
are no
in the
 It is
what Kit may do
PZPAPN
Kiwi-550
:  Kiwi-550
 Kiwi
R:  550 - 566
5:   PRhE -
3.96+, NAV 3.0+,
 The Kiwi-550, or Kiwi,
, and
fthe
.  Kiwi-550 is a
 of .
bKiwi-550
X, the Kiwi-550
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 608
|12's
!moved.
the Kiwi-550
, it
pof 550 to 566
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
can be
in the
5in all Kiwi-550
 "I'm KIWI-586.(C) Vege
-Soft,
.DOS AIDSTESTP"
 It is
what Kiwi-550 may do
PZPAPN
Klaeren
:  Klaeren
 Hate
i; TSR;
slowdown
 Italy
R:  978
5:   PRA -
, NAV,
 The Klaeren
, by the PCVRF.  It is
 reported to be
fItaly.  Klaeren is a
 of .
-and .
.  It
Nnot
bKlaeren
X, Klaeren
as a low
TSR of 1,312
mby the
Klaeren is
, it
-and .
over
1K in
by 978 to 996
 the
at the end of the
be no
3in the
>and
in the
Klaeren
respond sluggishly due to a
 slight
slowdown
 Klaeren is a fully
.  It is
what it
PZPAPN
KLF-356
:  KLF-356
R:  356
5:   PRaCK -
3.96+, NAV 3.0+,
8/93+,
.2.0+
 The KLF-356
and is
fthe
.  KLF-356 is a
uof .
bKLF-356
X, the KLF-356
in a "hole" in al
0:025E.
mby the
qby the DOS
not be
the KLF-356
, it
pof 356
at the end of the
a.  The
 and
in the DOS
not be
 The
in the KLF-356
 "KLF"
 "The KLF3"
 The
s very near the
 the
a, and the last
s in the
5at the end of the
 KLF-356
Nn't
to do
PZPAPN
Kode4
:  Kode4
 Kode4-399
fail to
 North America
R:  399
5:   PNCK -
3.96+,
8/93S+, NAV 3.0+,
8/93+,
.2.0+
 The Kode4
, and
s to be
fNorth America.  Kode4 is a
 of .
the Kode4
X, the Kode4
wall of the .
in the
it completes
sthe
, it
 the
s the
to the DOS prompt:
 "-=+ Kode4 +=-, The one and ONLY!"
the Kode4
pof 399
at the end of
 the
a.  Kode4 cannot tell
 by the
, so it
`adding
increments
 of 399
).  The
>and
in the DOS
not be
%the
, one
can be
din all
 "*.com"
 Kode4
Nn't
to do
not function
of Kode4 are:
 Kode4-B:
on the Kode4
, Kode4-B is
 a very minor
, having five
 May,
 Kode4-129:
, Kode4-129
s to be
 an earlier
of the Kode4
is a
vall .
in the
lthe
b129
)of the
by the
5.  The
 "-=+ Kode4 +=-, The one and ONLY!"
 In addition to
, the
 can be
in the
 "*.c*"
Kode4-129 may
 even
is an
s, the
9the
 the
"of the
a, and the remainder of the
9data
PZPAPN
Kohntark
:  Kohntark
>month
bdigit set to "0";
of a .
ait is
 Sweden or The
R:  655
5:   PNCK -
3.96+,
6.64+,
1.25+
 The Kohntark
, and is
feither
 Sweden or The
.  Kohntark is a
s to be an earlier
of the K-4B and K-4C
the Kohntark
X, the
 Kohntark
wone .
in the
E.  The
Mthe
of the
the Kohntark
pof 655
 the end of the
a.  The
>and
bdigit of the
amonth has
!set to "0".  The
in the K-4B
 Kohntark
Nn't
to do
 See:   K-4B   K-4C
PZPAPN
Korea
:  Korea
 LBC
7- Korea
G:  March,
 BSC - 360k
 Seoul, Korea
R:  N/A
5:   RF -
Floppy
 NAV,
:  CleanUp, M-
K, or DOS SYS
 The Korea, or LBC
}in March
in Seoul,
 Korea.
is a
 5.25" 360K
 The Korea
is not intentionally destructive, it
Nnothing
 in its
;form except for replicating.  In
instances,
Korea
damage the root
 it moves the
11, the last
 the root
E.  If
 entries,
be lost.
PZPAPN
Kremikovtzi
:  Kremikovtzi
j; TSR;
R:  1,015 - 1,029
5:   PRsAK -
\2.10+,
V111+,
/2.1+,
2.58+,
6.64+,
V111+,
2.58+,
.2.0+,
6.64+
 The Kremikovtzi
.  Its
it may be
fthe
.  Kremikovtzi is a
uof .
-and .
bKremikovtzi
as a low
TSR of
1K in
.  It hooks
, Kremikovtzi
-and .
pof 1,015 to 1,029
at the end of the
a.  The
>and
in the DOS
not be
 The
in the
5in all
 Kremikovtzi
 "RF *.
 It is
what Kremikovtzi
PZPAPN
Krivmous
:  Krivmous
R:  972 - 993
5:   PNA -
 NAV 3.0+,
8/93+,
 The Krivmous was
.  It is
(.  Krivmous is a
-and .
, but not
,.  It
lthe
to be hung
the Krivmous
search the
Eto determine if
w.  If an
d, the
wit and
run.  If
was not
d, the
check
 the
Eto determine if an
d, and
rby the Krivmous
pof 979
at the
"of the
a.  .
pof 972 to 993
at the
 end of the
a.  The
>and
in the DOS
not be
 The Krivmous
Mthe
cpoem
Ys an
.  The
to be hung,
pressing CTL-C
usually
to the DOS prompt:
was a crooked man, and he went a crooked mile,
da crooked sixpence against a crooked stile,
 He bought a crooked cat,
caught a crooked mouse,
 And
all lived together in a little crooked house."
 The
is not
as it
in the
of Krivmous are:
 Krivmous-B:
gequivalent to the Krivmous
has five
 differ.
PZPAPN
Kthulhu
:  Kthulhu
 write protect
 Poland
R:  512
5:   PNCK -
3.96+, NAV 3.0+,
8/93+,
 The Kthulhu
.  It is
fPoland.  Kthulhu is a
the Kthulhu
X, the
 Kthulhu
wall of the .
in the
pof 512
at the
 of the
a.  The
>and
in the DOS
not be
.  The
can be
in the
5in all Kthulhu
 "KTHULHU Today is my birthday."
 "IT $is coming."
 "$has gone."
 The Kthulhu
 during the month of May of any year,
Ming a
hang
s.  The
of the
depends on what
 the day of the month is set to in the
fthe 1st
 of May thru May 19th, the
 "IT is coming."
 On May 20th, it
Ms the
 "Today is my birthday."
fMay 21st thru May 31st, it
Ms the
 "IT has gone.
symptom of a Kthulhu
on write protected
 write protect
PZPAPN
Kuku-448
:  Kuku-448
 Ku-448
R:  448
5:   PNCK -
, NAV,
 The Kuku-448
.  Its
~, is
.  Kuku-448 is a non-
uof .
,.  Kuku-448 can be a destructive
, overwritting
in advanced
tcases.
Kuku-448 is
X, the Kuku-448
search the
Efor one
w.  If
 it may
r.  Kuku-448
pof 448
 at the
"of the
be no
3to the
>and
in a DOS
 If Kuku-448
Nnot find one
w, it
one .
ain the
a small
 trojan
.  Later,
X, the
write the word "Kuku!" in small colored boxes all
 over the
PZPAPN
Label
:  Label
 Int13
; sluggish response
 on DIR
R:  512
5:   ORCK -
, NAV,
 The Label, or Int13,
.  Label is a
uof .
 The
Label is
X, Label
, it
 one .
in the
a DOS DIR
lthe
by the
.  The
b512
 the
are not saved by the
be no
3in the
`, nor
be a
 in the
>and
in the DOS
, as well as
be corrupted
 by the Label
, but not actually
r.  Like
!permanently damaged.
Label may
on the same
aif the
is not
PZPAPN
Lancs
:  Lancs
 Lancspoly, Lancs-5476
`created; long
Kaccesses
 England
R:  5,476
5:   SNCE - Spawning
, NAV 3.0+,
1.25+
Bcompanion .
 The Lancs, Lancspoly, or Lancs-5476,
.  It is
fEngland.  Lancs is one of a group of
 three closely related
spawning or companion
 All three of the
in an LZ
Wpacked format.
the Lancs
 the Lancs
search the
Eto determine if
exists
the same base
ain the
E.  If the companion
 exist, the
create one.  The newly created companion .
of 5,476
).  The
in the DOS
is the same as the
 and
for the corresponding .
a.  The
 The Lancs
always is packed using LZ
Win the companion .
`.  The
in the
but is
 not
in the
`due to the compressed format:
 'HAVE A "HAPPY MONDAY" LANCSPOLY SUCKERS.'
 'POP WILL EAT ITSELF'
the Lancs
Tand
lthe
halted
L: "Cannot load
-MAND,
halted".
of Lancs are:
 Lancs-5882:
to Lancs,
 companion .
`are 5,882
 Lancs-7376:
to Lancs,
 companion .
`are 7,376
PZPAPN
Larry
:  Larry
R:  491 - 507
5:   PRsAK -
3.96+,
1.53S+,
.2.0+
 The Larry
.  Its
~.  Larry is a
uof .
-and .
.  It
on the
 monitor.
 The
the Larry
in a "hole" in  low
, hooking
|21.
be no
qby the DOS
the Larry
, it
pd in
by 491
pof 507
).  In both cases, the
at the end of the
a.  The
>and
in the DOS
not be
.  One
in the
5in all Larry
 "Larry on a
Lon the
monitor
the Larry
and a
PZPAPN
Laufwerk
:  Laufwerk
fail to function
R:  7,040
5:   ONE -
30.00+, NAV 3.0+,
V112+,
\2.10+,
2.11+,
n1.05+
V113+,
6.64+,
1.25+
 The Laufwerk
.  Its
.  Laufwerk is a
    overwritting
.  It corrupts
 the
the Laufwerk
wone .
on the
 and the B:
O.  The newly
lthe
b7,040
by the Laufwerk
were
larger
7,040
 7,040
were
smaller
7,040
 7,040
upon
t.  The
>and
in the DOS
to the
>and
.  The
can be
in the
 Laufwerk
5in all
 ".exe"
 "Laufwerk:"
PZPAPN
:  Lazy
slowdown; slow
writes;
R:  720
5:   PRxCK -
, NAV,
:  CleanUp, or
 The Lazy
, and its
is a
uof .
 The
the Lazy
 on a
, the
 unreserved low
hooking
{10 and 21.  The
processor
be significantly slowed down,
ing in
 very slow
writes
ring.
Lazy is
, it
 are
by 720
at the end of the
 The
>and
in the
 to the
>and
can be identified by the
"lazy"
near the end of all
the Lazy
[unexpected
allocate and
where the Lazy
 resides in
.  For example,
hang
it checks
if Lazy is
of Lazy are:
 Lazy-2:
has 16
 differ
fthe
Lazy
.  It
Nnot hook
|10 nor slow down
writes.
PZPAPN
:  LCT
 LCT-599, Liquid
G:  March,
R:  599
5:   PNCK -
/2.0+,
, NAV 3.0A06+,
1.0A06+
 The LCT, LCT-599, or Liquid
in March,
 Its
.  LCT is a
uof .
the LCT
X, the LCT
wall of the .
in the
 599
at the end of the
a.  The
>and
in the DOS
.  The
in the
5in all LCT
 "<T3> <tm>Liquid
 LCT
Nn't
to do
of LCT are:
 LCT-762: An earlier
of the LCT
vall of the .
 in the
pof 762
at the
"of the
a.  Unfortunately, LCT-762 cannot
 determine
it has
a, so it
proceed to repeatedly re
`, adding 762
t.  An
now be
 both the
"and the end of the
a.  The
 and
in the DOS
 to the
>and
the last
.  The
in the
5in all LCT-762
 "Liquid
5<tm>"
 March,
PZPAPN
Leech
:  Leech
 Leech2, Topler
G:  May,
>s may dis
R:  1,024
5:   PRhCK -
, NAV,
 The Leech
in May,
.  Leech is
(.  It is a
uof .
 The
Leech is
X, the
at the top of
$the
 as measured by the DOS
Aby 2,080
mby the
.  Leech
makes use of
Leech is
, it
10K in
by 1,024
), but the
in the
Eif Leech is
had a
of 12:00a before
fthe
viewed
Leech
.  Leech is
at the
9the
 "The leech live ...
The Topler"
 Leech is a
.  If it is
are unaware of Leech
be unable to detect its
 presence on the
 It is
if Leech
of Leech are:
 Leech2:
gequivalent to the
, Leech2
 has seven
differ.  Leech2
for any reason.
PZPAPN
Legalize
:  Legalize
G:  May,
may not
 The
R:  1,781
5:   PRhA -
8/93S+,
 NAV 3.0+,
.2.0+
 The Legalize
fThe
in May,
is a
uof .
-and .
 but not
bLegalize
X, the Legalize
at the top of
$the
, as
qby the DOS
@by 2,064
mby Legalize
|12's
!moved.
the Legalize
, it
-and .
 any reason.
 1,781
at the end of the
a.  The
>and
in the DOS
not be
.  One
can be
in the
5in all
 "LEGALIZE"
the Legalize
may notice
no longer function
, giving
 unexpected
 See:  Gotcha
PZPAPN
Lehigh
:  Lehigh
 Lehigh University
, 1987
 Corrupts
& FAT,
 Pennsylvania,
R:  N/A
5:   ORaKT -
, NAV,
K& replace
clean copy, or
\, NAV
 The Lehigh
aon both floppies
 and
Os.  The
tmechanism is to
 stack space.
copy of
,is accessed,
r.  A
 count is kept in
Qcopy of the
, and
 the
s the
and FATs.
 A variation of the Lehigh
, Lehigh-2, exists
maintains
 its
tcounter in RAM and corrupts the
and FATs
of Lehigh are:
 Lehigh-2:
to Lehigh, but the
tcounter is
 maintained in RAM, and the
:of the
 and FATs
 Lehigh-B:
to Lehigh, the
!modified to avoid
 detection.
 Lehigh-D: An
slight
of Lehigh, the major difference
fa Lehigh
typically fail to
ing in a
hang.
PZPAPN
Leningrad II
:  Leningrad II
, 1994
R:  2,000
5:   PRhCK -
\2.13+,
2.58+,
n1.05+,
/2.1+,
6.64+,
.2.0+,
6.64+,
2.58+
 The Leningrad II
, 1994, and
fthe
.  Leningrad II is a
bLeningrad II
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 4,096
{1C and 21
mby the
, the Leningrad II
pof 2,000
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
 repeated many
in the
 "Leningrad"
 It is
what Leningrad II
 See:   Sov
PZPAPN
Leprosy
:  Leprosy
 Leprosy 1.00, News Flash
 Unusual
 California,
R:  666
5:   ONAK -
/2.0+,
 NAV 3.0+,
.2.0+
 The Leprosy
Gin the San Francisco Bay Area of
 California on
is a
-and .
,.  Its
carrier
ais suspected to be a
 called 486
-P.ZIP
was uploaded to several BBSes.
the Leprosy
, the
b666
)of all .
-and .
 in the
Eone level up
fthe
E.  If the
Eis the root
E, all
in the root
r.  If
in the
r, it
show no
punless
were
 less
, in
case
 666
rthe .
-and .
`, it
.  The
be either:
to big to fit in
 "NEWS FLASH!!  Your
 incurable decay of LEPROSY 1.00, a
invented by
 PCM2 in
.  Good luck!"
 The second
Lby one out of every seven
-and .
 Since Leprosy is an
, the
not function
.  In fact,
 are
run for awhile (while the
`) and
Mone of the two
.  The
 If the
 Leprosy in its
a, one of the
Lfollowed by:
 "Bad or missing
6Interpreter"
&problem
s because
,is no longer really
,.  The
not proceed until a
Jis inserted into the
and an
&is attempted.
 While Leprosy's
Sin the
 can be
dby checking for the
chex
near the
"of the
 740AE8510046FE06F002EB08
`must be
Bd and replaced
clean,
 copies.
is no way to dis
since the
 666
)of the
, the
 store those
)anywhere else.
of Leprosy are:
 Angel Of Death: The Angel Of Death is a
uof .
-and .
,.  It
vup to four
in the
X.  It
vall .
in a
 before it
start
lthe
b555
by the
Angel Of Death
 not function
, usually
ing the
to the
 DOS prompt
much
Kactivity.  The
in the
 "All those of impure race beware
 because for the greater glory of
 the Aryan Race, the Angel of Death
 Doctor JOSEF MENGELE has
 Leprosy-654: Leprosy-654 is a
on the Leprosy
.  It
 four .
`in the
ever an
X, and
Ms the
 Leprosy-654
s the
b654
)of the .
v, permanently corrupting them.  The
is un
in the
5in Leprosy-654
 ".. *.
 March,
 Leprosy-664A: Leprosy-664A, or Betrayal, is a
on the Leprosy
.  It
vfour .
Wor .
`in the
ever an
X, and
 the
too big to fit in
 Leprosy-664A
s the
b664
)of the
v, permanently corrupting them.  The
are un
in the
5in all
 Leprosy-664A
too big to fit in
 "Betrayal is a sin, if it comes
 "The Unforgiven / Immortal Riot  Dedicated to Ellie! -
 Lurve you!  Sweden 15/09/93"
all of the .
Wand .
in the
Eare
r, the
Mthe
in the place of the "
too big"
ever an
 "Betrayal is a sin, if it comes
 Leprosy-664A
on the 10th day of any month, at
it can trash the
:  Sweden
^, 1994.
 Leprosy-5600: Leprosy-5600 is a
on the Leprosy-B
.  It
vup to four .
 or .
in the
b5,600
 The
>and
in the DOS
not be
.  Leprosy-5600 cannot recognize
, so the
bfour
rin a
rover and over again.
 function
, and
usually
in the
 of the
 "Not enough
can be
in the
5, as can
 the
 Leprosy-B: The major differences between the Leprosy and Leprosy-B
Leprosy-B uses a slightly different
 encryption method, thus allowing it to avoid detection
Leprosy was
ly, instead of
sall
in the
Eselected for
t, Leprosy-B
wfour
in the
X.  If four non-
`do not exist in
 the
E, it
move up one level in the
Estructure and
wup to four
E.  Like Leprosy, it
s the
`.  The Leprosy
 replaced
 "ATTENTION!  Your computer has
!afflicted
 the incurable decay
is the fate wrought by
 Leprosy Strain B, a
employing Cybernetic
 Mutation Technology (tm) and invented by PCM2  08/90."
 Leprosy-C: Leprosy-C is
on the Leprosy-B
, and
 has
to avoid detection by
products
 familiar
the Leprosy
at the
of its
~.  Leprosy-C
s up to three .
 in the
X.  If it cannot find three candi
win the
E, it
move upward in
 the
Estructure.
b320
5.  The
>and
not be
Leprosy-C
fail to
 either
ing in an access to the
 the
exiting
L, or
too big to fit into
ring.
 May,
 Leprosy-D:
to Leprosy-C, Leprosy-D's major difference is
-and .
,.  Leprosy-D
s the
b370
 May,
 Leprosy-FVHS: Leprosy-FVHS is a
on the Leprosy-B
.  It
vup to four .
 or .
in the
b2,218
 The
>and
in the DOS
not be
.  Leprosy-FVHS
Ms the
 "Allocating
.  Please wait
accessing
, please turn off all RAM
and press >>Enter<< to continue
 The
can be
in the
 all
, as can the
 "Copyright(C)
by Fairview High School,
 Boulder Colorado, 80303."
 "Person/People/Things we >>hate<<:
 Paul Harvey's sucks
! MacinTrashes Suck
 "Graham (Not Alexander but
fuck ass kids whjo calls
 himself graham) sucks!"
 "Person/People we admire:Lynn Bari, Jean Arthur, Jane
 Russel, Victoria Hill"
 "Person/People/Things we thing are cool:  Cybernetics,
 C++, 39 Steps, The Mafia, maybe "Monty Python". XX"
 ".. *.
 NightCrawler 3.0: The NightCrawler 3.0
is a
uof .
.  It
 of the .
in the
 the
b562
by the
Silver Surfer
not function
, and the
is usually
too big to fit in
 In addition to the
, the
in the
 NIGHTCRAWLER VERSION 3.0"
 (C) SECTOR INFECTOR"
 RMIT:
on the Leprosy-B
, RMIT
vboth .
,.  It
vup to four
 preference for .
b666
by the RMIT
5.  RMIT
9the
"V3" in the
btwo
).  The
can be
 all
is "*.
-".
fail to
, and may
in the
too big to fit in
 Scribble:
fSweden in
, Scribble is
 on the Leprosy
, but has
to avoid
 detection by
products familiar
 Leprosy
.  Scribble
s up to three
 in the
X.  It
before .
lthe
5.  The
 and
not be
all of the
 in the
 of the next
in the
 "Legalize Graffitipainting!
 Scribble 1.00 (c)
  VIRINC"
hang
.  The
in the
and not
:  Sweden
 Silver Surfer: The Silver Surfer is a
uof .
-and .
,.  It
vup to five
in the
X.  It
vall .
in a
 before it
start
lthe
b946
by the
Silver Surfer
 not function
, usually
ing the
to the
 DOS prompt
much
Kactivity.  The
in the
Uin Execu
 "I've never
!able to ascertain its exact nature,
 but I'm certain of its"
- dementia, paranoia, shizophrenia,
 hallucinations.  The end
 "is always death... The
lives to reproduce -
 it seems to
 "purpose...
r, the organism's central
 nervois
suffers a"
 "complete breakdown, leading to death."
 "-- Silver Surfer #61"
 "The Silver Surfer
- Lep-B
- by"
 The "
Uin Execu
may be
 The Plague: The Plague is a
 of .
-and .
,.  It
vup to three
in the
lthe
b591
by the
The Plague
not function
.  For .
`, the
 usually be
Lupon
too big to fit in
 The Plague
 and it cannot find an
randomness to whether or not
 actually
, the
 "Autopsy indicates the cause of
 death was THE PLAGUE
 Dedicated to the dudes at SHHS
 VIVE LE SHE-MAN!"
 While
L, the
garbage
4, rendering
 it unrecoverable.
:  Houston, Texas, Unites States
 Xabaras: Xabaras is a
 the Leprosy-B
.  It
vup to four .
 in the
b1,972
).  The
usually not
 and
Zof them usually
s in a
hang or
unexpected
s.  The
in the Xabaras
, and cannot be seen
 "Xabaras...the
of the devil!!"
-.. Access denied"
 "Your PC has
rby XABARAS VIRUS"
 "Created by Cracker Jack
 (c) IVRL"
:  Italy
 See:   Silver Dollar
PZPAPN
Liberty
:  Liberty
 Liberty-A, Liberty-B, Liberty-C, Liberty-D, Liberty-E,
 Liberty-F, Liberty-G, Liberty-H, Liberty-I, Liberty-J
G:  May,
W, and .OVL
i; BSC;
>and
 Sydney, Australia
R:  2,859 - 2,873
5:   PRfAK -
\, NAV,
:  CleanUp, or
 The Liberty
}in Sydney, Australia in May,
 Liberty is a
generic
W, and overlay
,may
r.  In
 advanced
ts, the
 The Liberty
gets its
fthe
"Liberty"
in all
`.  In .
`, it
in the last 3K of the
a.  In .
`, it
 near the very
"of the
, as well as
in the last
 3K of the
 The
the Liberty
 the
.  Liberty
at the top of
$the
Aby 8,496
{21 and 24
mby the
, as well
map to
becoming
Xmay be
rby the
.  All .
r, but
`over 2K in
r.  Overlay
 between 2,859 and 2,873
), and
the hex character
: 80722D80FA81772880.  The main body of the
at the end of all
 had
>and
in the DOS
 the
>and
`can
be identified by the
near the
"of the
 "- M Y S T I C - COPYRIGHT (C) 1989-2000, by SsAsMsUsEsL"
Nnot
`, the area where
would
ed in
be 00h
 Liberty is a self-encrypting
.  It is not yet
if it is
 destructive.
of Liberty are:
 Liberty-B:
strain is
to the
Liberty
.  The
s at the end of all
`has
 to: C8004C40464842020EB.  The word "MAGIC"
drepeated together many
s in
`.  The
>and
in the DOS
in Liberty-B
`to the
>and
 Liberty-C:
is very
 to Liberty-B,
are 16
1.  Like Liberty-B, the word "MAGIC"
 repeated together many
s in
`.  The
s at the end of all
1to: C8004C404648422020E9.
>and
>and
 Liberty-D:
gequivalent to Liberty,
 the "MAGIC"
repeated many
 Liberty-E:
gequivalent to Liberty,
 not
9the "MAGIC"
at all.
 Liberty-F: Liberty-F is almost identical to Liberty-D, it has
 two
differ in the
 Liberty-G: Liberty-G is almost identical to Liberty-E, it has
 two
differ
in it's
 Liberty-H: Liberty-H is almost identical to Liberty-D and
 Liberty-F, differing by two
in the
has 13
differ
fLiberty-C, and
 seven
differ
fLiberty-B.
 Liberty-I: Liberty-I is almost identical to Liberty-E and
 Liberty-G, it has two
in the
 differ.
 Liberty-J: Liberty-J is almost identical to Liberty-H,
 three
in the
differ.
 See:   Liberty-2
PZPAPN
Liberty-2
:  Liberty-2
 Liberty-2A, Liberty-2B, Liberty-2C
W, and .OVL
i; BSC;
>and
 Sydney, Australia
R:  2,869 - 2,883
5:   PRfAK -
\, NAV,
 The Liberty-2
is actually a group of three
to be earlier
s of the Liberty
Cin the
 preceding entry.  Liberty-2 is a
generic
W, and overlay
r.  In advanced
ts, the
 The Liberty-2
gets its
fthe
"Liberty"
in all
`.  In .
`, it
in the last 3K of the
a.  In .
`, it
 near the very
"of the
, as well as
in the last
 3K of the
 The
the Liberty-2
 the
.  Liberty-2
in high
ing in a
Aof 8,512
.  It hooks
{21 and 24, as well as
|67.
becoming
Xmay be
rby the
.  All .
r, but
`over 2K in
r.  Overlay
 between 2,869 and 2,883
).  The main body of the
at the end of all
 Liberty-2
lhad
>and
in the
 DOS
3to reflect the
`can
be identified by the
near the
"of the
 "- M Y S T I C - COPYRIGHT (C) 1989-2000, by SsAsMsUsEsL"
Nnot
`, the area where
would
ed in
be 00h
 The
s in all Liberty-2
it is much longer
qhere:
 "MAGICMAGICMAGICMAGICMAGICMAGICMAGICMAGICMAGICMAGIC"
 Liberty-2 is a self-encrypting
.  It is not yet
if it is
 destructive.
of Liberty are:
 Liberty-2B:
gequivalent to Liberty-2,
 has two
differ
fthe Liberty-2
 Liberty-2C:
gequivalent to Liberty-2,
 has six
differ
fboth the Liberty-2 and
 Liberty-2B
 Liberty.2867:
, 1994,
is an
 minor
of the Liberty-2
, 1994.
 See:   Liberty
PZPAPN
Liberty-1172
:  Liberty-1172
 Lib1172
R:  1,172 - 1,186
5:   PRhCK -
n, NAV,
 The Liberty-1172
.  Its
.  Liberty-1172 is a
uof .
bLiberty-1172
X, the
 Liberty-1172
at the top
$the
 and
, as
qby the DOS
@by 1,568
|12's
 not
!moved.
{09 and 21
 Liberty-1172 in high
Liberty-1172 has
, it
pof 1,172 to 1,186
 The
at the end of the
a.  The
>and
in the DOS
to the
>and
.  One
can be
in the
 "Liberty"
alo be
dnear the
"of the
is how Liberty-1172 marks the
 It is
if Liberty-1172
PZPAPN
Lippi-286
:  Lippi-286
 Lippi
R:  286
5:   PNCK -
3.96+, NAV 3.0+,
.2.0+
 The Lippi-286, or Lippi,
.  Its
.  Lippi-286 is a non-
uof .
the Lippi-286
X, the
 Lippi-286
wone .
in the
 286
at the end of the
a.  The
>and
in the DOS
.  The
in the
 Lippi-286
5in all
 "(C)RomlSoft(LipPI)
 Lippi-286
Nn't
to do
PZPAPN
Lisbon
:  Lisbon
, 1989
i; unusable
`(see
 Lisbon, Portugal
R:  648
5:   PNCK -
, NAV,
:  CleanUp,
\, NAV,
 The Lisbon
is a strain of the
 Jean Luz in Portugal in
, 1989.  The
is very
, except
in order to avoid
identification/detection
could identify the
Lisbon is
X, the
wor corrupt one .
ain the
E.  If a
r, 648
to the
at the end of the
lthe
$near the end of the
 "@AIDS"
 If a
was corrupted instead of
r, the
 five
4of the
be "@AIDS".
corrupted
no longer
, usually
ing in a
hang
X.  Corrupted
 any
psince the
bfive
4were
by the "@AIDS"
of Lisbon are:
 Lisbon-B:
to Lisbon,
Nnot
 "@AIDS"
.  It
may hang the
corrupted by
be begin
the hex
 "FEB8140C50", and
the actual
 Lisbon-B
 Lisbon-B2: Lisbon-B2 is a very minor
of Lisbon-B, differing
 by 2
wise, it is
gidentical.
 See:
PZPAPN
Little Br
00D    X
PTD
:  Little Br
 307
 The
R:  307
5:   SRCE - Spawning
3.96+, NAV 3.0+,
1.53S+,
.2.0+
 The Little Br
fthe
is a spawning
in technique
 to the Aids 2 and Twin-351
 The
Little Br
 Little Br
in a "hole" in low
in the
data area, hooking
|21.
be no
, the Little Br
X.  The .
not be
, but a corresponding .
be created by the
of 307
corresponding .
 pure
5and
=stamp in the DOS
it was created.  The
can be
 in the 307
 "Little Br
 Since DOS
before .
 the
, the corresponding
b.  The .
finished
start the .
of Little Br
 Little Br
-299:
to the
 Little Br
creates
`of 299
)for
X.  The same
 in the
9ed in
 Little Br
-300:
to the
 Little Br
creates
`of 300
)for
X.  The same
 in the
9ed in
 Little Br
-321:
to the
 Little Br
creates
`of 321
)for
:  The
 May,
 Little Br
-349: Little Br
-349 is a 349
 of the Little Br
.  It creates 349
*companion
 The companion
lthe attributes
 read-
, and hidden set so
 not be
in the DOS
 Little Br
-349
on the
 Tuesday in
, the day
major elections
 are held in the
Ming the
a beep multiple
 "DID YOU VOTE, SHITHEAD??"
can be
din the companion
 along
 Little Br
-361: Little Br
-361 is a 361
 the Little Br
.  It creates 361
 companion
.  The
 companion
lthe attributes
 read-
, and hidden set so
 not be
in the DOS
 One
can be
din the hidden .
-*.*"
PZPAPN
Little Girl
:  Little Girl
 Little Girl 2.0
3; write protect
 California,
R:  1,008
5:   PRhAK -
\, NAV,
1.53S+,
 The Little Girl
Gat a large corporation in the
 state of California, in the
.  Little
 Girl is a
uof .
-and .
,.  It is a destructive
the contents of the
 The
the Little Girl
X, the Little Girl
at the top of
$the
, as
qby the DOS
@by 1,280
, the Little Girl
,if it was not
the Little Girl
, it
 and .
for any reason.
Little Girl
 of 1,008
at the end of the
 The
>and
in the DOS
to the
>and
.  The
can be
in the
5in Little Girl
awas destroyed by
Little girl ver 2.00"
 The Little Girl
on a random basis, at
Zof an
in the
 the
Oand
Ming the
awas destroyed by
Little girl ver 2.00"
the Little Girl
[write
 protect
to access
on a write
 protected
J.  The
interfers
batch
`, and
 the
may be prompted to reinsert the
the batch
 even
it is still in the
of Little Girl are:
 Little Girl 3.0: A 1,200
of the Little Girl
is 1,536
), hooking
|21.  It
-and .
, or copied,
 adding 1,200
)to the
.  The
at the end of the
a.  The
>and
to the
>and
.  The
can be
in the
5in all Little Girl 3.0
awas destroyed by The little girl
ver 3.0"
 The Little Girl 3.0
corrupts .BAT, .SYS, and
 data
are accessed,
the second
.  Write
 protect
fwrite protected
PZPAPN
Little Pieces
:  Little Pieces
 1374, Pieces
j; unexpected
clears
 Italy
R:  1,374
5:   PRaE -
n, NAV,
 The Little Pieces
, in Italy.
is a 1,374
uof .
 The
Little Pieces is
 the
.  The area where it
is 1,392
)long and labeled
-MAND Data in
 low
mapping utilities
combine
 area
6interpreter, so the
6interpreter
to be 1,392
)longer
expected.
{13, 16,
 and 21 are
mby the Little Pieces
Little Pieces is
, it
 by 1,374
)and
lthe
at the end of the
>and
 the
the Little Pieces
#cleared unexpectedly
a key is pressed on
 the
.  The
is usually
is cleared,
not always:
 "One of
days I'm going to cut you into little pieces"
cannot be viewed in
`as it is
in the
[unexpected
ring, requiring the
to be re
&ed.
PZPAPN
Little Red
:  Little Red
, 1994
i; DOS
 sluggish DOS DIR
6output;
R:  1,465
5:   PRhAK -
\2.13+,
6.64+,
n1.05+,
V117+,
 NAV 3.0A06+,
1.25+,
6.64+,
V117+,
1.0A06+
\2.13, or
 The Little Red
, 1994.  Its
the sample
fan "in the wild"
tin the
.  Little Red is a
-and .
bLittle Red
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 1,744
{1C and 21
, the
 the copy of
in the C:
Oroot
Eif it
 was not
the Little Red
, it
X, copied,
 or a DOS DIR
6is issued.  In the case of the DOS DIR
 both the source and target
`are
rby the
pof 1,465
be hidden
 The
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the
 "C:\
 The DOS
indicate
Ton all
.  Output
 DOS DIR
be sluggish or delayed.
 hang the
PZPAPN
Little-139
:  Little-139
G:  March,
R:  139
5:   PNCK -
 The Little-139
in March,
documentation
 indicating
it was written for the "
bInternational
 Writing Contest
" sponsored by American Eagle Publications, Inc.
 It was
source
5, and is a simple, non-
the Little-139
wone .
in the
pof 139
 the
at the
"of the
a.  The
>and
in the DOS
to the
>and
 The
in the
 Little-139
Nn't do
PZPAPN
Loa Duong
:  Loa Duong
 Lao Duong
G:  May,
 BSC;
; music;
 Thailand
R:  N/A
5:   BRtM -
/2.0+, NAV 3.0+
:  CleanUp, or M-
 The Loa Duong
}in May,
in Thailand.  Loa
 Duong is a
uof the
Kand floppy
the Loa Duong
&ed, Loa
 Duong
at the top of
$the
|12's
be moved.
, as measured by
 the DOS
Aby 1,024
).  The
Loa Duong is
, it
wany non-write
 protected
are exposed to the
.  A DIR
6, such as DIR A:
be enough to
wthe
 The Loa Duong
stores the C:
 at Side 0, Cylinder 0,
8.  On high density 5.25"
 the
be stored at
28.  On double
 density 5.25"
I, the
be stored
11.  Since the
used to store the
Iis the last
of the root
E, any
aentries
were
be lost.
 Loa Duong
Kaccesses
play a Laotian funeral dirge on the
 speaker.
PZPAPN
LockUp
:  LockUp
 LK, Mithrandir III
G:  May,
 Hidden .
`created;
; "Divide Overflow"
Tmay
 Sweden
R:  496
5:   SRhE - Spawning
3.96+, NAV 3.0+,
1.53S+,
.2.0+
Bthe hidden .
 The LockUp
}in Sweden in May,
 is a
spawning or companion
, and uses
techniques to avoid detection.
 The
the LockUp
 the
at the top of
$the
'.  It
Nnot move
|12's
qby the DOS
@by 1,568
mby LockUp in
the LockUp
, it
 are not
, but rather the
creates a hidden 496
ain the
the same base
 hidden
`always
lthe
>and
of 3-24-23 2:17a
 in the DOS
has created the hidden
a, any
Ythe
 the companion .
Xby DOS.
 The
can be
din the 496
*companion
`created by the LockUp
 "DeMoRaLiZeD YoUtH"
 "Mithrandir III"
the LockUp
, it
to mask the
 presence of the hidden .
`in order to avoid detection by
.  The
may not see the hidden
`, so
of LockUp are:
 LockUp-B:
gequivalent to the
has three
differ.
:  Sweden
 See:   Mithrandir
PZPAPN
Lockup 3.0
:  Lockup 3.0
G:  May,
R:  2,969 - 2,983
5:   PRsA -
2.58+,
6.64+,
\2.13+,
2.58+,
6.64+
 The Lockup 3.0
in May,
.  Its
.  Lockup 3.0 is a
uof .
-and .
, but not
bLockup 3.0
X, the Lockup
 3.0
as a low
 of 3,280
mby Lockup 3.0 in
the Lockup 3.0
, it
 and .
pof 2,969
at the
"of the
pof 2,969 to 2,983
at the end of the
a.  In both cases,
 the
>and
in the DOS
to the
>and
.  The
in the
5in all Lockup 3.0
 "No.1"
 Pressing the CTRL and Break keys
in a
hang.
PZPAPN
00$    U
jPT$
:  Loki
 Loki-1237, Merde-5
R:  1,237 - 1,252
5:   PRhAK -
3.96+,
 NAV 3.0+,
V112+,
n1.05+,
8/93s+,
.2.0+,
V113+
 The Loki, Loki-1237 or Merde-5,
 Its
~are
.  Loki is a
uof .
-and .
 The
Loki is
X, the Loki
at the top of
$the
', hooking
{21 and 71.
4,336
).  It
wthe copy of
ed to by the
-SPEC en
mental variable at
if it was not
the Loki
, it
pof 1,237
), while .
by 1,237 to 1,252
).  In both cases the
at the end of the
a.  The
in the DOS
not be
.  The
can be
dnear the end of all
 "Loki"
Loki
[frequent
of Loki are:
 Loki-354: Loki-354 or Merde-6, is a
uof .
,.  Unlike
 the Loki
pof 354
at the end of the
in the
 Loki-973: Loki-973 is a
uof .
on the Loki
.  It
at the top of
$the
X, hooking
{21 and 71.
 Loki-973
pof 973
at the end of the
 The
>and
in the DOS
not be
.  The
in the
5in all Loki-973
me, I LIKE IT
!-Loki-nator!"
jfrequently
 Loki-1234: Loki-1234 is a
uof .
on the Loki
.  It
at the top of
$the
X, hooking
|21.
, Loki-1234
-and .
pof 1,234
).  .
by 1,234 to 1,248
).  In both cases the
at the end of the
a.  The
in the DOS
not be
 The
in the
5in all Loki-1234
 "LOKI"
 "Loki"
jfrequently
-and .
 are
PZPAPN
Lokjaw
:  Lokjaw
 Lokjaw-Drei
G:  March,
`created;
; noisy
Kaccess &
R:  898
5:   SRhC - Spawning
30.00+,
8/93S+, NAV 3.0+,
6.64+,
1.25+
Bthe 898
*companion
 The Lokjaw, or Lokjaw-Drei,
in March,
.  Its
.  Lokjaw is a
spawning or companion
 creating 898
`.  The Lokjaw
on the
 Civil War
bLokjaw
X, the Lokjaw
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 4,096
|12's
not be
 moved.
the Lokjaw
, it
Xby creating an 898
the same base
.  The actual .
not be
.  The 898
lthe
>and
in the DOS
Efor the
.  The
in the 898
*companion
9ing the Lokjaw
-(o)"
 "Lokjaw-Drei"
 Lokjaw
activate, accessing the
Kwhile
 emiting a scraping noise on the
speaker.  The
 be unresponsive, requiring the
to re
&or reset the
 To dis
wa Lokjaw
t, the
should power off the
 and
fa write-protected,
K.  The 898
*companion .
`should
of Lokjaw are:
 Lokjaw-Zwei:
, the Lokjaw-Zwei
 is 894
of the
.  It
8the
-(o)"
 "Lokjaw-Zwei"
 The Lokjaw-Zwei
clear the
, or compress the
to a 2-line face in the
 center of the
, and
access the
 The
be hung and
lto be reset.
 See:   Civil War
PZPAPN
Lord-933
:  Lord-933
G:  March,
i; "beep"
speaker
R:  933 - 948
5:   PNCK -
Bthe 898
*companion
 The Lord-933
in March,
.  Its
.  Lord-933 is a
uof .
the Lord-933
X, the
 Lord-933
wone .
in the
E.  A "beep"
be emitted
fthe
 speaker, and the
to run
the Lord-933
pof 933 to 948
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the
5in all Lord-933
 "*.com"
 "qvCreated by Death Lord"
PZPAPN
Los-693
:  Los-693
R:  693
5:   PRhC -
\, NAV,
3.96+, NAV 3.0+,
8/93+,
.2.0+
 The Los-693
, and is
 the
.  Los-693 is a
uof .
 but not
,.  It
alter the
) but not actually place
 a copy of the
bLos-693
X, the Los-693
at the top of
$the
', as well as alter the
qby the DOS
@by 768
 to 784
mby the
the Los-693
, it
pof 693
at the end of the
a.  The
in the DOS
to the
>and
.  The
in the
5in all Los-693
 "Lz"
 "593?"
 The "Lz"
ocurs at the very end of all
`.  It is
what Los-693
PZPAPN
LoveChild-2710
:  LoveChild-2710
G:  March,
i; DOS
R:  2,710
5:   PRhCK -
3.96+,
 The LoveChild-2710
in March,
.  Its
.  LoveChild-2710 is a
bLoveChild-2710
at the top of
$the
', hooking
{13 and
 24.
, as
qby the
 DOS
@by 4,096
 12's
!moved.
, the
,if it was not
, the LoveChild-2710
for any reason.
pof 2,710
 the
pis not
.  LoveChild-2710
at the end of
`.  The
>and
in the DOS
not be
.  No
 the
the LoveChild-2710
find
 the
, the DOS
indicate
Ton all
PZPAPN
LowerCase
:  LowerCase
 LowerCase-B, LCV
2IBM to ibm in
R:  864
5:   PNCK -
, NAV,
 The LowerCase
.  Its
.  LowerCase is a
 of .
LowerCase is
X, LowerCase
 search the
Oand
Efor an
w.  If it finds an
abefore it encounters
aof less
, it
 LowerCase
stop searching the
aof less
)is encountered, not further
 the
 LowerCase
by 864
).  The
at the
"of the
.  If
 the
9ed the
"IBM", the
1it to "ibm"
 LowerCase
Nn't
9any
mechanism.
of LowerCase are:
 LowerCase-B:
gequivalent to the
LowerCase
has seven
in its
differ.
PZPAPN
Lozinsky
:  Lozinsky
 Lozinsky-1018, Lozinsky-1023B
R:  1,023
5:   PRtCK -
\, NAV,
 The Lozinsky
fthe
 Lozinsky is a
uof .
Lozinsky is
X, the
at the top of
$the
|12's
be moved so
report 2,048
less
what is
 actually
zed.
{13 and 21
mby the
Lozinsky is
, it
 are
for any reason.
pof 1,023
)and
lthe
 the end of the
>and
in the
to the
>and
rby Lozinsky.
 It is
if Lozinsky
of Lozinsky are:
 Lozinsky-1018:
to the
Lozinsky
is five
)smaller, adding
 1,018
)to the end of
 Lozinsky-1023B:
gequivalent to the
has two
in its
differ.
 See:   Zherkov
PZPAPN
LPT Off
:  LPT Off
2; interfers/disables
 printing
R:  256
5:   PRxCK -
3.96+, NAV 3.0+,
1.25+
 The LPT Off
, and is
.  LPT Off is a
uof .
bLPT Off
X, the LPT Off
in a "hole" in low,
, hooking
{17 and 21.
 and
, as
qby the DOS
not be
the LPT Off
, it
very small .
 256
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
can be
in the LPT Off
 "(c)
 LPT Off interfers
printing on the
printers by disabling
 the functionality of the 17h
PZPAPN
Luca-309
:  Luca-309
R:  309
5:   PRCK -
3.96+, NAV 3.0+,
.2.0+,
1.25+
 The Luca-309
.  Luca-309 is a
u.  It
bLuca-309
X, the Luca-309
in a "hole" in low
, hooking
|21.
be no
 the DOS
.  The
wone .
in the
, the Luca-309
wone .
in the
pof 309
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in the Luca-309
5in all
 It is
if Luca-309
PZPAPN
Lucifer
:  Lucifer
G:  May,
may dis
 Italy
R:  1,086
5:   PRtCK -
, NAV,
 The Lucifer
in May,
.  It is
fItaly.
 Lucifer is a
uof .
Lucifer is
X, the
at the top of
$the
|12's
is not moved.
 The DOS
report
is 1,136
)less
expected by the
 and 21
mby the
Lucifer is
, it
`over
2K in
X.  If
X, it
by 1,086
hides the
pif it is
.  While most
 not
>and
in the
, if the
was 12:00a, the
rand Lucifer is
.  Lucifer
at the end of
 The Lucifer
8two
can be
, the last of
s at the very end of the
 "Lucifer (C) by C.J."
 "C.J."
 It is
if Lucifer
 See:   Alfa   Damage   V1024
PZPAPN
Lurve
:  Lurve
 ARCV-718
G:  March,
; DOS
 England
R:  718
5:   PRhC -
3.96+,
1.25+
 The Lurve, or ARCV-718,
in March,
, and is
fEngland.  Lurve is a
semi-
, but not
bLurve
X, the Lurve
at the top of
 but
$the
', hooking
|21.
 and
, as
qby the DOS
@by 2,048
|12's
!moved.
the Lurve
, it
for any reason.
pof 718
), however the
pis hidden
.  The
 Lurve
at the end of the
a.  The
>and
in the DOS
not be
 The
in the Lurve
 "[SOLOMoN] ICE-9"
 "Hello Dr. Sol."
 "Fido."
 "Lurve U lots"
 "ICE-9"
 "(c)
ARCV."
 "P.S."
 "Apache sez Hi(Dos)"
the DOS
the Lurve
, it
detect
Ton all
 It is
what Lurve
PZPAPN
LV 1.2
:  LV 1.2
 The
R:  477
5:   ONK -
3.96+,
8/93S+, NAV 3.0+,
8/93+,
.2.0+
 The LV 1.2
fThe
.  LV 1.2 is a
,.  It
Nnot
the LV 1.2
wthe copy of
in the root
Eof the
O.  It
s 477
)of the
 slack (hex 00) area at the end of the
a.  The
not be
.  The
>and
 the DOS
to the
>and
.  The
9ed in the
,IS INFECTED by VIRUS LV .1.2 !!!"
PZPAPN
Lycee
:  Lycee
 Lycee-1788, Lyceum
seconds set to "00";
R:  1,788
5:   PRhAK -
3.96+, NAV 3.0+,
8/93+,
.2.0+
 The Lycee, or Lycee-1788,
.  It is
fthe
.  Lycee is a
uof .
-and .
,.  It employs
techniques
 to avoid detection and quickly spreads the
bLycee
X, the Lycee
at the top of
 but
$the
, as
qby the DOS
 by 2,368
{08, 09, and 21
mby Lycee
, the Lycee
,if it was not
the Lycee
, it
X, copied, or
for any
 reason.
 1,788
), but the
be hidden
.  The Lycee
can be
dat the end
`.  The
in the DOS
the seconds field is set to "00",
 may
ing to
la blank
.  No
in the Lycee
the Lycee
Ton all
the DOS
of Lycee are:
 Lycee-1832: A 1,832
of the Lycee
, Lycee-1832's
is 2,416
).  It
hooks
 08, 09, and 21.
pof 1,832
be hidden
.  The
 seconds field in the
in the DOS
be set to "02".  The
in the
5, and hence not
 "Welcome to Lycee of
xTechnologies !"
 Lycee-1888: A 1,888
of the Lycee
, Lycee-1888's
is 2,928
).  It hooks
 09, 13 and 21.
pof 1,888
be hidden
.  The
oseconds field,
not be
 Lyceum.1901: A 1,901
of the Lycee
 Lyceum.1901's
is 2,944
), hooking
{08, 09, 13 and 21.
pof 1,901
be hidden
.  The
oseconds field,
not be
, 1994.
 Lycee-1975: A 1,975
of the Lycee
, Lycee-1975's
is 2,576
).  It
hooks
 08, 09, and 21.
pof 1,975
), the
pis not
 hidden
.  The
>and
in the DOS
.  No
in the
may detect
 as the "Feist"
PZPAPN
Lythyum
:  Lythyum
i; hidden
Kroot
R:  502
5:   PNCK -
3.96+,
1.53S+,
1.25+
 The Lythyum
, and is
.  Lythyum is a
 of .
,.  It was written by a
 member of the Virulent Graffiti
writing group.
Lythyum
X, the
 Lythyum
wone .
in the
 502
at the end of the
a.  The
>and
in the DOS
.  The
in the
 Lythyum
 "lythyum, the attitude adjuster, ViRuLeNT GRaFFiTi"
 "\Lythyum.hi! *.
rall of the .
`in the
E, it
create a hidden
a, LYTHYUM.HI!, in the
O's root
the next
 The hidden
9the
of Lythyum are:
 Lythyum-B:
to the Lythyum
, Lythyum-B is a very minor
PZPAPN
:  LZ
 Noon Beep
`created
 The
R:  5,085 - 8,847
5:   SNA - Spawning
 NAV,
V113+,
1.25+,
1.0A06+
 The LZ
.  It is
.  LZ is a
spawing
the .
it not
LZ is
r, the LZ
 search the
Efor .
.  For
it encounters, the
check to see if
 a corresponding .
the same base
.  If
 is not, the
create one.  The created .
9the
5, and be 5,085 to 8,847
 The
>and
be identical to the
>and
in the DOS
 The LZ
spreads by the
executing a .
 executing the
base
.  Since DOS
abefore a .
, the
5in the .
has completed
Z, it
load and
Ythe corresponding .
5is LZ
W'd, and the .
`created by
 the
9the
typically
9ed in
 LZ-2:
}in The
, LZ-2 is a
 later
of the LZ
.  It
wup to three .
in the
O's root
ever an
X.  The corresponding .
5,106 to 9,141
 same
=in the DOS
 the
:  The
PZPAPN
:  LZRQ
 Whit
 BSC;
R:  N/A
5:   BRtX -
\, NAV,
/2.0+,
2.58+
:  CleanUp, M-
K, or DOS SYS on
 The LZRQ
.  LZRQ is a
and the
).  It
s to be related to
 the Den Zuk
 The
fa LZRQ
 the LZRQ
at the top of
$the
', moving
|12's
, as
qby the
 DOS
@by 2,048
, the
wthe
 if it was not
the LZRQ
, it
wthe
of any non-write protected
Iaccessed on the
 On 360K 5.25"
I, the
write one
5to Side 1, Cylinder 39,
8, and copy the
to Side 1, Cylinder 39,
9.  The
 the
at Side 0, Cylinder 0,
 On 1.2M 5.25"
I, the
write one
5to Side 1, Cylinder 79,
14, and copy the
to Side 1, Cylinder 79,
15.  The
 the
at Side 0, Cylinder 0,
 On the
K, the
lwritten one
5to Side 0, Cylinder 0,
2, and copied the
to Side 0, Cylinder 0,
3.  The
s the
at Side 0, Cylinder 0,
 The
s in the
5is "LZRQ", it
in the extra
5, not the
 See:   Den Zuk
PZPAPN
M.I.R.
:  M.I.R.
G:  May,
i; BSC; .SYS
&failures; garbling of
R:  1,745
5:   PRhAK -
, NAV,
`, & DOS SYS
 The M.I.R.
in May
by the PCVRF.  It is
is a
 of .
-and .
,.  It
modifies
and .SYS
cannot
areas.
 The
M.I.R. is
X, the
at the top of
$the
{21 and 27
mby the
qby the DOS
be 3,584
)less
 is expected.  At
, the
 modified,
the modification
Nnot
in an
wious
 copy of the
M.I.R. is
, it
-and .
are at least 2K in
pof 1,745
), while
by 1,745 to 1,759
).  In
 both cases, the
at the end of the
a. M. I. R.
Nnot hide the
p, nor
 alter the
>and
in the DOS
 One
can be
near the
"of the
 "#.I.R. *-*-*-* Sign of the
 As an M.I.R.
tprogresses, the
aMSDOS.SYS may
rby the
Nnot
wious copy of the
, but is damaged.
a M.I.R. modified
and MSDOS.SYS, as
 well as an
in a garbled
>and
, followed by the
hanging.
 It is
if M.I.R.
 See:
PZPAPN
Maaike
:  Maaike
 Maaike.164
, 1994
R:  164
5:   ORsE -
V116+,
V116+
 The Maaike
, 1994.  The sample
 was
fThe
cmonth a
fa public domain
tin Canada.  Its
.  Maaike is a
 destroys .
and interfers
operation.
bMaaike
as a low
TSR, hooking
|21.  The
ed to the DOS
 prompt.
the Maaike
Zof an .
in the
replacing the .
 a 164
*copy of
.  The 164
lthe same
as the
>and
.  The hidden attribute
be set, thus the
Bd.  No
in the
Zof .
the Maaike
in the
 "Bad
 The .
`are un
, and
function if the
 not
-and .
 primarily of the "Write fault
Uwriting device AUX" or write
 protect
fwrite
 protected
of Maaike are:
 Maaike.250: A 250
of the Maaike
8the
 "Maaike I Love You !"
}:  Canada  May, 1994
PZPAPN
Macedonia
:  Macedonia
R:  400
5:   PRC -
/, NAV,
`, & DOS SYS
 The Macedonia
.  Its
.  Macedonia is a
uof .
 The
Macedonia is
X, the
be no
qby the DOS
 by the
Macedonia is
, it
occasionally
pof 400
at the end of the
be no
3to the
>and
in the DOS
.  The
can be
in the
5in Macedonia
 "MacedoniaToTheMacedonians"
 It is
if Macedonia
PZPAPN
MacGyver
:  MacGyver
i; TSR; DOS
 Taiwan
R:  2,824
5:   PRsE -
30.00+,
 NAV 3.0+,
n1.04+,
1.53S+,
6.64+,
1.25+
 The MacGyver
.  It is
 Taiwan.
is a
bMacGyver
X, the MacGyver
as a low
 TSR of 3,072
mby the
the MacGyver
, it
pof 2,824
at the end of the
a.  The
p, however,
be hidden by the
MacGyver is
.  The
>and
in the DOS
.  The
in the MacGyver
5in all
 "SCANVIR.SHW"
 The
in the
5, thus
 it is not
 "SCAN ZTEST
WGOD MACGYVER V1.0 Written by JOEY in
 Keelung. TAIWAN"
the MacGyver
[frequent
ly, the
 DOS
indicate
Ton all
of MacGyver are:
 MacGyver 2.2: MacGyver 2.2 is a 3,160
of the
 MacGyver
.  Its
 TSR is 3,648
), hooking
|21.  It
-and .
 are
.  It
Nnot
 copy.
the MacGyver 2.2
pof 3,160
be hidden
.  No
 the
5, and the
in the DOS
not be
: Taiwan
^, 1994.
PZPAPN
Madismo
:  Madismo
R:  6,007
5:   ONE -
30.00+, NAV 3.0+,
 The Madismo
.  Its
.  Madismo is a
the Madismo
access both the C:
Oand the
wall .
in the
 are larger
6,000
completes
, it
Mthe
to the DOS prompt:
 "Madismo Strikes Again!"
lthe
b6,007
 the Madismo
5.  The
>and
in the DOS
to the
.  The
in the
 "C:\
 "MADISMO *.
W>MADISMO.TXT"
 "MADISMO.TXT"
dreading
 "Abort, Retry, Ignore, Fail?"
 "Madismo Strikes Again!"
 "*.*"
 "No matching
the Madismo
are permanently corrupted
 since the
Nnot store the 6,007
should be replaced
copies.
PZPAPN
Magnitogorsk 2048
:  Magnitogorsk 2048
G:  May,
R:  2,048
5:   PRhAK -
, NAV,
 The Magnitogorsk 2048
Vin May,
.  It is
fthe
.  Magnitogorsk 2048 is
 a later
of the 2560
, and
utilities
detect it as 2560.
 The
Magnitogorsk 2048 is
X, the
at the
 top of
$the
 and
, as measured by the DOS
Aby 4,160
{08, 13, 21, and 22
mby the
Magnitogorsk 2048 is
, it
 and .
larger
 2,048
at the end of the
.  The
>and
in the
 not be
 Magnitogorsk 2048
it is
X.  In the case of
,, the
 not
lany
pas the
 portion of
,'s stack space.
 Magnitogorsk 2048 is a
, as is 2560.  While
es do not hide
do actively
 use techniques to avoid detection by
utilities not
 aware of them.
 It is
if Magnitogorsk 2048
 See:   2560
PZPAPN
Malaga
:  Malaga
&failure on
R:  2,612 - 2,626
5:   PRshAB -
W, &
 NAV,
1.53S+,
 The Malaga
.  Its
.  Malaga is a
uof .
-and .
, as well as the
Iand
Nnot
,.  It is a
 it imploys a technique
to the Brain
to hide the
 The
the Malaga
 the Malaga
as a low
TSR of 5,168
), hooking
{08, 13, and
 21.  At
, it
wthe
of the
O, and the
in the
 Later,
fthe
J, the
fail if it is a
J, but the Malaga
ODOS
&ing
fthe
in the
becoming
at the top
$the
, as
qby the DOS
@by 4,096
the Malaga
, it
wone .
Ys any
 a DOS DIR
6is issued.  (
a DIR
6is performed
t, or is
as a low
TSR.)  In the case of
Z, it
 the
;ly executing if it was not
the Malaga
pof 2,612 to 2,626
), the
at the
 end of the
.  The
>and
in the DOS
not be
.  The
 can be
in the
5in all
 "MSDOS4.0"
 In the case of the
, the
and a copy of the Malaga
be written to the
Kstarting at
0 of the last
side or track of
 the
K.  The
precede the copy of the
 Since Malaga is a
regards to the
t, if you check your
utilities and
 find it on
`, you need to power off the
and check the
again
&ing
, write-protected
wise, the
tmay be
 missed, and you
promptly
 It is
if Malaga
of Malaga are:
 Inofensivo:
on the Malaga
, Inofensivo
 is a 2,661
.  Its
is 5,184
), hooking
{08, 13, and 21.
, it
-and .
X, as well as one
a DOS DIR
6is issued.
 2,661 to 2,674
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The
can be
in the
 in all Inofensivo
 "inofensivo
 "MSDOS4.0"
 Malaga-B:
to the
 a minor
has nineteen
differ
fthe
PZPAPN
Malaise
:  Malaise
 V-IVL110
 France
R:  1,357 - 1,371
5:   PRhAK -
, NAV,
3.96+,
8/93+,
.2.0+,
1.0A06+
 The Malaise
Gin France in
.  Malaise
 is a
uof .
-and .
 The
the Malaise
X, the Malaise
 the top of
$the
'.  It
 not move
|12's
, as measured by the DOS
 by 4,096
mby Malaise in
the Malaise
, it
by 1,357 to 1,371
at the end of the
a.  The
in the DOS
not be
 Several
can be
in the
5in Malaise
 "Welcome
 into the
 "(c)
 Info
 "Laborato
 "V-IVL110"
 "To  inactivate  me,just set to  "*" the
 "in brackets:"
 "[#]"
 "Next
, be   more prudent !"
 Malaise
Nn't
to do
of Malaise are:
 Malaise-524:
on the Malaise
by the
Locks.  Malaise-524 is a 524
uof .
,.  Its
is 1,024
), hooking
{1C and 21.
, it
X, increasing
by 524
).  The
>and
in the DOS
to the
 and
.  The
can be
 the
5in all Malaise-524
-com"
 The
at the end of the
:  France  May,
 Malaise-1743:
on the Malaise
is 2,000
), hooking
 21.
, it
wthe copy of
in the C:
 root
Eif it was not
 Malaise-1743
vone .
-or .
in the
a DOS DIR
6is issued.
 1,743 to 1,757
at the
 end of the
a, however the
 hidden
.  The
>and
in the DOS
.  No
in the
Malaise-1743
 a sluggish response to DOS DIR
6, and the DOS
:  France
 Malaise-B:
to the
has had the
"[#]"
1to "[*]".
:  France
PZPAPN
Malign
:  Malign
 Malign-575
=minutes set to 01;
 interfers
DOS Dir
R:  575
5:   PRhCK -
3.96+, NAV 3.0+,
 The Malign, or Malign-575,
 and is
fthe
.  Malign is a
uof .
bMalign
X, the Malign
at the top of
$the
', hooking
{21 and
 22.
, as
qby the
 DOS
@by 2,304
, the Malign
wthe copy of
in the C:
Oroot
the Malign
, it
, or a DOS Dir
 is performed.
 of 575
at the
"of the
a.  The
in the DOS
the minutes field
be set to "01".
 The
in the Malign
5in all
 "Malign$?"
 "*.com"
 Malign may interfer
Mof output
fthe DOS Dir
othe addition of a line for a
"Malign
of Malign are:
 Malign-630: A 630
of the Malign
.  It
8the
 "Malign$Wait"
 "*.com"
PZPAPN
Malmsey
:  Malmsey
fail to function
 Canada
R:  495
5:   ONCK -
can,
n, NAV 3.0+,
6.60+,
1.25+,
6.64+
 The Malmsey
, and was written
 by a person using the
Lucifer Messiah.  Malmsey is
 Canada.
is a
,.  A
 later
of the
, Malmsey 2
$, is a
the Malmsey
X, the
 Malmsey
wone .
in the
b495
)of the host
a.  The
>and
in the DOS
to the
>and
.  The
can be
din all Malmsey
 "[Malmsey Habitat v. 1.3]"
 "Warmest Regards to  RABID"
f-- ANARKICK SYSTEMS!"
 Malmsey
Nn't
to do
be permanently corrupted.
of Malmsey are:
 Malmsey 2: A later
of the Malmsey
vone .
pof 1,703 to 1,717
at the end of the
a.  The Malmsey 2
, adding an
1,712
t.  The
>and
in the DOS
not be
.  The
can be
din the
5in Malmsey 2
 "Malmsey Habitat v. 2.0"
 "Lucifer Messiah -- ANARKICK SYSTEMS 07-18-"
 "Hap   Birthday
:  Canada
 Malmsey 3 Beta: A later
of the Malmsey 2
is a
uof .
-and .
,.  It
at the top of
$the
 DOS
', hooking
{3 and 21.
 and
, as
qby the DOS
@by 2,048
, Malmsey 3 Beta
-and .
pof 806
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
may be
Lby the
 "Gotcha!
 [MALMSEY HABITAT v3.
 Lucifer Messiah -- ANARKICK SYSTEMS"
in the
:  Canada  March,
PZPAPN
Maltese Amoeba
:  Maltese Amoeba
 Irish, Maltese
:; flashing
&failure
 Malta
 Ireland
R:  2,504 - 2,564
5:   PRtA -
, NAV,
 The Maltese Amoeba
Gin Ireland in
.  Its
, however, is Malta.  At the
of its
 it was
t to be wide-spread
in Ireland.  The Maltese Amoeba
 is a
uof .
-and .
`.  It
 The
Maltese Amoeba is
 Maltese Amoeba
at the top of
$the
Aby 4,096
), and
|12's
!moved.  Maltese Amoeba
hook
, Maltese Amoeba
-and .
by 2,504 to 2,564
), the
 at the end of the
be no
3in the
>and
in the DOS
 The Maltese Amoeba is a destructive
on ATs on
 March 15 and
1.  On
>s, it
bfour
of cylinders 0 through 29 of the
Oand any
Os.
has completed over-
 writing the
"of the
b30 cylinders of
O, it
proceed to a bright, flashing
M, leaving the
in a loop.
is re
&ed, the
cpoem
L, followed by a
hang:
 "To see a world in a grain of sand,
 And a heaven in a flower
 Hold infinity in the palm of your hand
 And eternity in an hour.
 THE VIRUS 16/3/91".
S, so the
cannot be seen in
in the
 "AMOEBA
by the Hacker Twins (C)
is nothing, wait for the release of AMOEBA II -
 The universal
u,hidden to any eye by ours!
 Dedicated to the University of Malta-the worst
 educational
in the universe,and the destroyer
 of 5X2 years of human life".
in the
of the
has activated.
of Maltese Amoeba are:
 Maltese Amoeba-B: A minor
of the Maltese Amoeba
adds 2,504 to 2,571
 the .
-and .
at the end of the
a.  The
in the
, as well as the poem
 "AMOEBA
by the Hacker Twins (C)
is nothing, wait for the release of AMOEBA II
 The universal
u, hidden to any eye by ours!
 Dedicated to the University of Malta-
 the worst educational
in the universe,
 and the destroyer of 5X2 years of human life."
:  Malta
PZPAPN
Mannequin
:  Mannequin
; interference
printing
R:  778
5:   PRhA -
n, NAV,
.2.0+
 The Mannequin
.  Its
.  Mannequin is a
uof .
-and .
`.  It
Nnot
 The
Mannequin is
X, the
 Mannequin
at the top of
$the
, as
qby the DOS
@by 848
|12's
!moved.
{17 and 21
mby the Mannequin
the Mannequin
, it
 and .
pof 778
at the end of the
a.  The
>and
 in a DOS
.  Two
can be
in the
5in Mannequin
 "RQSP2"
Mannequin may
[difficults or
 interference
to print to the
printer.
PZPAPN
Manola
:  Manola
 Spain
R:  957
5:   PRhC -
/, NAV,
 The Manola
fSpain.  It is
uof .
, but not
 The
the Manola
 the Manola
at the top of
$the
|12's
!moved.
, as
qby the DOS
 by 976
mby the Manola
 At the
of becoming
, the Manola
 check to see if the
ctwo
r, and
wthem if
are not
 C:\DOS\FORMAT.
 C:\DOS\KEYB.
the Manola
, it
pof 957
 The
at the end of the
.  The
>and
in the DOS
 The
can be
in the
 all Manola
 "Soy un Manuel
de tipo C"
 "C:\DOS\FORMAT.
-C:\DOS\KEYB.
 "KEYBOARD.SYS"
 It is
if Manola
PZPAPN
Manta
:  Manta
i; AUTO
WC.BAT & CONFIG.SYS replaced;
fail to
R:  1,077
5:   PNCK -
, NAV,
 The Manta
.  Its
 Manta is a
uof .
,.  Manta is
on the VCS
Manta is
X, up to four .
`in the
Emay be
rby the Manta
ly, the
may be
L, and the
 AUTO
WC.BAT and CONFIG.SYS
OC: may be replaced:
 "RAM Parity
U@ 0F67:1B2C
 (C)ontinue  (S)hut off NMI  (R)e
 If C is entered for "Continue", the
most likely
 function
 A blank entry may
be created in the
Efor a
 512
Nnot always
the Manta
 1,077
), the
at the end of the
 The 512
replaced AUTO
WC.BAT and CONFIG.SYS on
9the
, and several lines of
in German.
 See:   VCS
PZPAPN
Marauder
:  Marauder
 Canada
R:  860
5:   PNAK -
n, NAV,
1.53S+,
 The Marauder
.  It is
fCanada.  Marauder is a
,.  It is destructive
^2nd of any year.
Marauder is
X, the Marauder
search the
Efor an
w.  If the Marauder
Nn't find a
win the
E, it
move up one level in the
Estructure and check for an
 If it still hasn't
a, it
continue
 searching upward in the
Estructure.  If the root
 is r
Qed, it
search down through the
 structure for a candi
a candi
d, the
wit and the
 Marauder
pof 860
at the end of the
be no
3to the
>and
 DOS
 Marauder is an
and no
in the
^2nd of any year, the Marauder
activate.
>, the Marauder
`in the
repeated over and over again:
 "=  [Marauder]
Hellraiser - Phalcon/Skism."
 The
>and
 to the
>and
in the DOS
of Marauder are:
 DeadPool:
, DeadPool is a 560
of the Marauder
.  It
vone .
X.  If
Nnot exist in the
E, it
search one
E.  If an
is still
 not
d, it
jump to the
O's root
DeadPool
pof 560
at the end of the
 be no
3to the
>and
in the DOS
.  The
in the DeadPool
 "Deadpool by Phalcon/Skism"
 DeadPool
the 808th generation of
t, at
the word "Deadpool"
d on the
:  USA
 See:   Marl
PZPAPN
March 25th
:  March 25th
, 1994
 corrupts
KFAT & possibly
`on 3/25
R:  1,026 - 1,040
5:   PRhAK -
\2.10g+,
2.11a+,
2.58+,
V114+,
6.64+
V114+,
2.58+,
6.64+
 The March 25th
, 1994.  Its
is a
uof .
-and .
,.  It is
 destructive
on March 25th of any year.
bMarch 25th
at the top of
 but
$the
', hooking
|21.
 and
, as
qby the DOS
@by 1,056
|12's
 be moved.
, the March 25th
-and .
on the
.  It
,on the
 of 1,026 to 1,040
at the end of
 the
a.  The
>and
in the DOS
not be
.  No
in the
 The March 25th
 on March 25th of any year.  At
, the
 the
.  It may
corrupt
-and .
PZPAPN
Mardi Bros
:  Mardi Bros
 BSC; volume label
 France
R:  N/A
5:   FR - Floppy
\, NAV,
:  CleanUp, M-
K, or DOS SYS
 The Mardi Bros
in France.
is a
uof floppy
Nnot
the Mardi
 Bros
, the
.  It
 resides in 7,168
the top of
, but
$the
 DOS
'. The
can be seen
 using the DOS
6, or several
mapping
 utilities.
 Mardi Bros
wany non-write protected
 exposed to the
Ican be easily identified
volume label
1to "Mardi Bros".  The
show the
cfor the
J's Volume label
 "Volume Mardi Bros created ira 0, 1980 12:00a"
 While the
on the
lthe DOS
still remaining, it
include the
cphrase
 near the end:
 "Sudah ada vaksin"
 It is
if Mardi Bros is destructive, it
s to do
 nothing but spread.
 Mardi Bros can be removed
bpowering
 off the
and re
&ing
clean write protected DOS
J.  The DOS SYS
6should
be used to
 replace the
.  Alternately, M
 can be used
cthe power-down and re
PZPAPN
Mark II
:  Mark II
 Mark ][
R:  350 - 351
5:   PNCK -
8/93S+,
n1.04+,
2.58+,
6.64+, NAV 3.0A06+,
2.58+,
.2.0+,
1.25+,
6.64+,
1.0A06+
 The Mark II, or Mark ][,
.  Its
.  Mark II is a
uof .
the Mark II
wone .
in the
by 350 to 351
 the
at the end of the
a.  The
 and
in the DOS
 to the
>and
.  The
can be
in the
5in all
 Mark II
 Mark II
Nn't
to do
PZPAPN
:  Marl
R:  560
5:   PNCK -
D:  NAV,
1.53S+,
 The Marl
.  Its
~, is
.  Marl is a
uof .
the Marl
X, the Marl
search the
Eand
wthe
it finds.  If
E, it may
the Marl
pof 560
).  The
at the end of
 the
.  The
>and
in the DOS
not be
.  No
in the
 Marl
Nnot
to do
, and is an
 earlier
of the Marauder
 See:   Marauder
PZPAPN
Marzia
:  Marzia
i; MBR (
=seconds = "62";
:; DOS
 Pisa, Italy
R:  2,048
5:   PRhAKX -
W, & MBR
2.58+,
6.64+,
2.58+,
6.64+,
1.25+
`and repair MBR
 The Marzia
}in Pisa, Italy in
.  Marzia
 is a
, multi-partite
-and .
,, as well as the
&record (
bMarzia
X, the Marzia
at the top of
 the
', hooking
|21.
, as
qby the DOS
@by 3,072
|12's
not be
 moved.
, the
wthe
&record (
) if it was not
the Marzia
, it
pof 2,048
be hidden
.  The
at the end of
 The
>and
in the DOS
 not
to be
the seconds field
 set to "62".  The
can be
in the
5in all
 "MARZIA"
 "MARZIA3"
 The Marzia
Nnot
wvery small .
8destructive
&record
2 hours
 becoming
s of
may notice
the DOS
indicate
Ton all
PZPAPN
Matura
:  Matura
i; unexpected accesses to C:
R:  549
5:   PNCK -
3.96+, NAV 3.0+,
 The Matura
.  Its
.  Matura is a
uof .
the Matura
X, the
 Matura
wone .
on the
 and one
on the C:
pof 549
 the end of the
a.  The
>and
in the DOS
not be
.  The
 can be
din all Matura
 "c:*.com"
 It is
what Matura
, but it
destructive
of Matura are:
 Matura 92:
on the Matura
 is a
.  It
 at the top of
$the
', taking up 1,776
), and hooking
 21.
, it
-and .
the exception of
by 1,626 to 1,641
at the end of the
a.  In the case of
is no
as the
s a portion of the hex "00" slack area.
3in the DOS
>and
s on
`.  The
 are
in the
5in all
 "exe
-MAND"
 "MATURA92"
PZPAPN
:  Max
 BSC,
 Buenos Aires, Argentina
R:  N/A
5:   BRX -
, NAV,
/2.0+,
2.58+
 The Max
}in Buenos Aires, Argentina in
 Max is a
and the
).  It is destructive
 The
 Max
, the Max
at the top of
$the
, as
qby the DOS
@by 2,048
, the Max
wthe
is too
 large to fit entirely
in the
, so the extra
 portion of the
be written to Side 0, Cylinder 0,
2.  The
dat Side 0,
 Cylinder 0,
the Max
, it
wthe
of any non-write protected
is accessed on the
.  On 360K 5.25"
I, the extra portion of the
5and the
of the
be written
 to the last two
of the
 The Max
on what would
to a
as a random
 basis.
, it
s the
fthe
PZPAPN
Max.347
:  Max.347
, 1994
&Record
R:  347
5:   PRtXCK -
V116+,
\2.13+,
V116+
`& F-
K/MBR on DOS 5.0+
 The Max.347
, 1994.  Its
.  Max.347 is a
 multi-partite
vthe
) and .
bMax.347
wthe
, moving the
to Side 0, Cylinder 0,
2.  The
 not
residence
fthe
 Max.347
at the top of
, but
 the
', moving
|12's
 and
, as
qby the DOS
@by 1,024
 the
Max.347 is
, it
 of 347
at the end of the
 The
>and
in the DOS
 not be
.  The
in the
 "[Max]"
PZPAPN
Mayak
:  Mayak
 Jews2
-, .SYS, & .
slowdown; TSR;
R:  2,339
5:   PRsAK -
W, & .SYS
3.96+,
, NAV 3.0A06+,
 The Mayak
.  Its
.  Mayak is a
W, and .SYS
.  It employs
techniques to
 avoid detection.
bMayak
-or .
 the Mayak
check .SYS
`referenced in the C:
 CONFIG.SYS
a, and
.SYS
it completes
`, it
not be
, and
 The next
fthe C:
O, the Mayak
fthe
r.SYS
 referenced in the C:
OCONFIG.SYS
a.  The
in the Config area of
 allocating
2,464
 by Mayak.
the Mayak
, it
pof 2,339
at the end of the
a.  The
p, however,
not be
Mayak is
 The
can be
din the
5in all
 Mayak
 "Jews-2
. MSU
 "c:\config.sys device"
 ".com.exe.bin.sys"
s of
the Mayak
may notice
is running slower, and
 the
of Mayak are:
 Mayak-2370: Mayak-2370 is a 2,370
of the Mayak
 or Jews2
.  Its
2,720
), hooking
X, adding
 2,370
 Mayak-2370 may
accessing the
Os, "
Uin exe
, and
 are
PZPAPN
Mayberry
:  Mayberry
G:  May, 1994
i; DOS
 Sweden
R:  402 - 828
), depending on
present
5:   PNRhtAK -
-and/or .
\2.13+,
V117+,
V117+
 The Mayberry
is actually a group of eleven
fSweden in May, 1994.  The
group or
the exception of one, refer to
4in the 1960's
 television
"The Andy Griffith Show".  The exception
 refers to the character Jethro,
is not
television
of the Mayberry
es are
us of
, either .
W, or both, while
 are
us.  Two of the
es in the
]are fast
$is a brief description of the Mayberry
es.
 don't
to do
member(s) of the Mayberry
]are:
 Mayberry.402: Mayberry.402 is a 402
uof .
,.  It
vup to two .
pof 402
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[BW] Velmalou (c) by HypoDermic!! Part of the Mayberry
]!!!"
:  Sweden  May, 1994.
 Mayberry.409: Mayberry.409 is a 409
, but not
,.  It
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 1,024
, it
pof 409
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the
 "[BW] OPY (c) by HypoDermic!! Part of the Mayberry
]!!!"
:  Sweden  May, 1994.
 Mayberry.475: Mayberry.475 is a 475
uof .
,.  It
vup to three .
pof 475
 the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[BW] Jethro (c) by HypoDermic! Part of the Mayberry
]! (Huh!"
:  Sweden  May, 1994.
 Mayberry.496: Mayberry.496 is a 496
uof .
,.  It
vone .
 of 496
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[BW] Barney (c) by HypoDermic!! Part of the Mayberry
]!!!"
:  Sweden  May, 1994.
 Mayberry.502: Mayberry.502 is a 502
uof .
.  It
vtwo .
pof 502
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[BW] Floyd (c) by HypoDermic!! Part of the Mayberry
]!!!"
:  Sweden  May, 1994.
 Mayberry.609: Mayberry.609 is a 609
-and .
, but not
,.  It
at the top of
 the
', hooking
{21 and 24.
, as
qby the
 DOS
@by 1,024
, it
-and .
 of 609
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[BW] ANDY (c) by HypoDermic!! Part of the Mayberry
]!!!"
:  Sweden  May, 1994.
 Mayberry.687: Mayberry.687 is a 687
uof .
-and .
, but not
,.  It
vone .
-or .
pof 687
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
 "[BW] GoMer (c) by HypoDermic!! Part of the Mayberry
]!!!"
 "*.*"
:  Sweden  May, 1994.
 Mayberry.732: Mayberry.732 is a 732
uof .
-and .
,.  It
vup to three .
-or .
pof 732
at the end of the
a.  The
in the DOS
not be
 The
in the
 "[BW] AuntB (c) by HypoDermic!! Part of the Mayberry
]!!!"
 "*.*"
:  Sweden  May, 1994.
 Mayberry.747: Mayberry.747 is a 747
uof .
-and .
,.  It
vall of the .
-or .
 in the
pof 747
at the end of the
 The
>and
in the DOS
not be
.  The
in the
 "[BW] Otis (c) by HypoDermic!! Part of the Mayberry
 "*.* .."
:  Sweden  May, 1994.
 Mayberry.758: Mayberry.758 is a 758
-and .
, but not
,.  It
at the top of
 but
$the
', hooking
|21, and
 moving
|12's
, as
qby the DOS
@by 1,024
, it
, but not on
 copy.
 of 758
at the end of the
be hidden
.  The
>and
in the
 DOS
to be
the seconds field
!set to "08".  The
in the
 "[BW] Miss Crump (c) by HypoDermic!! Part of the Mayberry
]!!!"
:  Sweden  May, 1994.
 Mayberry.828: Mayberry.828 is a 828
-and .
, but not
,.  It
at the top of
 but
$the
', hooking
|21.
, as
qby the
 DOS
@by 2,048
, it
-and .
 of 828
at the end of the
be hidden
.  The
>and
in the
 DOS
to be
the seconds field
!set to "44".  The
in the
 "[BW] Goober (c) by HypoDermic!! Part of the Mayberry
]!!!"
Mayberry.828 may
 DOS
detecting
Ton all
:  Sweden  May, 1994.
 Mayberry.Dementia: Mayberry.Dementia is a 1,027
uof .
-and .
,.  It
vone .
-or .
pof 1,027
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the
 "[BW] [DP/4] Dementia Praecox  MnemoniX '94"
 "*.*"
:  Sweden
, 1994.
PZPAPN
Medical
:  Medical
&failure;
Zfailure
 Republic of South Africa
R:  189
5:   PNCK -
 NAV 3.0+,
n1.05+,
8/93+,
.2.0+
 The Medical
.  It is
fthe Republic of South Africa.  Medical is a
uof .
the Medical
X, the
attempt to
wone .
in the
E.  The
tattempt is not always successful, and
in a corrupted
a.  Both corrupted and
pof 189
).  On
, the
at the
 end of the
a.  Corrupted
to the end of the
a.  The
>and
in the
 DOS
 "0-00-80 12:00:00", and as a
, the
>and
 not
in the DOS
the Medical
not function
has attempted to
wone
ain the
E, the
either be
ed to
 the DOS prompt or a
hang may
ror corrupted
in a
hang.
PZPAPN
Meditation
:  Meditation
 Guru
R:  299
5:   PNCK -
3.96+, NAV 3.0+,
.2.0+
 The Meditation
.  Its
.  Meditation is a
uof .
the Meditation
X, the
 Meditation
wall of the .
in the
pof 299
at the
 of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all Meditation
 "Software Failure. Task Held.
 Guru Meditation #456789:#34567
 It is
what Meditation
of Mediation are:
 Meditation-B:
to the
Meditation
has one
differs.
PZPAPN
Lapse
Lapse
Lapse-323
R:  323
5:   PNC -
2.58+,
6.64+,
2.58+,
6.64+,
1.25+
 The
Lapse, or
Lapse-323,
.  Its
 Lapse is a
uof .
 but not
Lapse
wthree .
in the
 323
at the end of the
a.  The
>and
in the DOS
.  The
in the
5in all
Lapse
 "*ML.C?M
-MAND."
Lapse.323A (05/28/93)"
 "Copyright (c)
Lapse"
 It is
what
Lapse may do
Lapse are:
Lapse-375: A later
of the
Lapse
vthree .
pof 375
at the end of the
a.  The
in the
5and are not
 "*ML.C?M
-MAND."
Lapse.375A (05/29/93)"
 "Copyright (c)
Lapse"
 See:   Chromo 1.0
PZPAPN
Mercenary
:  Mercenary
R:  854
5:   PRhCK -
V108+,
3.96+,
, NAV 3.0+,
6.64+,
\2.13+,
1.25+,
6.64+
 The Mercenary
.  Its
.  Mercenary is a
uof .
bMercenary
at the top of
 but
$the
', not moving
|12's
, as
qby the DOS
@by 7,040
mby Mercenary in
the Mercenary
, it
pof 854
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the Mercenary
5, and are
 not
 "Mercenry Virii V.1 written by Lupus Yonderboy"
 "Greets to all of Phalcon / Skism (who don't know i exist)"
 "Welcome to the wonderful world of VIRII"
 "You are now in possession of the Mercenry Virii."
 "By Lupus Yonderboy"
 "Chaos Mr. Who."
is our mode and modus"
 "Hail to the Succubi"
PZPAPN
Merry Xmas
:  Merry Xmas
i; TSR; "Silent Night" played &
R:  1,694 - 1,708
5:   PRsE -
, NAV 3.0+,
n1.04+,
6.64+,
1.53+,
8/93+,
.2.0+,
1.25+,
6.64+
 The Merry Xmas
.  Its
.  Merry Xmas is a
uof .
.  It plays music during the Christmas
 season.
bMerry Xmas
X, the Merry
 Xmas
as a low
TSR of 2,016
{21 and 63
 the
the Merry Xmas
, it
pof 1,694 to 1,708
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
can be
in the Merry Xmas
5in all
 "Merry Christmas and happy new year !
 Written
fTamsui Oxford College."
 During the Christmas season, the Merry Xmas
' TSR
 2,000
, and hook
{08, 21, and 63.  It
 play "Silent Night" on the
speaker, and
Mthe
as a
 for a few minutes.  A
hang
PZPAPN
Meta-2048
:  Meta-2048
G:  May,
i; DOS
R:  2,048
5:   PRhAK -
8/93+
 The Meta-2048
in May,
.  Its
.  Meta-2048 is a
uof .
-and .
larger
bMeta-2048
at the top of
$the
', hooking
{09, 1C,
 and 21.
, as
qby the
 DOS
@by 8,336
 12's
not be moved.
the Meta-2048
, it
 and .
larger
2K in
 are
 2,048
).  The
at the
"of .
, and the end of .
`.  The
 be hidden on
were
became
, but not on those
were
rbefore the
 became
the last
.  The
in the DOS
not be
.  The
in the Meta-2048
 "Producte"
 "Mr. Watshira Sae-eu KMIT-NB
>12/28/
BIOS"
 "BIOS"
the Meta-2048
find
the DOS
of the
.  The
interfer
 input.
PZPAPN
Metallica II
:  Metallica II
fail to function;
R:  1,129 - 1,143
5:   PRtA -
2.58+,
2.58+
 The Metallica II
, and
 to be
fthe
.  Metallica II is a
-and .
, but not
bMetallica II
at the top of
$the
', moving
|12's
to 9F80.
, as
qby the DOS
2K.
mby Metallica II in
, the Metallica II
-and .
by 1,129
)while .
by 1,129 to 1,143
).  In both cases, the
at the end of the
a.  The
>and
in the
 DOS
, but usually not to the
>and
.  The
can be
in the
5in all Metallica II
 "Metallica Ver 2.0"
 "AIDS
-MAND"
 "(c)
Moscow 92"
[frequent
fwrite protected
not function
PZPAPN
Mexican Mud
:  Mexican Mud
seconds = 62
 Sweden
R:  575
5:   PRaCK -
, NAV 3.0+,
8/93+,
1.53S+,
.2.0+
 The Mexican Mud
.  While
it can be assumed to be
fMexico, it is believed to
 actually
!written in Sweden.  Mexican Mud is a
uof .
,.  It is
on the
 The
Mexican Mud is
, hooking
|21.
, as
qby the DOS
not be
the Mexican Mud
, it
X.  If
X, it
the Mexican Mud
pof 575
at the end of the
a.  The
>and
 the DOS
to be
 the seconds field in the
!set to 62.
the Mexican Mud
[frequent
 inadvertantly
by an
 See:
PZPAPN
:  MG
i; DIR
6may not function
R:  500
5:   PRCK -
, NAV,
 The MG
it has
 mentioned by
(n researchers several
s since
d MG as it was
 Matematicheska Gimnazia, a school in Varna,
(.  It is a
uof .
 The
MG is
X, the
in a portion of the
|24 is
mby the
, as are
 several
MG is
, it
one of
 two things
s: either the
Yany
 or a DIR
6is performed.  In the case of a
X, the
wone
in the
not necessarily the
 a DIR
X, one
in the
ras well.
by 500
not be
in a DIR
if the
>and
in the
Eare
.  The
 the end of
of a MG
tare
the DOS
 show
Ton all
if the
is present in
.  The DOS DIR
6may
 function
, for example DIR A:*.
yield "
d" even
`exist on the A:
O.  At
s, pauses
in the
 the DIR
6.  An
symptom is
unexpected
 may
due to the
of MG are:
 MG-2: MG-2 is a
,.  It is very
 to the MG
it is
MG-2
@by 55,104
).  MG-2 remaps many
|24, and may allocate
it is
, it
in the
by 500
not be
if the
.  The
at the end of the
 MG-3:
to MG-2,
to avoid detection.  It is
 MG-3B:
to MG-3,
 video card
a "hook" left in low
3at all
.  MG-3B be
ls as both a
 and in
u.  .
X, as well as
sone
in the
in the
a DIR
6is issued.
PZPAPN
:  MGTU
i; excessive
Kactivity;
-Path not
R:  273
5:   PNCK -
\, NAV,
 The MGTU
and came
is a
uof .
the MGTU
X, the
search the
Oand
Efor
. All
 the
 of 273
at the end of the
>and
in the
to the
>and
Mexcessive
Kactivity
activity
s because the
is checking all of the .
in the
 to determine if
are already
r, or if
need to be
[the
cannot see
 line parameters
#passed to them,
-having
 replaced the
parameters:
-Path not
 MGTU
Nnot do
PZPAPN
Mich II
:  Mich II
 Michelangelo II
i; TSR; beeping,
R:  924
5:   PRsC -
\2.13+,
1.25+
 The Mich II
, and is
.  Mich II is a
uof .
, but not
,.  Its
is derived
in the
Lon Marth 6th of any
 year.
bMich II
as a low
 of 1,488
).  It
{21 and 2F.
, the
Mthe
 "Bad
, Mich II
wone .
ain the
 target
a DOS DIR
6is issued.
pof 924
at the
"of the
a.  The
>and
in the DOS
not be
.  The
in the
 Mich II
 "It is March 6th,
for MICHELANGELO ][ to trigger."
 "YES! An
one.
is brought to you by:"
 "CRYPT KEEPER. HAVE PHUN"
,IBMBIO.
-IBMDOS.
 "Bad
 On March 6th of any year,
out Mich II
, the
bthree lines of
Las a
on the
is accompanied by beeping, and a
hang
PZPAPN
Michelangelo
:  Michelangelo
Edamage;
Kformat;
 Sweden or the
R:  N/A
5:   BRtX -
Floppy
, NAV,
:  CleanUp,
\or M-
 The Michelangelo
breported in
in Sweden
 and the
.  The
busable sample of
 actually
.  Michelangelo is a
and the
).  It is roughly
on the
very different in its behavior.
 The Michelangelo
is attempted to be
a Michelangelo
 Regardless of whether
&is successful, Michelangelo
 measured by the DOS
typically
 2,048
).  Michelangelo
at the top of
$the
|12's
 be moved to insure
Michelangelo in
is not
Michaelangelo is
, it
are accessed.  It
wthe
to access a
aon the
 On 360K 5.25"
I, the
be moved by
 the
11, the last
in the root
E.  On
 1.2M 5.25"
I, the
be re
28, part of the root
E.  Since the
now resides in the root
E, any entries
happened
 to be in the
of the root
be lost.
in the
having
!moved to Side 0, Cylinder 0,
7 on the
 Michelangelo
on March 6, at
format the
random
 See:
PZPAPN
Micro 128
:  Micro 128
-128, M-128
R:  128
5:   PRCK -
, NAV,
 The Micro 128
.  Its
.  Micro 128 is a
uof .
,.  It uses
techniques
 to the
 The
Micro 128 is
in a "hole in
in the
|area.
 by the
be no
, Micro 128
pd in
by 128
).  The
 at the end of the
>and
in the
to the
>and
 Micro 128
Nnot do
 See:
PZPAPN
Microbes
:  Microbes
 Bombay, India
R:  N/A
5:   BR - Floppy
\, NAV,
:  M-
K, or DOS SYS
 The Microbes
in India.  It is a
 The Microbes
the Microbes
.  The
may hang
&, and inserting a
Jbecoming
r.  At least on the author's XT
 test
, the
could not successfully
 Microbes
present
out powering off the
&ing
fa write protected
us, Microbes can be dis
Iby powering off the
&ing
-clean, write-protected
Jfor the
 The DOS SYS
6can
be used to recreate the
 on the
J.  For non-
data
I, the
 data
`on the
rdata
Jcan be copied
the DOS
 COPY
6to a non-
J, and
Jreformatted.
PZPAPN
Micropox
:  Micropox
; corrupts
R:  4,928
5:   PRhA -
, NAV,
 The Micropox
.  It was
}in the
.  Micropox is a
uof .
-and .
, it
Nnot
 It is destructive
 The
the Micropox
X, the Micropox
 at the top of
$the
', not
 moving
|12's
, as
qby the DOS
 by 4,944
{1C and 21
mby the
 One .
-and one .
in the
rby the
the Micropox
, it
pof 4,928
).  The
 at the end of the
.  The
>and
in the DOS
not be
.  No
in the
 The Micropox
in the
 month of March.  During the month of March,
Zof the
is not already
in the
PZPAPN
:  Miky
i; TSR; lost cluster;
rotation and
 Bolivia
R:  2,350
5:   PRsA -
\, NAV,
 The Miky
.  It
ated in
 Bolivia.  Miky is a
uof .
-and .
 and
 The
Miky is
X, Miky
as a low
TSR of 2,096
{16, 21, and 80
mby the
, Miky
-and .
 are
X, but not
,.  .
by 2,350
at the
`.  .
 2,350 to 2,364
at the end of
be no
3in the
>and
in the DOS
 Miky
on a random basis
input has
.  Upon
, it
rotate the
 the right,
4or graphics re
ing around the
 left hand side, and down one line.
a full rotation has
, the
be centered on the
 "MIKY 786290 B
livia"
cannot be seen in
`as the
Miky
notice a much higher
 normal number of lost clusters
#detected by the DOS
.  One lost cluster
 by Miky.
of Miky are:
 Miky-2390:
in May,
, Miky-2390 is a slightly
 larger
of the Miky
.  Its in
 TSR is 2,144
.  It adds 2,390
 the .
v, and 2,390 to 2,404
 to the .
v.  The
 two
can be
in the
 in Miky-2390
,symbolic M"
 "inOUTRUN E"
 May,
PZPAPN
Milano
:  Milano
 Italy
R:  2,078
5:   PRhE -
2.58+,
2.11+,
\2.13+,
6.64+,
V106+,
2.58+,
6.64+
 The Milano
, and is
fItaly.  Milano is a
uof .
Nnot
wvery small .
bMilano
at the top of
 the
', not moving
|12's
, as
qby the DOS
@by 4,160
{21 and 28
mby the
the Milano
, it
pof 2,078
at the
 end of the
a.  The
>and
in the DOS
to the
 and
.  No
in the
 It is
what Milano
PZPAPN
Milena
:  Milena
G:  May,
R:  1,160
5:   PRhAK -
, NAV,
8/93+,
 The Milena
in May,
.  Its
.  Milena is a
uof .
 and .
bMilena
X, the Milena
at the top of
$the
|12's
not be
 moved.
, as
qby the
 DOS
@by 1,184
mby Milena in
, the
 Milena
,if it was not
the Milena
, it
the Milena
pof 1,160
at the end of the
a.  The
>and
in the DOS
.  The
can be
in the
5in Milena
 "LOVE"
 "I Love Milena..."
 It is
if Milena
PZPAPN
Mindless
:  Mindless
:; data
R:  423
5:   ONCK -
8/93+,
1.25+
 The Mindless
.  It is
fthe
.  The Mindless
is a
the Mindless
X, the
 Mindless
wall of the .
in the
lthe
b423
)of the
 host
5.  The
unless it was
smaller
case it
 423
.  The
 and
in the DOS
not be
.  The
in the
5in Mindless
 "*.c*"
 On Sundays, the Mindless
X.  At
, it
trash the
Oand the
and the
"of the
O.  The
can be
din the
 on the trashed
 "[Youngsters Against McAffee] -NATAS KAUPAS"
 "The Mindless
v1.0"
in the
5so it is not
 The Mindless
corrupt data
 extension starting
"C",
sthem as
PZPAPN
MindRiot
:  MindRiot
R:  814
5:   ONE -
8/93S+, NAV 3.0+,
.2.0+
 The MindRiot
.  Its
.  MindRiot is a
the MindRiot
X, the
 MindRiot
check to see if
Eis a root
 If it is, the
, and the
ed to the DOS prompt.  If the
Eis not the
O's root
E, the
wone .
 in the
the MindRiot
lthe
)of the host
by the MindRiot
 The
unless
were
 smaller
), in
case
 814
.  The
>and
in the DOS
not be
.  The
in the MindRiot
 "* *.
W*.* \"
 "If You Think You Saw A Part Of Your Source
 You're Probably Right!"
Making
I Used Pieces
Sources...
 heheh...What Can I Say?"
 "I'm A Pirate At Heart!"
 "Lithium Chloride"
the MindRiot
are permanently corrupted,
 and should be replaced
clean,
copies.
of MindRiot are:
 MindRiot-B:
, MindRiot-B is a 907
of the MindRiot
.  It over-
 writes the
b907
)of host .
`.  The
in the
 "* *.
W*.* \"
 "YAM 92 -Mind Riot Strain B- LiCl"
 "The Mind Riot - Strain B -LiCl"
 "-YAM '92"
 "Howrya: Mr. M, Nap, N.S, S.M, Displ, Lov, Otto, A.B, K.P"
 "Whatsup: RABID, SKISM, SAC, CPI, Etc, Etc."
 "Middle Finger To: McAffee"
 MindRiot-B
in a sub
 on the
jmay
PZPAPN
Mini-45
:  Mini-45
 Dust, Minimal, Short-45, Mini-35, Mini-44, Mini-46, Mini-97,
 Mini-99, Mini, Trivial
R:  45
5:   ONCK -
, NAV 3.0+,
8/93+,
.2.0+
 The Mini-45
.  It is
is a
Mini-45 is
X, the
wall .
in the
 the
)of the
5.  No
be noticed, unless the
was less
, in
case it
now be 45
. The .
>and
in the
to the
>and
 All .
Mini-45
fail to function
be permanently
 damaged since the
)are lost.
of Mini-45 are:
 Dust: Dust is a 50
of the
Mini-45
s the
)of all .
 the
 The
>and
in the DOS
to the
>and
 Mini-35: Mini-35 is a 35
of the
Mini-45
.  Mini-35
)of the
in the
X.  The
>and
 in the DOS
 Mini-44: Mini-44 is a 44
of the
Mini-45
.  It
)of all .
in the
X.  The
>and
in the DOS
to the
 Mini-46: Mini-46 is a 46
of the
Mini-45
the difference in
, the
 functions
ly to the Mini-45
 Mini-97: Mini-97 is a larger
of the Mini-45
 particular
was the smallest
 the
of its submission in
.  Mini-97
vall .
`in the
do not
 start
a JMP (E9h) instruction,
by 97
 the
"of the
a.  The
>and
 in the DOS
:  The
 Mini-99: Probably an earlier
of Mini-97,
vall .
`in the
by 99
), and
lhad
>and
in the DOS
to the
>and
.  The
 the end of
:  The
 See:   Banana   Blood Lust   Define   Dutch
PZPAPN
MiniMax
:  MiniMax
R:  Up to 31,125
5:   PNC -
3.96+, NAV 3.0+,
1.25+
 The MiniMax
, and
fthe
.  MiniMax is a
uof .
the MiniMax
X, the
 MiniMax
wone .
in the
E, and
the host
run.
the MiniMax
 31,125
at the
 end of the
a.  The actual MiniMax
5is quite small, and
 most of the
comprise hex C3
 The
>and
in the DOS
to the
>and
.  The
can be
in the
 "*.com"
 MiniMax
Nn't
to do
PZPAPN
Minimite
:  Minimite
G:  March,
2to 4-24-80 12:04a
R:  183
5:   PNCK -
, NAV 3.0+,
30.00+,
n1.04+,
6.60+,
6.64+,
1.25+
 The Minimite
in March,
.  Its
.  Minimite is a
the Minimite
X, the
 Minimite
wone .
in the
E, and
the host
run.
the Minimite
pof 183
at the
"of the
a.  The
>and
 in the DOS
 04-24-80 12:04a.  The
can be
 the
5in all Minimite
 "-C.K.-"
 Minimite
Nn't
to do
PZPAPN
Ministry
:  Ministry
R:  1,168
5:   PNC -
 NAV,
.2.0+
 The Ministry
.  Its
.  Ministry is a
.  It
Nnot
on the Beta
the Ministry
check the
bthree non-
in the
Eto determine if
r.  If the
aren't
r, it
wthem.
the Ministry
pof 1,168
at the end
 of the
.  The
>and
in the DOS
not be
 Ministry is an
, and
are no
in the
.  The
in the
 "ask!"
 "I'm Buring Inside!"
 "Breathe You Fucker!"
 "Jesus Built My Hotrod!"
 "Everyday is Halloween!"
 "The Ministry
- Written by NegativX - (c)
-SiTT-"
 It is
what Ministry
 See:   Beta   Elvis-1250
PZPAPN
Minsk Ghost
:  Minsk Ghost
>set to 13-07-82
R:  1,450 - 1,478
5:   PRhAK -
3.96+, NAV 3.0+,
8/93+,
.2.0+
 The Minsk Ghost
.  It is
fthe
.  Minsk Ghost is a
uof .
-and .
.  It employs
 techniques to hide
ts and spreads quickly on
 The
the Minsk Ghost
at the top of
$the
, as
qby the DOS
@by 1,536
 by the
, Minsk Ghost
,if it was not
the Minsk Ghost is
, it
for any reason.
pof 1,450 to
 1,478
at the end of the
 The Minsk Ghost may re
, adding
1,450
).  However, all but 3 to 31
)of the
be hidden by the
it is
.  The
>in the DOS
to 13-07-82.  The
in the
5in all Minsk Ghost
 "MINSK GHOST,
 It is
what Minsk Ghost may do
PZPAPN
Mirror
:  Mirror
; mirror effect
R:  927
5:   PRhE -
, NAV,
 The Mirror
uof .
 The
the Mirror
X, the
at the top
 928
), and the
hook
|21.  At
, the
wall
in the
by 927
 to 940
at the end of the
always end
the two
4"IH".
 The Mirror
gets its
fits behavior.  Every
 awhile it
3the
's video
a mirror
 image of what was
on the
PZPAPN
Mithrandir
:  Mithrandir
 Mithrandir I
 Sweden
R:  694
5:   PRhCK -
6.64+,
.2.0+,
6.64+,
1.25+
 The Mithrandir, or Mithrandir I,
, and is
fSweden.  Mithrandir is a
 of .
,.  A
at the same
, Mithrandir III-B,
is a companion
 or spawning
bMithrandir
X, the
 Mithrandir
at the top of
$the
', not moving
 12's
, as
 by the DOS
@by 1,952
mby the
the Mithrandir
, it
larger
2K in
 694
in the middle of the
a.  The
>and
in the DOS
.  The
in the
5in all Mithrandir
 "Mithrandir"
 "DeMoRaLiZeD YoUtH"
of Mithrandir are:
 Mithrandir III-B:
, Mithrandir III-B
 is a later
of the Mithrandir
 as well as the  LockUp
Cin an
entry.
 Mithrandir III-B's
is 1,472
), hooking
|21.
, it
 creating a corresponding or companion .
 same base
 companion
ais 450
8the actual
 Mithrandir III-B
5.  Its
>and
in the
 DOS
be 3-24-23 2:17:40am, and the hidden
 attribute
be set.  The
in the
 "Mithrandir III"
:  Sweden
 See:   LockUp
PZPAPN
:  Mix1
 MIX1, MIX/1
, 1989
 TSR; .
i; location 0:33C = 77h; garbled output
 Israel
R:  1,618 - 1,634
5:   PRsE -
, NAV,
\, or
 The Mix1
22, 1989, on
 several BBSes in Israel.
is a
X, the
take up 2,048
)in RAM.
grow in
between 1,618 and 1,634
), depending on the
.  The
 however,
`of less
8K in
`can be manually identified by a characteristic
 "MIX1" always
#the last 4
)of an
a. Using
 DEBUG, if
*0:33C equals 77h,
the Mix1
is in
cause garbled output on both serial and parallel
 devices, as well as the Num-Lock
#constantly on.
 6th
&ing the
crash the
due to a
 bug in the
5, and a ball
start bouncing on the
 monitor.
is a
Nnot
lthe problem of
crashes
ring, and
 greater
16K in
 Mix1 has several
ities to Icelandic,
it may
!derived
of Mix1 are:
 Mix1-B: A 1,636
of the Mix1
, Mix1-B or
 Mix1-1636 adds 1,636 to 1,650
)to the .
v.  The
"MIX1" can be
dat the end of
 all
 Snow:
to the Mix1
, the "MIX1"
at the end of
`is now "SNOW".  Snow
 is unable to determine
it has
 so .
be re
r.  Initial
tby the
pthe
by 1,618 - 1,632
at the end of the
add an
1,632
)to the
 See:   Icelandic   Mix2
PZPAPN
:  Mix2
G:  March,
 and
R:  2,287
5:   PRhA -
\, NAV,
 The Mix2
in March,
reports of
were
V.  Mix2 is
on the Mix1
, and is a
uof .
-and .
Nnot
Mix2 is
X, Mix2
at the top of
, but
$the
'.  It
mark
area of reserved
-MAND Data" and
hook
|21.
, as
qby the DOS
Aby 3,040
|12's
not be moved.
Mix2 is
, it
-and .
 over 9K in
by 2,287 to 2,294
at the end of the
Nnot alter
 the
>and
in the
intensive, or
allocate all
hang
Mix2
 It is
what Mix2
 See:   Mix1
PZPAPN
:  MMIR
 MMIR.Extasy
, 1994
 Sweden
R:  282
5:   PRCK -
V116+,
\2.13+,
2.58+,
n1.05+,
6.64+,
1.25+,
6.64+,
2.58+,
V116+
 The MMIR or MMIR.Extasy
, 1994, and is
fSweden.  It is a
uof .
bMMIR
in a hole in al
, generally
 a buffer area at
, it
the MMIR
 of 282
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 in all
 "EXTASY! (c) Metal Militia / Immortal Riot"
jfrequently
of MMIR are:
 MMIR.In
Evil:
on the MMIR
`, and is a
at the top of
 the
', not moving
|12's
, as
qby the DOS
@by 1,600
mby the
 769
be hidden
 the
.  The
>and
in the
 DOS
to be un
 the seconds field
!set to "02".  The
in the
 "Our past is our future!
 "[INVISIBLE EVIL!] (c) Metal Militia/Immortal Riot"
 "Dedicated to all the victims.."
 "Greets to B-real!/IR"
 "It's like
and like
and like
 "It's like
and like
and like
 "It's like
.. &"
 "Love to Lisa!"
 "All i ever wanted.."
 "All i ever asked for.."
, non-
by 769
)while
:  Sweden  May, 1994.
 MMIR.Moonlite:
on the MMIR
 458
.  It
as a low
TSR, hooking
{09 and 21.
X, the
check to see if all of the
`in the
Eare
r.  If
aren't,
wthem.  If
are, it
Bthe .
by 458
at the
 end of the
a.  The
>and
in the DOS
to be
, but the seconds
 field
!set to "42".  The
in the
 "Metallic Moonlite(c) Metalic Militia/Immortal Riot"
 "Greetings to The Unforgiven/IR"
 "Bad
 "*.com"
 In addition to deleting .
`, the
:  Sweden  May, 1994.
 MMIR.Ravage:
on the MMIR
`.  It uses the same technique
, it
by 392
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
in all
 "RAVAGE! (c) Metal Militia / Immortal Riot"
:  Sweden
, 1994.
PZPAPN
Moctezumas Revenge
:  Moctezumas Revenge
 Ciudado, Moctezumas, Moctezuma
i; TSR;
&failure
R:  2,208 - 2,228
5:   PRsAK -
n, NAV,
1.53S+,
 The Moctezumas Revenge
.  Its
.  Moctezumas
 Revenge is a
uof .
-and .
,.  It
 hidden DOS
.SYS
on the
 The
Moctezumas Revenge is
X, the
as a low
TSR of 2,336
).  It
hook
{13 and
Moctezumas Revenge is
, it
 and .
wthe hidden DOS
.SYS
 as well.
 Moctezumas Revenge
the exception of
pof 2,208 to 2,228
at the
"of the
a.  In the case of
,and the hidden .SYS
be no
p.  The
 and
not be
in the DOS
`can be identified by the two
4"92"
ing in
)8 and 9 of
`.  The Moctezumas
 Revenge
 "Moctezuma's Revenge92"
of a Moctezumas Revenge
tinclude
Tfor
,and possibly the hidden DOS
.SYS
`.  A
Umay
aas well, due to the
writing out a copy of
 to an
cluster
out checking to see if it was
 in use.
fail to
fthe
 It is
what Moctezumas Revenge
of Moctezumas Revenge are:
 Moctezumas Revenge 2: A later
of the
 Moctezumas Revenge
has had
&failures and
 no longer
,and the hidden
no longer be
rby the
.  Moctezumas
 Revenge 2 adds 2,228
)to .
, locating its
5at the
"of the
a.  On .
 it adds 2,208 to 2,222
)locating the
at the
 end of the
a.  The
 an un
Scopy of the
 the
: "Moctezuma's Revenge62".  The
tidentifier has
f92 to 62,
 in .
it is no longer
near the
 of the
asince the
is now at the end of
 the
 March,
 See:
  Poison
PZPAPN
Monika-686
:  Monika-686
 Monika
R:  686
5:   PRhCK -
6.60+,
2.58+,
2.11+,
\2.13+,
2.58+,
.2.0+,
1.25+
 The Monika-686
.  Its
.  Monika-686 is a
uof .
,.  It
wvery small .
bMonika-686
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 704
mby Monika-686 in
, the
,if it was not
the Monika-686
, it
pof 686
 the end of the
a.  The
>and
in the DOS
to the
 and
.  No
 the
5in Monika-686
 It is
what Monika-686
PZPAPN
Monkey
:  Monkey
 BSC;
; possible
 "Invalid
Ospecification" on C:
R:  N/A
5:   BRtX -
, NAV,
:  Norton
KDoctor on
K, DOS SYS on
 The Monkey
.  Monkey is a
uof the
) and the
I.  It is a
 hiding the
tof the
Kand
it is
 The
 Monkey
, the Monkey
wthe
, as
qby the DOS
@by 1,024
).  The
moves
|12's
 to 9FC0.  On the
K, the
write one
5at Side 0, Cylinder 0,
3, and
alter the
the Monkey
, it
wnon-write
 protected
are accessed on the
.  On 360K
 5.25"
I, the
write a
 11, the last
of the root
E, and
alter the
.  On 1.2M 5.25"
I, the
5is at
the last
of the root
E).  If
 entries were
in the
 the corresponding
 inaccessible.
 Monkey is a
, and cannot be detected on either the
it is
tis hampered further in
 be inaccessible
&ing the
fa clean write
 protected
ing in an "Invalid
 specification"
.  Norton
KDoctor can be used to remove
 the Monkey
fthe
Kby rebuilding the
.  The DOS SYS
6can be used to replace the
PZPAPN
:  Mono
 1063
i; TSR;
 Poland
R:  1,063
5:   PRsCK -
, NAV,
8/93+,
 The Mono, or 1063,
fPoland.  Mono is a
,.  It
not, however,
unless the
is running in monochrome 80x25 mode.
 The
Mono is
X, the
as a low
TSR of
 2,048
TSR may
6data by
mapping utilities.
mby the Mono
Mono is
, it
 are
Xif the
is in monochrome mode
an 80 column
 by 25 line
M.  If the
Mis set to
else, it
 not spread.
 Mono
pof 1,063
).  The
at the end of the
be no
3to the
>and
in a DOS
are no
in the
 Mono
`, but it is
PZPAPN
Month 4-6
:  Month 4-6
 Agi-plan
G:  1989?
i; TSR;
R:  1,536
5:   PRsCK -
, NAV,
 The Month 4-6 or Agiplan
 it has
!rumored to exist since 1989.  The
of the sample
.  Month 4-6 is a
bMonth 4-6
as a low
 TSR, hooking
{21 and 24.  Unless the
,, the
usually hang at
, receiving an
it cannot load the
 interpretor.
, Month 4-6
 are
 1,536
at the
"of the
a.  The
>and
not be
.  Two
can be
in the
 "load
 The Month 4-6
 between
1st and
30th of any year, hence its
.  At
, the
trash the
PZPAPN
Monxla
:  Monxla
jand/or re
 failures
 Hungary
R:  939
5:   PRfCK -
 NAV,
 The Monxla, or
 Hungary.
is a
the Monxla
X, the
check the
.  If the
;seconds is greater
32/100's of a second, the
za very small portion of
at the
 top of
$the
'.  The
 allocates 80
), and
hook
{20 and F2.  The F2
|is later used to determine if the
is in
 thus avoiding multiple
s.  The
 portion of the
is not used to
the Monxla
X, the
search for one
 between 3,840 and 64,000
w.  The
 searched
b, and
Fories along the
path.
satisfies the
 requirement, the
wit.  On
the 13th day
 of any month, the
add its
5to the end of the
 candi
a, increasing the
by 939
 On the 13th day of any month, the
.  The
 involves damaging the
on the
 seconds in the
.  At the
a, the
damage the
ain one of
 three ways.  If the
;seconds was greater
60/100's, 4
 HLTs followed by a random
be placed at the
 of the
r.  Later
X, it
 may perform rather strangely or be destructive.  It depends on what
 the random
|was.  If the
;seconds was greater
 30/100's, but less
60/100's, two INT 19 calls are placed at
 the
"of the
a. Later
X, it
attempt to perform a warm re
&preserving the
|vectors.
, however,
in a
hang if
 any
|between 00h and 1Ch was
m.  If the
;seconds was greater
00/100's but less
30/100's,
 an INT 20 call is placed at the
"of the
r, thus
ing in it immediately terminating
later
 See:   Monxla B
PZPAPN
Monxla B
:  Monxla B
 Hungary
R:  535
5:   PNCK -
\, NAV,
 The Monxla B
in Hungary.
is a
uof .
,.  Monxla B is a
of the
Monxla B is
X, the
 check the seconds portion of the
.  Depending on the
 value
d, either one .
in the
r, or one .
in the
 corrupted.
 If the seconds portion of the
is equal 0 or a multiple
 of 8, one .
in the
E, or on the
 path,
be corrupted by the
bfive
4of the
 selected .
1to the hex
: 004D004F4D,
 or " M OM" in
. Corrupted
p.  Later
corrupted
usually
in the
#hung, requiring a re
 If the seconds portion of the
was not 0 or a multiple
 of 8, a .
in the
 Monxla B. If no
exist in the
 neither corrupted or
r, the
follow the
 path to find a candi
by 535
), the
at the end of
.  The
1the seconds in the
in the
Eto 58 so
can later tell
 See:   Monxla
PZPAPN
Mordor.1110
:  Mordor.1110
 Mordor, Paola.1110
^, 1994
&Record on
:; disables VSAFE & VWATCH;
zed TSRs and/or
Ors may no longer function;
 SCSI
Os and
SCSI devices may be disabled;
 possible interference
video
R:  1,110
5:   PRshC -
-& MBR
\2.10g+,
2.11a+,
6.64+,
n1.05+,
6.64+,
1.25+
`and replace MBR
 The Mordor.1110
^, 1994.  Its
.  Mordor.1110 is a
uof the
&record (the
9ing the
) and .
 It is destructive
bMordor.1110
as a low
TSR of
 1,440
), hooking
|21.
, the
wthe
&record
if it was
 not
r.  Later,
&ing
fthe
in the
becoming
at the top of
$the
the Mordor.1110
, it
pof 1,110
).  The
encrypts the host
, as well as the
5, so its
 relative position
in the
aisn't important to a normal
.  The
>and
in the DOS
not be
.  The
MORDOR v1.0"
 "Escrito por AZRAEL"
 "Un Anillo para gobernarlos a todos."
 "Un Anillo para en contrarlos"
 "un Anillo para atraerlos a todos y atarlos en las tinieblas"
 "en la Tierra de Mordor donde se extienden las sombras"
 "dedicado a PAOLA HASBANI"
 "Saludos A MURDOCK, MALVINAS, PatoruzU, KOHNTARK y
 FIRECRAKER"
limpact the operation of the
.  It
5to disable the VSAFE and VWATCH
, and may
render disabled or useless
zed device
Ors or
.  It
may disable SCSI devices, such as
Ks, due to it
Or in
.  Video
Moutput may
be impacted by the
 Mordor.1110 has a two part
mechanism,
 event
Nnot need to
for the destructive second
 event to
.  On March 31st of any year, the
 the
9ed in the
.  On any day in
, the
b18 cylinders (tracks 0 - 17)
 of the
of Mordor.1110 are:
 Mordor.538:
, 1994, Mordor.538 is a
uof .
, but not
 Its
TSR is 864
), hooking
 21 and DA.
, it
pof 538
 at the
"of the
a.  The
>and
 in the DOS
not be
.  No
in the
, 1994.
PZPAPN
More-649
:  More-649
G:  March,
=seconds set to "60"
 England
R:  649
5:   PRhCK -
30.00+,
n1.05+,
1.25+
 The More-649
in March,
, and is
 England.  More-649 is a
fast
uof .
bMore-649
X, the More-649
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 2,048
{12's
!moved.
the More-649
, it
for any reason.
pof 649
at the end of the
a.  The
in the DOS
to be
the seconds field
!set to "60".  The
 More-649
is unable to determine
it has
a, so it
walready
 adding an
 The
in the More-649
 "OH NO NOT MORE ARCV."
 "[MoRE] ICE-9"
 It is
what More-649 may do
PZPAPN
Mosquito
:  Mosquito
 Fax
i; TSR; function keys fail to operate
 expanding
R:  1,028 - 1,040
5:   PRsE -
, NAV,
 The Mosquito
.  Its
 location of
H, is
.  Mosquito is a
uof .
Wand overlay
9the word "
" in the
 The
Mosquito is
X, Mosquito
as a low
TSR of 2,128
mby the
, Mosquito
and overlay
by 1,028 to 1,040
), the
at the end of the
the Mosquito
9the
"Mosquito".
Mosquito
[a gradual
as the
.  The
 gradual
s because Mosquito
allocate an
)of low
a.  Function
 keys may
fail to function
 It is
if Mosquito
of Mosquito are:
 Lamer:
on the Topo
$, Lamer is a
 later
.  Lamer's
 is 3,136
)and hooks
|21.  It
 and overlay
X, adding 1,542 -
 1,552
.  The
 the end of
`.  The
>and
 the DOS
not be
.  The
can be
in the
 "Lamer Exterminator II"
 "Copyright 07.12.91 by Genius"
in the
5are the
ctwo
 "FaX
 "Welcome"
 Pfish:
on the Topo
$, Pfish is a
 later
.  PFish's
 is 3,136
)and hooks
|21.  It
 and overlay
X, adding 1,542 -
 1,552
.  The
 the end of
`.  The
>and
 the DOS
not be
.  The
can be
in the
-SPEC=C:\DOS\
,PATH=C:\DOS;C:\WIN3;C:\;C:\TOPO;
 C:\UTILITY"
 "PROMPT=$p$g TEMP=C:\WIN3\TEMP"
 "C:\WORK\FISHVIRUS.
 "PFISHVIRUS"
:  Italy
 Topo:
on the Mosquito
, Topo is a
 later
.  Topo's
 is 3,136
)and hooks
|21.  It
 and overlay
X, adding 1,542 -
 1,552
.  The
 the end of
`.  The
>and
 the DOS
not be
.  The
can be
in the
-SPEC=C:\DOS\
,PATH=C:\DOS"
 "PHORSEFAX"
 Topo
Nnot intercept
T, so
on write protected
in write
 protect
PZPAPN
MPS 1.1
:  MPS 1.1
 MPS-OPC 1.1
 Poland
R:  469
5:   PNCK -
P, NAV 3.0+,
 The MPS 1.1
.  It is
fPoland.  MPS 1.1 is a
MPS 1.1 is
X, the
wall .
in the
E.  If
E, it
 well.
 MPS 1.1
 469
at the end of the
 The
>and
in the DOS
to the
>and
 The
can be
in the
 in MPS 1.1
 "MPS-OPC
v1.1 *.
 A symptom of an MPS 1.1
requiring
6line input may not function
ing unexpected
 It is
if MPS 1.1 carries any destructive potential.
 See:   MPS 3.1   MPS 3.2   MPS 4.01   MPS II-754
PZPAPN
MPS 3.1
:  MPS 3.1
 MPS-OPC 3.1
 Poland
R:  640
5:   PNCK -
/, NAV,
 The MPS 3.1
.  It is
fPoland.  MPS 3.1 is a
MPS 3.1 is
X, the
wall .
in the
E.  If
E, it
 well.
 MPS 3.1
 640
at the end of the
 The
>and
in the DOS
to the
>and
 The
can be
in the
 in MPS 3.1
 "MPS-OPC
v3.1"
 It is
if MPS 3.1 carries any destructive potential.
 See:   MPS 1.1   MPS 3.2   MPS 4.01   MPS II-754
PZPAPN
MPS 3.2
:  MPS 3.2
 MPS-OPC 3.2
 Poland
R:  654
5:   PNCK -
, NAV,
 The MPS 3.2
.  It is
fPoland.  MPS 3.2 is a
MPS 3.2 is
X, the
wall .
in the
E.  If
E, it
 well.
 MPS 3.2
 654
at the end of the
 The
>and
in the DOS
to the
>and
 The
can be
in the
 in MPS 3.2
 "MPS-OPC
v3.2"
 It is
if MPS 3.2 carries any destructive potential.
of MPS 3.2 are:
 MPS 3.2-B:
gequivalent to the
has one
differs.
 See:   MPS 1.1   MPS 3.1   MPS 4.01   MPS II-754
PZPAPN
MPS 4.01
:  MPS 4.01
 MPS-OPC 4.01, MPC
3; TSR
R:  684 - 698
5:   PRsE -
n, NAV,
1.53S+,
 The MPS 4.01
.  Its
it is likely to be
fPoland, like the
es.  MPS 4.01 is a
uof .
 The
MPS 4.01 is
as a low
 TSR of 992
mby MPS 4.01 in
MPS 4.01 is
, it
X.  Very small .
, however,
 not be
r, but
lhad 2 to 14
)adds to
.  MPS 4.01
pof 684 - 698
at the
 end of the
.  The
>and
in the DOS
to the
>and
9the
 "MPS-OPC v4.01"
 MPS 4.01
Nn't
to do
 See:   MPS 1.1   MPS 3.1   MPS 3.2   MPS II-754
PZPAPN
MPS II-754
:  MPS II-754
 MPS-OPC II
, 1994
3; TSR
R:  754 - 770
5:   PRsA -
2.11a+,
2.58+,
/2.1+,
\2.10g+,
n1.04+,
6.2+,
6.60+,
V114+,
2.58+,
6.64+,
1.25+,
V116+
 The MPS II-754
, 1994.  Its
it is likely to be
fPoland, like the
es.  MPS II-754 is a
uof .
-and .
, but not
 The
MPS II-754 is
as a low
 TSR of 1,072
{21 and 24
mby the
, it
-and .
 are
X.  Very small .
, however,
not be
r, but
lhad 2 to 16
)adds to
 MPS II-754
pof 754 to
 770
at the end of the
.  The
>and
in the DOS
to the
>and
.  No
in the
5in MPS II-754
 See:   MPS 1.1   MPS 3.1   MPS 3.2   MPS 4.01
PZPAPN
:  Mr
 Italy
R:  508
5:   PNCK -
3.96+, NAV 3.0+,
 The Mr
fItaly in
.  Mr
is a
uof .
the Mr
wone .
in the
E, it may
the Mr
pof 508
at the end of the
a.  The
>and
in the DOS
not be
.  The
can be
 the
5in all Mr
 "Mr.
Ver. 1.10"
 It is
what Mr.
PZPAPN
Mr. D
:  Mr. D
, but possibly Poland
R:  1,536 - 1,550
5:   PRhE -
30.00+,
n1.04+,
1.25+,
6.64+
 The Mr. D
.  Its
 but it could possibly be
fPoland as it
s to be a later
of the Mr. G
.  Mr. D is a
bMr. D
X, the Mr. D
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 1,552
{21 and 2F
mby Mr. D in
the Mr. D
, it
pof 1,536 to 1,550
at the end of the
a.  The
>and
in the
 DOS
to the
>and
.  The
in the
5in all Mr. D
 "Mr. D"
 See:   Mr. G
PZPAPN
Mr. G
:  Mr. G
 Poland
R:  253
5:   PNCK -
3.96+,
1.25+,
6.64+
 The Mr. G
, and
s to be
 Poland.  It is an earlier
of the Mr. D
.  Mr. G is a
uof .
the Mr. G
X, the Mr. G
wall of the .
in the
 253
at the end of the
a.  The
>and
in the DOS
to the
>and
 The
in the
5in all
 Mr. G
 "Mr. G"
 See:   Mr. D
PZPAPN
MShark
:  MShark
R:  373
5:   PNCK -
, NAV,
1.53S+,
.2.0+
 The MShark
.  Its
.  MShark is a
the MShark
X, the
 MShark
wall .
in the
E.  If
E, it
the MShark
pof 373
at the end of
 the
.  The
>and
in the DOS
to the
>and
.  The
can be
 all MShark
 "Mshark-S v1.0"
 MShark
Nn'd do
of MShark are:
 MShark-378:
, MShark-378 is a 378
of the MShark
.  It adds
 378
)to the .
9the
 the MShark-378
 "(C) Mshark-S v.1.0"
PZPAPN
:  MSJ
 Israel
R:  15,392
5:   PNA -
 NAV 3.0+,
1.25+
 The MSJ
, and is
fIsrael.  MSJ is a
-and .
, but not
the MSJ
X, the MSJ
wone .
-or .
on the C:
 15,392
at the
 the
lan .
aformat
t.  The
>and
in the DOS
to the
>and
.  The
can be
in the MSJ
5in all
 "exe"
 "comspec"
 "Insufficient
Kspace"
 "\*.exe"
 "\*.com"
 "c:\autoexec.bat"
 "NOHARD"
-SPEC"
 The
cis the
"of the very long
in the
5, un
in all
 "Do not worry
is designed to avoide making any damage to"
 "your
`. A
remover
be send to computer Magazines"
 "by
30th of oct
can suppy to coustomers."
is a demonstration of what a Palestinian Boy can do."
 The remainder of the
8a political statement.
PZPAPN
:  MSTU
 MSTU-531
R:  531 - 532
5:   PNAK -
\, NAV,
 The MSTU
.  Its
.  MSTU is a
 of .
-and .
MSTU is
X, the
 search the
Efor
-and .
 Any
in the
rby the
.  If
E, it
the MSTU
pof 532
).  .
MSTU
pof 531
).  In both cases, the
at the end of the
be no
3in the
>and
in a DOS
can be
in MSTU
`are:
was written in MSTU,
 "*.exe *.com"
 It is
if MSTU
of MSTU are:
 MSTU-551:
on the MSTU
adds 551
 to the .
v, and 554
)to .
v.  It
8the same
 as the
Zof .
MSTU-551 may
in a
hang.
 MSTU-1536: A later
of the MSTU
, MSTU-1536 is a
uof .
-and .
, but
 not
,.  Its
is 2,000
), and
at the top of
', hooking
|21.
, MSTU-1536
-and .
pof 1,536 to 1,550
at the end of the
a.  The
in the DOS
not be
 The
can be
in the
5in all MSTU-1536
 "OOT"
 "CAN"
 "OKI"
 "RBOGEMAND"
ly, all
ccharacter sequence: "
 May,
PZPAPN
Mugshot
:  Mugshot
 BSC;
&failures
 India
R:  N/A
5:   BR -
, NAV 3.0+,
/2.1+
:  DOS SYS on
 The Mugshot
.  It is
fIndia.  Mugshot is a
Jwhose
the Mugshot
, the Mugshot
.  At
, the
&process
usually
 fail.
replaces the
J, the newly
 inserted
rif it is not write
 protected.  The
still not complete.
 Mugshot
lthe
in the
5in the
 "Ref:vb. Greetings
fAnil Rao!(snap
graphics
prog is aimed at developping permanent vaccines
is harmless it
Nnt destroy data.,
 affects
a:,b:
Os.For info. contact
 Anil Rao.
 Bombay, India."
 The Mugshot
lmoved the
to an
 location on the
K, where it
be immediately followed by
 several
include the
 "For every vaccine
is a
 ".Do no pla"
 Mugshot is a poor replicator, we were unable to successfully
&the
fany
we were
 able to
PZPAPN
:  Mule
i; TSR; Black box on
 Thailand
R:  4,112 - 4,126
5:   PRsAK -
, NAV,
 The Mule
.  It
ated in
 Thailand.  Mule is a
generic
uof .
 and .
`.  It
,.  Mule is
 on the
 The
Mule is
X, Mule
as a low
TSR of 4,096
{08 and 21
mby the
Mule is
, it
-and .
X.  If
X, it
are already
 Mule
by 4,117
 the
t.  At
, the
 the
"of the
a.  Later, if the Mule
vthe
, the
at the end
 of the
a.  During the re
t, the
ais treated as an .
 Mule
by 4,112 to 4,126
t, and 4,112
)upon later re
 The
always be
at the end of the
Mule
9the
"Mule",
derives its
 Thirty minutes
Mule became
, a black box
on the low left hand side of the
 the graphic effect of many members of the
 It is
what Mule
 See:
PZPAPN
Multi 1.1
:  Multi 1.1
G:  March,
R:  2,560
5:   PRhAK -
3.96+,
30.00+, NAV 3.0+,
1.25+
 The Multi 1.1
in March,
.  Its
, but it may be
fthe
.  Multi
 1.1 is a
-and .
bMulti 1.1
X, the Multi 1.1
at the top of
$the
', hooking
|24.
, as
qby the DOS
@by 2,608
|12's
!moved.
the Multi 1.1
, it
for any reason.
pof 2,560
be hidden
.  The
at the end of
`.  The
>and
in the DOS
not be
.  The
 the
5in Multi 1.1
is not
 "Multi
(R), Release 1.1, Copyright (c)
-92 by"
 Multi 1.1 is a full
, and dis
 are read into
.  As such,
CRC and checksumming
may not be able to detect its presence on the
PZPAPN
Multi Child
:  Multi Child
 Multi Child-104
R:  104
5:   PRaCK -
n1.04+,
, NAV 3.0+,
1.25+
 The Multi Child, or Multi Child-104,
.  Its
.  Multi Child
 is a
uof .
bMulti Child
in low al
 usually a DOS buffer.
mby the
.  It may
wone .
 in the
the Multi Child
, it
are copied to a target
 sub-
 of 104
at the end of the
 The
>and
in the DOS
to the
>and
.  No
in the
 Multi Child
 Multi Child
Nn't
to do
of Multi Child are:
 Multi Child-110:
, Multi Child-110
 is a 110
of the Multi Child
.  It
to the
PZPAPN
Multi-123
:  Multi-123
(n 123, V123, Multi, SD-123
2; slow
loads
R:  123
5:   PNCK -
, NAV,
 The Multi-123
.  It is
(.  Multi-123 is a
 of .
Multi-123 is
X, the
 search the
Eand
wall .
`it finds.
pof 123
at the end of the
a.  The
>and
in the DOS
to the
>and
 The Multi-123
cannot recognize
it has
r.  As a
, it
continue to
walready
`, adding
increments of 123
ps and
>and
2, an
symptom of a Multi-123
in a long period of
Kaccess
 before the requested
actually runs.
 Multi-123
Nn't do
PZPAPN
Multi-Face
:  Multi-Face
 MFace
i; TSR;
2; smiley face
4moving on
M; write protect
slowdown
R:  1,441
5:   PRsCK -
, NAV,
 The Multi-Face
.  Its
.  Multi-Face is a
uof .
 The
the Multi-Face
in low
mapping utilities may indicate
the Config area of
pd in
by 1,456
).  The DOS
indicate
64K in addition to the 1,456
by the
{08, 13, and 21
mby the Multi-Face
the Multi-Face
, it
pof 1,441
at the end of the
 The
>and
in the DOS
to the
>and
of an
tof the Multi-Face
a minor
slowdown
.  The slowdown is most noticable
Mis scrolled.  .
>and
 in the DOS
Xif the
>is different
>.  Write protect
on write protected
I.  Lastly,
 multiple smiley face
4may
on the
 moving around the
4on the
PZPAPN
Mummy
00K    V
PTK
:  Mummy
 Mummy 1.2
, Except Mummy 2.1
7in USA
i; TSR;
jon 8088
 Taiwan
R:  1,399 - 1,413
5:   PRsE -
, NAV,
 The Mummy
.  It is
fTaiwan.
is a
uof .
frequently
 hang 8088
.  It is
on the
bMummy
X, the Mummy
as a low
 TSR of 1,680
).  It
as an
pin the
 of the Config area of
is mapped by
 utilities.
mby the
the Mummy
, it
pof 1,399 to 1,413
at the end of the
.  The
 and
in the DOS
are no
in the
.  The
in the
 "Mummy
 "Kaohsiung Senior School"
 "Tzeng Jau Ming presents"
 "Series Number = [
 It is
what Mummy
of Mummy are:
 Mummy 1.0:
as the Platinum
 Mummy 1.0 is an earlier
of the Mummy
.  It
in low
, as
 the DOS
1,856
{03 and 21 are
, Mummy 1.0
by 1,489 to 1,503
 at the end of the
be no
3to the
>and
in the DOS
 The
in the
 "Mummy
1.00.00"
 "Kaohsiung Senior School"
 "Tzeng Jau Ming presents"
 "Series Number = [
:  Taiwan
 Mummy 2.1:
Gin multiple locations in the United
 States and the Republic of South Africa in May,
 Mummy 2.1 is a later
of the Mummy
.  Its
TSR is 1,632
 hooking
|21.  It
X, adding 1,364 to 1,378
 to the
.  The
 "PC Mummy Vers. 2.1"
 "Kaohsiung Senior School"
 "Tzeng Jau Ming presents"
:  Taiwan  May,
 Mummy 2.1B:
}in the
in May,
gequivalent to Mummy 2.1B, and
 has
minor alterations.
 May,
 Mummy 2.1C:
in March,
, Mummy 2.1C is a minor
of Mummy 2.1.  The
in the
 "Saddam Hussein Ver. 1.1"
makers."
 "Made by T.Z.M present."
 March,
PZPAPN
Munich
:  Munich
G:  March,
&failure;
 Germany
R:  2,355 - 2,370
5:   PNCK -
, NAV,
1.53S+,
.2.0+
 The Munich
}in Germany in March,
.  Munich
 is a
uof .
the Munich
X, the
wtwo .
in the
 of 2,355 to 2,370
at the end
 of the
.  The
>and
in the DOS
not be
.  Munich is an
and no
in the
 The Munich
Mfake
Xand
jmay
 has
r, the
fail to
of the
Lby the Munich
crashed by unauthorized access, explosion DANGER!!!"
 "Warning:
segments
 "ROM
Uat F000:0188 during low RMA, please
 contact your
engineer or local dealer -
halted"
 "Unrecoverable
halted"
 "Udvozli Ont a Munnich Ferenc Tarsasag!"
PZPAPN
Murphy
:  Murphy
 Murphy-1, V1277,
j; speaker noise; possible
 bouncing ball effect (see Murphy-2
 Sofia,
R:  1,277
5:   PRA -
\, NAV,
:  CleanUp, NAV, or
 The Murphy
.  It is a
generic .
u, and
 The
Xon a
, the
it is
, if a
X, or
for any reason, it is
rby the Murphy
bnon-
, the
attempt to
-MAND.
-.  The
 by 1,277
are less
1,277
not be
 The Murphy
watches the
 between 10AM and 11AM, the
turn on the
speaker
 and send a 61h to it.  At any
, the
 attempt to use the
speaker.
 The
in the Murphy
 giving an idea of
it was written and by whom,
 not
 "Hello, I'm Murphy.  Nice to meet you friend.
 I'm written since Nov/Dec.
 Copywrite (c)1989 by Lubo & Ian, Sofia, USM Laboratory."
rby the Murphy
of Murphy are:
 AntiChrist:
on the Murphy
, AntiChrist is a
uof .
.  It
at the top of
, but
$the
 DOS
qby the DOS
 by 1,040
m.  AntiChrist
larger
1K in
 are
pof 1,008
at the end of the
be no
 to the
>and
in the DOS
is considered a research
, and
 was not in the public domain at the
it was
: Italy   March,
on the Murphy
s is a
uof .
-and .
, and should
 be considered a
.  It
Nnot
,.  It
at the top of
, but
$the
, as
qby the DOS
@by 2,064
{21 and 22
m.  Br
-and .
pof 2,045
at the end of the
 The
not be
if the
 in the DOS
Foy as
#63,491
)larger.
s in arm.Copyright (C)
. V 1.0"
 ":*.
Zof the DOS
 detected on all
 Cemetery: Cemetery is a 1,417
of Italian Pest.
Cemetery is
Aby 1,440
, it
 well as
,are not
by 1,417
at the end of the
a.  One
can be
 Cemetery
: "CEMETERY".  It is
what Cemetery
 Delyrium: Delyrium is an 1,778
of Italian Pest.
Delyrium is
Aby 1,808
 hooking
|21. .
-and .
for any reason.
by 1,778
Delyrium
at the end of the
Delyrium
9the
 "(c) IVRL
(Ivrl Head Quarter, Milan Italy)"
 "Delyrium
- Created by Cracker Jack
 "Copyright by Italian
Research Laboratory
.because the dead is not so far"
.and the horror
 It is
what Delyrium
, but
[difficulties
 DOS COPY
6and executing
fthe B:
:  Italy
 Diabolik: Diabolik is an 1,171
of Italian Pest.
Diabolik is
Aby 1,200
by 1,171
Diabolik
at the end of the
Diabolik
 "Diabolik Ltd.   (C)
by Odrowad"
 "Trow"
 It is
what Diabolik
 Erasmus:
on the Murphy
, Erasmus is a
uof .
-and .
.  It
Nnot
,.  It
at the top of
, but
$the
, as
qby the DOS
@by 1,712
m.  Erasmus
pof 1,682
at the end of the
a.  The
din Erasmus
 "C.J.'91"
 "Gli Dei si mostreranno a gli uomini,
 Quando essi saranno autori di grande conflitto
 Prima il Cielo visto sara con spada e lancia,
 Che verso la mano sinistra portera piu grande afflizione.
 Alla rivoluzione del grande numero sette,
 Apparira ai tempi giochi d'Ecatombe,
 Non lontano dalla grande eta del millennio
 Coloro che entrarono usciranno dalle loro tombe.
 Saint-Remi, 14 dicembre 1533"
Erasmus may
[what
 to be warm re
&s upon
&s" are actually the in
 copy of
#reloaded, and
 AUTO
WC.BAT
: Italy   May,
 Finger: Finger is an 1,172
of Italian Pest.
 Finger is
@by 1,200
by 1,172
at the end of
a.  .
are either
X.  Finger
on Saturdays, at
X, followed by a
hang:
 "Cannot remember what I was doing!!
 Insert fingers in ears and re
&please"
to re
in a "
Jread failure"
 due to the
having damaged the
of the
 Goblin:
on the Smack
, Goblin is a
uof .
-and .
, but not
 It's
is 1,968
), and hooks
 Goblin
-and .
over 2K in
pof 1,951
at the end of the
 Goblin
on Friday, at
Zof an
in the
Mof a
 and deletion of the
in the
 If the
Xis a .
, the
 "What a horrible
, i wish not
Yit!"
 If the
Xis an .
, the
 "Goblin the Black Death  (c) by Cracker Jack IVRL '91"
%the
, the
din Goblin
 "(c) by Cracker Jack
Italian
Research Laboratory"
 "Patricia
Nnot function correctly,
 because I
ln't run it before send.
 Now I'm debugging it...ehehehehehehahahahahahah"
 "Smack
.what a horrible
 "Compliments to the
<for the nice
es...
 excuse me if I create
of your beautiful
es..."
es are a nice thing!!"
 "I'm hungry!! Why don't you buy me a Cheesburger??"
: Italy   May,
 HIV:
on the Murphy
, HIV is a
 of .
-and .
,.  It
at the top of
, but
$the
, as
qby the DOS
@by 1,632
m.  HIV
-and .
pof 1,614
 at the end of the
a.  The
din HIV
 "HIV
- Release 1.0
 Created by Cracker Jack
 (C)
Italian
Laboratory"
: Italy   March,
 Italian Pest:
on the Migram
, Italian Pest is a
uof .
.  It
at the top of
, but
qby the DOS
1.9K.
 Italian Pest may
over 2,048
Nnot always
wthem.
pof 1,910
at the
 end of the
be no
3to the
>and
in the DOS
 Italian Pest is in
in the
Land the
not executing:
 "I'm hungry!! Why don't you buy me a Cheesburger??"
 Italian Pest
on Fridays, at
 of an
in the
 "Your PC is
the Intergalactic Pest!"
 The
in the
Bd, and the C:
corrupted.
%the
, the
can be
din all
 "(c) by Cracker Jack
 Italian
Research Laboratory
 Created,Developed and Written by Cracker Jack,
 All rights reserved
 Con questo
dichiaro guerra a tutti i POVERI
 (ahhh quanto sono poveri!)
 cosiddetti '
Researchers' del globo...
 provate a prendermi..ahahahah
 I'IVRL e'forte
.vincera
Writers di tutte le nazioni...uniamci!"
: Italy   May,
 Kamasya: Kamasya is a 1,098
of the Italian Pest
.  It is a
uof .
.  It's
is 1,120
), and it hooks
|21.  Kamasya
by 1,098
at the end
a.  Kamasya
on Tuesdays, at
 "Kamasya nendriya pritir
 labho jiveta yavata
 jivasya tattva jijnasa
 nartho yas ceha karmabhih"
: Italy   March,
 Locker: Locker is a 1,642
of the Murphy
.  It
 is a
uof .
, but
 not
,.  It's
is 1,644
 hooking
|21.  Locker
 are
 1,642
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
can be
in the
 "(c) IVRL
(Ivrl Head Quarter, Milan Italy)"
 "all rights reserved!!!"
 "[0mPassword ->"
 "[0mPassword accepted!"
 "Incorrect Password, sorry!"
 "Locker Viri - Created by Cracker Jack
: Italy   March,
 Migram: Migram is a 1,221
of the Murphy
.  It
 is a
uof .
.  It's
is 1,248
), and it hooks
 Migram
over 1K in
by 1,221
at the end
a.  Migram
on Saturdays, at
 "MIGRAM VIRUS 1.0
 (C)
 The
Mof the
is followed
hang.
: Italy   March,
 Murphy-2: (V1521)
to the Murphy
, its
is 1,521
).  The non-
in the
are now:
 "It's me - Murphy.
 Copywrite (c)
by Lubo & Ian, Sofia, USM Laboratory."
 The Murphy-2
wany .
a, as well as any
aover 900
).  Instead of turning the
 speaker on between 10AM and 11AM,
waits for
 the
lthe minutes set to 00,
 may
la "bouncing ball" effect
to several
effect
Nnot, however,
 all
 Murphy-3: Murphy-3 is a 1,284
of the Murphy
 The major difference between Murphy and
if it is
.  The
no longer automatically
Murphy-3
 by 1,284
at the end of
 the
is the same as the
, except
a low buzzing
 sound
be emitted along
the clicks.  The
 in the
Murphy
(  May
 Murphy-4: Murphy-4 is
to the Murphy-2
is 1,480
)long.  It
wany
 larger
2,000
it is
.  Murphy-4
at the top of
$the
Aby 1,504
), as
qby the DOS
.  Murphy-4
 in the same manner as Murphy-2, and
8the same
(  May
 Smack:
on the Italian Pest
, Smack is a
uof .
-and .
, but not
,.  It's
is 1,856
), and
 hooks
|21.  Smack
-and .
 over 3K in
pof 1,835
at the end of the
be no
3to the
>and
in the DOS
Smack
[the occasional dis
ance of both
 and data
notice a gradual
 lost clusters on the
Kand
 Smack
on Fridays
X.  It may
Mthe
 "Is today Friday? (Y/N)"
 Replying "Y"
in the
and the
#terminated:
 "Sorry but on Friday I wish not work!!"
 Replying "N"
in the
 the threatened FAT damage
Nnot
due to a bug in
 the
 "You are untruthful!! For punishment I format your HD FAT!!"
in the Smack
was written in Italy by Cracker Jack
IVRL"
 "All rights reserved, please don't crack
 "Special
to Patricia Hoffman: I love you
 "SmackSmack"
 "Can you give me your telephone number??? Ciao bellissima!"
: Italy   May,
 Swami: The Swami
in May,
fa United
 States source.  Its
.  It is a
 Murphy and
be detected as Murphy by
 utilities.  Unlike Murphy,
Nnot
,.  Swami
pof 1,250
). It
 are
, or copied.
9the
 "Bhaktivedanta Swami Prabhupada (1896 - 1977)"
 Swami
Bthe
ain the
 See:   Tormentor
 Tormentor-1072
PZPAPN
MusicBug
:  MusicBug
 Music
&, Music Bug
; clicking;
 music randomly played on
speaker; lost clusters
 Taiwan
R:  N/A
5:   BRtX -
\, NAV,
:  CleanUp, or see
 The MusicBug
is a
.  It
ated in Taiwan.
the MusicBug
, the
at the top of
$the
'.  The
be moved, so
now report 638K of
.  Clicking may be heard for a short
fthe
speaker before the
&proceeds, but more likely a
 section of a tune
be played.  The
proceed.
MusicBug is
, it
periodically play an
 portion of the same tune
Kaccesses
.  It is thus
 rather disruptive.
MusicBug is
, any
Kaccessed (
.  In the case
Ks, MusicBug
vthe
l4K in lost clusters
5as well as a copy of the
 The
lost clusters:
 "MusicBug v1.06. MacroSoft Corp."
 "Made in Taiwan"
the MusicBug
can be dis
 powering off the
&ing
fa write protected
using the DOS SYS
6.  The lost clusters can
be removed by using the
the /F parameter.
Ks, however, cannot be dis
rin the same way.  While
 the DOS SYS
remove the
fthe
, and the lost clusters can be recovered, the
 remain an un
&able, non-
Kuntil a low-level format is
 performed.
PZPAPN
Mutant
:  Mutant
 Mutant 123, Mutant 127, Mutant 128,
Mutant,
-123,
G:  May,
&failure;
R:  123 - 128
5:   PONCK -
, NAV,
 The Mutant
]was
in May,
(.  The
 Mutant
]consists of three
las both a
uand an
u.  Mutant
]members
rby a member of the Mutant
X, the
search the
Eand
 all the .
may either be
 by the
as a
t, the
increasing
 depending on
is present, or the
may be
"of the .
tare permanently corrupted.
pof 123 to 128
), depending on
member of the
 Mutant
]is present.  In any case, the
in the
to the
>and
a member of the Mutant
 two
 "*.com"
 "VPV"
&ing
has a Mutant
]member
in a
&failure.
Mutant
ts may
in a
 hang.
member(s) of Mutant
]are:
 Mutant 123:
as V123,
member of the
 Mutant
]is 123
.  Generally,
Mutant 123
not function
, even if the
ahas a
 Mutant 127:
as V127,
member of the
 Mutant
]is one
*shorter
Mutant 128.  It
ls as
 Mutant 128: The
Mutant
submission, its
 128
).  It be
ls as
PZPAPN
Mutation
:  Mutation
H:
=seconds set to 02;
 "Divide overflow"
T; "Cannot load
-MAND,
halted"
too big to fit in
R:  688
5:   PRhCK -
30.00+, NAV 3.0+,
n1.04+,
2.11+,
\2.13+,
 The Mutation
.  It
s to be
fNorth America.  Mutation
|is a
uof .
X, the Mutation
at the top of
$the
', hooking
|21.
, it may
the Mutation
pof 688
at the end
 of the
a.  The
>and
in the DOS
to be un
, or may
ed.  Actually, the
 seconds field in the
to 02.  The
can be
in the
5in all
 Mutation
 "The Mutation
 RABID'S Back and Kicking in `93"
 "-Soltan Griss"
the Mutation
 the
, as well as possible
 "Divide overflow"
 "Cannot load
-MAND,
halted"
too big to fit in
of Mutation
|are:
 Mutation
|-B: A 694
of the
adds 694
)to .
v.  Like the
, it sets the seconds
 field in the
=to "02".  The
can be
in the
5in all
 "The Mutation
|(B)
RABID'S Back and
 Kickin' the Bucket in `93 -Soltan Griss"
jfrequently
PZPAPN
:  MVF
 Arka, Arkanoid
H:
i; TSR;
R:  1,898 - 1,909
5:   PRsCK -
 NAV 3.0+,
n1.05+,
 The MVF, or Arkanoid,
.  It is
 reported to be
fthe
.  MVF is a polymorphic,
uof .
bMVF
X, the MVF
as a low
TSR of
2.1K.
mby MVF in
the MVF
, it
X.  If
X, it
the MVF
pof 1,898 to 1,909
 at the end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the MVF
5, and are not
 "THE MVF-FILEVIRUS"
by the MVF"
 "MAD
Factory"
 "No. 0001"
 frequently
© of
of the MVF
 MVF-1954:
on the MVF
2.2K.  It adds 1,954 to
 1,969
)to the .
for any reason.
 The
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "THE MVF-FILEVIRUS"
by the MVF"
 "MAD
Factory"
 "28/9/91   -   V1.6"
jmay
 MVF-1954B:
to the MVF-1954
is a very
 minor
.  It
Nn't always
 MVF-1954C:
to the MVF-1954
is a very
 minor
PZPAPN
MX-335
:  MX-335
H:
R:  335 - 351
5:   PRhE -
3.96+, NAV 3.0+,
.2.0+,
1.25+
 The MX-335
.  Its
.  MX-335 is a
bMX-335
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 368
mby the
the MX-335
, it
pof 335 to 351
at the end of the
a.  The
>and
in the
 DOS
to the
>and
.  The
can be
dstarting in the 19th
*of all
 "MX"
PZPAPN
Mystic-377
:  Mystic-377
H:
Zfailure
R:  377
5:   PNCK -
30.00+,
n1.04+,
6.64+
 The Mystic-377
.  Its
.  Mystic-377 is a
uof .
the Mystic-377
 the Mystic-377
wone .
in the
E.  The
usually
ed to the
 DOS prompt.
the Mystic-377
pof 377
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the Mystic-377
 "'Mystic' by Digital Alchemy"
of Mystic-377 are:
 Mystic-379:
to the orginal
adds 379
)to the .
 The same
in the
, 1994.
PZPAPN
Natas
:  Natas
 Natas.4746
, 1994
i; DOS
&Record /
, Probably North America
R:  4,746
5:   PRhAK -
\2.13+
`, Replace MBR on
 The Natas or Natas.4746
, 1994.  It's
 source
5is rumored to
!distributed late last year in
 an issue of 40-Hex magazine.  Natas is a
vthe
&Record,
W, and overlay
bNatas
wthe
&record (the
9ing the
), as well the
© of
, as
qby the DOS
@by 5,664
the Natas
, it
 and overlay
, or copied.
pof 4,746
not be
.  The
at the end of all
not be
 Natas hides the
t.  The
>and
in the DOS
not be
.  The
in the
5in all Natas
 "Natas"
 The DOS
indicate
Ton all
jmay
of Natas are:
 Natas.4744:
}in Spain, Natas.4744 is a 4,744
 of the Natas
:  Spain
, 1994.
PZPAPN
Naught-865
:  Naught-865
 All
s may be corrupted;
&failure
R:  865
5:   ONAK -
Generic
30.00+,
2.11+,
V122+,
1.25+
 The Naught-865
.  Its
.  Naught-865 is a
uof the C:
Oroot
E.  It
wboth
and data
the Naught-865
X, the
 Naught-865
all of the
and data
 present in the C:
Oroot
b865
)replaced by the Naught-865
5.  The
>in the DOS
lthe year
 the year in the
>.  The
 to the
.  The
can be
dnear the
"of all
 "*.*"
 Since Naught-865
s all
`in the C:
Oroot
fail to
not function, and any data, .BAT, or
 configuration
`in the
be corrupted.
PZPAPN
], Horse
T; buzzing
speaker
 & clicking
 Sofia,
R:  1,154 or 1,160
5:   PRhAK -
, NAV,
 The
is a group of four
.  Several
were
 in May,
.  The
es in
]are all
es, and
gare very
one of the
es is
X, the
at the top
$the
 and 21
mby the
, as measured
the DOS
 by 1,280
).  At
, the
,if it hasn't
, it
-and .
`over 1K in
pby either 1,154 or 1,160
), depending on
is present,
at the end of the
.  The
not be able to be seen if the
.  The
>and
in the
 not be
one of the
es may
 find
Ythe DOS
 the adjusted
not match the
. Executing the
a /F option may
in corrupted
symptom
may be noticed on
is an
 annoying "buzz"
#emitted
fthe
speaker
for awhile.
s, scrolling of
 the
Mor pressing keys on the
 clicking noise.
sound effects
members of
], but not the later
 It is
what the
es do
es are:
 Horse: Very
-B, Horse is a minor variation.
 Like
-B, it is 1,154
 produces the sound effects
.  The
is: "Sofia,
 Horse 2: Horse 2 is very
-A.  It is 1,160
, and produces no sound effects.  The
is: "Sofia,Feb '91
 Horse 5: Horse 5 is very
$, it
 is a 1,776
has three
 Horse-8:
, Horse-8 is a 2,248
 member of the
].  It
in the DOS Data area of
, hooking
|21.
qby the DOS
not be
, Horse-8
-and .
larger
for a reason
Z.  The
 hides the 2,248
p, and the DOS
Horse-8 is
 Horse-8B:
, Horse-8B is a minor
of the Horse-8
.  Its
 is 4,864
)and hooks
|21.
lthe seconds field in the
=set to
 "60".
an effective
of 1,160
Nnot produce the sound effects of
-B.  The
"Sofia, Feb
 '91
" can be
dat the end of
an effective
of 1,154
produces the sound effects
.  It
8the
"Sofia,Jan
" and "(c)
."  It
s to be
 an earlier
an effective
of 1,610
 and
by 2,048
).  It is
, or what it
9the
an effective
of 1,776
-C.  It
 not
9any
{01, 1C,
 and 21
an effective
of 1,576
), the
to the Naughty
 Hacker-D
Nnot hook
|1C.  Like
-D, it
9any
-F is a 1,594
-C.  The
is "N.Hacker".
-G is an
1,154
].  It is
5modifications.
 The
 "Sofia,Jan/Feb
PZPAPN
Nazgul
:  Nazgul
fail to function
&failure
 The
R:  266
5:   PNCK -
8/93S+,
3.96+, NAV 3.0+,
 The Nazgul
.  It is
fThe
.  Nazgul is a
uof .
the Nazgul
X, the
 Nazgul
wall of the .
in the
E.  If
the Nazgul
pof 266
the Nazgul
at the
"of the
a.  The
>and
in the DOS
not be
.  The
can be
in the
5in all Nazgul
-Nazg
the Nazgul
fail to function
ing to the DOS prompt
has accessed
 the
.  If the
© of
r, the
PZPAPN
NaziPhobia
:  NaziPhobia
fail to
R:  4,240
5:   ONE -
1.25+
 The NaziPhobia
, and
fthe
.  NaziPhobia is a
uof .
.  It permanently corrupts the
the NaziPhobia
X, the
 NaziPhobia
wone .
ain the
 but not the
ain the
lthe
b4,240
)of the host
by the
 NaziPhobia
5.  The
unless
were
smaller
4,240
, in
 case
 4,240
.  The
in the DOS
to the
>and
 The NaziPhobia
on any Friday.  On Fridays,
 of an
in the
Land the
ed to the DOS prompt.
 'ON THE SABBATH.. THE GHOST OF HITLER SPEAKS :
 "MY FELLOW NAZI'S.. I WAS WRONG.."
 "I NOW
-MAND YOU TO
-MIT SUICIDE.. NOT GENOCIDE.."
 "DO IT.. SO THE WORLD WILL BE RID OF THE NAZIPEST..
 "AND ALL AUSLANDER CAN TRUELY BE FREE OF NAZIPHOBIA..
 NaZiPhobia (c) [VooDoo].. We support the
 The
fthe
in the
5in all NaziPhobia
PZPAPN
NCU LI
:  NCU LI
; Parity
 hang
R:  1,694 - 1,704
5:   PRhE -
3.96+, NAV 3.0+,
8/93+,
 The NCU LI
.  Its
~are
it may be
fthe
 NCU LI is a
uof .
 The
the NCU LI
at the top of
$the
, as
qby the DOS
@by 1,888
mby the
, the NCU LI
pof 1,694 to 1,704
at the
 end of the
a.  The
>and
in the DOS
to the
 and
.  The
can be
din the
5in all
 "NCU LI"
the NCU LI
[the
 video mode
#switched to 40 column mode, and the
 "PARITY ERROR ADDR (HEX) = ( 02C14H) SYSTEM HALTED"
s, the
be hung.  The
 not
as it is
PZPAPN
Necro Fear
:  Necro Fear
R:  1,823
5:   PRaCK -
30.00+,
, NAV 3.0+,
n1.04+,
6.60+,
6.64+,
1.25+
 The Necro Fear
.  It is
 the
.  Necro Fear is a
bNecro Fear
X, the Necro
 Fear
in low
, hooking
{21 and 2F.
, as
qby the DOS
 not be
the Necro Fear
, it
pof 1,823
at the end of the
a.  The
in the DOS
not be
.  The
in the
 "I am afraid
!bitten by the FEAR"
 "bug.  Just think, you may
lpassed in on to all of"
 "your friends!  What fun
it goes off"
 "all of
 "FEAR Copyright (c)
NecroSoft Technologies"
 "Developed in:"
 "The Metropolis of Sodium Chloride in Hydrogeon Dioxide"
jfrequently
on Necro Fear
PZPAPN
Necro Shadow
:  Necro Shadow
j; disruption of
contents,
 "blue snow"
R:  1,200
5:   PRhAK -
3.96+, NAV 3.0+,
8/93+,
 The Necro Shadow
.  It is
 the
.  Necro Shadow is a
-and .
bNecro Shadow
X, the Necro
 Shadow
at the top of
$the
', hooking
|21.
the Necro Shadow
, it
 and .
pof 1,200
at the end of the
a.  The
>and
in the DOS
not be
 The
in the
 "[Shadow] NecroSoft Enterprises-a division of BCA"
 "Greets to SKISM"
[frequent
&failures
 the
© of
disruptions
frequently
.  On monochrome
 as a couple of
on the
.  On VGA
, a bunch of blue squares or blue snow
.  In
 both cases, a
hang
accompany the
disruption.
of Necro Shadow are:
 Necro Shadow-B:
on the Necro Shadow
employs
techniques to avoid detection
 and quickly spread on
.  Its
 is 3,504
), hooking
|21.  It
, or a DOS DIR
6is performed.
pof 1,700
be hidden
Necro Shadow-B is
.  The
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[Shadow-B] NecroSoft Enterprises - a division of BCA"
 "Greets to SKISM"
Necro Shadow-B
 failures
© of
on write protected
in a write protect
U.  The DOS
Ton all
PZPAPN
Necrosoft Dementia
:  Necrosoft Dementia
 Necrosoft
=seconds = 02
 "CALLBACK.
-" and/or "!#TEMP#!"
`created
R:  4,209 - 4,223
5:   PRhAK -
, NAV 3.0+,
 The Necrosoft Dementia
.  It is
fthe
.  Necrosoft Dementia is a
uof .
-and .
bNecrosoft Dementia
at the top of
$the
', hooking
|21.
@by 8,416
|12's
not be moved.
the Necrosoft Dementia
, it
-and .
pof 4,209 to 4,223
at the
 end of the
a.  The
>and
in the DOS
to be
, or the
 "dis
fthe DOS Dir
.  The seconds field of
 the
>and
!set to "02",
is the
tmarker for
.  The
in the
 "!#TEMP#! REQUEST.IVA CALLFAST.
-RECEIPT.IVA CALLFAST.
-*.*"
 "Dementia] Copyright enterprises - All rights reserved"
 "I am the man
walks alone"
 "And
I'm walking a dark road"
 "At night or strolling through the park"
the light begins to
s feel a little strange"
 "A little anxious
it's dark"
 The Necrosoft Dementia
s create either one or
 both of the
d "!#TEMP#!" and "CALLFAST.
-".
`are created,
are 5,183
 copy of the
.  Executing the CALLFAST.
 in the
becoming active on the
 It is
what damage potential
of Necrosoft Dementia are:
 Necrosoft Dementia-B: A later
of the Necrosoft Dementia
and functional characteristics
 are the same as the
of the
.  The
 the
 "!#TEMP#! REQUEST.IVA CALLFAST.
-*.*"
 "Dementia] Copyright Necrosoft enterprises -
 All rights reserved"
 "I am the man
walks alone"
 "And
I'm walking a dark road"
 "At night or strolling through the park"
the light begins to
s feel a little strange"
 "A little anxious
it's dark"
PZPAPN
NeverMind
:  NeverMind
, 1994
R:  838
5:   PRhCK -
V116+,
\2.13+,
2.58+,
n1.05+,
6.64+,
1.25+,
6.64+,
V116+,
2.58+
 The NeverMind
, 1994.  Its
.  NeverMind is a
uof .
bNeverMind
at the top of
 but
$the
', not moving
|12's
, as
qby the DOS
@by 1,680
mby the
pof 838
at the end of the
a.  The
>and
in the DOS
not be
 The
in the NeverMind
 "A WORD TO PATRICIA:"
.NAH, NEVER MIND"
 "If
Nn't refer to you, just ignore it."
 "For more
xcall: ++1-408-988-3773 (USA)"
s to
!written by an individual wishing to
 get the author of
's attention.
PZPAPN
Newcom
:  Newcom
R:  3,045 - 3,060
5:   PRhAK -
n, NAV,
1.53S+,
 The Newcom
.  Its
.  Newcom is a
uof .
-and .
Newcom is
X, the
at the top of
 but
$the
, as measured by the DOS
 3,312
{1C and 21 are
mby the
|12's
is not moved.
becoming
, Newcom
-and .
X.  If
X, it
by 3,045
 to 3,060
at the end of the
a.  The
>and
in the DOS
not be
by the
 It is
what Newcom
 See:   Alfa
PZPAPN
:  NGV
:; TSR;
 unexpected
R:  Varies, depending on
present
5:   PORsCK -
V111+,
/2.1+,
2.58+,
2.11+,
6.64+,
V111+,
2.58+,
.2.0+,
6.64+,
1.25+
 NGV is not a single
, but rather a group of
!generated
generation utility
 called Nuke Gen
1.51.
es are either
us of .
, and may
,.  The
 typically
TSR,
 portion is not used for replication, the
es are
 The
$are members of the NGV group.  Eight of
 the
es are
s referred to as the "Adams
 and
9the
s of eight
fthe Adams
 television
fthe 1960s, and the
movie.
NGV generated
es are:
 NGV-1376:
, 1994, NGV-1376 is a
.  It
s the
b1,376
)of one .
ain the
X.  NGV-1376
9the
in the
-MANDE"
Created by NuKE -  Gen
V1.51 License n"
 "id# [NuKE]-93"
 NGV-1376's
TSR is 1,632
 hooking
, 1994.
 NGV-Cousin It:
, 1994, NGV-Cousin It is a
vone .
 in the
were
larger
1,681
by 1,680
)upon
were
 smaller
1,681
 3,361
)upon
t.  In both cases, the
at the
"of the
a, and the
>and
 the DOS
not be
.  The
in the
--=Adams=-"
 "Part of the Adams
][Cousin-It]DA & NwM KiCk"
 "ASS"
 NGV-Cousin It's
TSR is 1,968
 hooking
, 1994.
 NGV-Gomez:
, 1994, NGV-Gomez is a
vone .
ain the
were
larger
1,649
by 1,648
)upon
were
 smaller
1,649
 3,297
)upon
t.  In both cases, the
at the
"of the
a, and the
>and
 the DOS
not be
.  The
in the
--=Adams=-"
 "Gomez Adams/ [NuKE]  RoCks DeathBoy
 Learns Daily
fDA & NwM"
 NGV-Gomez's
TSR is 1,936
), hooking
|08 and 22.  The
zs a copy of the TSR
 into
jmay
, 1994.
 NGV-Lurch:
, 1994, NGV-Lurch is a
vone .
ain the
were
larger
1,649
by 1,648
)upon
were
 smaller
1,649
 3,297
)upon
t.  In both cases, the
at the
"of the
a, and the
>and
 the DOS
not be
.  The
in the
--=Adams=-?"
 "Lurch Part of the Adams
f-=DeathBoy KoASP=
 [NuKE]RoCks"
 NGV-Lurch's
TSR is 1,936
), hooking
, 1994.
 NGV-Morticia:
, 1994, NGV-Morticia is a
vone .
ain the
were
larger
1,793
by 1,792
)upon
were
 smaller
1,793
 3,585
)upon
t.  In both cases, the
at the
"of the
a, and the
>and
 the DOS
not be
.  The
in the
 "Morticia Adams Greets to Pure Energy,S.Radish,FireCracker,
 NuKE3"
 NGV-Morticia's
TSR is 2,000
), hooking
|08.
jfrequently
, 1994.
 NGV-Pugsley:
, 1994, NGV-Pugsley is a
vone .
ain the
were
larger
1,601
by 1,600
)upon
were
 smaller
1,601
 3,201
)upon
t.  In both cases, the
at the
"of the
a, and the
>and
 the DOS
not be
.  The
in the
--=Adams=-"
 "Pugsley Adams;Greets to Nowhere Man,Dark Angel,Rock,Savage,
 NuKE"
 NGV-Pugsley
Nnot
, 1994.
 NGV-Thing:
, 1994, NGV-Thing is a
vone .
ain the
were
larger
1,649
by 1,648
)upon
were
 smaller
1,649
 3,297
)upon
t.  In both cases, the
at the
"of the
a, and the
>and
 the DOS
not be
.  The
in the
--=Adams=-?"
 "Thing Adams? Part of the Adams Viri
]. [NuKE]"
 "RoCks Loser"
 NGV-Thing's
TSR is 1,936
), hooking
{08 and 22.
jand/or unexpected
&s may
, 1994.
 NGV-Uncle Fester:
, 1994, NGV-Uncle Fester is a
vone .
 the
were
larger
1,777
by 1,776
)upon
were
 smaller
1,777
 3,553
)upon
t.  In both cases, the
at the
"of the
a, and the
>and
 the DOS
not be
.  The
in the
--=Adams =-"
 "Uncle Fester Adams. [NuKe] RoCks. Part of the Adams
]Vir93"
 "PEN ZIP"
 NGV-Uncle Fester's
TSR is 2,064
 hooking
|09.
jfrequently
, 1994.
 NGV-Wednesday:
, 1994, NGV-Wednesday is a
.  It
s the
 1,312
)of one .
ain the
X.  NGV-Wednesday
9the
in the
-McAsshole"
 "(c) Wednesday's NuKE part of the Adam's
 "id# [NuKE]-93"
 "Parity
USYSTEM HALT"
 "Please REBOOT"
 NGV-Wednesday's
TSR is 1,568
 hooking
, 1994.
PZPAPN
:  Nina
R:  256
5:   PRhCK -
\, NAV,
 The Nina
, and is
is a
uof .
the Nina
 Nina
at the top of
$the
Aby 1,024
)as shown by the
 DOS
mby the
Nina is
, it
 are greater
X.  If
X, it
by 256
), and
lthe
at the
"of the
 The Nina
d Nina because the
8the
"Nina"
in the
Nnot do
PZPAPN
Nines
:  Nines
i; TSR; printer interference
R:  705
5:   PRsCK -
8/93S+,
, NAV 3.0+,
.2.0+
 The Nines
.  Its
.  Nines is a
 of .
 The
the Nines
as a low
TSR of 800
{17 and 21
mby the
 Nines
the Nines
, it
X.  If
the Nines
pof 705
).  The
at the end of the
.  The
>and
 the DOS
not be
.  No
 are
in the
5in Nines
the Nines
[interference
fthe
to print to the
printer.
of Nines are:
 Nines-706: One
*longer
Nines
adds 706
)to the .
 May,
 Nines-776: Nines-776 is a 776
of the Nines
 May,
PZPAPN
Ninja
:  Ninja
R:  1,546 - 1,634
5:   PRhA -
 NAV 3.0+,
8/93+,
 The Ninja
.  It is
fthe
.  Ninja is a
uof .
, but not
,.  It spreads quickly,
for any reason.
 The
the Ninja
 the Ninja
at the top of
$the
, as
qby the DOS
@by 1,408
 Ninja in
, the Ninja
-and .
for any reason.
pof 1,634
).  .
by 1,548
).  In both cases, the
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the
5, and thus
 not
,AIDSTEST.
 "Mutant Ninja
2.0 (C)
&Worm Software"
 It is
what Ninja may do
PZPAPN
No Frills
00Q    Y
PTQ
:  No Frills
 Australia
R:  813
5:   PRhAK -
n1.05+,
.2.0+
 The No Frills
.  Its
~was Australia.  No Frills is a
uof .
-and .
bNo Frills
X, the No Frills
at the top of
$the
|12's
 not be moved.
, as measured
 by the DOS
@by 2,048
mby No Frills in
, the No Frills
,if it was not
the No Frills
, it
 and .
X, or copied.
pof 813
at the end of the
a.  The
>and
in the DOS
 The
can be
in the
5in all
 No Frills
 "-No Frills by Harry McBungus-"
No Frills may
 the
of No Frills are:
 No Frills 1.01: A later
of the No Frills
by 1,536
hooking
 of 815
at the end of
 the
a.  The
in the
 has
 "-No Frills 1.01 by Harry McBungus-"
 No Frills 1.01
Nnot hang the
 the
:  Australia
 No Frills 2.0: A later
of the No Frills 1.01
 of 843
at the end of
 the
a.  The
in the
 has
 "+-No Frills 2.0 by Harry McBungus-+"
:  Australia
 No Frills 3.0: A later
of the No Frills 2.0
 of 835
at the end of
 the
a.  The
in the
 has
 "+-NF3.0-H.McB- [PuKE] -+"
 "=EXt.=COt-"
No Frills 3.0 may
:  Queensland, Australia
 No Frills-1358: A later
of the No Frills
by 2,048
), hooking
{09 and 21.
 of 1,358
at the end of
 the
a.  The
 the
 "Kcat 3.01 % 5%"
 "By Sir Twist & Thunderbird,
Many
kz to
 Harry McBungus whose
5d we politely nicked."
 "c:\win386.dat"
 No Frills-1358 may hang the
 the
:  Australia
PZPAPN
NoBock
:  NoBock
R:  440
5:   PNC -
n, NAV,
 The NoBock
.  NoBock
 is a
uof .
NoBock is
X, the
 check the
>.  If the
between
 1, 1980 and
30, 1980, it
Mthe
and halt the
, not
sany
 "No Bock today
halted!"
 The
be left spinning.
 If the
clock is set to a
>between
1, 1980 and
30, 1980, NoBock may
wone
ain the
Oand
 The
, however,
Nnot
Xduring
period of
 NoBock
pof 440
 the
at the end of the
 NoBock is an
, and the
cannot be viewed
PZPAPN
NoInt
:  NoInt
 Bloomington, LastDirSect,
 BSC;
 Canada
R:  N/A
5:   BRtX -
, NAV,
:  CleanUp, or M-
 The NoInt
}in Canada in
.  NoInt is a
of the
.  Like
, it
as well as the
 The
 the NoInt
, NoInt
at the
 top of
$the
 12's
be moved by the
, as measured by the DOS
 by 2,048
).  NoInt
wthe
.  The
to Side 0, Cylinder 0,
NoInt is
, it
 are accessed on the
.  On double density 5.25"
I, the
11.  On high density 5.25"
I, the
17.  In both cases,
are part of the root
Eof the
J, so any
`whose
Eentries were in
be lost.
 NoInt
Nnot
9any
take longer
normal to perform
 accesses or
&s.  High density
 often get a "
&failure"
are later attempted to
 The reason
NoInt is considered a
while
 it can be detected on
actively keep
software
#able to read
 the
on the
K.  Instead
ing the
, the
 may
unreadable to the
ing in an
.  If you
lreason to believe
 NoInt
, power off the
and re
fa clean write-
 protected
Jand
check the
Kfor the
 See:
PZPAPN
Nomenklatura
:  Nomenklatura
 Nomenclature, 1024-B, Nomen
 not
R:  1,024
5:   PRhAK -
, NAV,
:  CleanUp, or
 The Nomenklatura
in the
is a
uof .
,.  It is not related to the V1024
it is the same
 The
the Nomenklatura
Xon a
, the
 the top of
, but
$the
Aby 1,024
), and
mby the
, any .
-or .
greater
1,023
 for any reason
rby the Nomenklatura
pd by 1,024
).  The
Nnot hide the
 the
fa write-protected
in a "
L, and the
 The Nomenklatura
is destructive to the contents of
 exposed to
randomly
the frequency increasing as the
more filled
 data. The
Tmay
on data
`as well
s due to the
occasionally
 swapping a pair of words in the
buffer.  It may
 to critical
areas such as the FAT,
Fories since it may
to any clusters on the
K.  If a
aor critical
area was residing in a corrupted cluster,
be corrupted.  As such,
!exposed to
 the Nomenklatura
must be carefully checked as the integrity
 of non-
and any data
`should be considered
 suspect.
 The
d Nomenklatura as
 in all
PZPAPN
Not-586
:  Not-586
R:  586
5:   PRtCK -
3.96+, NAV 3.0+,
 The Not-586
, and is
fthe
.  Not-586 is a
uof .
bNot-586
at the top of
 the
', moving
|12's
 and
, as
qby the DOS
@by 1,024
 the
, the Not-586
pof 586
at the end of the
a.  The
>and
in the
 DOS
not be
.  No
in the
5in Not-586
 It is
what Not-586 may do
PZPAPN
 855, Nov 17
 Italy
R:  855
5:   PRhAK -
/, NAV,
8/93+,
 The
17th
.  Its
~was
, but it has
 since
!reported as
#widespread in Rome, Italy, in
17th is a
uof .
-and .
 The
17th is
at the top of
$the
, as
qby the DOS
@by 896
|12's
 moved.
{09 and 21
17th
, it
-and .
pof 855
at the end of
 the
be no
3to the
>and
in a DOS
.  One
in the
5of all
17th
 "SCAN.CLEAN.
 The
17th
s the
17th of any year.
17th are:
 Nov 17-768:  A 768
of the
17th
by 800
it is
.  It
Nnot hook
|09.
pof 768
at the end of the
 May,
 Nov 17-880: An 880
of the
17th
by 928
it is
.  It
 hooks
{09 and 21.
pof 880
at the end of the
a.  The
in the
 "SCAN.CLEAN.
WAMZ"
 Nov 17-880
17th thru
 31st of any year, at
trash the
Oand the C:
17th-B:
on the
17th
adds 855
)to the .
-and .
 usually hang the
function
PZPAPN
Nowhere Man
:  Nowhere Man
, VMessiah
; long
 followed by
not executing;
truncated
R:  6,286
5:   ONAK -
, NAV 3.0+,
n1.04+,
1.25+
 The Nowhere Man
, complete
 source
5in C.  Its
.  Nowhere Man is a non-
uof .
-and .
over 6,300
Nowhere Man is
X, the
search the
Efor a .
-or .
 6,300
a candi
ahas
d, the
b6,286
)of the
5.  The remainder of the
binary 00
be no
3to the
, or
>and
, in the DOS
E.  The
can be
 "NMAN"
 "BMAN"
the Nowhere Man has successfully
a, it
Mthe
, and the
 to the DOS prompt:
 "Out of
 If the
did not find a
w, it
to the DOS prompt:
 "All
r.  Mission complete."
 Both
are not
 The Nowhere Man
truncate
is zero
of Nowhere Man are:
gvery
to the Nowhere Man
completely
 the .
-and .
all .
 and .
in the
Eof over
4.5K
r, it
trash the
Oof the
, and root
 The
"NMAN" and "J-VIRUS!" can be seen in all
:  Canada  Montreal, Canada
 Nowhere Man 1.9:
to the Nowhere Man
6,286
.  It
Ms the
: "Out of
 Nowhere Man 2.0:
to the Nowhere Man
is 4,828
lhad
>and
 the
>and
.  While
 Nowhere Man 2.0
`, it may truncate
 both .
-and .
in the
 VMessiah: A 702
of the Nowhere Man
vall .
-and .
whose
 is at least 702
in the
lthe
b702
)of the host
the VMessiah
5.  The
>and
in the DOS
.  The
d samples so it is not
 "I am your VIRAL MESSIAH
 Follow me and be redeemed
 Your data doth exist no more
 The FAT holds ashes of your dreams"
 "[VCL] [
Messiah] Nowhere Man, [NuKE] '92"
 The
bquote
, comprising four lines, is
 See:
5Zero
PZPAPN
:  NPox
 Evil Genius
seconds = 58;
K; trashes
Kon 18th of month
 Canada
R:  963
5:   PRhAK -
, NAV 3.0+,
8/93+,
 The NPox, or Evil Genius,
was simultaneously
}in the
 Eastern
and Montreal, Canada in late
is a
,.  It is extremely destructive.
bNPox
at the top of
$the
qby the DOS
@by 1,024
|12's
not be moved.
{09 and
mby NPox in
.  The copy of
 in the C:
Oroot
 if it was not
, NPox
-and .
pof 963
at the end of the
a.  The
p, however,
not be
in the DOS
lthe seconds field
 of the
in the DOS
Eset to '58'.
is the
tmarker for the
 The
can be
in the
 all NPox
 "Evil Genius V2.0 - R.S/NuKE"
 "C:\
NPox
the DOS
may, however, find
random
on the
, or
Kis corrupted on the 18th of any month.
of NPox are:
 Evil Genius 2B:
gequivalent to the
has two
differ.
:  Montreal, Canada
 Evil Genius 2C:
gequivalent to the
has seven
differ.
:  Eastern
 NPox 2.0:
, NPox 2.0 is
on the
 NPox
.  It's
is 1,856
), hooking
{21 and 22.  NPox 2.0
-and .
are closed, and dis
 them as
are read into
lany
 NPox 2.0 is
pd in
by 2,048
).  The
at the end of
.  The seconds in the
>in the DOS
be set to 60 on all
 Two
can be
din all
 "NuKE PoX V2.0 - Rock Steady"
 "C:\
:  Montreal, Canada
 NPox 2.1:
, NPox 2.1 is
on the
 NPox 2.0
.  It's
 is 1,744
), hooking
{21 and 22.  NPox 2.1
-and .
are closed, and
vthem as
are read into
lany
NPox 2.1 is
pd in
by 1,686
).  The
 the end of
.  The seconds in the
 in the DOS
be set to 60 on all
.  Three
can be
din all
 "Death to Separatist"
 "C:\
 "NuKE PoX V2.1 - Rock Steady"
 NPox 2.1
on the 13th day of any month, at
K, rendering it
 inaccessible.  It
hang the
:  Montreal, Canada
PZPAPN
NR-481
:  NR-481
G:  March,
 North America
R:  481
5:   PNA -
, NAV 3.0+,
n1.04+,
6.60+,
.2.0+,
1.25+,
6.64+
 The NR-481
in March,
.  It is
fNorth
 America (Canada or the
).  NR-481 is a
uof .
-and .
, but not
the NR-481
X, the
 NR-481
wall the .
-and .
 the
pof 481
at the end of
 the
a.  The
>and
in the DOS
not be
.  One
in the
5in all NR-481
 NR-481
Nn't
to do
PZPAPN
:  NTKC
 C-23963
i; graphic picture
R:  23,963
5:   PNCK -
, NAV,
 The NTKC
in May,
.  It is
 the
.  NTKC is
on the Father Christmas
.  It is a
uof .
NTKC is
X, the
search
 the
Efor a .
w.  If one is
d, it
, the
 full
graphic of a personal computer, the
 cleared, and the host
NTKC
 23,963
).  The
at the end of the
din NTKC
 are:
 "regional   engeneering   centre"
 "LENINFORMATIKA  N T K C Computer-Service"
 See:   Father Christmas
PZPAPN
Null Set
:  Null Set
 Null
R:  733
5:   PNCK -
1.53S+,
 The Null Set
.  It is
.  Null Set is a
the Null Set
X, the
search the
Eto locate the
over
.  If an
, the
the Null Set
pof 733
).  The
at the end of the
.  The
>and
in the DOS
not be
 Null Set
Nn't
to do
PZPAPN
Null-178
:  Null-178
to write to PRN device;
R:  178
5:   PNCK -
 NAV,
1.53S+,
 The Null-178
.  Its
is a
 of .
the Null-178
X, the
check the
bfive .
`in the
 and
wthem if
were not
bfive .
`are
r, it
further down in the
the Null-178
pof 178
at the end
 of the
.  The
>and
in the DOS
to the
 and
.  One
can be
in the
5of the Null-178
 "*.com"
Null-178 may notice
attempt to write to
device PRN.  If the
Nnot
lan attached printer, and
in DOS.
PZPAPN
Number One
:  Number One
 Number 1, #1, Number One-B, Number One-Argentina
G:  1987 (see
`fail to function;
 displayed
 West Germany
R:  12,032
5:   ONC -
30.00+,
.2.0+
 The Number One
for inclusion in
, however, is not a new
but is an
 extinct rather "old"
.  The Number One
was written in
, 1987, by M. Vallen using Turbo Pascal 3.01A.  It is
 documented, complete
source, in a book by Ralf Burger.
is an
the Number One
X, the
wthe
ait finds in the
E.  If the .
awas
less
12,032
, it
la 12,032
=stamps in the
 reflect the
Number One has finished
a, it
Mthe
aHas
rby Number One!
 The
X is the
of the .
has just
rby the
are no more .
 Number One to
win the
E, it
aHas
rby Number One!
 Number One
wany
lthe Read
 Attribute set.
 Since Number One is an
, it is not possible to
 remove the
`and repair the damage.
`should be erased and replaced
clean copies.
of Number One are:
 Number One-Argentina:
to the Number One
Gin Argentina in
s the
b12,032
)of the .
v.  The
 has
ahas
rby Number One".
 It may
3the
Mvideo attributes
:  Argentina
 Number One-B:
to the Number One
Ms the
"<Smile>" in place of the
 ASCII character
all .
rand an
 See:   AIDS
PZPAPN
Number 6
:  Number 6
 The
R:  631
5:   PRhC -
30.00+, NAV 3.0+,
 The Number 6
, and
s to be
fThe
.  Number 6 is a
, but not
,.  It may be related to the
 Civil War
bNumber 6
X, the Number 6
at the top of
$the
', not moving
|12's
, as
 the DOS
@by 1,024
{12 and 21
mby the
the Number 6
, it
 for any reason.
pof 631
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in the
5in all Number 6
 "#6
, Trident/The
 It is
what Number 6 may do
 See:   Civil War
PZPAPN
Nygus
:  Nygus
 Poland
R:  757
5:   PRhA -
3.96+, NAV 3.0+,
.2.0+
 The Nygus
fPoland in
is a
uof .
-and .
, but
 not
bNygus
X, the Nygus
at the top of
$the
, as
qby the DOS
 by 1,024
mby the
the Nygus
, it
by 757
at the
 end of the
a.  The
>and
in the DOS
to the
>and
 It is
what Nygus
of Nygus are:
 Nygus-Klaw:
, Nygus-Klaw is
fPoland.  Its
is 1,024
), hooking
|21.
it is
, Nygus-Klaw
-and .
 752
at the end of the
a.  The
>and
in the DOS
to the
.  No
in the
 Nygus-Klaw may
X, or the
may be
ed to the
 DOS prompt unexpectedly.
:  Poland
PZPAPN
Nympho 1.0
:  Nympho 1.0
 Nympho Mitosis
j, possibly
beeping;
R:  839
5:   PRhAK -
3.96+,
6.60+,
2.58+,
2.58+,
6.64+,
1.25+
 The Nympho 1.0, or Nympho Mitosis,
.  Its
.  Nympho 1.0 is
uof .
-and .
bNympho 1.0
at the top of
$the
 DOS
', not moving
|12's
, as
qby the DOS
+progam,
@by 1,136
 Nympho 1.0 in
 While Nympho 1.0 is a
, it
Fmanor.
wone .
in the
pof 839
not be
.  The Nympho 1.0
at the end of
`.  The
>and
in the DOS
not be
.  The
in the
5in all Nympho 1.0
 "[Nympho Mitosis] v1.0 Copyright (c)
Lapse"
j, possibly accompanied by beeping on the
speaker,
 may
s corrupt the
PZPAPN
Offspring
:  Offspring
 Offspring v.07
i; hidden .
`created;
R:  1,294
5:   PSRhA -
& Spawning
 The Offspring
.  Its
.  Offspring is a
uof .
-and .
the mechanism it uses
wthe different
s is distinct for
Q.  It
 not
bOffspring
X, the Offspring
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 3,048
|12's
not be
 moved.
the Offspring
, it
X, or up to five .
`in the
a DOS DIR
6is issued.
pof 1,294
at the end of the
a.  The .
>and
in the DOS
not be
the Offspring
, it
wup to
 five .
in the
ever the
Os or
Fories.  .
`are
rby the
creating a 1,294
*companion .
the same base
companion
lthe
 and
were created, and the read-
and hidden
 attributes set.  The .
`themselves
not be
 The
in the Offspring
 "(c)
negoriV"
k you for providing me and my offspring
 safe place to live *"
 "* Offspring I v0.07. *"
jmay frequently
the Offspring
of Offspring are:
 Offspring v.05: A earlier
of the Offspring
, hooking
|21.  Its
 is 2,096
), as a TSR.  It
vall of the
`in the
a DOS Dir
6is issued.  It
are copied.  In both cases, the
 mechanism is to create a hidden companion .
the same base
of 711
lthe read
and hidden attributes set,
 and the
>and
. The
in the
 "(c)
VG Enterprises"
 "* Congratulations, You
lrecieved the privelge
rby the"
 "Offspring I v0.05."
jfrequently
primarily
a DOS Dir
6is performed.
 Offspring v.81: A later
of the Offspring
, hooking
|21.  It
vup to five
 the
`, creating a hidden
 companion .
the same base
 1,127 to 1,177
lthe read
and hidden attribute set.
all of the .
`are
r, it
tof the
by 1,127 to 1,177
 the
at the endof the
a.  The
>and
in the DOS
not be
.  The
in the
 "G(c)
negoriV"
 "OFFSPRING V0.81"
in the
Mof the
is not corrupted:
PZPAPN
:  Ohio
, 1988
 BSC;
 Indonesia
R:  N/A
5:   RtF -
Floppy
, NAV,
, or DOS SYS
 The Ohio
is a
s360K floppy
Ks.  The Ohio
in many
 respects to the Den Zuk
, and is believed to possibly be the
 earlier
of Den Zuk.  A
Ohio
 immune to
tby the Pakistani Brain
 The
in the Ohio
 "V  I  R  U  S
 The Hackers
 Y C 1 E R P
 D E N Z U K 0
 Bandung 40254
 Indonesia
 (C) 1988, The Hackers Team
 See:   Den Zuk
PZPAPN
Oi Dudley
:  Oi Dudley
 Dudley
 Australia
R:  1,218 - 1,245
5:   PRhAK -
, NAV 3.0+,
 The Oi Dudley, or Dudley,
Gin Australia in
.  Oi Dudley is a
uof .
 and .
,.  It is a polymorphic
 employing an encryption mechanism
on the encryption used in the
 V2P6
, thus requiring an algorithmic approach to detection.  It
a fast
u, spreading
for any
 reason.  It has
!reported by several sources as
#prominent
 in Australia.
bOi Dudley
X, the Oi Dudley
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 4,608
|12's
!moved.
the Oi Dudley
, it
for any reason.
pof 1,218 to 1,245
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
 indicating the
, is
in the
 "[Oi Dudley!][PuKE]"
the Oi Dudley
Fories.
PZPAPN
OMud-512
:  OMud-512
j; TSR
R:  512
5:   PRsCK -
, NAV 3.0+,
2.11+,
6.64+,
6.64+
 The OMud-512
.  Its
.  OMud-512 is a
uof .
bOMud-512
as a low
TSR of
{10 and 21
 OMud-512 in
the OMud-512
, it
pof 512
at the end of the
a.  The
>and
in the
 DOS
to the
>and
.  The
can be
in the
5in all OMud-512
 "OMud."
OMud-512
[frequent
X, as well as possibly unexpected access to
 the
PZPAPN
:  OMT
 413, One More Thing
G:  May,
i; long
Kaccesses;
 Australia
R:  413
5:   PNCK -
1.25+
 The OMT, One More Thing or 417,
Gin Australia
 in May,
by Peter Ferrie.  The OMT
is a
uof .
 It is destructive
in years
the OMT
X, the OMT
wall of the .
in the
it has completed
sall of the .
hang usually
s.  The
wthe C:
Oroot
E, however it
5isn't functional.
the OMT
pof 413
at the end of
 the
a.  The
>and
in the DOS
not be
 OMT is an
, so no
 the
`.  The
 are included in the
 "c:\*.com"
 "And one more thing... fuck you!"
 The OMT
the year of the
.  At
, the
 starting at side 0, cylinder 0,
PZPAPN
Ondra
:  Ondra
 4915
G:  May,
:; access to
 unexpected
R:  5,000
5:   ONE -
3.96+,
8/93S+, NAV 3.0+,
1.25+
 The Ondra
in May,
.  Its
 Ondra is a
the Ondra
X, the
 Ondra
wall .
larger
 5,000
in the
 completed
sthe
in the
E, it
 start
on the B:
O.  If the B:
 a write-protected
J, it
retry writing to the
 indefinitely.
has completed
 the
ed to the DOS prompt.
the Ondra
p, but rather
be completely
5and
of the contents of
.  The
 and
in the DOS
not be
 The
can be
in the
 all Ondra
 "ondra.dat"
 "Invalid en
ment"
 "Run
the Ondra
, and
jmay frequently
of Ondra are:
 Ondra-B:
is a
 of Ondra
.  It
vone .
be completely
9ed in the
b4,915
 the
a.  It
8the same
as the
PZPAPN
Ontario
:  Ontario
Tin the case of extreme
 Ontario, Canada
R:  512
5:   PRtAK -
, NAV,
.2.0+
 The Ontario
}by Mike Shields in Ontario, Canada
.  The Ontario
is a
W, and overlay
`.  It
 The
the Ontario
X, it
the top of
$the
 and
@by 2,048
).  At
 the
,on the C:
O, increasing its
by 512
Xon the
, the
at the end of the
a.  For .
pby 512
)in all cases.  For .
Wand overlay
`, the
be 512 - 1023
).  The
 difference in
for .
Wand overlay
`is because the
fill out the unused space at the end of the last
 of the
random data (usually a portion of the
E) and
append
to the end of the
aat the
 next
using a
of more
 may notice larger
ps for
always
is a multiple of the
on the
 In the case of extreme
ts of the Ontario
Tmay be noticed.
 See:   1024 SBC   Ontario 730   Ontario III
PZPAPN
Ontario 730
:  Ontario 730
 Ont-730
i; TSR; FAT &
Damage
 Ontario, Canada
R:  730 - 744
5:   PRsA -
W, & Overlay
, NAV,
.2.0+
 The Ontario 730, or 730,
Gin Ontario, Canada,
.  Ontario 730 is a
W, and overlay
 The
Ontario 730 is
as a low
 TSR of 1,024
).  It
Ontario 730 is
, it
W, and
Nnot always
.  It
 not
Ontario 730
 of 730 to 744
).  The
at the end of the
a.  The
>and
in the DOS
not be
.  One
can be
 the
5of the Ontario 730
 "!=TVu"
 In advanced
ts of the Ontario 730
, the
) may be damaged by the
 See:   Ontario
PZPAPN
Ontario III
:  Ontario III
 Ontario, Canada
R:  2,048
5:   PRhAK -
 The Ontario III
 Ontario, Canada.  The Ontario III
on the 1024 SBC or
 Ontario II
, and is a polymorphic
vof .
W, overlay and .SYS
`.  It
 The
the Ontario III
X, it
the top of
$the
 and
@by 5,120
mby the
.  At
, the
wthe copy of
ed to by the
-SPEC
mental variable.
as the
the slack space at the end of
the Ontario III
, it
W, overlay (.OVL), and .SYS
for any reason.
 2,048
not be
 the
.  The
at the end
 of the
 The Ontario III
uses a very complex form of encryption
 no more
)remaining constant in
d samples.
 While the
in the
 not
`due to the encryption:
-SPEC=\
WOVLSYS"
 "MSDOS5.0"
 "YAM"
 "Your PC has a
&ache! - Get
medicine!"
 "Ontario-3 by Death Angel"
 The Ontario III
8an embedded
 it is never actually written out to
K.  It employs
techniques to avoid its
#disassembled using the DOS
 DEBUG
.  If it detects the use of the DOS DEBUG
fthe
 See:   1024 SBC   Ontario
PZPAPN
Oropax
:  Oropax
 Music
, Musician
?, 1989
i; tunes
R:  2,756 - 2,806
), but usually 2,773
5:   PRC -
, NAV,
, or
 The Oropax
has had several reports, but wasn't
 until
?1989.  It
`, increasing
by between 2,756
)and 2,806
 always
by 51.  The
 active
 (on a random basis) five minutes
tof a
a, playing
 three different tunes
a seven minute interval in between.
 One
recently reported in
Vplays six different tunes
 at seven minute intervals.
of Oropax are:
 Oropax-B:
in May,
 2,755 to 2,800
at the
 end of the
a.  It
 as a low
TSR of 3,072
), hooking
{21, CC, and F8.
 May,
 Oropax-C:
is a minor
of Oropax
!modified to avoid
 detection by one particular
utility.  It is
 not in the public domain.
 Oropax-D:
is a minor
of Oropax
!modified to avoid
 detection by one particular
utility.  It is
 not in the public domain.
PZPAPN
Otto6
:  Otto6
; host
R:  640
5:   PNCK -
3.96+, NAV 3.0+,
1.53S+,
 The Otto6
.  It is
.  Otto6 is a
 of .
,.  It
za small
 portion of its
it is not a complete copy
 of the
, and the
is not
wive
bOtto6
X, the Otto6
za small portion of its
5at the top of
$the
, as
qby the DOS
@by 2,048
mby the portion
 of Otto6
, providing it was not
, the Otto6
wone .
in the
the Otto6
X, the
 Otto6
wone
in the
pof 640
 the end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the
 "OTTO6 VIRUS, <<
S>>, YAM,
 COPYRIGHT MICROSHAFT INDUSTRIES
S>> YAM, MICROSHAFT INDUSTRIES (tm.)
 The Otto6
is an
.  It not
encrypts the
5, but the host
as well.
 It is
what Otto6
of Otto6 are:
 Otto-415:
on the Otto6
, Otto-415 is
 a 415
.  It
vone .
ain the
pof 415
at the
 end of the
a.  The
>and
in the DOS
not be
.  The Otto-415
encrypts the
5and the
, so the
are not
 "OTTO VIRUS written by: OTTO SCHTUCK"
 "COPYRIGHT MICROSHAFT INDUSTRIES
(tm.)"
PZPAPN
Outland
:  Outland
 2136, Oliver
R:  2,136 - 2,150
5:   PRhAK -
 NAV 3.0+,
3.96+,
8/93+,
 The Outland, Oliver or 2,136,
 Its
~are
.  Outland is
 the
, and like
<, is a
uof .
W, and overlay
`.  It
alters the
of the
J, maintaining a counter
bOutland
X, the Outland
at the top of
$the
', hooking
{21 and
 27.
, as
qby the
 DOS
@by 4,368
 12's
!moved.
the Outland
, it
 and overlay
pof 2,136
pof 2,136 to 2,150
 The
at the end of the
a.  The
>and
in the DOS
not be
 The
in the Outland
5in all
 "Bill the Cat Lives!"
 "Oliver Wendell Jones"
 "Politically Incorrect Personal Computers Presents:"
 "the OLIVER VIRUS!"
 "Nya Ha Ha!  Men Rule!  America Kicks Butt!  Rap Sucks!"
 "Eat Fatty Food!  Dames Melt Like Jell-O for Naughty Men!"
 "Ted Kennedy Sucks Barney Frank`s Fag Cock!"
 "Banana 6000 P.I.P.C. (C) I spell -Lightening- wrong!"
 The Outland
maintains a counter in the
of the
O.  It is
what it
 See:
PZPAPN
Over-4032
:  Over-4032
 Pascal-4032
 to function
anot
R:  4,032
5:   ONE -
30.00+,
V112+,
V113+,
1.25+
 The Over-4032 or Pascal-4032
.  Its
.  Over-4032 is a non-
.  It
 permanently corrupts the
the Over-4032
wone
 the
lthe
b4,032
)of the host
by the
.  Unless the
smaller
4,032
be no
smaller
4,032
 4,032
t.  The
in the DOS
to the
>and
naturally
compiled
the Borland Pascal
 compiler
are no unique
Over-4032
not function
, and
 may
Mthe
anot
PZPAPN
 OW-Trident, OW-64
 to function
R:  64
5:   ONCK -
3.96+,
, NAV 3.0A06+,
1.0A06+
 The
, OW-Trident, or OW-64,
.  The submission was actually of four related
 The OW-Trident
three
Cunder
at the end of
entry.
the OW-Trident
wall .
in the
)of the host
3in the
, unless the .
smaller
).  In the event
the host
smaller
, it
of 64
).  The
>and
in the
 DOS
1to the
 and
.  The
in all
-Trident"
are permanently damaged, and
no longer
 function
of the
 OW-37: A 37
of the OW-Trident
.  It
s the
bfive .
in the
 The
can be
din all
 OW-40: A 40
of the
.  It
s the
)of all of the
`in the
X.  No
in the
5.  Both
and data
`are corrupted by the
 May,
 OW-42: A 42
of the OW-Trident
s the
)of all .
in the
X.  It
8the
 OW-42B:
to OW-42, it is a minor
 Small-46: A 46
, Small-46
vone .
ain the
lthe
)of the host
ovewritten
 by the
, and the
>and
to the
>and
.  It
8the
 Small-72: A 72
, Small-72
vall of the .
`in the
lthe
)of the host
by the
, and the
>and
 the DOS
to the
>and
.  It
PZPAPN
Oxana
:  Oxana
=seconds set to 62;
R:  1,670
5:   PRhE -
3.96+, NAV 3.0+,
.2.0+,
1.25+
 The Oxana
, and is
fthe
.  Oxana is a
uof .
in its
5a long
in Russian.
bOxana
X, the Oxana
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 4,112
|12's
not be
 moved.
the Oxana
, it
for any reason.
pof 1,670
at the end of the
a.  The
>and
in the
 DOS
to be
 seconds field
!set to 62.
%the
mentioned
in Russian, the
in the
 "MSDOS3"
 It is
what Oxana may do
of Oxana are:
 Oxana.1719: Oxana.1719 is a 1,719
of the Oxana
.  Its
is 4,096
), hooking
|21.
, it
pof 1,719
at the
 end of the
a.  The
>and
in the DOS
to be
 seconds field
!set to '62'.
draw a graphic rectange in the center of the
9ing
cyrillic
4and 6 boxes.  If
 a character is
d in
Qbox followed by hitting the
key, the
continue
1994.
PZPAPN
:  Pa
 5792
H:
R:  5,792
5:   PNE -
n, NAV 3.0+,
8/93S+,
.2.0+,
1.25+
 The Pa, or 5792,
.  Its
it is probably
fEastern
V.  Pa is a
uof .
the Pa
X, the Pa
 may
wup to three .
on the C:
O.  The
start looking for
win the root
 moving down through the
Estructure.
the Pa
pof 5,792
at the
"of the
a.  The
>in the DOS
not be
, but
 the minutes in the
!set to 57.
rthree .
, the
Land the
ed to the DOS prompt:
Uin *.
a Pa
X, the
Lby the
and the
 to the DOS prompt:
 "Pa,pa slodki bobasku ..."
is not
PZPAPN
H:   March,
R:  1,589
5:   PNCK -
, NAV,
1.53S+,
 The P
in March,
.  Its
is a
the P
X, the
wone .
in the
E, it may
the P
pof 1,589
 at the end of the
a.  The
>and
 the DOS
not be
are several
can be seen
in the
5in P
 "\ ENU \TENNIS"
 "CHECKIT.LOG"
 "WHISTLE.SPL"
 "ETABLE1.GIF"
 "*.*"
 It is
what P
may do
to the
.  The
 "\ ODS \ STRIP R"
 "DOS"
 "GODS"
 "VOCEAN.LHZ"
 "MRA.V2E  CAR"
 "*.*"
 See:   Generic   Hominy
PZPAPN
Parasite
:  Parasite
H:
& buzzing; warm re
 Canada
R:  1,132
5:   PNCK -
n, NAV,
 The Parasite
fCanada.
 Parasite is a
uof .
,.  It is
on the Sicilian
 Mob
, and in
Fly on the
Parasite is
X, the Parasite
search the
Efor the
it finds
a, it
the Parasite
pof 1,132
).  The
at the end of
 the
be no
3to the
>and
in a DOS
 The
in the
 Parasite
 "(C)
by [NUKE] InterNat`nl Software Development"
 "Parasite
, Released
, Montreal, Canada"
 "--> [NukE] H/A/P/C/T/V at its Best! <---"
 "RABiT,RABiT,RABiT...EAT THIS!"
 "To John McAfee [I'll be BACK!]"
 "PATH="
one out of every four
 the Parasite
Mthe
accompanied by
 a loud buzzing on the
speaker:
 "Parasite
! by Rock Steady [NukE] HP"
is not
as it is
L, the
 Parasite
cause a warm re
&of the
of Parasite are:
 Parasite 2: Parasite 2 was
, and is
fMontreal, Canada.  It is a modified
of the
Parasite
many of
 the
having
!removed.  The
remain are:
 "ParaSite II - By: Rock Steady"
 "PATH="
Parasite 2 is
 the
wone .
ain the
E, plus
,if it was not
Parasite 2
pof 901
at the end of the
3to the
>and
in the DOS
Parasite 2
 may
[a "machine gun" noise
#emitted on the
speaker
jand intermittent
&failures may
.  The
the C:
E, and FAT on Mondays, however
Nnot function
:  Montreal, Canada
 Parasite 2B:
to Parasite 2, the Parasite 2B
 two
)larger
Parasite 2.  It adds 903
 the .
v.  The
 can be
din all
 "ParaSite IIB - By: Rock Steady"
 "PATH="
8the same bug as Parasite 2, preventing it
factivating on Mondays and
 Vengeance:
on the Parasite
, the Vengeance
Gin the
in late May,
.  It
vone .
pof 723
at the
 end of the
a.  The seconds in the
in the
 DOS
!set to 56, the
tmarker.
Vengeance
9the
 "*** Vengeance is ours! ***"
 "SKISM/Phalcon '92"
 "PATH=*.
 May,
 Vengeance-B:
, Vengeance-B is
 to Vengeance
.  The seconds in the
in the DOS
be set to 00
 on all
 Vengeance-B
9the
 "PATH=*.
:  Canada
 Vengeance-C:
, Vengeance-C is
 to Vengeance
, it has eight
 differ.
:  Canada
 See:   Sicilian Mob
PZPAPN
Paris
:  Paris
H:
i; slow
loads upon
 Paris, France
R:  4,909
5:   PNAK -
, NAV,
 The Paris
}in Paris, France, in early
is a generic
uof .
Wand overlay
`, and
,.  It is not
the Paris
X, the
wall .
Wand overlay
`on the
 and
the exception of very small .
check to see if
,on the C:
, if it has not
by between
 4,909 - 4,925
at the end of the
 The Paris
can be destructive in
instances,
ing in
Ibecoming corrupted if the
a Paris
PZPAPN
Parity
:  Parity
i; long .
loads; possibly
 intermittent parity
R:  441
5:   PNCK -
\, NAV,
 The Parity
, and
ated in
is a non-
uof .
`, and
the Parity
X, the
wall .
`in the
E.  If
,is in the
E, it
by 441
), the
at the end of the
.  The
>and
in the
not be
 by the
 The major symptom of a Parity
 significantly longer to load and
`.  The
is due to the
searching the
 for .
"PARITY CHECK 2" at
 and halt the
PZPAPN
Parity
:  Parity
 BSC;
; "PARITY CHECK"
hang;
 possible root
 Germany
 Australia
R:  N/A
5:   BRtX -
, NAV 3.0+,
8/93+,
:  CleanUp,
\, M-
K/P and DOS SYS
 The Parity
}in Australia.
is believed to
 in Germany.  Parity
&is a
uof the
) and
.  It is a
Fing
to read the
to the
 The
 the Parity
wthe
, as
qby the DOS
@by 1,024
), and
|12's
!moved to 9FC0.  The
lcopied the
to Side 0, Cylinder 0,
14 before
sthe
at Side 0, Cylinder 0,
the Parity
, it
wnon-
 write protected
are accessed. On 360K 5.25"
I, the
 On 1.2M 5.25"
I, the
28.  In both cases,
are the last
 the root
E, and any
Eentries
be lost.
the Parity
keys are pressed on the
 "PARITY CHECK"
s, the
be hung, requiring the
to reset the
 Parity
&is a
, it re
to read the
to the
copies it stores.
PZPAPN
Particle Man
:  Particle Man
s C:\AUTO
WC.BAT & C:\CONFIG.SYS
 New Mexico,
R:  690
5:   PNCK -
\, NAV 3.0+,
n1.04+,
2.58+,
6.64+,
2.58+,
1.25+,
6.64+
 The Particle Man
Gin the State of New Mexico in
 the
.  Particle Man is a non-
uof .
the Particle Man
 the Particle Man
wall .
in the
E, as well as
the AUTO
WC.BAT and
 CONFIG.SYS
the Particle Man
pof 690
at the end of the
a.  The
>and
in the
 DOS
not be
1.  The
in the
, and are not
 "Particle man, particle man
 Doing the things a particle can
 What's he like? It's not important
 Particle man Is he a dot, or is he a speck?
he's underwater
Nhe get wet?
Nthe water get him instead?
 Nobody knows, Particle man
 (c) Copyright Drizzt Do'Urden '92"
-*.* ..
 Particle Man
Nn't
to do
the AUTO
WC.BAT and CONFIG.SYS
&problems.
of Particle Man are:
 Particle Man 2:
gequivalent to the
is a minor
:  New Mexico,
PZPAPN
Pascal-4260
:  Pascal-4260
 Iris, Wirus
`corrupted/
"Abort, Retry,
 Warsaw, Poland
R:  4,260
5:   ONA -
, NAV 3.0+,
1.53S+,
1.25+
 The Pascal-4260
.  It is
 Warsaw, Poland.  Pascal-4260 is a
-and .
.  It is written in Borland's
 Turbo Pascal language.
the Pascal-4260
access the C:
Oand
wone
.  It
Ms the
$, substituting X for the
 "General
Ureading
 Abort, Retry,
 Regardless of what the
responds, the
 a second
aon the C:
O, and
Mthe
again.
responds the second
ed to
 the DOS prompt.
 The Pascal-4260
vboth .
-and .
 on the C:
O, and it can read down through the
 structure.
lthe
b4,260
)over-
 written
the Pascal-4260
5.  The
>and
 in the DOS
not be
.  Several
can be
in the
 "(C) by OSCAR"
 "6'89"
 Plus
fBorland's compiler.  The
in the
 thus not
 "To dopiero pierwaze pozdrowienia dla S.Fischera i M.Sella"
 "General
Ureading
 "Abort, Retry,
should be replaced
copies.
PZPAPN
Pascal-5220
:  Pascal-5220
 Pas-5220, Re
&Patcher
`corrupted/
 unexpected
&s; seconds in
= "00"
R:  5,220
5:   ONAK -
, NAV 3.0+,
1.25+
 The Pascal-5220 or Re
&Patcher
is a
vor trojanizes .
-and .
Pascal-5220 is
access the B: and C:
Os, trojanizing all .
"of the
5to re
 the
X.  The
wseveral
in the
b5,220
)of the
3to the
.  The seconds field of
 the
in the DOS
be set to "00".  The
can be
in the
 "*.com"
 "*.exe"
 "*.zip"
 "*.arc"
 "05520"
 "CJu"
Pascal-5220
[frequent
&s, and may notice
has dis
 DOS
PZPAPN
:  Path
 VHP-547,
j; random
4written to
R:  547 - 562
5:   PNCK -
, NAV,
 The Path, or VHP-547,
.  Its
.  Path is a
 of .
the Path
X, the
search the
Efor one
w.  If it finds one, it may or may not
rby the
 Path
pof 547 to
 562
).  The
at the end of the
be no
3to the
>and
 in a DOS
.  The
 "IBM"
 "PATH="
of an
tof the Path
hang the
s may
in random
#written to the
PZPAPN
Pathhunt
:  Pathhunt
i; .DBF
:; "Path not
 Republic of South Africa
R:  1,231
5:   PNA -
, NAV,
 The Pathhunt
Gin the Republic of South Africa
by Oliver Steudler.  Pathhunt is a
uof .
-and .
`.  It may
 corrupt .DBF
advanced
Pathhunt is
X, Pathhunt
 search the
Estructure for three .
do not start
a JMP instruction (E9h or EBh).  If
 the three .
are not
d, it
search the
path looking for
w.  If three
 candi
still
lnot
d, it
 up to three .
all of the .
r, it
w.DBF
`, permanently corrupting
data
ly, Pathhunt
Nnot always
correctly,
 corrupted and no
 longer function
, both .
-and .
Pathhunt
by 1,231
at the end
 of the
be no
3in the
 and
in the DOS
 The Pathhunt
comes
fthe behavior of the
a candi
, the
s the
to PATHHUNT,
vit, and
 it back to its
PZPAPN
Patient
:  Patient
i; TSR;
R:  1,504 - 1,519
5:   PRsA -
, NAV,
8/93+,
 The Patient, or PK,
Gin the
.  It was
by John McAfee.  Patient is a
-and .
u.  It
Nnot
,.  Patient is
d for its unusual behavior regarding
start to
 The
Patient is
X, Patient
as a low
TSR of
 1,920
{08, 21, 24, and 67
mby the
Patient is
, it
not start to spread or
for 20 minutes.
 for a minimum of 20 minutes, it
-and .
 over
2K in
-and .
by 1,504 to 1,519
at the end of the
be no
3in the
>and
in the DOS
 Patient
s hang the
 Later,
hang the
 Patient is an
, and
are no
in the
PZPAPN
Paturuzu
:  Paturuzu
 Paturuzu.1024
, 1994
i; TSR
 Argentina
R:  1,024
5:   PRsC -
V116+,
\2.13+,
n1.05+,
/2.1+,
2.58+,
6.64+,
.2.0+,
6.64+,
1.25+,
V116+,
2.58+
 The Paturuzu or Paturuzu.1024
fArgentina in
, 1994.  It is a
uof .
 but not
bPaturuzu
as a low
TSR of 1,360
), hooking
{13 and 21.
, it
 of 1,024
at the
"of the
a.  The
>and
in the DOS
not be
.  The
in the
TOMY"
of Paturuzu are:
 Paturuzu.931: A later
of the Paturuzu
at the top of
$the
@by 1,920
), and
mby the
, the
wthe copy of
in the C:
Oroot
Eif it wasn't
, the
 of 931
not be
.  The
 and
in the DOS
may dis
, and
 the seconds field
!set to "58".  The
in the
 "Huijaaa!! La proxima vez sera tarde..."
 "Si sos MENEMISTA reza por tus discos."
 ">>
PatoruzU 2.0 - Argentina <<"
 "C:\
, the DOS
detect
Ton all
:  Argentina  May, 1994.
PZPAPN
Pay Rise
:  Pay Rise
 Dennis, Pay Rise-897
G:  March,
 England
R:  897
5:   PRhAK -
3.96+,
 The Pay Rise, Pay Rise-897 or Dennis,
 March,
.  It is
fEngland.  Pay Rise is a
uof .
-and .
bPay Rise
X, the Pay Rise
at the top of
$the
'.  It
Nnot move
 12's
, as
 by the DOS
@by 1,872
mby the Pay Rise
, the Pay Rise
-and .
pof 897
 the end of the
a.  The
>and
in the DOS
not be
.  The
 are
in the Pay Rise
 "[Dennis-1] Apache Warrior, -= ARCV =-."
 "To Dennis Yelle You Need A Pay Rise!"
 "McAfee Eat Lead
 It is
what Pay Rise may do
of Pay Rise are:
 Pay Rise-874: An 874
of the Pay Rise
 1,824
), hooking
|21.  It adds 874
)to the .
-and .
 and
8the same
as the
:  England  March,
PZPAPN
PC Flu
:  PC Flu
R:  802
5:   PRfCK -
/, NAV,
.2.0+
 The PC Flu
.  Its
.  PC Flu is a
uof .
 The
PC Flu is
X, PC Flu
in low
 hooking
|21.
 not be
PC Flu is
, it
for any
 reason.
PC Flu
pd in
 by 802
).  The
at the end of the
a.  The
dnear the end of all
 "PC-FLU by WIZARD
 It is
what PC Flu
 See:   PC Flu-2
PZPAPN
PC Flu-2
:  PC Flu-2
 Flu-2
i; TSR; possible
 input omissions
 Poland
R:  2,112 - 2,126
5:   PRsAK -
, NAV,
30.00+,
.2.0+,
1.25+
 The PC Flu-2
.  Its
 Poland.  PC Flu-2 is a
uof .
-and .
Nnot function
on 386 computers, and
`on those
in a
hang.
 The
PC Flu-2 is
X, the
 PC Flu-2
as a low
TSR of 6,192
{21 and 27
 the PC Flu-2
the PC Flu-2
, it
for any reason.
pof 2,112
at the
"of the
pof 2,112 to 2,126
at the end of the
a.  In either case, the
>and
in the DOS
by the PC Flu-2
 PC Flu-2 is an
and no
in the
 It is
what PC Flu-2
of PC Flu-2 are:
 PC Flu-2B: A 2,141
of the PC Flu-2
adds 2,141 to 2,157
)to the .
v.  In addition to the 6,192
*TSR
 by the
is a small portion of the
 placed in high
hooks
 and 09.
interfers
input so
d on the
may not
.  The
 the
 "PC-FLU Mk II by Wizard
:  Poland
 PC Flu-2D: A later
of PC Flu-2B,
 2,134 to 2,148
)to the .
8the same
as PC Flu-2B,
 and
interfers
input.
:  Poland
 PC Flu-2E:
to PC Flu-2D,
adds 2,134 to
 2,148
)to the .
v.  It is
 different in
 are
X.  It
8three
in the
 "PC-FLU Mk II by Wizard
 "-FLU Mk II by Wizard
 "Incorrect DOS
:  Poland
 PC Flu-2F: A 2,156
of PC Flu-2,
-and .
pof 2,156
at the
"of the
 2,156 to 2,170
at the
 end of the
Nnot interfer
input.
:  Poland
 See:   PC Flu
PZPAPN
:  PCBB
 1677, PC
*Bandit
H:   March,
&failure;
 Sweden
R:  1,677
5:   PRK -
1.25+
 The PCBB, or PC
*Bandit,
in March,
.  It
ated in Sweden.
is a
it is very buggy and not really viable in its
 present state.  It is
on the 1720
the PCBB
immediately
,.  At
, the
be hung.  If the
,, the
hang.
the PCBB
pof 1,675 - 1,677
).  The
 the end of the
a.  The
>and
in the
 DOS
to the
>and
.  The
 can be
dat the end of all
 "PCBB"
of PCBB are:
 PCBB-3:
in March,
, the PCBB-3, or 1720-C, is a
 1,719
of the PCBB
.  It
vthe copy
ed to by the
-SPEC en
ment
X, as well as
 becoming
at the top of
$the
', hooking
{09, 1C, and
 21.
@by 4,096
Nnot
to hide the
.  The
"PCBB" can be
dat the end of all
`, and the
 its
 "<> Demoralized Youth <>"
 "PCBB,
 "Written by <: Charlie! :>".
:  Sweden  March,
 PCBB-3B:
, the PCBB-3B
 1,722
of the PCBB-3
.  It
vthe copy
ed to by the
-SPEC en
ment
X, as well as
 becoming
at the top of
$the
', hooking
{09, 1C, and
 21.
@by 62,176
it is difficult to get it to do
to hide the
.  The
"PCBB"
 can be
dat the end of all
`, and the
in its
 "<> Demoralized Youth <>"
 "PCBB,
 "Written by <: Charlie! :>".
:  Sweden
 PCBB-5: PCBB-5 is a 1,680
of the PCBB
.  It
in a manner
to PCBB-3.  The
 major difference is
 on open or
Z, adding 1,680
 The
pis not hidden, and the
in the DOS
to the
>and
.  Like the
 members of
group, the
"PCBB" can be
 at the very end of
`.  It
in the
 "Pc
*Bandit ver5".
 PCBB-5 is a polymorphic
, employing a complex encryption
 mechanism.
:  Sweden
 PCBB-5B:
to PCBB-5,
is a minor
and is
gequivalent.
:  Sweden
 PCBB-1141: PCBB-1141 is a 1,141
of the PCBB
X.  Its
 4,096
at the top of
$the
 DOS
{09, 1C, and 21
of PCBB
,, not
 and .
pd in
 by 1,141
at the end of the
be hidden
PCBB-1141 is
.  The
>and
in the
 DOS
not be
.  The
"PCBB" can be
dat the end of all
:  Sweden
 PCBB-3072:
on the PCBB
, PCBB-3072 or PCBB-11 is a
 3,072
of the
.  It
 and
X.  Its
is 6,176
at the
 top of
$the
 09, 1C, 21, and 24
 PCBB-3072
-and .
pof 3,072
at the
 end of the
 hidden if PCBB-3072 is
PCBB-3072 is
, the DOS
indicate
Ton all
.  The
 and
in the DOS
not be
.  The
in the
5and are not
 "PCBBCSX.?."
W.BATVBAPW"
 The
"PCBB" can be
dat the end of all
:  Sweden
 See:   Sistor
PZPAPN
:  PCV
 PCVRSDS
 TSR; .
`may be
 Italy
R:  1,904
5:   PRsA -
n, NAV,
3.96+,
 The PCV
fItaly.  PCV is a
uof .
-and .
.  It
 The
PCV is
X, PCV
as a low
TSR of 1,904
).  The
hook
PCV is
, it
-and .
X.  .
by 1,904
at the
"of the
a.  .
by 1,910 to 1,918
at the end of
`.  The
p, however,
mostly be hidden by the
 if it is
.  The
>and
in the
not be
notice
or are
Bd randomly
fthe
`may be
, .BAT
`, or data
`may
to view them, such as
aeditor.
Ymay
Bd by the
 If the DOS
indicate
PZPAPN
Peace Man
:  Peace Man
 The
R:  2,066 - 2,080
5:   PRhE -
V108+,
6.60+,
2.58+,
2.11+,
 NAV 3.0A06+,
n1.05+,
\2.13+,
2.58+,
6.64+,
1.25+,
1.0A06+
 The Peace Man
, and is
 The
.  It is a
uof .
bPeace Man
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 2,592
{21 and 22
mby Peace Man in
, the Peace Man
pof 2,066 to 2,080
at the
 end of the
a.  The
>and
in the DOS
to the
 and
.  The
in the
5in all Peace Man
ag pappie"
 "peace man, peace
 "GG"
 The last
, "GG", can be
dat the very end of all
 It is
what Peace Man
PZPAPN
Pegg-833
:  Pegg-833
 Pegg
G:  March,
; write protect
R:  833 - 847
5:   PRhEK -
30.00+, NAV 3.0+,
6.64+,
1.25+
 The Pegg-833
in March,
.  Pegg-833 is a
,and .
.  It
 not
bPegg-833
X, the Pegg-833
at the top of
$the
', hooking
{21 and
 6C.
, as
qby the
 DOS
@by 1,120
 12's
not be moved.
, the Pegg-833
,, if it was not
, the Pegg-833
pof 833 to 847
at the end of the
a.  The
>and
in the
 DOS
not be
.  No
 are
in the
5in Pegg-833
the Pegg-833
[repeated
 write protect
fwrite-protected
I.  The write-protect
scroll down the
response.
PZPAPN
Pentagon
:  Pentagon
 Extinct
, 1988
 TSR; BSC 360k floppies;
a(see
R:  N/A
5:   RF -
Floppy
, NAV,
K, CleanUp, or DOS SYS
 The Pentagon
consists of a normal MS-DOS 3.20
 where the
'IBM' has
!replaced by 'HAL', along
`.  The
ahas a
of the hex character 0F9H, and
8the portion of the
would not fit into the
, as well as the
of the
K.  The second
d PENTAGON.TXT and
Nnot
 be used or
9any data.  The 0F9H
ais accessed by its
 absolute storage address.  Portions of
 The Pentagon
v360K floppies, and
look for
 and remove the Brain
fany
v. It is
, occupying 5K of RAM, and can survive a warm re
 (CTL-ALT-DEL).
PZPAPN
Penza
:  Penza
R:  700
5:   PRhAK -
, NAV 3.0+,
 The Penza
.  Its
.  Penza is
on the Vacsina
es.  It is a
uof .
-and .
 The
the Penza
at the top of
$the
'.  It
Nnot move
 12's
, as
 by the DOS
@by 2,288
mby Penza in
the Penza
, it
pof 700
at the end of the
a.  The
>and
in the DOS
 not be
.  No
 The Penza
Mthe
 accompanied by a beep
 "Welcome to Penza!"
 Penza
Nn't
to do
Mits
 and
of Penza are:
 Penza-1210: A 1,210
of the Penza
, Penza-1210's
is 1,328
), hooking
, it
-and .
X, increasing
by 1,210 to
 1,225
).  The
at the end of the
a.  The
>and
in the DOS
not be
on the
monitor:
 "Best wished
fPenza!"
 See:   Vacsina
PZPAPN
Perfume
:  Perfume
 765, 4711, G-
?, 1989
 Germany
R:  765
5:   PRhCK -
, NAV,
\, NAV, or
 The Perfume
is of German
, and has
 in Poland in
?, 1989.
 The
the Perfume
 the Perfume
at the top of
$the
, as
qby the DOS
@by 1,024
mby the
, the Perfume
,if it was not
the Perfume
, it
pof 765
 the end of the
a.  The
>and
in the DOS
not be
.  One
 in all
 The
s ask the
a question, and
 not run the
unless the
responds by
 typing 4711, the
of a German perfume.  In the most
, however, the questions
miscellaneous
of Perfume are:
1.2: A later
of the Perfume
1,024
), hooking
|21.  As
, it
if it was not
r.  G-
 1.2
X, adding
 653
.  The
 at the end of the
a, and the
>and
 in the DOS
not be
 The
in the
5in all G-
 "G-VIRUS V1.2"
 "Schon mal was von G-
rt ?"
V1.2
Mthe second line of
 as a
on the
 See:   Sorry
PZPAPN
Phalcon.894
:  Phalcon.894
, 1994
R:  894
5:   PNCK -
V116+,
\2.13+,
n1.05+,
2.58+,
6.64+,
1.25+,
6.64+,
V116+,
2.58+
 The Phalcon.894
, 1994.  It is probably
fNorth America.  Phalcon.894 is a
uof .
the Phalcon.894
wall of the .
in the
pof 894
 the
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the
 "\ *.com *.* .."
 "PHAL-894.
 See:   Beta
PZPAPN
Phantom
:  Phantom
; shift of
 Hungary
R:  2,274
5:   PRhC -
, NAV,
 The Phantom
}in Hungary in
, by Dr.
 Szegedi Imre.
is a
uof .
`, but not
 The
the Phantom
X, the Phantom
 the top of
$the
{20 and 21
mby the
, and the
 DOS
report
 2,704
)less
expected.
becoming
, the Phantom
if the
 is greater
2K.
 2,274
at the end of
the Phantom
Lintermittently
 "HI ROOKIE!
 I`m a THESEASE! I live in YOUR computer - sorry...
ks to Brains in the Computer Siences!"
, as
 in the
5, cannot be seen in
 are
S.  The
Sin the
5are:
 "The PHANTOM Was HERE - SORRY"
 "(c) PHANTOM  -
was designed in the HUNGARIAN
 VIRUS DEVELOPING LABORATORY. (H.V.D.L.) v1.0"
symptom of the Phantom
occasionally
 alter the
what should start on the left side
 of the
starts in the middle (it is shifted 50%
 around on the same line).
PZPAPN
Phoenix
:  Phoenix
failure;
,header
R:  1,704
5:   PRhCK -
, NAV,
 The Phoenix
is of
, and was
to the
 author of
document in
by Vesselin Bontchev.
is one of a
]of three (3)
may be referred
 to as the P1 or Phoenix
es is
 documented separately due to
varying characteristics. The
 Phoenix
is a
, generic
uof .
 and
 The
the Phoenix
X, the
 high
, reserving 8,192
 the
 8,192
). If the
fa floppy
O, and
,was not present on the
J, the
 request
,present be inserted in
 the
O.  Phoenix
immediately
part of the binary zero portion of the
, and
 changing the
header
.  The
,residing in the C:
Oroot
becoming
, the
attempt to
 any .
X.  Most of its
, however,
in a
r.  Phoenix is a fairly poor
 replicator.  If the
is successful in
sthe
a, it
append its
5to the end of the
a, increasing the
by 1,704
 Phoenix is not able to recognize
it has
a, so it may re
`several
in an
1,704
#appended to
 the
the Phoenix
[problems
executing
 Phoenix
in a warm re
&of the
ring, however the
of Phoenix
 survive the re
&.  If an autoexec.bat
ais not present on the
f, the
prompt for the
 enter
>and
 The Phoenix
employs a complex encryption mechanism, and
ners
able to look for simple hex
 not be able to detect it.
is no simple hex
7to all
rsamples.
is not related to the Cascade (1701/1704)
 See:   Evil   Phoenix 2000   PhoenixD   Proud   V82
PZPAPN
Phoenix 2000
:  Phoenix 2000
; TSR;
R:  2,000
5:   PRshAK -
\2.13+
 The Phoenix 2000
fThe
, where it was uploaded to several BBSes by a person identifying
 themself as "
<".
ated in
(, and
 is closely related to the earlier V82
.  Phoenix 2000 is a
uof .
-and .
`, as well as
 The
Phoenix 2000 is
X, the
 Phoenix 2000
at the top of
$the
'.  It
 small TSR in low
of 112
).  The
at the top
is 8,192
is the amount
qby the DOS
 by.  The
be slightly more.
 The Phoenix 2000
hooks
|2A.
|12's
!moved.
Phoenix 2000 is
, it
-and .
 copied, or accessed in any way.  While it
always
`are
successfully
 2,000
)of binary 00
4in a continuous block.  If the
 2,000
)of binary 00
4do not exist, the
amay be
 partially
r, but
not be replicating copy of the
pof 2,000
in the middle
 or end of the
a.  Phoenix 2000 is unable to identify
 previous
ts of
`, so
 may
rby Phoenix 2000, adding an
2,000
)to the
afor
be no
 to the
>and
in the DOS
,and .
the Phoenix 2000
.  In
two cases,
 the
2,000
)of binary 00
 the
5.  For .
less
2,000
)of binary 00
4, the
be partially
 and may not function
as a
 See:   Phoenix   V82
PZPAPN
PhoenixD
:  PhoenixD
failure;
,header
R:  1,704
5:   PRhCK -
, NAV,
 The PhoenixD
is of
, and was
to the
 author of
document in
by Vesselin Bontchev.
is one of a
]of three
may be referred
 to as the P1 or Phoenix
es is
 documented separately due to
varying characteristics. The
 PhoenixD
is a
, generic
uof .
`, and
 The PhoenixD
is a "bug fixed"
of the Phoenix
 The
the PhoenixD
X, the
 high
, reserving 8,192
 the
 8,192
). PhoenixD
check to see if the
 root
8a copy of
,.  If a copy of
d, it
rby PhoenixD by
part of the binary zero portion of the
, and
 changing the
header
.  The
,residing in the C:
Oroot
becoming
, the
attempt to
 any .
X.  PhoenixD is a much better replicator
 the
Phoenix
, and is usually able to
by 1,704
 PhoenixD is not able to recognize
it has
a, so it may re
`several
in an
1,704
#appended to
 the
 A characteristic present in the PhoenixD
is not
 in the
Phoenix
in addition to it
for any reason.  The simple act of copying a .
PhoenixD present in
in both the source
 and target
the PhoenixD
[problems
executing
 Phoenix
in a warm re
&of the
ring. If an autoexec.bat
ais not present on the
f, the
prompt for the
to enter
>and
 The PhoenixD
employs a complex encryption mechanism, and
ners
able to look for simple hex
not be able to detect it.
is no simple hex
7to all
rsamples.
is not related to the Cascade (1701/1704)
 See:   Evil   Phoenix   Proud
PZPAPN
:  Pi
i; TSR;
R:  1,552 - 1,568
5:   PRsE -
n, NAV 3.0+,
1.53S+,
.2.0+
 The Pi
.  Its
.  It is a
uof .
X, the Pi
as a low
TSR of 2,048
).  It hooks
{1C and 21.
the Pi
, it
pof 1,552 to 1,568
 the end of the
a.  The
>and
in the DOS
to the
>and
.  One
 in the
 "P I _ P I"
Pi has
10 minutes,
Mthe
in the upper right hand corner of
 the
PZPAPN
Piazzolla
:  Piazzolla
i; TSR
 Argentina
R:  874
5:   PRsC -
2.58+,
1.53S+,
2.58+,
6.64+,
1.25+
 The Piazzolla
fArgentina in
is a
uof .
, but not
bPiazzolla
X, the Piazzolla
as a low
 of 1,200
mby the
Piazzolla is
, it
X.  Piazzolla
pof 874
).  The
at the
"of the
.  The
>and
in the DOS
.  The
can be
in the
5in all Piazzolla
 "Piazzolla"
-MAND
 "PIAZZOLL.$$$"
 Piazzolla
Nn't do
PZPAPN
:  Pif
 Pif Paf B v1.0
G:  May,
 Hungary
R:  760 - 774
5:   PRhAK -
, NAV 3.0+,
.2.0+
 The Pif, or Pif Paf B v1.0,
in May,
 Hungary.  Pif is a
uof .
-and .
 The
the Pif
at the top of
$the
, as
qby the DOS
@by 800
 12's
not be moved.
 Pif in
the Pif
, it
-and .
X.  If
X, it
pof 760
).  .
pd in
 by 760 to 774
).  In both cases, the
at the
 end of the
 The
can be
in the
 Pif
 "PIF-PAF B v1.0"
 "Nincs kegyelem !"
the Pif
notice
 and
continue to
Athe longer the
is in
X, Pif
copy of
, decreasing
by an
PZPAPN
:  Pila
 Unknwon
R:  1,731 - 1,746
5:   PRhA -
2.58+,
\2.13+,
2.58+
 The Pila
.  Its
.  Pila is a
uof .
 and .
, but not
 The
the Pila
at the top of
$the
|12's
 not be moved.
qby the DOS
@by 2,016
mby Pila in
the Pila
, it
-and .
pof 1,731 to 1,746
at the end of the
a.  The
in the DOS
not be
 The
in the
5, and
 is not
 "pilapilapilapilapilapilapilapilapilapilapilapilapilapilapila"
 It is
if Pila
 bears
ity to the Year-
PZPAPN
Ping Pong
:  Ping Pong
 Bouncing Ball,
&, Bouncing Dot, Italian, Italian-A,
 Vera Cruz
G:  March, 1988
 Graphic
M(see
); TSR; BSC
R:  N/A
5:   BRsF -
, NAV,
K, CleanUp,
, NAV,
 or DOS SYS
 The Ping Pong
is a
breported
 in March 1988.  The
Ping Pong
vFloppy
Ks.  Later
wthe
as well.
is on a random basis, a bouncing
 ball or dot
s on the
Mcan
 stopped through a
&.  No
damage is apparently
 done.
 The
Ping Pong
is extinct,
, Ping Pong-B listed
$, is a
7MS-DOS
of Ping Pong are:
 Ping Pong-B: A later
of the Ping Pong
 May, 1988.
 Ping Pong-C:
to Ping Pong-B,
Nnot
 the bouncing ball
effect.
:  Argentina
PZPAPN
Pinky
:  Pinky
 Pinky Ghost
H:
`created; Cursor may dis
may fail to function
{01 and 03
R:  952
5:   PSaE - Spawning
2.58+,
6.64+,
2.58+,
6.64+,
1.25+
 The Pinky, or Pinky Ghost,
 and is one of three related
fthe popular Pac-Man video game.  Pinky is a
, spawning or companion
 creating corresponding .
bPinky
X, the
za portion of
 hooking
{01 and 03.
is an attempt by the
 avoid having debugger
used against it.  The
 on to
the Pinky
wthree or more .
in the
Eby creating a .
the same base
 corresponding or companion
be 952
, and
 the Read
attribute set.  The companion
>and
 the DOS
match the .
a.  The
in the
5in all of the
 Pinky companion
 "[Pinky Ghost]"
 "The Pac-Man PINKY Ghost is watching."
 "(Can you find Inky?)"
 It is
what Pinky may do
of Pinky are:
 Pinky.Clyde: A 5,120
of Pinky, Pinky.Clyde
 one .
in the
X.  The host
copy the host
the same base
and a
aextension of .PAC, the
aattributes
be set to Read-
and Hidden.  The
s the
b5,120
)of the host
were
larger
65,535
 65,535
.  The
>and
in the DOS
not be
.  The
in the
 "[Clyde Ghost]"
 "!@-!@-!@.
-!.!"
 "The Pac-Man CLYDE Ghost is watching.."
 "(are we getting irritating?)"
 to the DOS prompt
too big to fit in
, 1994.
 See:   Blinky   Inky
PZPAPN
Pirate
:  Pirate
 Lima
 Lisbon, Portugal
R:  609
5:   ONCK -
, NAV,
 The Pirate
Gin Lisbon, Portugal in
, by Pedro Lima.  Pirate is a
Pirate is
 search the currect
Efor an
 it finds an
a, it
wit,
b609
)of the
Pirate
was less
 609
).  If the
was less
 the
 609
be no
 in the
>and
in the DOS
 If Pirate
Nnot find an .
w, it
continue
 searching the
Euntil the
&s the
&the
a Pirate
in a
hang.
 The
can be
din all
Pirate:
 "1989 /
Software Pirates - Fast Serial - Portugal"
PZPAPN
Pirate 1344
:  Pirate 1344
Zfailure;
too big to fit in
R:  1,344 - 1,358
5:   PRhE -
\2.13+,
 The Pirate 1344
.  Its
.  Pirate 1344 is a
uof .
bPirate 1344
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 1,344
 and 21
mby the
the Pirate 1344
, it
pof 1,344 to 1,358
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
5in all Pirate 1344
 "PirateMZ"
Lon the
monitor on
rmonochrome
may fail
too big to fit in
 Pirate 1344
Nnot
to be related to the  Pirate
Cin an
entry.
PZPAPN
Pisello
:  Pisello
 1030
H:
i; TSR
 Italy
R:  1,030 - 1,040
5:   PRsE -
, NAV,
 The Pisello
.  It is
fItaly.  The Pisello
is a
uof .
bPisello
X, the Pisello
as a low
 TSR of 2,112
mby the TSR,
mby the
mapping utilities.
the Pisello
, it
pof 1,030 to 1,040
).  The
at the end of the
.  The
>and
 the DOS
not be
in the
5in Pisello
.  The
in the
 "My
is PISello BYE 31-1-92"
 It is
what Pisello
of Pisello are:
 Pisello-B:
gequivalent to Pisello, Pisello-B is
 a minor
 May,
PZPAPN
Pitch
:  Pitch
H:
i; TSR; high pitched noise emitted
 speaker
 France
R:  593
5:   PRsCK -
3.96+, NAV 3.0+,
1.25+
 The Pitch
Gin France in
.  Pitch is
uof .
 It can be a very noisy
bPitch
X, the Pitch
as a low
TSR of
 1,568
).  It
hook
{1C, 21, 25, 26, 2F, and 47.
 In addition to the TSR, it
allocate an
64K of
, so
actually
Aby 65,680
, the
wthe
on both the
;and C:
the Pitch
, it
X, along
on the
Oand
OC:.
pof 593
at the
"of the
a.  The
can be
in all
 "*.com .. *.*"
 "DOS
the Pitch
for 15 to 30 minutes,
emit a high pitched noise
fthe
speaker.
of Pitch are:
 Pitch-B:
gequivalent to the
has five
differ.
:  France
PZPAPN
Piter-1228
:  Piter-1228
H:   March,
1to 0-00-83 12:05a
R:  1,228
5:   PRhAK -
n, NAV 3.0+,
 The Piter-1228
in March,
.  Its
.  Piter-1228 is a
uof .
-and .
bPiter-1228
at the top of
$the
', hooking
{09 and 21.
|12's
not be moved.
, as
qby the DOS
@by 1,376
the Piter-1228
, it
pof 1,228
at the end of the
a.  The
 and
in the DOS
 the value "0-00-83 12:05a".  The
in the Piter-1228
 "Recommendation for restart make use of RESET"
 "Piter"
 It is
what Piter-1228 may do
PZPAPN
Pixel
:  Pixel
 V-345
 Endangered
H:   1988
 Greece
R:  345
5:   PNC -
, NAV,
.2.0+
\, or
 The Pixel
distributed in Greece in 1988 by
 Pixel magazine.  It is a
,.  Since its
release,
!many
of the Pixel
are listed
$under
, or under the
 entries
the Pixel
X, the Pixel
wall .
`in the
 345
at the
"of the
a.  The
>and
in the DOS
to the
>and
 The
can be
 the
Pixel
 "=!=
sick
U:Call doctor or buy Pixel for cure
 description"
 "WB"
 "WB" is the
tmarker for the
Pixel
, and is
din the third and fourth
)of all
 The
Pixel
Nn't do
of Amstrad are:
 MS-748:
on the Pixel
, MS-748
vall of the .
in the
pof 748
 at the
"of the
a.  The
>and
 the DOS
to the
>and
.  The
dnear the
"of all MS-748
 "MS*.
 Pixel-257:
to the Pixel
adds 257
)to the
 All
lhad
1to "4-24-80 12:04a".
 "Fucking hell:You wet pussy"
 The two character ASCII
"WB"
 the third and fourth
)of all
 is the
tmarker for the
.  Pixel-257
Mthe second
all of the .
 the
r.  At
, the
Y, but the
ed to the DOS prompt
 Pixel-275:
to the Pixel-257
 275
)to the
v.  It
Nn't
 the
, and
are the same as for Pixel-277.
 Pixel-277:
to the Pixel
, except
is now 277
, and
9any
.  The
!replaced
5to produce a parity
50% of the
: V-277
 Pixel-283:
to Pixel,
adds 283
)to the
>and
in the DOS
 to "4-24-80 12:04a".
 are:
 "=!What a stupid you are
 Pixel-283
Nn't do
 Pixel-295:
to Pixel,
adds 295
)to the
>and
in the DOS
 to "4-24-80 12:04a".
din Pixel-295 are:
 "=!=
sick
U:Call doctor or buy PIXEL for
 cure description"
 Pixel-295
Nn't do
 Pixel-297:
on the Pixel
in the
pof 297
 at the
"of the
a.  The
>and
 in the DOS
not be
 The
can be
in the
5of all Pixel-297
 "Happy Birthday,Cheef"
 Pixel-299:
to Pixel, except
of the
 is 299
: V-299
 Pixel-342:
to Pixel, except
of the
 is 342
).  The "WB"
tmarker in the
1to "IV".
 Pixel-739:
to Pixel, except the
of the
 now 739
lhad
>and
set to the
>and
.  The
in the
are: "IV" (the
 marker) and "*.
-".  Pixel-739 is actually much smaller
, the remainder of the
 Pixel-779:
to Pixel, except the
of the
 now 779
lhad
>and
set to the
>and
.  The
in the
are: "IV" (the
 marker) and "*.
-".  Pixel-779 is actually much smaller
, the remainder of the
 Pixel-837:
to Pixel, the
of the
is now
 837
lhad
>and
set to the
>and
 are:
 "=!= I love you so much !!!"
 "-- Francis"
 Pixel-847:
to Pixel, except
of the
 is 847
: V-847
 Pixel-847B:
to Pixel-847, except
in the
is now in Spanish and is:
 "=!= En tu PC hay un
RV1, y esta es su quinta
 generacion".
distributed by a magazine in
 Spain in
aNOCARGAR.
: Spain
: V-847B
 Pixel-850:
members of
 was
in March
by 850
at the
"of the
8the same
as the
Pixel.
V, March
: Pixel 2
 Pixel-850 Dropper: The Pixel-850 Dropper is the
"dropper"
aof the Pixel-850
is 384
, and
wall .
 the
Pixel-850.
V, March
: S-847
 Pixel-852:
to the Pixel-847
 not
9any
.  The
sample of
by the author did not
9any
 however,
replicating on a test
, all
fthe video buffer,
 implies the
sample was the
distribution
 of the
checks
)4-5 of .
 to determine if the
awas
r.  If
)4-5 are "SS", the
assumes the
ais already
: V-852
 Pixel-854:
to the Pixel-852
, Pixel-854 differs
 primarily in
it adds 854
)to the .
 Portugal-500:
on the Pixel
fPortugal in May,
.  It is a
wall the .
`in the
pof 500
at the
"of the
.  The
>and
in the DOS
to the
.  Portugal-500
9any
, and
: Portugal, May
 See:   Amstrad   Hell   Pixie   Silly   Silly-365
PZPAPN
Pixie
:  Pixie
 Pixie 1.0
Kread
R:  812
)(and multiples
5:   PNCK -
D:  NAV,
 The Pixie, or Pixie 1.0,
 a source in the
.  Pixie is a
uof .
,.  It is very
 buggy.
Pixie is
X, the Pixie
wall of the .
`in the
E.  A bug in
Nnot recognize
it has completed
sall of the .
`, so it promptly starts re
 them.
continue until the
&s the
 Pixie
pof 812
usually the
be a multiple
 of 812 due to the re
ts.  The
at the
"of the
a.  The
>and
in the
 DOS
to the
the last
t/ re
 The
can be
din all Pixie
 "The Pixie
v1.0 - Written by NegativX"
 "- Copyright (c)
, -SiTT-"
 The Pixie
is actually much smaller
), around
 306
.  The
be filled
 binary 00
4, or random data
Zof .
the Pixie
 in a
Kread
ring.
Uis on the
adue to
 the
&ing while the
was writing to the
of Pixie are:
 Pixie 1.0B: A minor
of the Pixie
 May,
 See:   Pixel
PZPAPN
Plastique
00<    I
    PT<
:  Plastique
 Plastic Bomb, Plastique 3012, Plastique 1, Anticad 3
 TSR; .
i; possible
slowdown or bomb
 noises
 Taiwan
R:  3,012
5:   PRsA -
\, NAV,
:  CleanUp, or
 The Plastique, or Plastic Bomb,
 it comes to us
fTaiwan.  Plastique is a
generic
uof .
-and .
Nnot
,.  Unlike the Plastique-B
listed
Nnot
wfloppy
 The
Plastique is
X, the
as a TSR in low
.  The TSR is 3,264
, and hooks
, it
attempt to
-or .
is rather "buggy",
 and it is not always successful in
it is successful
sthe
a, the
p.  For
`, the
pby 3,012
).  For
pbetween 3, 012 and 3,020
 Plastique
attempt to
 for any reason,
again, it is not always successful.
20th of any year, the Plastique
, it
do either of two things.  It
either
 progressively slowdown the
, or it
intermittently emit
 "bomb" noises
fthe
speaker.
of Plastique are:
 HM2: The earliest
, it
.  Executing an
s in the
 hanging requiring a re
: Taiwan, May
 Plastique 4.21: A
of the Plastique
 the
real difference is
the encryption of
 the
is slightly different.
wise it
ls exactly the same as Plastique.
: Taiwan,
 Plastique COBOL: A
of the Plastique
is 3,004
, and its
TSR is 3,248
.  The
character
can be
is "COBOL".
of the Plastique
 related
es.
by 3,004
 3,004 to 3,019
of the
.  Between
1st and
 21st, the
progressively slowdown the
20 minutes, the
50% of its
speed.
 30 minutes, the
may lockout the
, as well as corrupt the
's CMOS
 configuration.  Between
22nd and
?31st, the
Nnot activate, and no
slowdown or CMOS
 See:   Invader   Plastique-B   Tobacco
PZPAPN
Plastique-B
:  Plastique-B
 Plastic Bomb, Plastique 5.21, Plastique 2, Anticad 1
 TSR; .
i; BSC;
 Taiwan
R:  4,096
5:   PRsAB -
W, &
\, NAV,
:  CleanUp, or
 The Plastique-B, or Plastique 5.21,
is a later
of the
 Plastique
.  Like Plastique, it is a
generic
uof .
-and .
.  It
Nnot
 If the
>is before
20th, the
Plastique-B is
X, the
as a TSR in low
.  The
 TSR is 5,120
{08, 09, 13, 21, and ED
 are
mby the
 If the
20th, the
in high
$the
'.  The same
mby the
, it
attempt to
-or .
for any reason.  It
 has had many of the "bugs" fixed
were in Plastique, and is
 usually successful in
-and .
by 4,096
 Plastique-B
wthe
of any
 accessed on an
20th,
, the Plastique-B
either progressively slowdown the
or cause "bomb"
 noises to be emitted periodically
fthe
speaker.  It may
the contents of all
 depending on if a predetermined limit in the
 See:   Invader   Plastique
PZPAPN
Play Tetris
:  Play Tetris
R:  552
5:   PRhCK -
3.96+, NAV 3.0+,
.2.0+
 The Play Tetris
.  Its
.  Play Tetris is a
uof .
 no relationship to the Tetris game or the Tetris game's author.
bPlay Tetris
X, the Play
 Tetris
at the top of
$the
', hooking
, as
qby the DOS
@by 768
|12's
not be moved.
the Play Tetris
, it
pof 552
at the end of the
a.  The
in the DOS
not be
.  The
can be
in the
5in all
 Play Tetris
 "PLAY TETRIS,HI-HI-HI..."
PZPAPN
Plovdiv 1.1
:  Plovdiv 1.1
 Poland
R:  800
5:   PRCK -
 NAV,
 The Plovdiv 1.1
.  It is
fPoland.  Plovdiv 1.1 is a
 of .
 The
Plovdiv 1.1 is
 Plovdiv 1.1
in the DOS
 Data area in
.  It
hook
{1E, 21, and 22.
be no
qby the DOS
the Plovdiv 1.1
, it
wone .
ain the
X, a DIR
6is performed, or a .BAT
X.  It
 for any reason.
Plovdiv 1.1
 of 800
be hidden
 the
.  The
at the
be no
3to the
>and
in a DOS
.  The
in the
 "*.com"
 "(C)Damage inc.Ver 1.1,Plovdiv,
of a Plovdiv 1.1
tare
the DOS
indicate
Ton all
`if it
expect
6line input may
and fail to
 function
 It is
if Plovdiv 1.1
 See:   Plovdiv 1.3
PZPAPN
Plovdiv 1.3
:  Plovdiv 1.3
 Plov
 Poland
R:  1,000
5:   PRhAK -
, NAV,
.2.0+
 The Plovdiv 1.3
.  It is
fPoland.  Plovdiv 1.3 is a
 of .
-and .
 The
Plovdiv 1.3 is
 Plovdiv 1.3
at the top of
$the
{21 and 22
, as
 by the DOS
@by 1,344
|12's
!moved.  Plovdiv 1.3
, if it was not
the Plovdiv 1.3
, it
wone .
-or .
ain the
 any
or .BAT
X, a DIR
6is performed,
 as well as
`are
for any reason.
Plovdiv 1.3
 of 1,000
be hidden
 the
.  The
at the
 end of
be no
3to the
 and
in a DOS
.  The
in the
 "*.*"
 "(C)Damage inc. Ver 1.3
Plovdiv S.A."
of a Plovdiv 1.3
tare
the DOS
indicate
Ton all
`if it
expect
6line input may
and fail to
 function
 It is
if Plovdiv 1.3
of Plovdiv 1.3 are:
 Plovdiv 1.3B:
on Plovdiv 1.3,
uses 1,840
, hooking
{21 and 22.  Like
 Plovdiv 1.3, it
-and .
X, DOS DIR
6issued, or a .BAT
it completes
sall of
 the
in the
E, it
start
sthe C:
O.  The
in the
 "(c)Damage inc. S.A. Ver 1.3B IX.91 Plovdiv".
: Poland  May,
 See:   Plovdiv 1.1
PZPAPN
Plumbum
:  Plumbum
 Plumbum-A
>month
 Poland
R:  534
5:   PNCK -
/, NAV 3.0+,
 The Plumbum, or Plumbum-A,
 along
seven
of the
.  The Plumbum
es is
fPoland, and are
on the W13
one of the Plumbum
es is
 the Plumbum
wone .
in the
pof 534
at the end of the
a.  The
>in the DOS
, the month in the
>having
!set to "13".  The
can be
in the
5in all Plumbum
 "osoftyright Microsoftyright Microsoftyright"
 "Microsoftyright Microsoftyright Microsoft 1988"
 Plumbum
Nn't
to do
of the Plumbum
 Plumbum-B: A 534
, Plumbum-B
2the month in
 the
`to "14".  The
in the
5are:
 "Plumbum Plumbum Plumbum Plumbum Plumbum Plumbum"
 "Plumbum Plumbum Plumbum Plumbum Plumbum !!"
:  Poland
 Plumbum-C: A 543
, Plumbum-C
vone .
 543
at the end of the
a.  The
>in the DOS
, the month field having
!set to "15".  The
can be
in the
 "osoftyright Microsoftyright Microsoftyright"
 "Microsoftyright Microsoftyright Microsoft 1988"
:  Poland
 Plumbum-D: A 450
, Plumbum-D
vone .
is executing, adding
 450
)to the
 the
>'s month in the DOS
Eset to
 "15".  The
can be
in the
:  Poland
 Plumbum-E:
to the Plumbum-D
 adds 450
)to the
v.  The
>in the DOS
 the month is "15", and the day field may
8the same
as Plumbum-D.
:  Poland
 Plumbum-F:
to the Plumbum
 adds 534
)to the .
vand sets
 the month in the DOS
>to "13".
 The
can be
in the
 "osoftyright Microsoftyright Microsoftyright"
 "Microsoftyright 141$FLuofyright Microsoft 1988"
:  Poland
 Plumbum-M1: A 679
of Plumbum, Plumbum-M1 sets the
>'s month in the DOS
 "15".  The
can be
in the
 "BE CAREFULL!!!"
 "IN YOUR
-PUTER IS ONE POWERFULL CREEPER!!!"
 "Hey you! You are lucky! YOU HAVE ME!!!"
 "written in WARSAW (c) Plumbum"
:  Poland
 Plumbum-M2: A 518
of Plumbum, Plumbum-M2 sets the
>'s month in the DOS
 "15".  The
can be
in the
 "BE CAREFULL!!!"
 "Hey you! You are lucky! YOU HAVE ME!!!"
 "written in WARSAW (c) Plumbum"
:  Poland
 See:   W13
PZPAPN
Plutto
:  Plutto
R:  602
5:   PNCK -
, NAV 3.0+,
.2.0+
 The Plutto
, and is
fthe
 Plutto is a
uof .
the Plutto
wone .
in the
E, it may
the Plutto
pof 602
 the end of the
a.  The
>and
in the DOS
not be
.  One
can be
in all
the Plutto
 "pLuTto_B"
 Plutto
Nn't
to do
PZPAPN
:  Poem
 ACDC
 Republic of South Africa
R:  1,825 - 1,888
5:   PRfCK -
, NAV,
1.53S+,
 The Poem
}in the Republic of South Africa in
, by Oliver Steudler.  Poem is a
uof .
 The
Poem is
X, the
in low
{01, 03, 21, and 7C
mby the Poem
Poem is
, it
very small .
X.  If
X, it
ras well.  Poem
 1,825 to 1,888
at the end of
 the
be no
3to the
in the DOS
 The copy of Poem
keeps track of how many
|21 has
!called.
|21 has
!called
 2,112
, the
Mthe
cpoem on the
M, and the
be prompted to press Escape to
 continue:
 "Void - Composed by Marvin Giskard for T
 In a field a million buds stood,Over them a million days
 came  - a day a bud -  opening  up one by one
Fed light.But one didn't do as
s did,It waited
 for
your  loving rays  to shine upon it to open its
 pedals  revealing  the  pure beauty of its sincere love.
 Never
# unfaithful to its dream of the day of your
 light, Forced  to  resist  any
 light but yours -
 because  of it - until  the  day  the brilliance of your
 life sustaining light shines it
: wanting,
 wishing, waiting.  Many were the buds you rather  shined
 upon  opening  them - revealing
 phony colours. I
ed  your light onto me but
s you tried instead,
 No  subtle  motion  r
Qed you, still I refused
 light - holding out for you - Even
your  light
 fade,  Not  having
d one to do your light justice,
 mine
still be
: wanting, wishing, waiting.
 22 Nov - 21 Dec"
?21 of any year, Poem
activate.  At
, the
Mthe
poem, as well as
b1,221
of the
OC:,
Scopy of the
PZPAPN
Poet
:  Poet
i; low pitched sound or beeping; buzzing;
 frequent
R:  2,149 - 2,224
5:   PRhAK -
\2.10+,
2.11+
 The Poet
.  Its
.  Poet
5is a
uof .
-and .
bPoet
X, the Poet
at the top of
$the
', not moving
|12's
, as
qby the
 DOS
{03 and 21
mby the Poet
the Poet
, it
pof 2,149 to 2,224
at the end of the
a.  The
>and
in the DOS
.  The
in the
 Poet
, and are thus not
 "Lucifer Messiah -- ANARKICK SYSTEMS"
 "POET Proto
the Poet
frequently hang the
ly, a low pitched sound
 or beep may be emitted
fthe
speaker, followed by a
 continuous buzzing sound.
PZPAPN
Pogue
:  Pogue
; music
R:  2,973 - 3,850
5:   PRhC -
, NAV,
 The Pogue
.  It is
(.  Pogue is a
uof .
, but not those
la base
starts
the three
-".  Pogue
8portions of
ffour
es:  512,
<, Seventh Son, and
 Yankee Doodle.  It employs a complex encryption mechanism, and
 detection of
require an algorithmic approach.
an un
Scopy of
, and as a
to the
as an
 one of the four
es on
it is
 The
the Pogue
 the Pogue
at the top of
$the
, as
qby the DOS
@by 9,728
|12's
!moved.
{1C and 21
mby the
the Pogue
, it
X, or copied.  In the case of
 copying, both the source and the target
r.  The
 exception is
Pogue
aif the base
starts
the three
-".
is the mechanism
 used by the
to avoid
 Pogue
pof 2,973 to
 3,850
).  The
at the end of the
.  The
>and
in the DOS
by the
tprocess.
 Usually the Pogue
encrypt
using its garbling
 encryption mechanism on
`.  In
`, no
in the
an un
Scopy of the
5.  In
cases, the
 "Pogue Mahone!"
 - or -
 "Pgoue Mahone!"
 "TNX2DAV"
 The un
ts of Pogue on
`as well the Pogue
may be detected by
ners as any of the
 four
es on
Pogue is
 The Pogue
play music on the
speaker
and the
is between 08:00 and 09:00.
 See:   DAME   Groove
PZPAPN
Poison
:  Poison
 Poison 1
G:  May,
 Mexico
R:  2,416 - 2,436
5:   PRhA -
2.58+,
6.64+,
2.58+,
6.64+
 The Poison, or Poison 1,
}in Mexico in May,
 Poison is a
uof .
-and .
 While Poison
Nn't
,, a later
(Poison 2)
,.  The Poison
is a highly modified
of the
and Moctezumas Revenge
bPoison
X, the Poison
at the top of
$the
', hooking
{08, 13,
 and 21.
, as
qby the
 DOS
@by 2,432
 12's
not be moved.
the Poison
, it
pof 2,416
at the
"of the
by 2,416 to 2,436
at the end of the
a.  The
in the DOS
not be
.  The
in the Poison
 "Mon 5-1"
 It is
what Poison
of Poison are:
 Poison 2:
}in Mexico in
, Poison 2 is a minor
of Poison.  The basic difference is
,.  The
in the
 "Wed 6-0"
:  Mexico
 Poison 3:
}in Mexico in
, Poison 3 is a minor
of Poison.  Like Poison 2,
,.  The
in the
 "Fri 6-1"
:  Mexico
 See:
  Moctezumas Revenge
PZPAPN
Pojer
:  Pojer
 Prague, Czechoslovakia
R:  1,919
5:   PRhAK -
 NAV 3.0A06+,
1.25+,
1.0A06+
 The Pojer
Gin Prague, Czechoslovakia, in
.  Pojer is a
uof .
bPojer
X, the Pojer
at the top of
 but
$the
', not moving
|12's
, as
qby the DOS
@by 2,160
mby Pojer in
, the Pojer
-and .
pof 1,919
).  The
 Pojer
at the end of
.  The
>and
in the DOS
 It is
what Pojer
of Pojer are:
 Pojer-1935:
fCzechoslovakia in
 Pojer-1935 is a 1,935
of the Pojer
.  Its
is 2,096
 hooking
|21.
it is
-and .
by 1,935
at the end of the
a.  The
 and
in the DOS
.  No
in the
:  Czechoslovakia
 Pojer-1941:
s to be
fPoland.  Pojer-1941 is a 1,941
of the
 Pojer
.  Its
is 2,096
), hooking
|21.
it is
-and .
by 1,941
at the end of the
a.  The
 and
in the DOS
.  No
in the
:  Poland
 Pojer-1949:
s to be
fPoland.  Pojer-1949 is a 1,949
of the
 Pojer
.  Its
is 2,272
), hooking
|21.
it is
-and .
by 1,949
at the end of the
a.  The
 and
in the DOS
.  No
in the
:  Poland
PZPAPN
Polimer
:  Polimer
 Polimer Tapeworm
 Hungary
R:  512
5:   PNCK -
/, NAV,
 The Polimer
Gin Hungary in
is a
uof .
the Polimer
X, the
 "A le' jobb kazetta a POLIMER kazetta !   Vegye ezt !"
can be
dnear the
"of all
L, the
attempt to
 one .
aon the
Oand
E, and one .
 on the C:
are between 512 and 64,758
.  If
 the .
whas the Read-
attribute, it
not be
r, and the
$ERROR
is actually 456
by 512
at the
"of the
Nnot
to do
%replicating.
PZPAPN
Polish 217
:  Polish 217
 217, Polish Stupid, V217
 Koszalin, Poland
R:  217
5:   PNCK -
\, NAV,
 The Polish 217, or Polish Stupid,
Gin Koszalin,
 Poland, in
is a
the Polish Stupid
 the
wthe
din the
 217
at the end of the
the hex
5757h.  The
>and
in the
Eis not
 A side note on
the copy of
ed to
 by the
-SPEC en
mental variable is
rby the
, the
[a warm re
Nnothing
%replicating in its
of Polish 217 are:
 Polish 217 B: The Polish 217 B
's major difference is
r, a warm re
in the
 "Specified
-MAND search
Ebad".
in the
Land the
 terminated:
 Path not
can detect Polish 217 may not be able
 to detect Polish 217 B as it has
 V72 and
not detect it.
 Polish 217 C: The Polish 217 C
is very
to the
 Polish 217 B
.  It has had 14
 order to avoid detection by
products.
PZPAPN
Polish 529
:  Polish 529
 529, P529, Piter, Piter2
i; TSR
 Poland
R:  529
5:   PRsCK -
, NAV,
 The Polish 529
in Poland.
is a
uof .
`.  It
,if it is
 The
the Polish 529
X, the
as a low
TSR of 1,664
 the
, any .
aover
 1600
rby the
show a
pof 529
)and
at the
"of the
Nnot
to do
of Polish 529 are:
 Polish 529B:
on the Polish 529
, the
 major difference
TSR is 1,648
PZPAPN
Polish 583
:  Polish 583
 Polish-583,
 Poland
R:  583
5:   PNCK -
\, NAV,
 The Polish 583
ated in Poland and was
is a
uof .
Polish 583 is
X, the
wone
aon the
Oand
E.  The
 newly
by 583
 the
at the end of the
 The
>and
in the
Eis not
Nnot do
PZPAPN
Polish
:  Polish
 Polish
do not
 Poland
R:  150
5:   PNCK -
/2.0+,
3.96+,
, NAV 3.0A06+,
.2.0+
 The Polish
.  It is
 Poland, and is a
uof .
the Polish
 the
wone .
in the
E, and
to the DOS prompt.
pof 150
at the end of the
a.  The
 and
in the DOS
 to the
>and
.  One
in the
 "*.com"
Nnot do
not function
of Polish
 Polish
-158:
to the Polish
adds 158
 the .
:  Poland
 Polish
-176:
to the Polish
adds 176
 the .
v.  It
8one
: "*.com"
:  Poland
 Polish
-226:
to the Polish
adds 226
 the .
:  Poland
PZPAPN
Polish-45
:  Polish-45
 P-45
 Poland
R:  45
5:   ONCK -
, NAV,
 The Polish-45
corrupts the
Polish-45 is
X, the
wall .
in the
Eby over-
 writing the
)of the
a copy of the
 Since the
)are
, the
 permanently damaged and
no function
 be a
pif the .
awas
smaller
).  In
case, the
lhad
>and
in the DOS
to the
>and
Polish-45 should be
Bd and replaced
 clean copies.  It is not possible to dis
as the
)of the
!lost.
PZPAPN
Polish-376
:  Polish-376
 V376
 Poland
R:  376
5:   PNCK -
n, NAV,
 The Polish-376
ated in Poland and was
is a
uof .
Polish-376 is
X, the
wall .
in the
E.  If
,resides in
E, it
 well.
 Polish-376
 376
at the end of the
 The
>and
in the DOS
to the
>and
 Polish-376
Nnot
to do
PZPAPN
Poor Man
:  Poor Man
 Beggar
R:  1,168
5:   PNCK -
2.11+,
2.58+,
6.64+,
n1.05+,
2.58+,
.2.0+,
6.64+,
 The Poor Man, or Beggar,
.  Its
.  Poor Man is a
the Poor Man
wone .
in the C:
Oroot
Eof the C:
ODOS sub
pof 1,168
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the
5in all Poor Man
 "c:\
6.com c:\dos\
6.com"
 "Good morning, Sir!  How nice it is! Please giv"
 "money,"
 "Good morning, sir! How nice it is!"
 "Please give me
money, I,m a poor man."
 "Do
good things, sir!"
PZPAPN
Porridge
:  Porridge
R:  1,384
5:   PNCK -
3.96+,
30.00+,
 The Porridge
.  Its
.  Porridge is a
,.  It hides the .
Porridge is
X, the
wone .
in the
pof 1,384
), unless
 were
smaller
1,384
).  In the case of
were
smaller
1,384
 2,768
t.  The
 at the
"of the
a.  The
>and
 in the DOS
to the
>and
sets the Hidden attribute on
v, so
Porridge
fthe DOS
 The
can be
in the
5in all
 Porridge
 "*.com"
PZPAPN
Possessed
:  Possessed
 Possessed-2443, Possessed 1.03A, Possessed 1.03B,
 Possessed 1.07, Possessed 1.07B, Possessed 1.08
i; TSR;
; write fault
 Australia
R:  2,446 - 2,460
5:   PRsAK -
, NAV,
1.53S+,
 The Possessed
, in Australia.
 Possessed is a
uof .
-and .
bPossessed
X, Possessed
as a low
TSR of 3,008
{08, 21, and 24
mby the
, if it was not
Possessed is
, it
-and .
X.  Possessed
at the
 end of all
the exception
by 2,446
).  .
by 2,446 to 2,460
).  In the
 case of
be no
 it is
r.  All
>and
in the
Possessed
9the
 "POSSESSED! Bwa! ha! ha! ha! ha!
 Author: JonJon Gumba of AdU"
Possessed has
15 to
 20 minutes, it
occasionally erase a
Yit.
to copy
in the
receiving a "Write fault
 writing device
-1",
the source and target of the operation
 was a
of Possessed are:
 Possessed 1.03A: Possessed 1.03A is a
of the Possessed
's TSR
 2,912
, hooking
{08, 21, and
 24.  It
becoming
, and
-and .
X.  .
by 2,367
).  .
by 2,367 to 2,381
 not
.  In all cases, the
at the end of the
 the
for the
, the
in the
 Possessed 1.03B:
to Possessed 1.03A, Possessed 1.03B's
 major characteristic
its TSR is now
 2,928
 Possessed 1.07:
to the
Possessessed
adds 2,446
)to .
,, and 2,446 to 2,460
)to .
.  Its in
TSR is 2,992
), hooking
{08, 21, and 24.
%the
din the
 the
, two
d: "*.
-" and "*.
 Possessed 1.07B:
to Possessed-2443 and Possessed 1.07,
TSR is 3,008
by 2,443
by 2,443 to
 2,457
Nnot
has 17
differ
fPossessed-2443.
 May,
 Possessed 1.08:
to Possessed 1.07,
's major
 difference is
8one
: "Fucker".
 Possessed-2443: Three
)smaller
the Possessed
 Possessed-2443 was
.  Its
TSR is 2,992
{08, 21, and 24
 2,443
 by 2,443 to 2,457
Nnot
r.  Possessed-2443
8the
din the
 Possessed
PZPAPN
Possum
:  Possum
/corrupted;
R:  202
5:   ONCK -
3.96+, NAV 3.0+,
n1.05+,
.2.0+
 The Possum
.  Its
.  Possum is a
the Possum
wthe
 in encounters in the
 202
)of the host
.  Since the
 202
)of the host are
, the
 permanently corrupted and no longer function
Possum
p, unless
was less
), in
 the
 202
.  The
in the DOS
not be
 The
can be
din all
the Possum
 "IN HASTINGS addr
UD9EB, 02"
- WOLVERINE v1.01"
 "by Nick(ie) Haflinger"
the Possum
rall of the .
 the
Zof an
 in a
 "I AM '
x' IN HASTINGS addr
UD9EB,02"
 The '
9a group of garbled
 Possum
Nn't do
 See:   Hastings
PZPAPN
Praying
:  Praying
R:  579
5:   PRhCK -
\2.09+,
 The Praying
.  Its
.  Praying is a
bPraying
at the top of
 the
', not moving
|12's
, as
qby the DOS
@by 2,640
{1C and 21
mby Praying in
the Praying
, it
pof 579
at the end
 of the
a.  The
>and
in the DOS
not be
.  The
can be
in the
5in all Praying
 "Keep On Praying,Jesus!"
 It is
what Praying
PZPAPN
Predator
:  Predator
 Predator-1072
i; slowly corrupts
>has 100 years
R:  1,072
5:   PRtCK -
6.64+,
6.64+,
1.25+
 The Predator, or Predator-1072,
 Its
.  Predator is a
,.  It
Nnot
wvery small .
bPredator
at the top of
$the
', moving
|12's
, as
qby the DOS
@by 2,160
{13 and 21
mby Predator in
the Predator
, it
 for any reason.
 of 1,072
be hidden
 Predator is
.  The
>and
in the
 DOS
to be un
 years has
to the
>.  The
at the
 end of
`.  The
in the
 "Predator
 (c) Mar. 93  Priest"
the Predator
#detected by the DOS
on all
.  The
5to slowly corrupt
`by randomly altering
 in read
of Predator are:
 Predator-1148: A 1,148
of the Predator
 2,304
).  It adds 1,148
)to the .
v.  It
8the same
as the
 Predator-1154: A 1,154
of the Predator
 2,320
).  It adds 1,154
)to the .
v.  It
8the same
as the
 Predator-1195: A 1,195
of the Predator
 2,400
).  It adds 1,195
)to the .
v.  It
8the same
as the
PZPAPN
Pregnant
:  Pregnant
d to "PREGNANT"
R:  1,199
5:   PRhCK -
\, NAV,
 The Pregnant
Gand
 Pregnant is a
uof .
 The
Pregnant is
X, Pregnant
at the top of
$the
qby the DOS
 2,048
mby the
, Pregnant
 are
hides the
it is
, so the
not see a
is performed.  The
 actually
by 1,199
at the
"of the
had a
of 12:00a in the
la blank
 Pregnant
future
>or event, at
3the
s in
Fories to "PREGNANT".  The
 triggering factor has not yet
!determined.
PZPAPN
Press
:  Press
R:  1,024
5:   PNE -
3.96+, NAV 3.0+,
8/93+,
 The Press
.  It is
fthe
.  Press is a
a Press
X, the Press
wone .
in the
pof 1,024
at the end of the
a.  The
in the DOS
not be
.  The
in the
5in all
 Press
 "Press any key"
 "\ IRUS S"
 The Press
Mthe
 "Press any key"
PZPAPN
Prime
:  Prime
 Prime Evil
i; unexpected
 Sweden
R:  580
5:   PNCK -
, NAV 3.0+,
8/93+,
.2.0+
 The Prime, or Prime Evil,
.  It is
fStockholm, Sweden.  Prime is a
uof .
the Prime
X, the
 Prime
locate and
wone
in the
pof 580
 at the
"of the
a.  The
in the DOS
not be
 The
in the Prime
5, and as such cannot be seen in
 "*.C*"
 "Prime Evil! (C) Spellbound, Line Noise
5d in Stockholm, Sweden."
 "Please spell my
right!"
the Prime
rall of the .
in the
Zof an
 in a warm re
ring.
PZPAPN
Print
:  Print
 EB 21, 8290, PRTSC
, 1989
 BSC;
Kaccess slowdown
 Bombay, India
R:  N/A
5:   BR -
\, NAV,
:  CleanUp, M-
K, NAV, or DOS SYS
 The Print
}in Bombay, India in
 1989 by Neville Bulsara.  It is the
 in India.
are two
s of Print
, the later
having had
bugs fixed.
fa Print
O, the
in the
 top of
.  The
adjusts the amount of
 thinks is
zed.
show
is 2K less
zed.  On floppy
Ks, the
of the
be copied to
becoming
, the
wany
 or floppy
is accessed by the
notice
Kaccesses done for
 any reason
be much slower
expected.  In
cases,
the root
show apparently garbage entries in
 it.
entries are actually part of the
 The
of the Print
is buggy, and as such
Nn't actually accomplish
having to do
printing
s to
on the Ping Pong
, and
identify it as such.
of Print
 Print
-2: Print
-2 is the later, bug fixed
 the Print
attempt
 to perform a
print or dump to the
 printer
every 255
KI/Os
PZPAPN
PrintMonster
:  PrintMonster
H:
R:  853
5:   PRtCK -
3.96+,
1.25+
 The PrintMonster
.  Its
.  PrintMonster is a
uof .
bPrintMonster
at the top of
$the
', moving
|12's
, as
qby the
 DOS
@by 1,024
mby PrintMonster in
 The PrintMonster
vall .
in the
pof 853
at the end of the
a.  The
in the DOS
not be
.  The
can be
in the
5in all
 PrintMonster
 "PrintMonster30"
the PrintMonster
PZPAPN
Problem
:  Problem
 Problem-856
H:
R:  856
5:   PRhAK -
3.96+, NAV 3.0+,
.2.0+
 The Problem
.  It is
.  Problem is a
uof .
-and .
bProblem
X, the Problem
at the top of
$the
, as
qby the DOS
@by 1,008
 by the
rif it was not
rby the
, the Problem
-and .
X, copied, or
for any reason.
pof 856
at the end of the
a.  The
>and
in the DOS
not be
.  The
can be
in the
5in all Problem
 "THIS IS YOUR PROBLEM !"
hang
the Problem
of Problem are:
 Problem-734: An earlier
of the Problem
is 896
hooking
|21.  It adds 734
)to the .
v, and
Nnot
9any
 Unlike the Problem
, it
Nnot
 The
at the end of the
a, and the
>and
in the DOS
not be
 Problem-863: A 863
of the Problem
is 1,024
hooking
|21.  It adds 863
)to the .
v, and
8the same
.  The
 executing the
do not
PZPAPN
Protecto
:  Protecto
 Protect, Protecto-1157
H:
fail to
R:  1,157
5:   PRtAK -
, NAV 3.0+,
 The Protecto, or Protecto-1157,
 It is reported to be
fthe
.  Protecto is a
uof .
-and .
bProtecto
X, Protecto
at the top of
 but
$the
', moving
|12's
, as
qby the DOS
@by 2,064
 1C and 21
mby Protecto in
the Protecto
, it
 and .
pof 1,157
at the end of the
a.  The
>and
in the DOS
not be
.  The
can be
din all Protecto
aprotection"
anot
 "masm.exe"
Protecto may
larger
64K are
of Protecto are:
 Protecto-1196:
to the Protecto
.  The major differences are
{1C, 21, and 24 are
mby the
 and
 1,196
).  The
can be
din all Protecto-1196
 "sl.exe"
aprotection"
anot
 Protecto-1323:
to the Protecto
.  The major differences are
{1C, 21, and 24 are
mby the
 and
 1,323
).  The
can be
din all Protecto-1323
 "c.exe"
aprotection"
anot
 Protecto-1355:
to the Protecto
.  The major differences are
{1C, 21, and 24 are
mby the
 and
 1,355
).  The
can be
din all Protecto-1355
 "c.exe"
aprotection"
anot
 See:   CPSU-2535
PZPAPN
Protipus
:  Protipus
H:
`of 5,472
); Hidden .
R:  5,472
5:   SNE - Spawning or Companion .
n1.04+,
2.58+,
2.58+,
1.25+
 The Protipus
.  Protipus is
uof .
uses a
 technique
to spawning or companion
the Protipus
wone .
in the
b, the
s the
the last
 character of the base
is now a "V".  The hidden attribute
set so
in a DOS
.  The
creates a 5,472
5,472
8the Protipus
5and
lthe
>and
.  The
can be
in the
 5,472
*Protipus .
 "Sei stato contagiato dal Protipus virex
 "Conficius said: 'Arrangietes'"
 ".exe"
tof the Protipus
is fairly
 straight-forward.  The
should match the hidden
s to the 5,472
`.  The 5,472
`should
Bd, and
 the
d to the correct
.  Lastly, the
 hidden attribute should be reset so
s in the
 DOS
PZPAPN
Proud
:  Proud
 V1302, P1 Related
H:
 FAT entry
R:  1,302
5:   PRtCK -
\, NAV,
 The Proud, or V1302,
(by Vesselin Bontchev.  Proud is a
 of .
 The
Proud is
X, the
 checks to determine if
|13 is in use by an
 and if it is, the
hang the
.  If
|13 is
 not in use by an
, Proud
at the top of
, but
$the
Aby 8,192
be replaced by the
, it
 certain candi
ranges
for any
 reason. The candi
ranges are:
 2,048 - 14,335
 16,384 - 30,719
 32,768 - 47,103
 49,152 - 63,487
 Proud is an
, and is unusual in
it "splits" the
rinto two parts, placing the
 between the two sections.  Proud
is unable to distinguish
ahas
r, so .
`can
rmultiple
the exception of
add 1,302
)to the
`generally don't
on the
tas the
part of the 00h area of
 Proud can be a damaging
a probability of 1 out of 256,
 it may swap entries in the
PZPAPN
 see
es listed
H:
 Varies depending on
present
R:  Varies depending on
present
5:   PONAK -
30.00+,
, NAV 3.0A06+,
1.25+
is a
5generation
developed by Phalcon/Skism
 during the summer of
.  It
s to be
response to the
 VCL
generator
fNowhere Man of Nuke.
 The
es listed
$are
were
generated, at least in part,
 the
generator.
 The 644 and Walkabout
din the
 wild in the
and Canada.
were created
 7% Solution:
is a 599
uof .
-and .
,.  It
at the
 top of
$the
 the
X, hooking
 21.
, as
 by the DOS
@by 2,048
, it
-and .
pof 599
 at the end of the
a.  The
in the
 "The 7% Solution"
 The 7% Solution
may corrupt
CMOS.
 7% Solution 2.0:
^, 1994,
is a 672
uof .
-and .
,.  It
at the
 top of
$the
 the
X, hooking
 21.
, as
 the DOS
@by 2,048
, it
-and .
 are
pof 672
at the
 end of the
a.  The
in the
 "The 7% Solution 2.0"
may corrupt
CMOS,
ing in all devices
 and the
zed, disabled, or
 reset to a default value.
:  Sweden
^, 1994.
 7% Solution 3.0:
is a 918
uof .
-and .
,.  It
at the
 top of
$the
 the
X, hooking
 01 and 03.
qby the DOS
 1,024
, it
-and .
pof 918
at the end of the
be hidden
 The
in the
 "The root
Eof the
Ohas"
!destroyed by the 7% Solution 3.0
 203: The 203
.  Its
.  The 203
is a
uof .
the 203
wone .
in the
pof 203
at the end of the
a.  The
 and
in the DOS
not be
 One
in the
 "*.com"
 The 203
Nn't do
 644: The 644
.  It is
uof .
-and .
`, but not
Zof an
in all .
-and .
in the
Ebecoming
the 644
 644
at the end of the
 The
>and
in the DOS
 not be
.  The
 the
5:   "*.exe *.com"
 696: The 696
.  It is
uof .
-and .
Zof an
in three .
Wor .
in the
Ebecoming
preference to .
the 696
pof 696
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in the
 "c:\autoexec.com"
 "*.exe *.com"
 Abraxas:
, Abraxas is a 546
uof .
-and .
,.  It
vone
 in the
a preference for .
pof 546
 the
at the end of the
a.  Abraxas
not always recognize a
 and re
wthe
s, it adds an
).  The
>and
in the
 DOS
not be
.  The
 "*.exe *.com"
 "[Z10] Abraxas"
not function
 the
to the DOS prompt
&failures
,has
 Abraxas-1520:
, Abraxas-1520 is a 1,520
uof .
 but not
,.  It
vup to four .
 in the
pof 1,520
at the
 end of the
a.  The
>and
in the
 DOS
not be
.  The
 "Ich bin ein Geschenk von dem Teufel"
 ".. *.com \"
the Abraxas-1520
 Alien-1:
, Alien-1 is a 571
uof .
-and .
,.  It
at the
 top of
$the
 the
X, hooking
 21.
, as
 by the DOS
@by 1,216
, it
-and .
pof 571
 at the end of the
a.  The
in the
 "ALiEN 1 Levia
 Alien-3:
, Alien-3 is a 625
uof .
-and .
,.  It
at the
 top of
$the
 the
X, hooking
 21.
, as
 by the DOS
@by 1,328
, it
-and .
pof 625
 at the end of the
a.  The
in the
 "ALiEN 3 - Demon Spawn Levia
 Anathema:
, Anathema is a 588
uof .
-and .
,.  It
at the
 top of
$the
 the
X, moving
 12's
qby the DOS
 2,048
mby Anathema in
, it
-and .
pof 588
 at the end of the
a.  The
in the
 "[ANATHEMA] THE STRANGER"
 cross-linking of
and data
&failures
© of
 Armana-564:
, Armana-564 is a 564
uof .
-and .
.  It
vtwo .
`in the
 all of the .
`in the
r, it
wtwo .
`in the
pof 564
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
in the Armana-564
 "[MPC]"
 "rx3"
 "*.exe *.com"
all of the .
`, and four non-
rin the
E, a
 hang
 Bamestra 1:
, Bamestra 1 is a 530
uof .
.  It
vtwo .
`in the
pof 530
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the Bamestra
 "[MPC] [Bamestra] Frans Veldman"
 "*.exe"
 Bamestra 2:
, Bamestra 2 is a 535
 minor
of Bamestra 1.
 Bamestra 3:
, Bamestra 3 is a 531
 minor
of Bamestra 1.
 Bamestra 4:
, Bamestra 4 is a 536
 minor
of Bamestra 1.
 Bamestra 5:
, Bamestra 5 is a very minor
of Bamestra 2.
 Bamestra 6:
, Bamestra 6 is a very minor
of Bamestra 1, adding 530
)to the
 Bamestra 7:
, Bamestra 7 is a 529
 minor
of Bamestra 1.
 Bamestra 8:
, Bamestra 8 is a 534
 minor
of Bamestra 1.
 Bamestra 9:
, Bamestra 9 is a very minor
of Bamestra 1, adding 530
)to the
 Bamestra 10:
, Bamestra 10 is a minor
of Bamestra 1, adding 530
)to the
 Birthday:
, Birthday is a 1,104
uof .
.  It
vone .
aon the C: and B:
pof 1,104
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the
5in all Birthday
is the birthday of the great one."
be no computer usage today."
is the second release of the weak virii, It is weak
 virii
%	 *.
 If the B:
Nnot
J, a
 Cheesy:
, Cheesy is a 381
uof .
.  It
vone .
ain the
pof 381
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the
5in all Cheesy
 "[MPC] Dark Angel of PHALCON/SKISM"
 "[Demo
W] for 40Hex"
 "*.exe"
 Chuang Tzu:
, Chuang Tzu is a 970
uof .
-and .
, but not
,.  It
vtwo .
Wor .
in the
pof 970
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the Chuang Tzu
 "No one has lived longer
a dead child,
 and Methusula died young."
 "Heaven and Earth are as old as I,
 and ten thousand things are one."
 "-- Chuang Tzu, 300 B.C."
 "[MPC]
 Cinco de Mayo:
, Cinco de Mayo is an
 885
uof .
, but not
,.  It
vthree .
in the
pof 885
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the Cinco de
 Mayo
 "** Cinco de Mayo **"
 "No trabajas hoy."
 "[MPC] [VCL] [Cinco de Mayo]"
 "Danzig Tanks to Dark Angel and Nowhere Man for
 excellent
creation
! more to follow"
 "*.exe *.com .. US"
 Cinco
to the Cinco de Mayo
is a
vthree .
X.  Its
, location,
 and
>effect are the same as the
 The
in the
 "**Cinco de Mayo**"
 "No trabajas hoy."
 "Bebe mas cerveza!!"
 "[MPC] [VCL] [Cinco de Mayo]"
 "Danzig
ks to Dark Angel and Nowhere Man for
 excellent
creation
! more to follow"
 "*.exe *.com .. US"
 Clint:
, Clint is a 1,076
uof .
-and .
,.  It
at the
 top of
$the
 the
X, moving
 12's
qby the DOS
 3,072
mby Clint in
, it
-and .
pof 1,076
 at the end of the
a.  The
in the
 "[CLINT]   (c) Copyright
THE STRANGER"
 "THIS VIRUS PROUDLY MADE IN THE USA!"
 Crumble:
, Crumble is a 778
uof .
-and .
,.  It
vtwo
 in the
pof 778
 the end of the
a.  The
>and
in the
 DOS
not be
.  The
 "*.exe *.com"
 "[MPC]"
 "[CrumblKouch] Kouch"
 DataDeath:
, DataDeath is a 1,060
uof .
-and .
,.  It
vfour or five
in the
preference for .
pof 1,060
at the end of the
 The
>and
in the DOS
 not be
.  The
 "Hello I am Absolute
of DataDeath"
 "I am in your computer now... I
lmagic"
 "powers..."
 "DataDeath - Taking The World By Storm!!!"
 "Now your
pay for your stupidity!"
 "Hi to: Aristotle, Apocalypse, Vengeance, and YOU!"
 "Love You Joslyn"
 "HACKERS, VIRUSES, AND ANARCHY FOREVER..."
 "-Absolute
(DataDeath)"
 "Your
Ohas now felt my magic lightning"
produced (
modifications of course!)"
 "*.exe *.com"
 Death 2:
, Death 2 is a 671
uof .
-and .
, but not
,.  It
vone
 in the
preference to .
pof 671
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
 "*.exe *.com"
 "[MPC] The
Of Death 2"
 "The Happy Hacker"
 Eclypse:
, Eclypse is a 641
uof .
-and .
,.  It
vone
 in the
preference to .
pof 641
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
 "[MPC] [Eclypse] Abraxas"
 "*.exe *.com"
 Grease:
, Grease is an 856
uof .
-and .
,.  It
vfive .
in the
pof 856
at the end of the
a.  The
in the DOS
not be
 The
in the Grease
 "You
!hit
the Grease Man
 "Listen to him on 92.3 or 94.1 FM in the NYC listening
 area
f6-10PM"
 "Monday-Friday.  Give him a call at 1-800-544-9294 and
 tell him the good news!"
 "Ohhh Schweet ahhh!"
jfrequently
 Groovy:
, Groovy is a 466
*non-
uof .
.  It
vtwo .
`in the
pof 466
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the
5in all Groovy
 "GRooVYGRooVYGRooVYGRooVYGRooVYGRooVY stupid biquts *.exe"
 Helmet 1.0:
, Helmet 1.0 is a 412
uof .
, but
 not
,.  It
vone
in the
pof 412
at the end of the
 The
>and
in the DOS
not be
.  The
 "[MPC] [HELMET 1.0] Basher IV"
 "*.com US"
 Hiccup:
in March,
, Hiccup is a 533
uof .
at the top of
$the
X, hooking
|21.
, as
qby the DOS
@by 2,048
pof 533
 the
at the end of the
a.  The
in the
 "[N.I.T is a waste of money!]"
 "[Created at the National Institute of Technology]"
 "[Hiccup]"
 ""May the world fear the hiccup! Created Feb.
 March,
 Iron Hoof 1:
, Iron Hoof 1 is a 459
uof .
.  It
vthree .
in the
;or higher level
pof 459
at the end of the
 The
>and
in the DOS
not be
.  The
in the
 "[Iron Hoof]
less One -- ANARKICK SYSTEMS"
 "*.exe .."
 Iron Hoof 2:
, Iron Hoof 2 is a 462
uof .
.  It
vthree .
in the
;or higher level
pof 462
at the end of the
 The
>and
in the DOS
not be
.  The
in the
 "[Iron Hoof v2]
less One -- ANARKICK SYSTEMS"
 "*.exe .."
 Kersplat:
, Kersplat is a 670
uof .
-and .
,.  It
at the
 top of
$the
 the
, as
qby the DOS
@by 2,048
mby Kersplat in
-and .
pof 670
at the end of the
 The
in the
 "[KERSPLAT] THE STRANGER"
 Love Bink:
, 1994, Love Bink is a 557
uof .
,.  It
at the top of
$the
, as
qby the DOS
@by 1,184
 by the
, it
pof 557
at the end of the
a.  The
in the
 "Today The Love Of Binky Started...
 Your Computer Shall Celebrate!"
 "[MPC] Binky Love Z-Boy"
 Love Bink
s the
 of any year.
, 1994.
 Math Test:
, Math Test is a 1,136
uof .
-and .
,.  It
at the
 top of
$the
 the
X, hooking
 21.
, as
 the DOS
@by 2,384
, it
-and .
 are
pof 1,163
at the
 end of the
a.  Math Test
between 9:00 and 10:00
 in the morning, at
it may
Mthe
requiring the
to respond
 "It's
for a math test courtesy of YAM!
 And the question is...
 What is 00 + 00 ="
 If the
s "00",
run.  If
else is
 the
L, and the
 to the DOS prompt:
 "WRONG
! TRY AGAIN!"
 The
fthe
in the
5, as is the
 "Admiral Bailey [MATH TEST VIRUS]"
 McWhale:
, McWhale is a 1,125
uof .
-and .
, but not
,.  It
vtwo .
Wor .
preference for
 of 1,125
at the end of
 the
a.  The
>and
in the DOS
not be
 of the
X, the
Lin the middle of the
M, scrolling
fright to left on one line:
 "Beware!!!
 Anti-
.John
.McAfee
.wrote
 WHALE
 HONEST!!!
, the
follow
 "- (c)
Abraxas Warez
 The
in the
 as is the
 " ABRAXAS -"
 "[MPC] [McAfee' Whale] [pAgE]"
 "*.exe *.com .. US"
 Unexpected
jmay
 McWhale-1022:
in March,
, McWhale-1022 is a 1,022
uof .
-and .
, but
 not
,.  It
vtwo .
Wor .
preference for
 of 1,022
at the end of
 the
a.  The
>and
in the DOS
not be
 of the
X, the
Min a scrolling, diagonal
 formation on the
 "by McWhale - (c)
McAfee Warez."
 "McAfee, wrote the WHALE
 "...and Solient Green is people"
, the
reports
 The
in the
 as is the
 "*.exe *.com .. US"
 March,
 Mimic-Den Zuk:
, Mimic-Den Zuk is
 a 4,893
vtwo .
pof 4,893
 the
at the end of the
a.  The
>and
in the DOS
not be
.  Several
in the
5, and are not
 "DENZ-SIM
requires DOS
2.0 or later"
 "DOS
2.x -"
is the wrong
 "check for
 On Fridays, Mimic-Den Zuk
.  At
Zof an
 of the .
in the
by a trojan.
trojan
 "Den Zuk" logo on the
it is
 and
to the DOS prompt.  The
s the
b4,243
)of trojanized .
 Mimic-
, Mimic-
 is a 2,832
uof .
-and .
, but
 not
,.  It
weither all .
Wor all
in the
pof 2,832
at the end of the
a.  .
may be
r, adding an
2,832
 be no
3to the
>and
in the DOS
.  Mimic-
is an
 Several
in the
trojanized .
 "JERU-SIM.
-V1.02"
 "Written by URN KOUCH"
 "Copyright (c) URN KOUCH
requires DOS
2.0 or later"
 "DOS
2.x -"
 Mimic-
on Fridays.  Upon
Zof an
 the .
in the
#trojanized.
 The
"of the .
 a small
mimics the behaviour of the
 Napolean Complex:
, Napolean Complex
 is a 729
uof .
,.  It
vthree
 in the
preference for .
pof 729
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
 "LMluvsSI"
 "Dynamite cums in small packages!"
 "[NAPOLEAN
-PLEX v1.0]
less One -- ANARKICK SYSTEMS"
 "*.exe *.com .."
 are
X, as well as the
s write a
 portion of its
5to the
 Nirvana:
, Nirvana is an 835
uof .
.  It
vall of the .
`in the
 the C:
Oroot
pof 835
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
 "YOU ARE DEAD. YOUR
-PUTER IS NOW EXPERIENCING NIRVANA"
 "IT IS DELETING ALL
WCUTABLE FILES FROM YOUR HARD DRIVE"
&% of Nirvana released in
 No God:
^, 1994, No God is an 728
uof .
- and .
.  It
vfive .
Wor .
`in the
pof 728
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[NOGOD]"
 "*.exe *.com .."
 "God is fake, He wouldn't let
happen."
^, 1994.
 No Wednesday:
, No Wednesday is a
 520
uof .
, but not
,.  It
vone
 in the
pof 520
 the end of the
a.  The
>and
in the
 DOS
not be
.  The
 "*.com"
 "[MPC] [No Wednesday]"
 "* by Goethe *"
 "for [AKL/4269]"
anot
 No Wednesday
on any Wednesday, at
Zof an
in the fake
anot
d." and the
 to the DOS prompt.  The
run normally on any
day of the week.
 Page:
, Page is a 570
uof .
-and .
X, it
wall of the .
in the
E.  If the .
were
instead
wall of the .
in the
pof 570
 the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "C:\AUTO
 "*.exe *.com \ [pAgE]"
 Page-B:
in May,
, Page-B is a 780
uof .
X, it
wthe
in the
 regardless of whether it was
tof Page-B on the
 the
.  The
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in the
 "by-->>pAgE<<--(C)
TuRN-THE-pAgE"
 "Ancient Sages"
 "Is one of pAgEs"
 The Page-B
Mthe
 in a diagonal scroll using multi-colored letters:
 "Ancient Sages
 Is one of pAgEs"
 May,
.Greetings:
, 1994,
is a 1,118
uof .
-and .
,.  Its
is 2,288
 hooking
{08, 09, and 21.
, it
-and .
pof 1,118
 the
at the end of the
a.  The
in the
 "Admiral Bailey [YAM]"
 "***[ Just wanna say Wa'Sup to: ]"
 "The Carmel Massive"
 "The Jamaican Posse and"
 "Mad Cobra. Keep the FLEX alive!"
 "By-The-Way John call
one "Greetings"."
, 1994.
.Mom:
, 1994,
.Mom is a 974
uof .
-and .
X, the
wall of the .
in the
E.  If all of the .
were
r, the
proceed
wall of the .
in the
pof 974
at the end of the
 The
>and
in the DOS
not be
.  The
in the
 "MoM#\/# () #\/#"
 "You are hereby notified
your
has just
 encountered"
 "a very unusuall
Ucan be very fatal!!!"
 "Please check your
for any further
 "DOS EXCEPTION ERROR #13"
 "*.com *.exe .."
, 1994.
.Powermen.717:
, 1994,
.Powermen.717
 is a 717
uof .
 and .
X, the
wup to five .
in the
E.  If all of the
were
r, the
 proceed to
wup to five .
in the
pof 717
at the end of the
 The
>and
in the DOS
not be
.  The
in the
 "[MPC] [PowerMEN] PowerMEN"
 "*.exe *.com .."
jmay
 and all of the .
in the
Ewere
rby the
, 1994.
.Walt.311:
, 1994,
.Walt.311 is a 311
uof .
vone .
ain the
pof 311
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the
.Walt.311
 "[MPC]"
 "[SHY_KOO]"
 "[Walt Whittman]"
 "*.com"
, 1994.
 PSMPC-331:
, PSMPC-331 is a 331
uof .
.  It
vmultiple .
`in the
pof 331
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the PSMPC-331
 "[MPC]"
 "*.com"
 PSMPC-338:
, PSMPC-338 is a 338
uof .
.  It
vone .
ain the
pof 338
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the PSMPC-338
 "[MPC]"
 "*.com"
wthe
bfour .
`in a
 PSMPC-339:
, PSMPC-339 is a 339
uof .
.  It
vone .
ain the
pof 339
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the PSMPC-339
 "[MPC]"
 "*.com"
jmay
 PSMPC-344:
, PSMPC-344 is a 344
uof .
.  It
vone .
ain the
pof 344
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the PSMPC-344
 "[MPC]"
 "*.com"
jmay
 PSMPC-347:
, PSMPC-347 is a 347
uof .
.  It
vone .
ain the
pof 347
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the PSMPC-347
 "[MPC]"
 "*.com"
jmay
 PSMPC-351:
, PSMPC-351 is a 351
uof .
.  It
vone .
ain the
pof 351
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the PSMPC-351
 "[MPC]"
 "*.com"
jmay
 PSMPC-352:
, PSMPC-352 is a 352
uof .
.  It
vone .
ain the
pof 352
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the PSMPC-352
 "[MPC]"
 "*.com"
jmay
 PSMPC-353:
, PSMPC-353 is a 353
uof .
.  It
vone .
ain the
pof 353
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the PSMPC-353
 "[MPC]"
 "*.com"
jmay
 PSMPC-478:
, PSMPC-478 is a 478
uof .
Wand .
.  It
vtwo .
Wor .
`in the
pof 478
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the PSMPC-478
 "[MPC]"
 "*.exe *.com"
jmay
 PSMPC-573:
, PSMPC-573 is a 573
uof .
Wand .
.  It
vtwo .
Wor .
`in the
pof 573
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the PSMPC-573
 "[MPC]"
 "*.exe *.com"
30 seconds to 1 minute
X, the
attempt to write to
 device "PRN" (the
printer).  If the device isn't
hang may
 PSMPC-598:
, PSMPC-598 is a 598
uof .
Wand .
.  It
vall of the .
Wor .
`in the
pof 598
at the end of the
 The
>and
in the DOS
not be
.  The
 are
in the PSMPC-598
 "[MPC]"
 "*.exe *.com"
 PSMPC-603:
, PSMPC-603 is a 603
uof .
Wand .
.  It
vall of the .
Wor .
`in the
pof 603
at the end of the
 The
>and
in the DOS
not be
.  The
 are
in the PSMPC-603
 "[MPC]"
 "*.exe *.com"
jaccompanied by loud buzzing on the
 speaker may
 PSMPC-611:
, PSMPC-611 is a 611
uof .
Wand .
.  It
vall of the .
Wor .
`in the
pof 611
at the end of the
 The
>and
in the DOS
not be
.  The
 are
in the PSMPC-611
 "[MPC]"
 "*.exe *.com"
 Pussy:
, Pussy is a 493
companion
 creating a corresponding .
a.  It
at the top of
$the
 DOS
, as
qby the
 DOS
@by 4,096
mby Pussy in
, it
 creating a .
the same base
be 493
>and
.  It
 the Pussy
5.  The Pussy
may corrupt the
(FAT)
 Quadratic-986:
, Quadratic-986 is a 986
X, it
the copy of
qby the
-SPEC en
mental variable.  The
)of the hex 00 area
s it
pthe
by 986
at the end of the
a.  The
>and
in the DOS
lthe seconds field set to "62".  The
in the
 "Quadratic Equation"
 "SD93"
j, and thus
&failures, frequently
 Scarey:
, Scarey is a 739
uof .
-and .
,.  It
at the top of
$the
, as
qby the DOS
@by 1,552
mby Scarey in
-and .
pof 739
at the end of the
 Scarey
5to emit a buzzing noise on the
 speaker while performing a read of the
 Schrunch:
, Schrunch is a 458
uof .
,.  It
vone
in the
pof 458
at the end of the
 The
>and
in the DOS
not be
.  The
 are
 "[ZEB (C)
] [SCHRUNCH[ Abraxas 2]"
 "*.com"
 On VGA
, executing an
 in the
#placed in 50 line mode, and
 beeping may
.  On non-VGA
, garbled
 may
on the
 Silent Killer:
, 1994, Silent Killer is a
 397
uof .
,.  It
at the top of
$the
X, hooking
|21.
, as
qby the
 DOS
@by 448
, it
pof 397
at the end of the
 The
in the
 all Silent Killer
 "[ZRK] Silent Killer Z-Rock"
, 1994.
 Skeleton:
, Skeleton is a 556
uof .
-and .
,.  It
vthree
 in the
preference to .
pof 556
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
 "[MPC] [Skeleton] Deke"
 "*.exe *.com"
jmay
has run out of
 non-
:  Germany
 Sucker:
, Sucker is a 572
uof .
-and .
,.  It
at the top of
$the
, as
qby the DOS
@by 2,048
 by Sucker in
, it
pof 572
at the end of the
a.  The
in the
 "[MPC] Sucker (C)
 Sunday Death:
, Sunday Death is a
 644
uof .
,.  It
vall .
 and .
in the
pof 644
 the end of the
a.  The
>and
in the DOS
not be
.  The
 "[BCA]"
 "Sunday Death --
(c)BCA"
 "Raven"
 "*.exe *.com"
 On Sundays,
Zof an
 in a
hang
ring.
 T-Rex:
, T-Rex is a 410
uof .
at the top of
$the
qby the DOS
.5K.
mby T-Rex
, it
pof 410
at the
 end of the
a.  The
 the
5in all T-Rex
 "[MPC] T-REX subcon"
frequently hang the
 are
X, and
&failures
 copy of
simply
to the DOS prompt.
 Test 441:
, Test 441 is a 441
uof .
.  It
vthree .
all of the .
in the
r, it
move upward in the
Estructure.
pof 441
 at the end of the
a.  The
>and
in the
 DOS
not be
.  The
can be
in the
 in all
as the
is not
 "[MPC] [Test] Sam Hain"
 "*.exe .."
 Tim 3:
, Tim 3 is a 301
uof .
.  It
ain the
pof 301
 at the end of the
a.  The
>and
 the DOS
not be
.  The
in the
 "[MPC] [TIM] Abraxas"
 "*.com"
 Tim 4:
, Tim 4 is a 515
uof .
.  It
vone .
Wor .
ain the
pof 515
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[MPC] [TIM] Abraxas"
 "*.exe *.com"
 Tim 5:
, Tim 5 is a 401
uof .
.  It
ain the
pof 401
 at the end of the
a.  The
>and
 the DOS
not be
.  The
in the
 "[MPC] [TIM] Abraxas"
 "*.com"
 Tongue:
, Tongue is a 597
uof .
-and .
,.  It
vthree
 in the
preference to .
pof 597
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
5in all
 "*.exe *.com"
 Toys:
, Toys is a 773
uof .
-and .
,.  It
vtwo .
-or .
in the
 preference given to .
pof 773
at the end of the
a.  The
>and
 in the DOS
not be
.  The
 "All my toys are broken"
 "And so am I inside."
 "The carnival has closed"
 "Years ago..."
 "[VCL/MPC]"
 "*.exe *.com"
 Walkabout:
, Walkabout is a 573
uof .
-and .
,.  It
at the
 top of
$the
 the
, as
qby the DOS
@by 2,048
mby Walkabout in
-and .
pof 573
at the end of the
 The
in the
 "[WALKABOUT TSR VER 1.0] THE STRANGER"
 War Dork:
, War Dork is a 553
uof .
vthree
in the
pof 553
at the end of the
a.  The
>and
in the DOS
.  The
 "[MPC] War Dork A rombus"
 "*.exe .."
 Warez D00d:
, Warez D00d is a 1,803
uof .
 and .OVR
,.  It
 candi
in the
pof 1,803
at the end of the
a.  The
>and
 in the DOS
not be
.  The
 "HEY!!! Blow ME, WaReZ FAGGOT"
 "You got sorta lucky!!!"
 "I am afraid
I am going to
lto smash your
 WaReZ, d00d!!!"
 "Go ahead! Call the police and tell them"
 "[NuKe]"
 "paid you a visit!"
 "*.exe *.ovr *.com"
Mthe
 graphics, and corrupt
in the
 "DONT'T YOU KNOW THAT PIRACY IS ILLEGAL
 I am afraid
I am going to
lto smash your
 Warez, d00d!!!
 Go ahead! Call the police and tell them [NuKe] paid
 you a visit!"
 Who Cares:
, Who Cares is an 181
uof .
,.  It
vall of the .
 in the
pof 181
), unless
were
smaller
), in
case
).  The
at the
"of the
a.  The
>and
in the DOS
to the
 and
.  The
 can be
in the
5in all
 "*.com"
 Z10:
, Z10 is a 704
uof .
-and .
, but not
,.  It
vtwo
in the
 preference given to .
pof 704
at the end of the
a.  The
>and
 in the DOS
not be
.  The
 "*.exe *.com"
 "[PF] [Z_10] Paul Ferguson"
 Zeppelin:
, Zeppelin is a 1,508
uof .
-and .
,.  It
vfive
 in the
preference given to .
pof 1,508
at the end of the
a.  .
may be re
rby the
, adding an
1,508
t.  The
>and
in the DOS
not be
.  The
 "*.exe *.com"
 "Ripped
fucker off"
 "SHIT!!! Wont work
 "[pAgE] [SwanSong] Gandolph"
 The Zeppelin
activate
sfive .
, the
be cleared and a color graphic of a zeppelin
, accompanied by tones
#emitted on the
 speaker.  On mono
, the graphic may
 series of
s of various
`, a
hang usually follows.
 See:  ARCV-n   G2   Joshua   Shock Therapy   Warez-1341
PZPAPN
Psychogenius
:  Psychogenius
 Cover Girl, Psycho
H:
& data
`corrupted;
&failure
R:  723
5:   ONAK -
& Data
, NAV,
8/93+
 The Psychogenius, or Cover Girl,
source.  Psychogenius is a
vany execu
or non-
 execu
a.  It permanently corrupts any
Psychogenius is
X, it
 all
exist in the
E.  It
Nnot care if
 the
`are execu
, or if
are data
sort.
lhad the
b723
by the
5, and
>and
to the
be no
if the
was 723
)or larger.
were
smaller
now be 723
 The
can be
din the
5in all
 "Oh, oh, oh,   She's my cover girl,
 Oh, oh, oh,
 oh, oh, oh,
 Cover Girl by The New Kids On The Block
 Hangin' Tough (c) 1988 CBS Records"
 "Written by"
 "(Psychogenius)   12/28/91"
 "NKOTB JORDON"
 It is not possible to dis
`as the
`should be
Bd and restored
fa clean backup copy.
of Psychogenius are:
 Psychogenius-B:
gequivalent to the
has one
differs
fthe
 May,
PZPAPN
Psychosis
:  Psychosis
H:
^, 1994
 Sweden
R:  1,202
5:   PNC -
6.64+,
1.22+,
6.64+
 The Psychosis
^, 1994, and
fSweden.  It is a
, but not
the Psychosis
X, the
 Psychosis
wthree .
not in the
E.  Typically, the
rby the
in a
$the
Ein the
Estructure.
 Psychosis
pof 1,202
at the end of the
a.  The
>and
in the DOS
not be
 The
in the Psychosis
 "\ *.com *.* .."
 "\\ Merry Xmas and a happy new year //
 Sweden - Snowing Again"
year passed by"
tear the
ows cry"
 "to
3the world we ever try"
 "to make a difference before we die"
 "[PSYCHOSIS]"
 "Greets, Phalcon/Skism."
 "(c) 93/94 The Unforgiven / Immortal Riot"
6th of any year.
even
s, the
 a 704
*TSR, hooking
|08.
the TSR is
 the
Mthe
 4 - 9.  The
s every few minutes at the top of the
a dozen or so
to the
PZPAPN
Puke-393
:  Puke-393
 Puke
H:
 Australia
R:  393
5:   PRAK -
30.00+,
 NAV 3.0+,
n1.04+,
6.60+,
6.64+,
1.25+
 The Puke-393
fAustralia in
 Puke-393 is a
uof .
-and .
 The
the Puke-393
X, the Puke-393
 a "hole" in low
, hooking
|21.
 and
, as
qby the DOS
not be
, the Puke-393
-and .
pof 393
at the end of the
a.  The
in the DOS
not be
.  One
in the
 "[PuKE]"
 It is
if Puke-393
PZPAPN
PV-81
:  PV-81
H:   March,
R:  81
5:   PNCK -
3.96+,
 The PV-81
in March,
.  Its
~.  PV-81 is a primitive,
uof .
the PV-81
X, the PV-81
wone or several of the .
 the
pof 81
at the
 of the
a.  Unfortunately, PV-81 cannot determine
if it
 has
a, so it
wthem, adding an
at both the
"and the
 end of the
a.  The
>and
in the DOS
to the
 and
the last
.  One
in the
jmay
 wise, the
Nn't do
PZPAPN
:  QMU
 QQ-1513
H:
2; TSR or
R:  1,513
5:   PRsCKX -
 NAV 3.0+,
8/93+
 The QMU
.  QMU is a
uof the
) as well as .
,.  Its
bQMU
Xon a
, QMU
as a low
TSR of 2,080
).  The TSR
{13 and 21.  At
, QMU
wthe
, moving
 the
to the second side 0, cylinder 0,
2, and writing a full copy of the
starting in
 If the
is later
fthe
K, the
at the top of
 the
qby the DOS
@by 5,120
{13 and 21
|12's
!moved.
QMU is
, it
pof 1,513
).  The
at the end
`.  The
>and
in the
 DOS
to the
>and
`include the
normally
din the
, along
 "Bad
 It is
what QMU
PZPAPN
:  QP3
 1028,
<1028
H:
slowdown
R:  1,028 - 1,042
5:   PRhAK -
n, NAV,
 The QP3
.  Its
.  QP3 is a
-and .
,.  It is
on the
 The
QP3 is
X, QP3
at the top of
, but
$the
 as measured by the DOS
Aby 1,104
{1C and 21
mby the
, QP3
-and .
X.  If
X, it
r.  Unlike
<, it
Nnot
by 1,028
by 1,031 to 1,042
).  In both cases,
be no
3to the
=in the
 The
at the end of the
 The QP3
8one
can be viewed in
: "QP3".
 It is
what QP3
 See:
PZPAPN
Quake
:  Quake
H:   May,
i; shaking or "quaking" of
 The
R:  518 - 532
5:   PRfE -
3.96+, NAV 3.0+,
.2.0+
 The Quake
}in The
in May,
.  It
 is a
uof .
a very
 noticeable
effect.
 The
the Quake
 the Quake
in the DOS
 buffers.
be no
the Quake
, it
pof 518 to 532
at the
 end of the
a.  The
>and
in the DOS
not be
are no
in the
the Quake
[shaking or
 "quaking" of all but the bottom line of the
 effect
s every few minutes.
PZPAPN
Queens
:  Queens
 Micro Cop, Queensland
H:
Kinaccessible;
 Queensland, Australia
R:  N/A
5:   BRX -
, NAV 3.0+,
:  DOS SYS on
 The Queens, or Queensland,
}in Queensland,
 Australia in
.  Queens is a
and the
fthe
bQueens
 the Queens
at the top of
$the
', moving
|12's
, as
 the DOS
@by 2,048
, the
wthe
the Queens
, it
wthe
of any non-write protected
is accessed on the
.  The Queens
is too large to fit entirely in the
, so a portion of the
elsewhere
 on the
J, along
 On double density 5.25 inch
I, the
 in the
location, along
its continuation
10.  The
 On high density 5.25 inch
I, the
 the
location, along
its continuation in
27.  The
 Since the
s the last two
of the root
Eentries in
 inaccessible.
 On the
K, Queens
wthe
.  The
s, but the
 inaccessible as a
the Queens
notice
blank the
M, reversing
 the video, and
Mthe
at the bottom of the
 "unauthorized software used  --Micro Cops"
s, the
be hung.
 See:   Generic
PZPAPN
Quiet
:  Quiet
H:
i; TSR
 Kansas,
R:  2,048 - 2,063
5:   PRsC -
, NAV 3.0+,
 The Quiet
Gin the State of Kansas in the
.  Quiet is a
 of .
, but not
,.  It's
 was in a computer repair facility, so it is believed to be in the
 public domain.
bQuiet
X, the Quiet
as a low
TSR of
 2,304
).  The
{16, 21, and 64.
the Quiet
, it
X.  Quiet
pof 2,048 to
 2,063
at the end of the
.  The
>and
in the DOS
.  The
can be
din the last 2K of Quiet
 "DNAMMOC"
 "t=1024 /write=off /win /quiet"
 It is
what the Quiet
PZPAPN
Quick
:  Quick
 Brasil
 BSC;
Jroot
R:  N/A
5:   BRtX -
\, NAV 3.0+,
:  CleanUp, M-
K, or DOS SYS on
 The Quick
.  Quick is a
and the
).  Quick is a
 employing techniques to re
to read the
 secotr and
 The
fa Quick
 the Quick
at the top of
$the
', moving
|12's
, as
qby the
 DOS
@by 1,024
, the
wthe
 if it was not
the Quick
, it
wthe
of any non-write protected
Iaccessed on the
 On 360K 5.25"
I, the
write one
10, and copy the
 The
s the
 On 1.2M 5.25"
I, the
write one
27, and copy the
 The
s the
 On the
K, the
lwritten one
5to Side 0, Cylinder 0,
2, and copied the
to Side 0, Cylinder 0,
3.  The
s the
at Side 0, Cylinder 0,
 The
Nnot
9any
in the
 and has
d to due to its ability to quickly spread to
#detected.  Since the
s the
 last two
of the root
 entries
were
be lost.
PZPAPN
Quirk
:  Quirk
H:
`created
R:  9,977
5:   SNE - Spawning or Companion
 The Quirk
.  Its
.  Quirk is a
spawning
 or companion
the Quirk
X, the
 Quirk
wtwo or more .
in the
E.  The .
themselves are not
 rather the
creates a 9,977
ain the same
the same base
.  The newly created .
`are not hidden, and
lthe
>and
in the
 DOS
set to the
>and
 It is
if Quirk
PZPAPN
:  R-10
 DataRape-10, Rape-10
H:
 Canada
R:  500
5:   PRhCK -
/, NAV,
 The R-10, DataRape-10, or Rape-10
, and
ated in Canada.  R-10 is a
 of .
,.  It is one of the
the RABID group claims responsibility for writing.
 The
R-10 is
X, R-10
at the top of
 the
{21 and 69
mby R-10
, as
 the DOS
@by 528
R-10 is
, it
by 500
), the
at the end
 of the
be no
3in the
 in the DOS
 R-10
on a random basis, at
 the
X.  The
 of the
Kstarts at the C:
 writing to the
Kthe
completes writing
to the
K, it
continue formatting the
O, writing
 full of x'FF'
4until the
powers off the
 R-10 is probably an earlier
of the R-11
 See:   R-11
PZPAPN
:  R-11
 DataRape-11, Rape-11
H:
 Canada
R:  747
5:   PRhCK -
/, NAV,
 The R-11
fsources in both
 the
V.  At least in the case of the United
 States submission, the
din the public domain.  R-11
 is a
uof .
 The
R-11 is
X, R-11
at the top of
$the
remain
1, but
Aby 848
{21 and 69
mby the
, R-11
X.  If
X, it
 R-11
by 747
at the end of the
 R-11 hides the
.  If the DOS
R-11
, it
indicate a
a.  The DOS
 may
get an "Invalid
Ospecification"
R-11
 R-11, on a random basis, may
on the
K.  It
s to be a later
of the R-10
 See:   R-10
PZPAPN
Radyum
:  Radyum
H:
R:  448
5:   PNCK -
3.96+,
30.00+, NAV 3.0+,
1.25+
 The Radyum
.  It is
.  Radyum is a
the Radyum
wone
in the
pof 448
at the end of the
a.  The
>and
in the DOS
 not be
.  The fourth and fifth
be "II".  The
 the Radyum
 "radyum, the attitude adjuster,
 brought to you by ViRuLeNT GRaFFiTi"
 "\*.
 Radyum
Nn't do
of Radyum are:
 Radyum 2-707: A 707
of the Radyum
vone .
in the
X.  If an
Nnot exist in
 the
E, it
move upward in the
 structure until it locates a
Qes the root
E, if it
Nn't locate an
w, it
create a hidden
a, HELLO.RAD, of 156
 " radyum,
2, by the attitude adjuster"
 " brought to you by ViRuLeNT GRaFFiTi"
 " 07/31/92   Greets to Gary Watson!"
 " look for us again in the future."
 Radyum 2-707 adds 707
)to the .
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the Radyum 2-707
5, as is the
 "Hello.Rad .. *.
may be identifed by the
 "QQ" starting in the fourth
*of all
 March
 Radyum-B: A 698
of the Radyum
vone .
in the
X.  If an
Nnot exist in
 the
E, it
move upward in the
 structure until it locates a
Qes the root
E, if it
Nn't locate an
w, it
create a hidden
a, HELLO.RAD, of 147
 " radyum-b, by the attitude adjuster,"
 " brought to you by ViRuLeNT GRaFFiTi"
 " 07/31/92   Greets to Gary Watson!"
 " look for us again in the future."
 Radyum-B adds 698
)to the .
at the end of the
a.  The
>and
in the DOS
not be
.  The
 the Radyum-B
5, as is the
 "Hello.Rad .. *.
may be identifed by the
 "QQ" starting in the fourth
*of all
 Radyum-C: A 860
of the Radyum
vone .
in the
X.  If an
Nnot exist in
 the
E, it
move upward in the
 structure until it locates a
Qes the root
E, if it
Nn't locate an
w, it
create a hidden
a, HELLO.RAD, of 221
 " radyum-c, by the attitude adjuster,"
 " brought to you by ViRuLeNT GRaFFiTi"
 " 08/18/92
 " 6 out of 16
keep the same"
 " position and value, not too bad in my"
 " book! greets to patti hoffman, i love you!"
 Radyum-C adds 860
)to the .
at the end of the
a.  The
>and
in the DOS
not be
.  The
 the Radyum-C
5, as is the
 "Hello.Rad .. *.
may be identifed by the
 "QQ" starting in the fourth
*of all
PZPAPN
:  Rael
H:
, 1994
Bd upon
 unexpected access to C:
O; TSR
 Argentina
R:  3,211 - 3,226
5:   PRsC -
\2.13+,
2.58+,
6.64+,
1.25+,
6.64+,
2.58+
 The Rael
fArgentina in
, 1994.
is a
uof particular
in the C:\DOS
bRael
as a low
TSR of 3,268
), hooking
|21.  The
access the C:
the express purpose of
 "c:\dos\sys.com"
 "c:\dos\dosshell.com"
 "c:\dos\format.com"
 "c:\dos\keyb.com"
were not
r, the Rael
wthem.  The
pof 3,211 to 3,226
 the end of the
a.  The
>and
in the DOS
not be
 Next, the
Mthe
on the
 "RAEL IMPERIAL AEROSOL KID"
!performed, the
 any
 The
, as well as the
s, are
in the
5, as well as the
 "01/NOV/93 por RAEL"
 "com
-MAND
 "RAEL IMPERIAL AEROSOL KID VIRUS III"
 "-Buenos Aires-Argentina...Rael, Imperial Aerosol Kid-"
 "Exists in the daylight, spraygun head...-SaTaN"
 "C BRaIn B.B.S. 383-7480 Las 24 Horas"
PZPAPN
:  Rage
H:
 Canada
R:  575
5:   PNCK -
, NAV,
 The Rage
.  Rage is
 Canada, and one of the
RABID
s to
lwritten.
is a
uof .
Rage is
X, the
check
 the
Oand
Efor an
w.  If one is
very small .
`, the
 Rage
wit.
by 575
at the end of the
be no
3in the
=in the DOS
.  The
can be
 "Patricia Boon"
Rage
Mthe
 "Pray for death - RABID '91"
cannot be
`as it is
in the
 It is
if Rage
PZPAPN
:  RAM
H:   May,
i; black box;
Bd on Fri 13th;
 TSR;
slowdown
R:  3,517
-) & 1,808 - 1,822
5:   PRsAK -
, NAV 3.0+,
 The RAM
Vin May,
.  The RAM
on the
.  Like the
es, it is
uof .
W, and overlay
`.  It
 The
the RAM
 the
as a low
TSR of 4,008
{08 and 21
, the RAM
 are
X.  The
 is the same as for the
, 1,808 to 1,822
at the end of the
 The RAM
walready
, adding
1,808
)to the
 How the RAM
is the major difference
 between
es.  The RAM
, places a copy of
 the
"of the .
and an
copy at the end.
 The
pon .
be 3,517
 the end of the
, and a
pof 1,704
9two
 "sUMsDOS"
the RAM
for 30 minutes, a
 "black box"
on the lower left hand side of the
 The
slow the
down by
 percent.
 The RAM
on Friday the 13ths.  If the
on Friday the 13ths, it
 the
Ythem.
 See:
PZPAPN
Random
:  Random
H:
 Australia
R:  615
5:   PRhCK -
, NAV 3.0+,
n1.04+,
6.60+,
1.25+,
6.64+
 The Random
in March,
Hin Melbourne, Australia in
.  Random is a
uof .
 The
the Random
 the Random
at the top of
$the
', hooking
, as
qby the DOS
Aby 624
|12's
not be moved.
the Random
, it
X.  If
X, it
the Random
pof 615
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
5in all Random
 Kevin Mitnick"
 Lenny DiCcoco"
 Hans Hubner"
 414's"
 Legion of Doom"
 Phiber Optik"
     Dr Popp"
 Robert Morris"
     Shooting Shark"
 Chesire Catalyst"
 Captain Crunch"
 Ron Austin"
 Kevin Poulsen"
 "are all to be congratulated"
PZPAPN
Rattle
:  Rattle
 Death Rattle
H:
seconds = 62
R:  615
5:   PRaCK -
 NAV 3.0+,
1.53S+,
 The Rattle, or Death Rattle,
.  Its
the submission was
Van source.
 Rattle is
on the
uof .
 The
the Rattle
 the Rattle
, as
 by the DOS
mby Rattle in
the Rattle
, it
X.  If
X, it
the Rattle
pof 615
at the end of the
a.  The
>and
in the
 DOS
to be
 the seconds field
!set to 62.
the Rattle
[frequent
jdue to a
 See:
PZPAPN
RaubKopie
:  RaubKopie
 Raubkopi
H:   March,
 Germany
R:  2,219
5:   PNAK -
, NAV,
 The RaubKopie
in March,
by Jan Terpstra of
 the
.  It is
fGermany.  Raubkopie is a
uof .
-and .
`.  It
RaubKopie is
X, the
wup to five .
in the
E.  If less
five
existed in the
E, it
`until the
number of
it has
s five.
Raubkopie
 2,219
at the
"of the
a.  The
>and
in the
not be
Raubkopie
 2,475 to 2,491
at the end of the
a. The larger
`is due to a
 different mechanism
#used to
wthe
`, the
badd up to 16
)to the candi
is now di
by 16.
adding the
), it
adds 256
)of hex
 00's and appends the Raubkopie
5to the end of the
.  The
>and
in the
not be
 The RaubKopie
occasionally
and require
 a response
is invoked.  The
Lcannot be seen
S.  The
 A C H T U N G
 Die Benutzung einer RAUBKOPIE ist strafbar!
 Nur wer
Jn, Handbucher,
 oder PD-Lizenzen besitzt, darf Kopien verwenden.
mierung is muhevolle Detailarbeit:
 Wer Raubkopien verwendet, betrugt
mierer un den Lohn ihrer Arbeit.
 A pause
, and the
cquestion
 "Bist Du sauber ? (J/N) "
 Entering "J" for yes
in the
Land the
proceed to
 "Ich
glauben, was Du sagst
 Entering "N" for no
in the
, the
 second of
is garbled, and the
be terminated:
 "CPU-ID wird gespeichert...
* LO<garbled>
 The last garbled
samples of
* Losche dieses
in the RaubKopie
to format the
of the
Kif the
>is greater
 the 12th of the month, or the hour is
17:00 (5:00 PM).
5, however,
Nnot function
due to a bug
in the
 RaubKopie
%the
of the
Fories
9ing RaubKopie
 sorted so
at the
"of the
of RaubKopie are:
 Raubkopie-FRD:
, Raubkopie-FRD is
of the
 1,888
at the
"of the
pof 2,150 to 2,160
at the end of the
 The
in the
 "\ OSSI EN ST"
 "C:\ * NETWARE LMS MAUS MDB DOS BASE L"
 "*.exe *.com"
 "C:\   C:\CONFIG.SYS DEVICE =   COUNTRY.SYS"
 "hgt42"
 "V1 FRD"
of RaubKopie
alter the C:\CONFIG.SYS
9the "DEVICE =   COUNTRY.SYS" statement
PZPAPN
Reaper
:  Reaper
 Reaper Man
H:
 England
R:  1,072
5:   PRhA -
3.96+, NAV 3.0+,
8/93+,
.2.0+
 The Reaper, or Reaper Man,
 It is
fEngland.  Reaper is a
uof .
-and .
, but not
,, and
 not
on the A:
bReaper
X, the Reaper
at the top of
$the
', hooking
, as
qby the DOS
@by 3,008
|12's
not be moved.
the Reaper
, it
are copied or
reason
location is
on the A:
the Reaper
 1,072
at the end of the
 Reaper is not able to determine
r, so it
, adding an
1,072
).  The
>and
in the DOS
be corrupted to an unusual value
is not a normal,
 valid
>and
.  The
>and
s in the
 DOS
are not
rby the
 The
can be
in the
 all Reaper
 "Reaper Man"
 "(c) 92, Apache Warrior, ARCV Pres."
 "[ReaperMan] Apache Warrior"
PZPAPN
:  Re
H:
i; unexpected
 Eastern
R:  715
5:   PNCK -
, NAV 3.0+,
.2.0+
 The Re
.  It is
fEastern
V.  Re
&is a
uof .
the Re
wone .
in the
E, it may
the Re
pof 715
at the end
 of the
a.  One
 "891221"
the Re
[unexpected
ring
PZPAPN
Red Diavolyata
:  Red Diavolyata
830, MLTI
H:
R:  830
5:   PRhCK -
\, NAV,
 The Red Diavolyata
is an 830
,.  It was
, and
ated in the
 The
Red Diavolyata is
 the
at the top of
$the
'.  The
 not moved. The DOS
indicate
@by 960
mby the
Red Diavolyata is
, any .
rby the
.  If
X, it
pd by 830
), and
>and
in the
to the
>and
.  The
at the end of the
 The
can be
dat the end of
 "Eddie die
where in
m was written in the city of Prostokwashino"
 "(C)
  RED DIAVOLYATA"
 "Hello! MLTI!"
ly, the
"MLTI!
-MAND" can be
 It is
if Red Diavolyata
of Red Diavolyata are:
 Red Diavolyata B: Very
to Red Diavolyata B, the major
 difference
fthe
are two
 the
differ
fthe
PZPAPN
RefRef
:  RefRef
H:
R:  1,204
5:   PRhE -
, NAV 3.0+,
3.96+,
8/93+,
 The RefRef
.  Its
.  RefRef is a
 of .
bRefRef
X, the RefRef
at the top of
$the
, as
qby the DOS
 by 2,496
{21 and 22
mby RefRef in
the RefRef
, it
very small ones,
pof 1,204
at the end of the
a.  The
>and
in the DOS
not be
 The
in the RefRef
 "ReFReF"
 "TFReF"
 "4tsonpm"
 It is
what RefRef
PZPAPN
Reklama
:  Reklama
H:
i; TSR
 Poland
R:  2,723
5:   PRsCK -
, NAV 3.0+,
3.96+,
 The Reklama
.  It is
fPoland.  Reklama is a
uof .
bReklama
X, the Reklama
as a low
 TSR of 2,736
).  It hooks
the Reklama
, it
pof 2,723
).  The
at the end of the
a.  The
 and
in the DOS
not be
 The
can be
in the
 all Reklama
 "Przekaze tylko pewna informacje i juz mnie nie ma."
 "Wszystko jest OK."
 "A oto ta oczekiwana informacja:"
 "Ognisko Muzyczne  F R A Z A   we Wroclawiu uczy gry na :"
 "- pianinie,"
 "- akordeonie,"
 "- syntezatorach,"
 "- gitarze,"
 "- skrzypcach,"
 "- uczy rowniez spiewu solowego."
 "Ognisko  Muzyczne  F R A Z A  organizuje  rowniez  kursy"
 "CHWYTOW GITAROWYCH."
 "Juz po czterech miesiacach poznasz tajniki"
 "gry na gitarze badz syntezatorze."
 "I TY mozesz umiec grac na roznych instrumentach muzycznych."
 "Kontakt :   Wroclaw, tel. 25-90-97"
 "Nacisnij dowolny klawisz abys mogl pracowac"
 "Jesli chcesz umiescic relame w
ie samokopiujacym,"
 "pisz do:"
 "Agencji Wydawniczej:  skr. poczt. 1009, WROCLAW 3"
 "Wirusek reklamowy   1"
 It is
what Reklama
PZPAPN
Relzfu
:  Relzfu
 233, Fake VIRx
H:
i; "Specified
-MAND search
Ebad"
 Finland
R:  233
5:   PNCK -
, NAV,
 The Relzfu, or 233,
Gin Finland in
.  Relzfu is a
uof .
Relzfu is
X, the
 search the
Efor an
, the
wit,
was attempted to
Relzfu
 233
at the end of the
be no
3in the
>and
in the
 DOS
E.  Two
can be
 "ufzleR"
 "*.com"
 The
!used for the
 reversed.
 It is
if Relzfu
PZPAPN
Repent
:  Repent
H:
fail to function
&failures
R:  350
5:   ONCK -
30.00+, NAV 3.0+,
n1.04+,
6.64+,
8/93+,
6.64+,
1.25+
 The Repent
.  Its
.  Repent is a
the Repent
X, the
 Repent
wthe
bfour .
 the
E.  If
 it may
r.  The Repent
5to move
 up one
Ein the
Estructure,
 not function
in higher level
Fories are
 not
rby the
the Repent
lthe
)of the host
by the Repent
be no
3to the
unless it was
smaller
, in
case it
 350
.  The
>and
in the DOS
not be
.  One
in the Repent
the Repent
not function
 and are permanently corrupted.
&failures
© of
rby the
PZPAPN
Reset
:  Reset
 Omega, Friday-13th-440
H:
i; Very long
Kaccesses
R:  440
5:   PNCK -
, NAV,
 The Reset
.  Its
is a non-
uof .
the Reset
X, the
search the
Estructure looking
 for .
aencountered
rby the
has completed
sthe
O, it
search the C:
Oin the
 same manner.  Since the
searches the entire
O, a long
 period of
Kaccess
 any
the Reset
pd in
 by 440
).  The
at the end of the
a.  One
can be
in the
:  "*.
 Reset
Nnot
to do
PZPAPN
H:
R:  512
5:   PRfE -
, NAV 3.0+,
.2.0+
 The
Gin the
s is a
uof .
and in
on the video card if it is
|21 is
mby the
in the
|area.
s is
, it
pof 512
at the end of
 the
a.  The
>and
in the DOS
not be
.  No
in the
 It is
what
PZPAPN
Revenge Attacker
:  Revenge Attacker
 777, Revenge
H:
i; DIR
6problems;
hang;
Kformat
 Philipines
R:  1,127
5:   PRsCK -
, NAV,
 The Revenge Attacker, or 777,
ated in the Philipines.  Revenge Attacker is a
generic
uof .
 It is a very destructive
 The
Revenge Attacker is
 the
as a low
 TSR of 1,392
mby the
rby the
Revenge Attacker is
, it
wone .
by 1,127
at the end of the
>and
in the
 the
>and
be marked by the
 "777"
din the fourth through sixth
are two
 "*** 777 - Revenge Attacker V1.01 ***"
 Revenge Attacker's low
TSR is not used for
t, but
interfer
operation
 internal
6s are issued.  For example, issuing a DIR
Revenge Attacker is
in a
Eentry repeated in place of
 actual
Eentry.
a DIR
6, the
hang.
all .
in the
Eare
 Revenge Attacker
activate.  At
, followed by repeated 7's across
 the
.  While it is
Ming the
and writing the 7's
 to the
, it
Kstarting
 Side 0, Cylinder 1,
0.  Fat
:, and
aloss may
even if the
turns off
 the computer immediately
PZPAPN
Revelation
:  Revelation
H:
R:  4,096
5:   PRhCK -
 The Revelation
.  Its
.  Revelation is a
 It employs an encryption mechanism
used by the
 "Fish"
bRevelation
at the top of
 but
$the
', not moving
|12's
, as
qby the DOS
@by 32,768
 21 and 22
mby Revelation in
, Revelation
over 4,096
a DOS DIR
X.  The
 not always
wthe .
`it encounters,
s it
 just add 10
)to the end of the
 the 4096
pof 4,096
4,086
be hidden by
 the
it is
.  The
 at the end of the
a, and the
>and
in the DOS
not be
.  The
in the Revelation
 "Genesis"
 "Revelation
Alpha"
 "Exodus"
 "Copyright (c)
by Transvisionary"
the Revelation
 DOS
indicating
Ton all
 See:   Fish
PZPAPN
Reverse.A
:  Reverse.A
 Spider
H:
, 1994
R:  950 - 962
5:   PRhAK -
\2.13+,
6.64+,
n1.05+,
V117+,
1.25+,
6.64+,
V117+
 The Reverse.A
, 1994.  Its
.  Reverse.A is a
-and .
 It is a fast
u, spreading quickly on
bReverse.A
at the top of
 but
$the
', not moving
|12's
, as
qby the DOS
@by 992
mby the
-and .
.  It
 not
wvery small
Reverse.A
pof 950 to 962
at the end of the
a.  In the case of
,, the
a portion of the hex 00 area of the
a, so
 be no
t.  The
>and
 in the DOS
not be
.  The
in the
 "Red Spider
created by Garfield
fZielowa Gora
 in Feb
 "moc.dnammocexe.niamcn"
 It is
what Reverse.A
PZPAPN
Riihi
:  Riihi
H:
, 1994
R:  132
5:   PRaCK -
\2.13+,
V116+,
n1.05+,
2.58+,
6.64+,
1.25+,
6.64+,
V116+,
2.58+
 The Riihi
, 1994.  Its
.  Riihi is a
uof .
bRiihi
in al
, hooking
|21.
and/or
, as
 by the DOS
not be
, the Riihi
pof 132
at the end of the
a.  The
>and
in the DOS
to the
>and
.  No
in the
PZPAPN
RIP-699
:  RIP-699
 RIP, Patsy
H:
i; TSR;
 Australia
R:  699
5:   PRsCK -
 NAV 3.0+,
.2.0+
 The RIP-699, RIP, or Patsy,
Gin Australia in
.  It is a
uof .
,.  It
on March 6th and
it may
bRIP-699
X, the RIP-699
as a low
 TSR of 1,792
).  It hooks interupts 10 and 21.  It may
 as part of
6Data in
under
mapping
 utilities.
, RIP-699
pof 699
 at the end of the
a.  The
>and
in the DOS
not be
.  The
in the RIP-699
 "RIP Patsy Cline 8th
1932 - 6th March 1963"
 RIP-699
on March 6th and
8th of any year.  On
 those
>s, if the
Ys a
to set the
 video mode to
mode 80 by 25
 the
PZPAPN
:  RNA
H:   March,
i; zero
`created;
R:  7,296
5:   PNA -
, NAV,
1.25+
 The RNA
in March,
.  Its
.  RNA is a
uof .
 and .
.  It
Nnot
RNA is
X, the RNA
wup to four .
-and .
in the
 of 7,296
at the
 the
a.  The
>and
in the DOS
not be
 The
can be
din RNA
 "Run
 "uc253.rqz"
the RNA
[intermittent
X.  The
notice
zero-
`may be created in the
Oand
Kaccesses to
Omay
, but the
Nn't actually
on the
of RNA are:
 RNA-7408: RNA-7408, or RNA2, was
 It is
in behavior to the
are given preference for
tover
pof 7,408
at the
"of the
a.  The
can be
in the
 "Run
 "Portions Copyright (c) 1983,90 Borland"
PZPAPN
Rocko
:  Rocko
H:
 Canada
R:  666
5:   PRhAK -
, NAV,
1.53S+,
 The Rocko
fCanada.  Rocko
 is a
-and .
,.  It employs
techniques to
 avoid detection.
bRocko
X, Rocko
at the top of
$the
, as
qby the DOS
@by 704
mby Rocko
the Rocko
, it
-and .
 to not
lany
pas the
hides the
it is
.  The DOS
the Rocko
pof 666
at the end
 of the
a.  The
in the DOS
may dis
.  The seconds in the
stamp
!set to 60.  One
can be
in the
 "RocK STeaDY!"
 The Rocko
on the 13th of any month, at
 the
 on the
K.  It
8two mechanisms to perform
damage.
of Rocko are:
 Mutating Rocko:
on the Rocko
, at the
of its submission, is not
 detected by
aware of the Rocko
 to an
complex encryption mechanism.  Its
is 1,280
), hooking
{09 and
 21.  It adds 609
)to the .
Z, the
at the
 end of the
Mutating Rocko is
, the
be hidden.
 One
can be seen in all
 "(c) Rock Steady/NuKE]"
 Mutating Rocko
on the 24th of any month,
hits CTRL-ALT-DEL, the
K.  On
the 24th of the month, a cold
:  Montreal, Canada
 Rocko-B:
to the Rocko
.  It has 11
differ.
 The
at the end of the
: Montreal, Canada
PZPAPN
Roguey
:  Roguey
 Badcmdx
H:
i; TSR; host
 Lost clusters on
fail to function;
&failure
R:  967
5:   PRsCK -
V111+,
/2.1+,
2.58+,
n1.05+,
V111+,
2.58+,
.2.0+,
6.64+
 The Roguey, or Badcmdx,
.  Its
.  Roguey is a
uof .
bRoguey
as a low
TSR of 1,584
mby the
Roguey is
, it may
 are
 967
be hidden
.  Roguey encrypts the entire host
 in addition to its
5, so the position of the
in the
 host
aisn't particularly applicable.
 The
may be
Lby the
 "Bad
, and thus is
 not
 In addition to
Ming the
s of
may note an
pin the
rance of lost clusters on
Ks, as well as the
failing to
 copy of
PZPAPN
Rosen
:  Rosen
H:
R:  131
5:   PNCK -
/, NAV,
 The Rosen
.  Its
.  Rosen is a
uof .
the Rosen
wall .
in the
E.  If
E, it
the Rosen
pof 131
at the
 of the
a.  The
>and
in the DOS
to the
.  The
can be
in the
5in all Rosen
 "R*.
 The Rosen
is unable to recognize
rby the
, so it
later re
wthem,
 adding an
Nnot do
PZPAPN
:  RPVS
 453, TUQ
 Endangered
H:
 West Germany
R:  453
5:   PNCK -
/, NAV,
6.64+
 The RPVS, or 453,
Gin West Germany in early
is a
uof .
 The RPVS is
d for an unusual
s in a
adump
 of the
- "TUQ.RPVS" -
in not really a
, but a
 series of PUSH instructions.
 The RPVS
is a rather unsophisticated
ever a .
the RPVS or 453
X, the
look for an
ain the
 The
determines if the .
ahas
 by checking to see if the last two
)of the
aare 9090h.  If
 the last two
)are not 9090h, the
 appending 453
5to the end of the
a.  One .
not normally be
Nnot
9any logic to activate and cause damage
 in its
;state.  It
9many NOP instructions and
 odd jumps
leave plenty of space for later additions.
of RPVS are:
 RPVS-B: The RPVS
 the end of an
s, the
act differently.  It
not be able to
 determine
it has already
a, so it
wthe
ait finds in the
Eover and over again.
PZPAPN
RSP-1876
:  RSP-1876
 1876
H:
i; beeping; random
4written to
R:  1,876
5:   PRsAK -
, NAV,
 The RSP-1876
.  Its
.  RSP-1876 is a
uof .
-and .
bRSP-1876
in low
to a TSR.  The area
as a TSR, however,
most
mapping
 utilities.
{21 and 22
mby the
RSP-1876 is
, it
-and .
X.  If
X, it
 1,876
at the end of the
 The
>and
in a DOS
.  The
can be
 the
 "RSP"
Zof RSP-1876
in beeping
 emitted
fthe
speaker, as well as randome
#written to the
 may
PZPAPN
:  RTL4
H:
 The
R:  503
5:   PNCK -
n1.03+,
 NAV 3.0+,
8/93+,
1.25+
 The RTL4
, and is
.  RTL4 is a
the RTL4
X, the RTL4
wone .
in the
 along
Ming the
 "RTL4"
 "Joop van den Ende Produkties BV
 Marco Daas (Casting Assistent)
 Postbus 397
 1430 AJ  AALSMEER
 van Cleeffkade 15
 1413 BA  AALSMEER
 The
 Wedden dat... je een
hebt?"
hang
.  The
`, so it is not
the RTL4
pof 503
at the end of
 the
a.  The
>and
in the DOS
not be
.  In addition to the
, the
 The individual and the addresses
 by the
, but should not be construed to indicate
 individual wrote the
PZPAPN
Ryazan
:  Ryazan
H:
R:  512
5:   PRaE -
3.96+,
 The Ryazan
and is
fthe
.  Ryazan is a
uof .
bRyazan
X, the Ryazan
in a "hole" in al
at 0010.  It
|21.
, as
qby the DOS
not be
the Ryazan
, it
very small ones,
pof 512
 the
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the Ryazan
 "!!Ryazan"
 It is
if Ryazan
PZPAPN
Rybka
:  Rybka
H:
i; TSR;
Zfailures;
&failures
R:  123 Plus
5:   PRAK -
, NAV,
 The Rybka
.  Its
.  Rybka is a
uof .
-and .
 The
Rybka is
X, the
 Rybka
as a low
TSR of 1.3K
), hooking
|21.  Since the
 Rybka
cannot later recognize
it has already
 its TSR, it
zit again
X.  As a
continue to
Ain 1.3K increments as the
tprogresses.
Rybka is
, it
-and .
 over 132
X.  If
X, it
ras well.  Rybka
by at least 132
 many cases the
pmay be over 13,000
).  In
 any event, the
at the end of the
a.  The
>and
in a DOS
.  The
can be
 "VACSINA"
%the increasing loss of
while the
, Rybka
 failing to
ing the
to the DOS
 prompt.  If
r, the
PZPAPN
Sabbath
:  Sabbath
H:
R:  1,684
5:   PNC -
 The Sabbath
.  Its
.  Sabbath is a
uof .
, but not
the Sabbath
wone .
in the
pof 1,684
at the end of the
a.  The
>and
in the DOS
not be
 The
in the Sabbath
 "[Sabbath
By Havoc The Chaos of Trinity"
 "Sucks To Be You Pal!"
 "Your Computer
The Sabbath
- Trinity!"
 "Dedicated To Heaven In Black (He's Excited By
jfrequently
PZPAPN
:  Sad
H:
&failures;
R:  301
5:   PNCK -
, NAV 3.0+,
8/93S+,
8/93+,
.2.0+
 The Sad
.  Its
.  Sad is a
uof .
bSad
X, the Sad
wthe
bfour .
`in the
were not
pof 301
at the
"of the
a.  The
 and
in the DOS
not be
 The
can be
in the
 all Sad
 "Sad
- 24/8/91"
 "*?.com"
the Sad
[frequent
j, as well as
&failures
© of
 in the month of
in the "Sad
- 24/8/91"
of Sad are:
 Sad-307: A 307
of the Sad
 adds 307
)to the .
v.  Like
 the
, Sad-307's
 at the end of the
a, and the
>and
 in the DOS
not be
 The
din the
.  The major distinction
regards
is the
' behavior in
 Upon
Zof an
during the month of
, the
Mits
 the
O, effectively trashing the
 See:   Bljec
PZPAPN
Saddam
:  Saddam
 Sadam, Profesor
H:
&failures; I/O
 "Insufficient
to run .BAT
`; DIR
 France (reported
 Israel
R:  919
5:   PRsCK -
\, NAV,
 The Saddam
breported in France in
, the
bsample of
was actually
, its
was Israel.  Saddam is a
uof .
,.  It is
 on the Do-Nothing
 The
the Saddam
X, the
in low
not as a TSR.
{21 and 22
mby the
 it has not
Saddam is
, it
pof 919
), the
at the end
>and
upon
are several
may be
[d on
the Saddam
.  The most obvious symptom is
 the
occasionally be
 "HEY SADAM
 LEAVE QUEIT BEFORE I
cannot be seen in
`, it is
Y.BAT
 in an insufficient
a Saddam
fail, the
 hang.
in an I/O
Uand the
aborting
Z.  The DOS
6may
not function
.  Lastly,
 may
[frequent
jrequiring the
to re
 the
of Saddam are:
 Profesor:
on the Saddam
, Profesor
adds 919
)to the .
v.  Its usage and
to Saddam,
 differs in
s allocate very large
 amounts of
fail to
Y.  Professor
vup to two .
 the
Zof an
in a line of meaningless
L.  Professor
8the
 "???
 "The Profesor is in town again !!!"
 See:   Do-Nothing
PZPAPN
Sadist
:  Sadist
H:
i; unexpected warm re
&s of
R:  1,436 - 1,450
5:   PNE -
, NAV,
 The Sadist
.  Its
.  Sadist is a
uof .
the Sadist
X, the
 Sadist
search the
Eand
wup to
 three
r, a warm re
&may
, or the host
the Sadist
pof 1,436 to 1,450
 the end of the
.  The
>and
in the
 DOS
.  The
can be
in the
5in all
 Sadist
 "CopyRight by Vadim V.N.1989"
PZPAPN
Sandwich
:  Sandwich
H:
 Manchester, England
R:  1,172
5:   PRhC -
/, NAV 3.0+,
3.96+,
30.00+,
.2.0+,
1.25+
 The Sandwich
fManchester,
 England.  Sandwich is a
uof .
requiring a
response in a manner
 to the Ear
.  It
Nnot
 The
the Sandwich
X, the Sandwich
 at the top of
$the
, as
qby the DOS
@by 3,008
mby the Sandwich
, the Sandwich
for any reason.
by 1,172
the initial
not be
if the
.  The
at the end of the
 The
>and
in the DOS
 not be
one out of every six
 in the Sandwich
Ming a
requiring a
 response.  The
ARCV Member Likes a <sandwich> Sandwich?
 Is it A. Apache Warrior
 B. ICE-9
 C. Slartibartfast
 Select a Letter: "
 The "<sandwich>"
be one of the
 "Cheese, Beef Spread, Cucumber and Crisp"
 "Corned Beef and Salad Cream"
 "Jaffa Cake and Hamster on Rye"
 If the
answers the question correctly, the
 the
, and the
 "Well you know you`re ARCV Members."
 If the
answers the question incorrectly, the
 the
, and a
hang may
 "Bad Luck.. Better Luck Next
 All of the
in the
5, and thus
 not
.  The answers for the questions,
on the sandwich
s in the order
, are A,
 B, and
the Sandwich
notice
#detected on all
 Sandwich
PZPAPN
Saturday The 14TH
:  Saturday The 14TH
 Durban, Saturday 14th
G:  March,
 TSR;.
W, .OV?
i; corrupts
, FAT &
on Saturday 14th
 Republic of South Africa
R:  669
5:   PRA -
, NAV,
 The
breports of the Saturday The 14TH
came
fSouth
 Africa in March
.  The Saturday The 14TH, or Durban
, is a
generic
W, and
 overlay
`, but not
by between 669 and 684
 The Saturday The 14TH
on any Saturday
falls on
 the 14TH of any month, at
 100 logical
of the C:
O, B:
O, and A:
O.  In
 effect, on
OC:, the
destroys the
, and
(FAT).
PZPAPN
Sayha Watpu
:  Sayha Watpu
i; TSR
R:  4,000
5:   PRsAK -
\2.13+, NAV 3.0A06+,
1.0A06+
 The Sayha Watpu, or SW
UV2f,
.  Its
.  Sayha Watpu is
uof .
-and .
,.  It is a fast
u, quickly spreading on
bSayha Watpu
as a low
TSR of
 9,824
{16 and 21
mby the
the Sayha Watpu
, it
 and .
for any reason.
pof 4,000
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in all Sayha Watpu
 "SW
U V2f Sayha Watpu"
 It is
what Sayha Watpu may do
PZPAPN
Schrunch-420
:  Schrunch-420
Mof garbled
 may "schrunch" the
R:  420
5:   PNCK -
n, NAV 3.0+,
.2.0+,
1.25+
 The Schrunch-420
.  Its
.  Schrunch-420 is a
uof .
the Schrunch-420
wup to six .
in the
 420
at the end of the
a.  The
>and
in the DOS
.  The
can be
in the
5in all Schrunch-420
 "*.com"
 "- S C H R U N C H
 U P   T I M E -"
 The Schrunch
Mgarbled
 the
Mand hang the
.  It
 "schrunch" or compress the
 work on the
it was tested on.  It
write
 protect
fwrite
 protected
PZPAPN
Scott's Valley
:  Scott's Valley
 2131, Scott's, Slow-2131
 TSR; .
-and .
 Scott's Valley, California,
R:  2,131
5:   PRsA -
\, NAV,
 The Scott's Valley
 Scott's Valley, California.
is a
 generic
uof .
-and .
`, and
Nnot
 The
the Scott's Valley
X, the
as a low
TSR of 2,384
|21 is
mby the
, any .
-or .
by 2,131
).  .
between
 2,131 and 2,140
9the
chex
in the
5: 5E8BDE909081C63200B912082E.
 It is
is malicious.
PZPAPN
Scream
:  Scream
 Fist, Screaming Fist
, Except Scream 2-696,
7in USA & Canada
 Canada
R:  711 - 1,191
5:   PRtAK -
 NAV,
 The Scream, or Screaming Fist,
}in Canada in
.  Scream is a
uof .
 The
the Scream
at the top of
$the
', moving
|12's
, as
 the DOS
@by 2,048
{21 and 24
mby Scream in
, the
check to see if C:\
,has
rby the
.  If it is not
r, the
 promptly
wit.  The copy of
on the
Omay
the Scream
, it
for any reason.
pof 711
pof 711 to
 1,191
).  In both cases, the
at the end
 of the
.  The
>and
in the DOS
 Two
can be
din the Scream
5in all
 "Screaming Fist"
 "C:\
 It is
if Scream
of Scream are:
 Scream 1B: The Scream 1B
gequivalent to
 the Scream
.  It has four
differ
fthe
:  Canada
 Scream 2: The Scream 2
on the Scream
.  It
 adds 838
)to the .
v, and 838
 to 1,318
)to .
.  Like Scream, the
at the end of the
S, and no
 its
:  Canada
 Scream 2B: The Scream 2B
is a 692
of the
 Scream
it is
 and
, as measured by the DOS
@by 2,048
{21 and 24
mby Scream 2B.
 Scream 2B is
, it
-and .
, or copied.  .
by 692
).  .
pof 898 to 1,172
).  In both cases, the
at the
 end of the
:  Canada
 Scream 2C: The Scream 2C
gidentical to
 Scream 2B.  It is a minor
:  Canada
 Scream 2-696: The Scream 2-696
Gin the
in May,
it is
, as measured by
 the DOS
@by 2,048
), and
it is
, it
-and .
, or copied.  .
pof 696
).  .
pd in
by 902 to 1,176
).  In both cases, the
at the
 end of the
a.  Scream 2-696 is polymorphic,
 employing a complex encryption mechanism.  As of May,
, it was confirmed by several large
ts to
 be in the public domain, and is considered a
 in the
as a
:  Canada  May,
 Scream 2-732: The Scream 2-732
}in the
in May,
.  It is
in many
 respects to the Scream 2-696
 however,
by 732
).  .
pof 1,128 to 1,212
 In both cases the
at the end of the
a.  Like Scream 2-696,
is polymorphic.
 May,
 Scream-650: The Scream-650
is a 650
of the
 Scream
vthe C:
Oroot
Ecopy of
X.  It
Nnot
 until the
fthe
Kand the
rcopy of
 as measured by the DOS
 by 2,048
mby Scream-650.
it is
, it
 are
, or copied.
pof 650
at the end of the
a.  The
 and
in the DOS
not be
.  The
 the
 "Screaming Fist (c)12/91"
 "C:\
:  Canada
 See:   Emf   Enemy
PZPAPN
Scroll
:  Scroll
seconds set to "62";
U; .BAT
 England
R:  795 - 1,306
5:   PRhCK -
 NAV 3.0+,
1.53S+,
1.25+
 The Scroll
fManchester, England in
.  Scroll is a
uof .
,.  It employs
techniques to
 avoid the
noticing the
 The
rby the Scroll
 the Scroll
at the top of
$the
, as
qby the DOS
@by 3,008
 Scroll in
, the Scroll
for any
 reason.
 795 to 1,306
hide
it is
.  The Scroll
at the end of
.  The seconds field in the
>and
in the DOS
!set to "62", the
tmarker for
 the
.  The
in the
 "[SCROLL] ICE-9 ARcV"
the Scroll
may notice
the DOS
detect
the Scroll
.  It
 .BAT
`, permanently corrupting them.
PZPAPN
Scythe
:  Scythe
 England
R:  1,208
5:   PRCK -
3.96+,
30.00+, NAV 3.0+,
1.25+
 The Scythe
fManchester, England in
.  Scythe is a
uof .
,.  It employs
techniques to
 avoid the
noticing the
ts, and is a fast
 The
rby the Scythe
 the Scythe
at the top of
$the
, as
qby the DOS
@by 3,008
 Scythe in
, the Scythe
for any
 reason.
 1,208
usually hide
it is
(note: it
Nn't always do
).  The Scythe
at the end of
.  The
in the DOS
.  The
be different, and the
be set to 10:56.18.  The
in the
is the Scythe for Reaper Man."
 "Beware I`m Sharp!"
 "Made in England by Apache Warrior, ARCV Pres."
 "Scythe Ver. 1.01 (c) Apache Warrior 92."
 "Reaper Man Swung The SCYTHE and the PC Died!"
 "[SCYTHE] Apache Warrior, ARCV Pres."
the Scythe
may notice
the DOS
detect
the Scythe
PZPAPN
SeaCat
:  SeaCat
 Read-
Attribute set on
R:  160
5:   PNCK -
3.96+, NAV 3.0+,
 The SeaCat
.  Its
.  SeaCat is a
uof .
the SeaCat
X, the
 SeaCat
wone .
in the
 160
at the
"of the
a.  The
>and
in the DOS
to the
>and
.  The Read-
attribute
be set on in the
 DOS
for the
a.  The
 can be
in the
5in all SeaCat
 "SeaCat*.com"
 SeaCat
corrupt .
smaller
 are
rby the
PZPAPN
Search-1000
:  Search-1000
G:  March,
R:  1,000
5:   PNCK -
8/93S+,
3.96+,
, NAV 3.0A06+,
.2.0+
 The Search-1000
in March,
.  Its
.  Search-1000 is a
uof .
the Search-1000
wone .
in the
pof 1,000
at the end of the
a.  The
>and
in the DOS
to the
>and
 The
can be
in the
5in all
 Search-1000
ly, the
"CPX"
dat the very
"of all
of Search-1000 are:
 Search-377: A 377
of the Search-1000
vall of the .
in the
pof 377
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all Search-377
 "*.com"
:  Israel
PZPAPN
:  Self
 Polish-457, Polish-550, Self-457, Self-550
 Poland
R:  457 or 550
5:   PNCK -
, NAV,
 The Self
is actually two
were
ated in Poland.  Both
 are
us of .
one of the Self
es is
 the
search the
Eto find all
.  All
the Self
.  The
 either 457 or 550
), depending on
of the two
es is
 present,
at the
"of the
a.  In either case, the
>and
 the DOS
to the
 and
of Self are:
 Self-457: The 457
of the Self
pd in
by 457
).  The
can be
 "MS *.
-" and "RZRZ".
 Polish-457.
 Self-550: The 550
of the Self
pd in
by 550
).  The
can be
 "CMS*.
-", "*.
W", and "QYQY".
as Polish-550.
PZPAPN
Semtex
:  Semtex
 Czechoslovakia
R:  1,000
5:   PRhCK -
n, NAV,
 The Semtex
.  It is
fCzechoslovakia.  Semtex is a
uof .
bSemtex
Xon a
 Semtex
at the top of
$the
, as
qby the DOS
 by 4,080
|12's
not be moved.  Semtex
hook
{8 and 21.
, Semtex
Semtex is
, it
for any reason.  In the case of copying
fone
Eto an
, both the source and target
 copy of the .
Semtex
by 1,000
 The
at the end of
 be no
3to the
>and
in the DOS
.  The
can be
 the
 "S E M T E X  by Dusan Toman, CZECHOSLOVAKIA
 (7)213-040 or (804)213-23"
is not
Lby the
Semtex has
for 60 minutes, it
 produce a
Qcursor position on the
9a colored background and an ASCII
 character.  The effect is a multi-color flashing
of very
 small rectangles.  The
to normal by
 pressing a key on the
of Semtex are:
 Semtex-B: A 1,000
of the Semtex
is 4,080
), hooking
|21.  It
for any reason.
pof 1,000
at the end of the
a.  The
pis not hidden
.  The
>and
in the DOS
not be
.  The
in the
5in all Semtex-B
 "S E M T E X  by Dusan Toman, CZECHOSLOVAKIA
 ***
la nice day  ***"
jmay
:  Czechoslovakia
 Semtex-C: A 619
of the Semtex
is 4,080
), hooking
{08 and
 21.  It
for any reason.
pof 619
at the end of the
a.  The
 is not hidden
.  The
>and
in the DOS
not be
.  The
in the
5in all Semtex-C
 "S E M T E X  by Dusan Toman, CZECHOSLOVAKIA
 (7)213-040 or (804)213-23"
jmay
:  Czechoslovakia
 Semtex-D: A 1,000
of the Semtex
is 4,080
), hooking
{08 and 21.  It
 are
for any reason.
pof 1,000
at the end of the
a.  The
pis not hidden
.  The
>and
in the DOS
not be
.  The
in the
5in all Semtex-D
 "S E M T E X  by Dusan Toman, CZECHOSLOVAKIA
 (7)213-040 or (804)213-23"
jmay
:  Czechoslovakia
PZPAPN
Seneca-B
:  Seneca-B
& data
&failure;
R:  493
5:   ONAK -
3.96+, NAV 3.0+,
8/93+,
 The Seneca-B
.  Seneca-B is
and data
`.  It corrupts the
the Seneca-B
X, the
 Seneca-B
wall of the
in the
b493
)of the host
a.  The
Nnot differentiate between
and data
`, so
:, data
and data
the Seneca-B
as the
 smaller
.  The
>and
in the DOS
to the
>and
.  The
in the
 Seneca-B
 "*.* .."
PZPAPN
Sentinel
:  Sentinel
 Sentinel-3, Sentinel-5, BC
stuck key failure"
R:  4,625
5:   PRHAK -
, NAV,
.2.0+
 The Sentinel
, and is
is a
uof .
`, and
,.  Unlike most
Turbo Pascal source
5.  It
 may be purely a research
Sentinel is
X, the
at the top of
, but
$the
|12's
 not moved by the
mby the
,, if not
rby Sentinel at
as well.
Sentinel is
, it
-and .
larger
1K as
pof 4,625
), the
at the end of the
makes no
 attempt to hide the
>and
 the
Eis not
by the
 The
can be
dat the very end of
Sentinel:
 "You won't hear me, but you'll feel me
 (c)
by Sentinel.
ks to Borland."
 Sentinel
Nnot
to do
of Sentinel are:
 Sentinel-3: Sentinel-3 is a 5,173
of the Sentinel
.  Unlike Sentinel,
, it
hide the
if it is
.  Sentinel-3's
is 5,328
are no recognizable
visable in
Sentinel-3
notice
executing the
 DOS
Tdo not
Sentinel
since it didn't attempt to hide the
(  May
 Sentinel-5: Sentinel-5 is a 5,402
of Sentinel-3.
Sentinel-5 is
, it
hide the
.  Like
 Sentinel-3, executing the DOS
 uncover
.  Sentinel-5
 smaller
2K in
in the
stuck key failure",
 always
if the
to view
aeditor
Sentinel-5 is
.  Sentinel-5's
is 5,568
are no readable
in the
5in Sentinel-5
(  May
PZPAPN
Serena
:  Serena
i; TSR
 Italy
R:  792
5:   PRsCK -
, NAV 3.0+,
n1.04+,
6.64+,
6.64+,
1.25+
 The Serena
.  It is
fItaly.  Serena is a
uof .
bSerena
X, the Serena
as a low
TSR of
 1,104
).  It hooks
the Serena
, it
pof 792
at the end of the
a.  The
in the DOS
not be
.  No
in the
 It is
what Serena
PZPAPN
Seventh Son
:  Seventh Son
 7th Son, Seventh Son-284, Seventh Son-350
 The
 Eastern
R:  284 or 350
), depending on
5:   PNCK -
 NAV 3.0+,
8/93+
 The Seventh Son
is actually two
 behavior
were
}in the
are believed to
lactually
ated in Eastern
 The Seventh Son
es are
us of .
a Seventh Son
X, the
 Seventh Son
search the
Oand
 encountered
by either 284 or 350
), depending
of the Seventh Son
es has
rthe
be no
3in the
>and
in the DOS
E.  The
can be
 "Seventh son of a seventh son"
 Seventh Son
Nnot
to do
of Seventh Son are:
 Seventh Son-284: Seventh Son-284 is a 284
 Seventh Son-332: Seventh Son-332 is a 332
 the Seventh Son
.  It
vall .
 in the
pof 332
 at the end of the
a.  The
>and
 in the DOS
not be
.  The
din the
 Seventh Son
es are
:  The
 Seventh Son-350: Seventh Son-350 is a 350
 Seventh Son.426: Seventh Son.426 is a 426
 the Seventh Son
.  It
vall .
 in the
pof 426
 at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the
5in all
 "ARBEIT MACHT FREI!"
 "The Unforgiven / Immortal Riot  Sweden 01/10/93"
:  Sweden
, 1994.
 Seventh Son-473: Seventh Son-473 is a 473
 the Seventh Son
.  It
vall .
 in the
pof 473
 at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the
5in all
 "Fight Fire
Fire..."
 "Soon to fill our lungs the hot winds of death"
 "The gods are laughing, so take your last breath"
 "Immortal Riot..Death Greets me warm.."
 Seventh Son-Kernel: Seventh Son-Kernel, or Kernel, is a 610
on the Seventh Son
at the top of
$the
X, decreasing
by 8,448
).  It hooks
|21.
pof 610 to 624
at the end of the
 be no
3to the
>and
in the
 DOS
.  One
in the
5in all
 "KERNEL"
PZPAPN
Shadow
:  Shadow
 Shadow, Shadow-2
G:  May,
R:  713
5:   PNCK -
n, NAV,
 The Shadow
*, or Shadow,
}in May,
.  Its
.  Shadow
*is a
generic
, it
Shadow
X, it
 one
in the
E.  If
,is in the
E, it may
 713
rby Shadow
by 723
)if it
r.  In both
 cases, the
at the end of the
be no
3to the
>and
in the
Shadow
9two
 "!seviL etybwodahS"
 The
comes
fthe
 reversed says "Shadow
*Lives!".
 It is
if Shadow
of Shadow
*are:
 Shadow-2: A smaller
of the Shadow
, Shadow-2 adds
 635
`.  The
 can be
 "!sevil etybwodahS*.
 "AWK"
PZPAPN
Shake
:  Shake
 Shake Dropper
G:  May,
R:  476
5:   PRCK -
\, NAV,
 The Shake
(in May,
 Daniel Kalchev.  It is a
generic .
u, and
 The
X, the Shake
, altering the image of
 The Shake
sthem as
 accessed.
by 476
pcannot be seen using a DIR (list
 if the
 While the
is not destructive, it
occasionally
 the
: "Shake well before use !"
 attempted to be run.
L, the
 terminates rather
Ys.  A second attempt to run the same
in it running successfully.
of Shake are:
 Shake Dropper: A small .
drops the Shake
(, May,
PZPAPN
Shaker
:  Shaker
 Prague Joker
i; "shaky"
effect may be produced;
 Prague, Czechoslovakia
R:  512
5:   PRhCK -
, NAV,
 The Shaker
 reported to
ated in Prague, Czechoslovakia.  Shaker
 is a
uof .
 It is
on the Back
, and
 identify it as such.
 The
the Shaker
 Shaker
at the top of
$the
, as
qby the DOS
@by 528
{08 and 21
 by Shaker in
|12's
 moved.
Shaker is
, the
wany .
it is
X.  If
X, it
r.  Shaker
pof 512
).  The
at the
 end of the
be no
3to the
>and
in the DOS
.  One
 can be viewed
in the
 "Shaker"
Shaker may
[a "shaky"
effect
effect, however,
on all
 See:   Back
  Blinker
PZPAPN
Shaman
:  Shaman
G:  March,
R:  251
5:   PNCK -
3.96+,
1.25+
 The Shaman
in March,
.  Its
.  Shaman is a
uof .
the Shaman
wall of the .
in the
 251
at the
"of the
 The
>and
in the DOS
to the
>and
.  The
can be
in the
5in all Shaman
 "*.com"
 "Demo
v1.0  Copyright (c) 20.8.
by Shaman"
 Shaman
Nn't
to do
PZPAPN
Shanghai
:  Shanghai
G:  May,
=seconds = "62"
 China
R:  848
5:   PRhCK -
, NAV 3.0+,
30.00+,
n1.04+,
.2.0+,
6.64+,
1.25+
 The Shanghai
in May,
, and is
fChina.  Shanghai is a
uof .
bShanghai
X, the Shanghai
at the top of
$the
', not moving
|12's
, as
qby the
 DOS
@by 2,048
mby Shanghai in
, the Shanghai
wthree .
in the
a DOS DIR
 issued.  Shanghai
Nnot
the Shanghai
pof 848
at the end of
 the
a.  The
>and
in the DOS
to be un
, but the seconds field
!set to "62".  The
can be
in the
5in all Shanghai
 "ShangHai Railway Institute"
 It is
what Shanghai may do
PZPAPN
:  Shhs
R:  585
5:   ONAK -
n, NAV 3.0+,
8/93S+,
1.53S+,
 The Shhs
.  Shhs is a
uof .
 and .
,.  It corrupts the
Shhs is
X, the Shhs
 search the
Efor three
w.  If
were
d, it
wthem.  If
were
d, the
search
 the
Efor three
 and
wthem if
were
d.  If all the .
-and .
in the
Ewere
r, the
activate (see
$).  If the
Nn't activate,
 the
L, and the
ed to the DOS prompt:
too big to fit in
in the
, and is a fake
the Shhs
lthe
b585
 of the host
the Shhs
5.  Unless
 the
was smaller
be no
3to the
in the DOS
were
smaller
 585
rby Shhs.
be no
 to the
>and
in the DOS
all of the .
-and .
in the
the Shhs
, the
activate
the next
X.  At
, the
of the
 starting at
0.  The
 "I'm sorry, Dave... but I'm afraid I can't do
 Dedicated to the dudes at SHHS
 The BOOT SECTOR
u..."
to access
on the
fDOS.  Examination of the
on the
Norton Utilities in
 maintenance mode
reveal the
in the
 "Killed by:
 The "
9the
of the
activated
f.  For example, if the
 the
activated, the thirteen periods
be replaced by
-...".
 The Shhs
S, so the
cannot be seen
`.  Since Shhs
s the
"of the
cannot be dis
r, but must
Bd and replaced
fnon-
rcopies.
 has activated, the
Kshould be reformatted.
of Shhs are:
 Secret Service:
on the Shhs
, the
 Secret Service
s the
b600
 the .
v.  It
vthree .
in the
all of the .
in the
r, the next
Zof the
in the
trashing the
O.  The
in the
too big to fit in
 "I'm sorry John McAfee (NOT!)..."
 "Secret Service
has arrived..."
 "Dedicated to all
makers!"
 "By: Agent #13/Nuke Member"
 "Killed by:"
:  Canada
PZPAPN
Shield
:  Shield
G:  March,
i; hidden .
`created;
3; TSR;
R:  5,152
)(companion
`), 127
5:   PSRsA -
Spawning
, NAV,
8/93+,
 The Shield
in March,
.  Its
is a
spawning or companion
by creating corresponding .
`.  It
adds 127
)to .
`do not carry an active
 The
Shield is
X, the
 Shield
as a low
TSR of 5,456
the Shield
, it
create a hidden
 companion .
aof 5,152
)for
.  It
add 127
.  The 127
to the end of .
, and the
>and
in the DOS
 The Shield
is creates an active
in the
 companion, hidden .
jmay
PZPAPN
Shifter
:  Shifter
R:  6,672
5:   PRtEX -
/, NAV 3.0+,
n1.05+,
\2.13+,
1.53S+,
`& Replace
 The Shifter
.  Its
.  Shifter is a
 of the
) and
bShifter
X, the Shifter
wthe
, the
9ing the
x.  The
Nnot
, and
not start
 The next
fthe
K, the
 Shifter
at the top of
$the
', moving
|12's
, as
qby the
 DOS
@by 7,168
the Shifter
, it
pof 6,672
at the
 end of the
a.  The
>and
in the DOS
not be
.  No
in the
 Shifter
 It is
what Shifter
PZPAPN
Shiny Happy
:  Shiny Happy
=seconds = "48";
 :-)
1to :-(
 North America
R:  921
5:   PRtAK -
30.00+,
n1.04+,
6.64+,
1.25+
 The Shiny Happy
, and
fNorth America.  Shiny Happy is a
 of .
-and .
,.  It employs
techniques to avoid detection.
bShiny Happy
X, the Shiny
 Happy
at the top of
$the
', moving
|12's
, as
qby the DOS
@by 1,024
 03, and 09
mby Shiny Happy in
the Shiny Happy
, it
 and .
pof 921
be hidden
Shiny Happy is
.  The
at the end of all
`.  The
>and
in the DOS
, but the seconds field
1to "48".
 The
can be
in the
5in all
 Shiny Happy
 "Shiny Happy
by Hellraiser and Dark Angel
 of Phalcon/Skism"
the Shiny Happy
, it
 character sequence ":-)" to ":-("
it is
d on the
PZPAPN
Shirley
:  Shirley
i; TSR
 Germany
R:  4,099 - 4,112
5:   PRsE -
can, NAV 3.0+,
8/93+,
 The Shirley
.  It was
}in Germany in
.  Shirley is a
 of .
bShirley
X, the Shirley
as a low
 TSR of 4,160
mby Shirley in
the Shirley
, it
pof 4,099 to 4,112
at the end of the
a.  The
>and
 the DOS
not be
.  The
in the
5in all Shirley
 "IWANTSHIRLEY"
 "Marty McFly lives
where in
(Doc Brown)"
 "Fuck for Eddie!!"
one place to spend nice holidays...
 "CASAL BORSETTI"
 "in Italy...
 "Fuck for John McAfee and all the
Vrs-Killers..."
 "We
la right to live
 "Greetings to the 1704... you were the
 "Greetings to
-B...You were the Second!"
 "But now its my turn."
 "Hope You
lfun
the Shirley-
 The
the "IWANTSHIRLEY"
 included
in the
5in German.
PZPAPN
Shock Therapy
:  Shock Therapy
R:  620
5:   PRtAK -
3.96+,
30.00+, NAV 3.0+,
 The Shock Therapy
.  Its
.  Shock Therapy is a
uof .
-and .
bShock Therapy
X, the
 Shock Therapy
at the top
$the
', moving
 12's
, as
 by the DOS
@by 2,048
mby Shock Therapy in
the Shock Therapy
, it
 and .
pof 620
 the
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the Shock Therapy
 thus not
 "Your HD is TOAST!
x to Shock Therapy!"
 "SHOCK THERAPY"
 "TIaMaT"
 It is
what Shock Therapy
 See:
PZPAPN
Sicilian Mob
:  Sicilian Mob
warm re
 Canada
R:  1,024
5:   PNCK -
/, NAV,
 The Sicilian Mob
.  It is
fCanada.
is a
uof .
,.  It is
on the
the Sicilian Mob
 the
look for an
 The
Eis searched
b, and
 path.  If no
path has
!set, the
search the
Estructure.
ahas
, the
the Sicilian Mob
pof 1,024
).  The
at the
 end of the
a.  The
>and
in the DOS
 Starting in
, the
Mthe
 "Sicilian Mob Ia -
[NUKE]'91 - Rock MP"
in all
`, as are the
 "Copyright (C)
by [NUKE]
 InterNat'nl Software Development"
 "Completed
, Montreal, Canada"
 "--> [NUKE] H/A/P/V/T at its Best <--"
the Sicilian Mob
is a one in seven chance of the
performing
 a warm
 See:   Parasite
  VHP
PZPAPN
Signs
:  Signs
 Signs of Life
i; TSR
R:  720
5:   PRsCK -
3.96+, NAV 3.0+,
.2.0+
 The Signs, or Signs of Life,
 Its
.  Signs is a
uof .
bSigns
X, the Signs
as a low
TSR of
 720
).  It
hook
|21.
mapping
 utilities may show the TSR as
pin the
of the
 "config" area in
the Signs
, it
pof 720
 the end of the
a.  The
>and
in the DOS
not be
.  The
 can be
in the
5in all Signs
 "Signs Of Life."
 It is
what Signs may do
PZPAPN
Silence
:  Silence
R:  555
5:   PRhCK -
, NAV 3.0+,
1.53S+,
.2.0+,
 The Silence
.  Silence is a
uof .
,.  Its
 The
the Silence
 the Silence
at the top
$the
'.  It
Nnot move
|12's
qby the DOS
@by 1,568
mby Silence in
the Silence
, it
X.  If
X, it
rby the
the Silence
pof 555
at the
"of the
a.  The
>and
 in the DOS
not be
.  The
in the
 "The Silence Of The Lambs!"
 Silence
Nn't
to do
 See:   Youth
PZPAPN
Silly
:  Silly
 200, V200
G:  May,
R:  200
5:   PNCK -
, NAV,
 The Silly
Vin May,
.  It is a
uof .
Silly is
X, the
 search the
OC:, and
wall .
pof 200
 the
at the
"of the
a.  The
>and
in the
not be
 The Silly
Nnot do
 See:   Amstrad   Hell   Pixel   Silly-365
PZPAPN
Silly
:  Silly
 formatted
R:  2,268 - 2,313
5:   PNAK -
30.00+,
2.11+,
\2.13+,
 The Silly
.  Its
.  Silly
y is a
uof .
,.  It
trojanizes .
the Silly
X, it
wor trojanize up to two
on the C:
O.  The
blook for the
in the C:
Oroot
E, and
move downward as necessarily in the
 structure.
 of 2,268 to 2,313
at the
"of the
a.  Trojanized .
p.  The
>and
in the DOS
not be
Ys an .
!trojanized
 by the Silly
, the
be cleared, and
 an animated face
in the upper left hand corner of the
, accompanied by the
 "Hello, I'm Silly
 Now I'm formating Your HARDDISK!
's fine! - Isn't it (har,har)..."
 The C:
be accessed,
Kis not formatted
 by the
a short period of
, the
 cleared and the
 "ERROR: No SYSTEM
 Insert SYSTEM
OA: and push any key!"
 The
attempt to format the A:
PZPAPN
Silly-365
:  Silly-365
 Pixel, Pixel 877
G:  May,
i; slow to very slow
loads;
R:  877+
5:   PNCK -
, NAV,
8/93S+,
 The Silly-365
Vin May,
.  It is a
 very buggy
of the Silly
.  Like Silly, it is a non-
uof .
,.  It is
#listed separately as its behavior and
tare considerably different.
Silly-365 is
X, the
 search the
E, and
wall .
d.  If the .
in the
Ewere
rby Silly-365,
be re
Silly-365
>and
in the
to the
>and
tand re
 The bugs in Silly-365
lto do
the re
ts of
tof a
by Silly-365, the
by 877
).  On the
t, the
by an
 877
).  The second re
in a
pof 1,754
).  The third re
tadds 3,508
 The pattern is
starting
the second re
t, the
pis equal to two
s the previous
 Needless to say, even
starting
a very small 42
, by the eighth
t, the
is too large to be
 The
problem
Silly-365 is
it is very noticeable.  As
 the
tproceeds, the
takes longer and longer to
Yany .
.  By the seventh re
ton the one
 of my test
, the
was literally working on re
 two .
for 20 minutes.
 The Silly-365
was intended to
Mthe
an 8th generation
U fucking defoult
 Please by me a new
, in actual 8th generation
ts, is not
 as the 8th generation
ais too large to be
 as a .
 Silly-365
fits base
is 365
.  The Silly
Nnot do
of Silly-365 are:
 Silly-740:
to Silly-365,
is actually 370
.  Like Silly-365, it re
 multiple
s, so
multiple of 370 or 740
 See:   Amstrad   Hell   Pixel   Silly
PZPAPN
Silver Dollar
:  Silver Dollar
; long
Kaccesses;
do not
R:  2,071
5:   ONAK -
, NAV 3.0+,
 The Silver Dollar
.  Its
a mention is made
in the
of Boulder,
 Colorado in the
.  Silver Dollar is a
vboth .
-and .
the Silver Dollar
search the
Efor up to four
w.  If the
(s) are
d, the
wthem,
b2,071
)of the host
.  The
>and
in the DOS
not be
.  The
can be
in all Silver Dollar
 "Copyright(C)
by CU, Boulder Colorado."
too big to fit in
 "Person/People/Things we >>hate<<:"
 "Person/People we admire:"
 "Person/People/Things we think are cool:  Irving Berlin's Music."
rby the Silver Dollar
may notice
too big to fit in
.  Long
Kaccesses
of Silver Dollar are:
 Silver Dollar-2A:
, Silver Dollar-2A is a
 1,644
of the Silver Dollar
.  It
vfour .
Wor .
in the
b1,644
)of the host
.  The
>and
in the DOS
 not be
.  The
in the
5in all
 "Allocating
. Please wait
accessing
, please turn off all RAM"
and press >>Enter<< to continue
too big to fit in
 "Copyright(C)
by Fairview High School,
 Boulder Colorado, 80303. Macintrashes Suck!"
 "Victoria McMath. XX"
 "Linda"
 "Darnell."
 ".. *.
 The
bfour
Las a
Xand all of the .
in the
lalready
rby the
 Silver Dollar-2B:
, Silver Dollar-2B is a
 1,874
of the Silver Dollar
.  It
vfour .
Wor .
in the
b1,874
)of the host
.  The
>and
in the DOS
 not be
.  The
in the
5in all
 "Allocating
. Please wait
accessing
, please turn off all RAM"
and press >>Enter<< to continue
too big to fit in
 "Copyright(C)
by Fairview High School,
 Boulder Colorado, 80303. Macintrashes Suck!"
 "Person/People/Things we >>hate<<: Paul Harvey's sucks
 MacinTrashes Suck
! BASIC Suck
 "Windows sort of suck. Person/People we admire:"
 "Victoria McMath(Ginger Rogers),"
 "Linda Darnell. Person/People/Things we think are cool:"
 "The author of Star Trek, Poker Faces, C++, LISP. XX"
 ".. *.
 The
bfour
Las a
Xand all of the .
in the
lalready
rby the
 Silver Dollar-2D:
, Silver Dollar-2D is a
 2,218
of the Silver Dollar
.  It
vfour .
Wor .
in the
b2,218
)of the host
.  The
>and
in the DOS
 not be
.  The
in the
5in all
 "Allocating
. Please wait
accessing
, please turn off all RAM"
and press >>Enter<< to continue
too big to fit in
 "Copyright(C)
by Fairview High School,
 Boulder Colorado, 80303. Macintrashes Suck!"
 "Person/People/Things we >>hate<<: Paul Harvey's sucks
 MacinTrashes Suck
! Graham (Not Alexander but
 ass kids whjo calls himself graham) sucks!"
 "Person/People we admire:Lynn Bari, Jean Arthur, Jane
 Russell"
 "Person/People/Things we think are cool: Cybernetics, C++,
 39 Steps, The Mafia, maybe "Monty Python""
 ".. *.
 The
bfour
Las a
Xand all of the .
in the
lalready
rby the
 Silver Dollar-2F:
, Silver Dollar-2F is a
 736
of the Silver Dollar
.  It
vfour .
Wor .
in the
b736
)of the host
.  The
>and
in the DOS
 not be
.  The
in the
5in all
 ".. *.
 The
too big to fit in
s be
 Silver Dollar-8101:
fa United
 States source, Silver Dollar-8101 is a 8,101
 of the Silver Dollar
.  It
 one .
-or .
in the
 the
b8,101
)of the host
.  The
>and
in the DOS
.  The
 the
5in all
 "Copyright(C)
by CU, Boulder Colorado."
 "Person/People/Things we >>hate<<:"
 "Person/People we admire:A Midgit, or maybe two :-)."
 "The Luna - moon. Ivy, Irene, Iris"
 "Person/People/Things we think are cool or find phus:"
 "Strip Poker,"
 "Gambling."
 "PLO"
 "The Silver Dollar
Strikes Again"
is dedicated to a nice person AMY"
 "Everyone say Hi Amy!"
 Silver Dollar-SHJH:
, Silver Dollar-SHJH
 is a 1,547
of the Silver Dollar
.  It
vfour .
Wor .
in the
b1,547
)of the host
.  The
>and
in the DOS
 not be
.  The
in the
5in all
 "Allocating
. Please wait
accessing
, please turn off all RAM"
and press >>Enter<< to continue
too big to fit in
 "Copyright(C)
by Souther Hills Jr. High, 1500 Knox Dr.,
 Boulder Colorado, 80303. Macintrashes Suck!"
 "Victoria McMath. XX"
 "Linda"
 "Darnell."
 The
bfour
Las a
Xand all of the .
in the
lalready
rby the
the fourth
Las a
 See:   Leprosy
PZPAPN
Simple
:  Simple
R:  424
5:   PNCK -
3.96+, NAV 3.0+,
1.25+
 The Simple
, and is
fthe
.  Simple
is a
uof .
the Simple
X, the
 Simple
wall of the .
in the
E, as well as the copy of
in the
Oroot
pof 424
at the
 of the
a.  The
>and
in the DOS
to the
>and
.  The
can be
in the Simple
5in all
 "SIMPLE
 "C:\V.0 *.
 "C:\
 Simple
Nn't
to do
PZPAPN
Simple Minds
:  Simple Minds
do not
R:  207
5:   ONCK -
 NAV 3.0+,
 The Simple Minds
.  Simple
 Minds is a
the Simple Minds
 the Simple Minds
wall of the .
 in the
it has completed
sall of
 the .
`, it
Mthe
 the
to the DOS prompt:
 "A vir 4 da simple minded people of the earth
 Since ya didn't notice dis vir.. YAR LAME
the Simple Minds
lthe
 207
)of the host
by the Simple Minds
5.  Since the
b207
)of the host
are not saved
 by the
, host
are permanently corrupted.  The
punless the
smaller
), in
case
 207
.  The
>and
in the DOS
to the
 and
%the
, the
in the
5in Simple Minds
Simple Minds
fail to
 copy of
PZPAPN
Simulati
:  Simulati
hang;
R:  1,257 - 1,313
5:   PNC -
, NAV,
 The Simulati
.  Its
.  Simulati is a
.  It
Nnot
Simulati is
X, the
 search the
Efor an
.  If
 one is
d, the
wit.
by 1,257 to 1,313
at the end of the
a.  The
in the
to the
>and
 On a random basis, the Simulati
hang the
.  The
be one of the
 three:
 "ALIVE... Your
rby the SIMULATION
la nice day!"
 "FRODO LIVES!"
 "HA HA HA YOU HAVE A VIRUS"
L, are centered vertically
 and horizontally on the
PZPAPN
Sinep
:  Sinep
G:  March,
R:  644
5:   PRhCK -
3.96+,
V112+
V113+,
1.25+
 The Sinep
in March,
.  Its
.  Sinep is a
uof .
bSinep
X, the Sinep
at the top of
$the
', hooking
|22.
|12's
not be moved.
qby the DOS
@by 672
the Sinep
, it
pof 644
 the end of the
a.  The
>and
in the DOS
to the
 and
.  No
 the
5in Sinep
jmay
PZPAPN
Siskin
:  Siskin
 Sistkin-948
R:  948 - 956
5:   PRhAK -
, NAV 3.0+,
 The Siskin, or Siskin-948,
along
of the
es are
fthe
 Siskin is a
uof .
-and .
,.  On XT class machines, the
es in
destroy or corrupt the
 The
the Siskin
 the Siskin
at the top of
$the
'.  It
Nnot move
|12's
qby the DOS
@by 960
{1C and 21
mby Siskin in
the Siskin
, it
usually
pof 948
by up
 to 956
).  The
at the end of the
a.  The
>and
in the DOS
not be
 Frequent
jmay be
[d on
 especially
© of
of Siskin are:
 Siskin-1017: An earlier
of the Siskin
is 1,024
 It adds 1,017 to 1,025
)to the .
-and .
>and
to the
>and
 Siskin-Goodbye: An
member of
group of
es, Siskin-
 Goodbye's
is 848
).  It adds 839 to
 847
)to the .
-and .
>s the
>and
 are
PZPAPN
Sistor
:  Sistor
 Sistor-2225, Plaice
j; bouncing small diamond
 Sweden
R:  2,225
5:   PRtAK -
, NAV,
1.53S+,
.2.0+
 The Sistor, or Sistor-2225,
location.  It is believed to
ated in
 Sweden.
is a
uof .
-and .
 The
the Sistor
at the top of
$the
|12's
be moved.
, as
 by the DOS
@by 4,096
{1C and 21
mby the Sistor
 At the
of becoming
, the Sistor
 check to see if the copy of
,the
r.  If it is not
r, the Sistor
the Sistor
, it
pof 2,225
 at the end of the
be no
3to the
>and
in the DOS
.  The
can be
dnear the end of all
 "Sistor"
the Sistor
or .BAT
, the
be left spinning.
 The
notice a "bouncing ball" on the
s to actually be a very small diamond
 character.
of Sistor are:
 Sistor-1129: A 1,129
of the Sistor
is an earlier
of the Sistor-J4J
 listed
$.  It
pof 1,129
 the end of the
a.  The
in the DOS
not be
, and the
pis not hidden.
 The
8one
is the
tmarker
at the very end of
 "J4J"
:  Sweden  May,
 Sistor-2380: A 2,380
of the Sistor
the exception
p, and
jdo not
 typically
 Sistor-2630: A 2,630
of the Sistor
the exception
p, and
jdo not
 typically
 by 2,630
t.  Sistor-2630
 cannot distinguish
r, so it
, adding an
2,630
 are no
in the
 Sistor-J4J: A 1,273
of the Sistor
by 1,273
be hidden
 if Sistor-J4J is
.  The
 at the end of
.  The
in the DOS
not be
Sistor-J4J
notice
the DOS
, and
to be
 smaller
actually are
qas having
T).  The
can be
in the
5in Sistor-J4J
 "Elo
, Elo
, lam
 sabakt
 "Charlie says:  Support ()DEMORALIZED YOUTH()"
 "J4J"
:  Sweden
 Sistor-J4J Alpha:
, Sistor-J4J Alpha
s to be an earlier
of the Sistor-J4J
.  Its
is 4,096
), hooking
|21.  It
were
ron open
usually not function
Sistor-J4J Alpha
pof 833
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
 can be
in the
5in all Sistor-J4J
 Alpha
 "Jump 4 Joy, alpha-release. Not to be distributed!"
 "J4J"
:  Sweden
 See:   PCBB
PZPAPN
Skater
:  Skater
 Skater-1021, Tonya
i; TSR;
 Australia
R:  1,021
5:   PRsCK -
30.00+, NAV 3.0+,
1.25+
 The Skater, Skater-1021, or Tonya,
 Australia in
.  Skater is a
 of .
bSkater
X, the Skater
as a low
 TSR of 2,416
).  It
hook
{10 and 21.
mapping utilities may indicate the
as an
pin the
of the in
copy of the
6inter-
 pretor, showing a
pof up to
2,500
, the Skater
pof 1,021
at the end of the
a.  The
in the DOS
not be
.  The
in the Skater
     "I love Tonya
king. The best womens Figure Skater in history."
     "Now Tonya, Do
triple axle and kick Kristi Yamaguchi's arse"
     "- Australian Parasite -"
 The
btwo
may be
Lby the
ever a
to set the
video mode
mode, 80 by 25.
of Skater are:
 Skater-977: A smaller
of the
at the top of
$the
', hooking
{10 and 21.
, as
qby the DOS
@by 2,016
, Skater-977
pof 977
at the end of the
a.  Skater-977
 in the same manner as the
, and
 the same
:  Australia
PZPAPN
Skew-469
:  Skew-469
 Skew
R:  469 - 485
5:   PRxE -
3.96+, NAV 3.0+,
1.25+
 The Skew-469, or Skew,
, and
fthe
.  Skew-469 is a
 of .
.  It is a fast
u, quickly spreading on
bSkew-469
in a "hole" in al
 low
, hooking
{1C and 21.
, as
qby the DOS
 not be
the Skew-469
, it
for any reason.
pof 469 to 485
 the
at the end of the
a.  The
 and
in the DOS
 the
>and
.  No
in the
 It is
if Skew-469
PZPAPN
Skism
:  Skism
R:  1,992
5:   ONE -
P, NAV 3.0+,
 The Skism
}in the
is a
Skism
look for an
win the second
fthe
O's root
E.  If an
is not
d, the
continue
 reading down through the
Estructure looking for
, Skism
wit,
b1,992
)of the host
be no
3to the
unless it was
smaller
1,992
), in
case it
 1,992
.  The
>and
not be
Skism
has completed
a, it
 the
to the DOS prompt.  The
not function.
 Skism
8the
in the
 "The man who brought you"
 "622, Skism One, Captain"
 "Trips, and Sub-Zero now"
 "shanks you again,
 "his latest..."
 "Skism
 "Get a late pass!"
 "* *.
 It is
if Skism
 corrupting the
of Skism
 Angel Dust 1.0:
on the Skism
 one .
ain the
if more
two sub
Fories
 are present on the
lthe
b700
.  The
8the
 not
 "* *.
W*.* \"
 "ANGEL DUST V1.0"
jmay
 Skism
gequivalent to the
's encryption has
!slightly
 modified.
 Skism-808:
on the Skism
 one .
ain the
if more
two sub
Fories
 are present on the
lthe
b808
.  The
8the
 not
 "Skism Rythem Stack
-808."
 "Smart Kids Into Sick Methods"
 "Dont alter
5into your own strain, faggit."
 "HR/SSS NYCity,
is the fifth of many, many more
 "You sissys
 "* *.
W*.*"
 On the last Friday of any month, the
attempt
 to destroy all
`in the
 May,
PZPAPN
Skull
:  Skull
 Necro
:; graphic
R:  666
5:   PNCK -
 The Skull, or Necro,
, and is
fthe State of Pennsylvania in the
.  Skull is a
uof .
,.  It
"drop" a second
, the Skull
$under
.  Since the Skull
s, it is listed as a
rather
as part of
 the base Skull
the Skull
X, the Skull
wone .
in the
 If it cannot find a .
w, it
instead "drop"
 the Skull
 an .
the Skull
pof 666
at the end of
 the
a.  The
>and
in the DOS
not be
.  The
in the Skull
 "PATH="
 The Skull
Nn't do
and drop the
 Skull
$.  The Skull
it is
of Skull are:
 Skull
W: Skull
Wis the
is dropped
 by the Skull
rby the Skull
X, the Skull
wone .
in the
b466
 the host
.  The Skull
Ma graphic
 "skull" on the
 "You cant
 Its already dead!"
in the
5.  The
is un
in the Skull
:  Pennsylvania, USA
PZPAPN
Skynet
:  Skynet
, 1994
output slowed;
 China
R:  1,448 - 1,462
5:   PRhE -
\2.13+,
V116+,
V116+
 The Skynet
fChina in
, 1994.  It is a
uof .
disrupts
 operation.
bSkynet
X, the Skynet
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 1,664
mby the
the Skynet
, it
pof 1,448 to 1,462
at the end of the
a.  The
>and
in the
 DOS
not be
.  The
$can be
in the
5in all
the Skynet
, the
d" out to the
 "Terminator
 Don't be afraid.
 I am a very kind
 You
ldo many works today.
let your computer slow down.
la nice day,
 Goodbye.
 Press a key to continue. . ."
a key is
pressed, it
Mthe
 at the top of the
, followed by the
output
Lin single lines:
 "*** Terminator I *** Created by Sky Net in Chung-Li."
Lat the end of the output, as
 well as at the end of all output
X.  In
cases, it
in the loss of
of the output data
fthe
%the
Skynet
 noticeably slow output, and unexpected
jmay
of Skynet are:
 Skynet.1809:
fFrance in
, 1994, Skynet.1809 is a
 1,809
.  It
veither the
qby the en
ment
-SPEC variable, or a .
 or .
by 1,809
usually
 1,809 to 1,849
in the case of very small
`, the
pmay be as much as
 6,000
).  In either case, the
 at the end of the
a.  The
>and
 the DOS
 the
>and
 The
in the
5in all
 "ENCULATOR III"
-SPEC="
 "SMARTCHK.*"
 "CHKLIST.*"
 "IRUS\ENCULATO"
 "DESTI13"
:  France
, 1994.
PZPAPN
Slayer
:  Slayer
 Brain Slayer, Slayer, Yankee Doodle Dropper, VBasic 2
G:  March,
i; long
Kaccesses;
Kaccesses to unexpected
R:  5,120
5:   PNA -
\, NAV,
 The Slayer
es was
Gin March,
 group of
;ly consists of five
 were
fdifferent locations at
the same
.  All of the
 of .
-and .
do not
$is a generic description of the
es in
 Specifics for
are listed under "
" at the
 end of
entry.  In
cases, the
difference between the
is a few
a Slayer
X, it
wall .
-and .
in the
 the
ly, depending on the
, it may
Os as well.
a Slayer
 between 5,120 and 5,135
at the
 end of the
a.  The
>and
in the
not be
of Slayer
es include long
Kaccesses
, and possibly
 accesses to unexpected
Os.  The order of the
bin the
 At least one member of
], Slayer-E or Yankee Doodle
 Dropper, carries the Yankee Doodle
later
 release on
Yankee Doodle is the TP45VIR
 Members of the Slayer
]are:
 Slayer-A: Slayer-A
wup to nine
in a
the root
E, on the
 addition to
on the
 Slayer-B:
to Slayer-A,
in the C:
Oroot
Ein addition to
 those
on the
Oand
 Slayer-C:
to Slayer-A and Slayer-B, Slayer-C
 all
on the
Oand all
on the C:
O.  The
can be
din samples of Slayer-C:
 "KEYB*.
-KEYB*.
WBASRUN BRUN COBRUN NET$OS *.
 "IBMBIO.
 "IBMDOS.
,*.* .. \ .. *.
 "Access denied."
 Slayer-D: Slayer-D is
to Slayer-C, the major difference
while it accesses the C:
X, it
on the C:
Ounless the
fC:. The
 Slayer-C
 Slayer-E: Slayer-E is
as the Yankee Doodle Dropper.
X, it
 the
on the
Oand
E, and
wa few
on the C:
period
has elapsed since the
release the Yankee Doodle
onto the
ing in an active Yankee Doodle
 If the
successfully removes Yankee Doodle,
 but
Nn't remove the Slayer-E
t, Yankee Doodle
promptly re
wthe
fthe Slayer-E
remain.
 be in the public domain.
PZPAPN
Sleepwalker
:  Sleepwalker
1to 10:47a
 Australia
R:  1,268 - 1,282
5:   PRhCK -
30.00+,
1.25+
 The Sleepwalker
, and is
 Australia.  Sleepwalker is a
bSleepwalker
at the top of
$the
', hooking
{1C and 21.
, as
qby the DOS
@by 1,552
|12's
!moved.
the Sleepwalker
, it
pof 1,268 to 1,282
at the end of the
a.  The
>in the DOS
not be
 but the
to "10:47a".  The
in the Slime
 "STAC"
 "Sleepwalker. (c) OPTUS
 It is
what Sleepwalker
PZPAPN
Slime
:  Slime
 ARCV-773
G:  March,
; DOS
 England
R:  773
5:   PRhCK -
3.96+,
 The Slime, or ARCV-773,
in March,
, and is
fEngland.  Slime is a
semi-
bSlime
X, the Slime
at the top of
$the
', hooking
|21.
 and
, as
qby the DOS
@by 2,048
|12's
!moved.
the Slime
, it
 for any reason.
 of 773
be hidden
 the
is in
.  The Slime
at the end
.  The
>and
in the DOS
not be
.  The
 are
in the Slime
 "[Slime] By Apache Warrior, ARCV Pres."
 "Sliming around your PC,
 I go make a sticky MESS over your
ly, the
can be
at the end of
 all
 "4Qu2u"
the Slime
, the DOS
detect
Ton all
PZPAPN
Slovak
:  Slovak
 Slovak 2.00, Slovakia
G:  May,
 Czechoslovakia
R:  1,673 - 1,771
5:   PNE -
30.00+, NAV 3.0+,
1.25+
 The Slovak, Slovak 2.00 or Slovakia,
 Czechoslovakia in May,
.  During May,
of four
 different
es were
}in the Slovak
].  Slovak 2.00
entry,
initial
 listed
$under
.  All of the
es in
group are
polymorphic
the Slovak 2.00
X, the
 may
wone .
in the
Nnot always
`.  The
 always
wan .
Ewhere the
Xis not the
E, and is on the
path.  At
, the
wone .
in the
the Slovak 2.00
pof 1,673 to 1,771
at the
 end of the
a.  As
all of the Slovak
es, the
 Slovak 2.00
S, and no
in the
.  The
>and
 in the DOS
not be
a Slovak 2.00
X, the
requiring the
in the word "SLOVAK":
 "SLOVAKIA
2.00  (c)
by ??. All Rights Reserved.
 Greetings
fBratislava, SLOVAKIA.
the word SLOVAKIA:"
 If the
starts to
a word
SLOVAKIA, the
Mthe
cleared
 the
presses escape as requested:
the word SLOVAKIA, not CZECH, YUGOSLAVIA, or SLOVENIA!!
     Press Esc."
s the word SLOVAKIA, the
 One
in the
 "PATH=*.
 Slovak 2.00
Nn't
to do
Mits
requiring a
response.
of Slovak are:
 Slovak 1.00: An earlier
of Slovak,
`instead of .
, adding 1,352 to 1,603
)to the end of the
v.  The
Lis much simplier, still requiring
the word SLOVAKIA:
 "Greeting
fBratislava, SLOVAKIA.
the word SLOVAKIA:"
: Czechoslovakia  May,
 Slovak 2.02: A later
of Slovak 2.00,
, adding 1,969 to 2,091
)to the
v.  The
Lby the
to Slovak 2.00,
the exception
 the
number
be 2.02.
: Czechoslovakia  May,
 Slovak 3.00: A later
of Slovak 2.02,
pof 2,051 to 2,177
at the end of the
a.  The
to Slovak 2.02,
the exception
number is now 3.00.
: Czechoslovakia  May,
 Slovak-4: An earlier
of Slovak,
is very
to the Slovak 1.00
Nnot
Many
pof 1,363 to 1,587
at the end of the
a.  It is
 slighly polymorphic.
: Czechoslovakia
 Slovak-4B: A later
of the Slovak-4
, Slovak-4B
vone .
 of 2,586 to 2,810
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
s be
L, requiring the
the word "Slovakia":
 "SLOVAKIA
4.00 (c)
by ??"
 "ALL Rights Reserved."
 "Greetings
fBratislava, SLOVAKIA."
the word SLOVAKIA:
 Typing the word Slovakia
in the
ed to the DOS prompt.
: Czechoslovakia  May,
PZPAPN
:  Slow
 Slowdown, Zero
G:  May,
 Australia
R:  1,701
5:   PRsA -
, NAV 3.0+,
:  CleanUp, NAV, or
 The Slow
Gin Australia in May
.  It is a
generic
W, and
 overlay
,is not
 The
Xon a
, the
as a low
TSR, taking
 up 1,984
mby the
 Later, as
rby the Slow
.  While the Slow
5is actually 1,701
pby more
amount.
by 1,721
at the
"of the
by 1,716 to 1,728
at the end of the
 In the process of
`, the
may hang the
, causing the
lto re
 The Slow
on the
 It is
what else the Slow
of Slow are:
 Slow II: A minor
of the Slow
adds 1,721
)to the .
v, and 1,716 to 1,730
)to .
.  The
at the
"of .
 the end of .
usually
 not function
ing in frequent
 Slow III:
on the Slow II
, Slow III is very
no longer
 hang the
 March,
 Slow IV:
on the Slow III
, Slow IV is very
:  Australia  March,
 See:
PZPAPN
Sluknov
:  Sluknov
R:  867 - 875
5:   PRhCK -
2.11+,
\2.13+
 The Sluknov
.  Its
.  Sluknov is a
 of .
bSluknov
X, the Sluknov
at the top of
$the
', not moving
|12's
, as
qby the
 DOS
@by 1,728
mby the
, the Sluknov
pof 867 to 875
at the
 end of the
a.  The
>and
in the DOS
not be
.  No
in the
 It is
what Sluknov
PZPAPN
Small ARCV
:  Small ARCV
 England
R:  236
5:   PNCK -
\, NAV 3.0+,
.2.0+
 The Small ARCV
fEngland in
 Small ARCV is a
uof .
,.  It
Nn't
to do
the Small ARCV
wone .
in the
pof 236
 the
at the end of the
a.  The
 and
not be
.  The
can be
in the
5in all Small ARCV
 "[SmallARCV] Apache Warrior. *.com"
PZPAPN
Small
:  Small
 England
R:  349
5:   PNE -
 NAV 3.0+,
8/93+,
.2.0+,
1.25+
 The Small
fEngland in
 Small
Wis a
uof .
Nn't
to do
the Small
wone .
in the
pof 349
 the
at the end of the
a.  The
 and
not be
.  The
can be
in the
5in all Small
 "*.exe [Small
W] Apache Warrior."
PZPAPN
Small-38
:  Small-38
and data
fail to
 Canada
R:  38
5:   ONAK -
& Data
 The Small-38
fWallace
 Hale of Canada.  Source
fMr. Hale was
, and indicates
he wrote it in response to the Mini-45
in May,
is not believed to be in the
 public domain, and is considered a research
.  It is a
and data
Small-38 is
X, the
wall
in the
E.  The
 not care if the
ais an execu
or a data
a.  It
wany
ait encounters.
 the
punless the
 less
), in
case the
).  The
>and
in the DOS
to the
>and
Small-38 has finished
sall the
`in the
E, the
be hung in a search loop on the
E.  The
need to be re
&ed to get out of the
 loop.
and data
Small-38 are permanently
 damaged, having had the
should
 be replaced
a clean backup copy.
PZPAPN
Small-115
:  Small-115
Zfailure
R:  115
5:   PNCK -
n1.04+,
3.96+, NAV 3.0+,
y1.53S+,
.2.0+
 The Small-115
, its
.  Small-115 is a
uof .
the Small-115
wall of the .
in the
E.  The
ed to the DOS
prompt.
the Small-115
pof 115
at the end of the
a.  The
>and
in the DOS
to the
>and
.  One
in the
 in all Small-115
 "*.com"
 Small-115
Nn't do
PZPAPN
Small-145
:  Small-145
R:  145
5:   PRxCK -
, NAV 3.0+,
1.53S+,
 The Small-145
, its
.  Small-145 is a
uof .
bSmall-145
in a "hole" in low al
, hooking
|21.
, as
qby the DOS
not be
the Small-145
, it
pof 145
at the
"of the
a.  The
>and
in the DOS
to the
>and
in the
5in Small-145
 Small-145
Nn't do
PZPAPN
Small-178
:  Small-178
R:  178
5:   PRxCK -
3.96+, NAV 3.0+,
 The Small-178
, and is
.  Small-178 is a
uof .
bSmall-178
in a "hole" in low al
, hooking
|21.
, as
qby the DOS
not be
the Small-178
, it
pof 178
at the end of the
a.  The
in the DOS
to the
>and
.  No
in the
5in Small-178
 Small-178
Nn't do
PZPAPN
Smaug
:  Smaug
R:  349
5:   PNC -
n1.04+,
6.64+,
 NAV 3.0A06+,
.2.0+,
1.25+,
6.64+,
1.0A06+
 The Smaug
.  Its
.  Smaug is a
uof .
, but not
the Smaug
wone .
in the
pof 349
 the
at the end of the
a.  The
 and
in the DOS
not be
.  The
in the
5in all Smaug
-MAND.*.
 "I$ W
PZPAPN
Smiley
:  Smiley
 Smiley face ASCII character bouncing around
R:  1,987 - 1,994
5:   PRfCK -
, NAV 3.0+,
n1.05+,
8/93+,
 The Smiley
.  Its
.  Smiley is a
, but its
tmechanism is
u.  The
 portion is
used for the
effect.
the Smiley
X, the
 Smiley
wone .
ain the
Nnot
X.  For example, if it encounters a very small .
ain the
Eas it searchs for an
a, it
typically not
the Smiley
pof 1,987 to 1,994
).  The
 the end of the
a.  The
>and
 the DOS
 The
can be
in the
 Smiley
 "\*.
W*.* \*.
 "yANKEE Doodle#and VACsin."
 "The red planet("InvasiOn"
,in the
Oroot
 the Smiley
za portion of
the next
&s the
, the Smiley
|1C.
 a short period of
has elasped, the Smiley
produce
effect of an ASCII smiley face character
bounces
 around the
 It is
if Smiley carries any damage potential.
PZPAPN
Socha
:  Socha
R:  753
5:   PRhCK -
, NAV,
 The Socha
.  Its
, or
~, are
.  Socha is a
,.  It should be noted
 Socha
>has
the year is 1981.
 The
Socha is
X, the Socha
at the top of
$the
, as
qby the DOS
@by 3,008
mby the
if the year
 of the
>is 1981.
Socha is
, it
 are
if the
>'s year is 1981.  In
years, the
in its
;form
Socha
 753
>and
in the DOS
to the
>and
.  The Socha
at the end of
.  The
can be
dnear the end
 of Socha
 "Socha"
 "C:\m_edit\me$.ovl com
 Socha
Nnot
to do
PZPAPN
Sofia Term
:  Sofia Term
 Sofia Term.839
, 1994
R:  839
5:   PRhCK -
\2.13+,
6.64+,
1.25+,
6.64+
 The Sofia Term, or Sofia Term.839,
, 1994.
 Its
, or
~, are
.  Sofia Term is a
uof .
bSofia Term
at the top of
$the
', not moving
|12's
, as
qby the DOS
@by 3,072
mby the
if it was not
, it
Sofia Term
pof 839
 at the end of the
>and
in the DOS
 list not be
.  The
in the
5in all
 "Sofia
by TERMINATOR"
 It is
what Sofia Term may do
of Sofia Term are:
 Sofia Term.887:
, 1994, Sofia Term.887 is
 a later
of the Sofia Term
 Its
is 8,192
), hooking
 copied.
pof 887
).  In the case of
be no
pas the
)of the slack (hex '00') area
 at the end of the
.  The
in the DOS
not be
 The same
s in the
can be
, 1994.
PZPAPN
Solano 2000
:  Solano 2000
 Dyslexia 2.01, Solano
G:  March,
i; TSR; unusual
 California,
R:  2,000
5:   PRsC -
, NAV,
 The Solano 2000
}in Solano County,
 California in mid-March
by Edward Winters.  The
by the
Dyslexia
V2.01,
can be produced by
 negating
null terminated
in the
5.  Using
 the same technique, what
s to be the creation
>of the
, 08FEB90, can be produced.  The
xregarding the
xproduced by negation of
)was determined by Jay
 Parangalan of Solano County. The Solano 2000
is a generic
u.  The
Xon the
, the
proceeds to
wevery .
can be manually identified by using a
editor to
 view the
)1168 through 1952
consist of '(' or 28h
, such as DISKCOPY.
is included on all DOS
not run
 instead an "invalid
Ospecification"
is not in the
5, but is due to an
Ucondition
#induced due to the
's presence. The
-induced
ring
KCopy
was how the
bspotted and eventually
Solano is
, it
take up 3K of RAM
 The Solano 2000
Nno apparent
damage, however it
Ncheck the video buffer occasionally, and may transpose numbers
din certain locations.
effect, however, was
 not
[d on the author's
in researching
!reports
instead of transposing numeric
4, the Solano
3color attributes on the
it is active in
of Solano 2000 are:
 Dyslexia 2.00: same as Solano 2000, except
the 28h
 are now binary zeros.  The attempted transposing of
 numeric
4in video
 slowed down.  The creation
s to be
 22JAN90 instead of 08FEB90.
 Solano 2000-B: same as Solano 2000, except the 28h
1to DAh
4, and are
)1168 through 1912 in
 Solano D:
to the
Solano,
has had
 its encryption slightly
in order to avoid
 detection.  The 28h
 to 00h
 Subliminal 1.10: A very early
of the Solano 2000
vany .
 1,496
, the
monitor
to flicker.  What is
ring is
to flash
 the
"LOVE, REMEMBER?" in the lower left
 portion of the
Mfor a subliminal duration.
 The actual amount of
Ms on the
varies due to CPU speed differences.
PZPAPN
thing
thing
thing-658
i; SOME.
acreated;
R:  658
5:   PRhCK -
, NAV,
 The
thing
 Its
, and
~, are
thing is a
uof .
 The
thing
X, the
thing
at the
 top of
$the
, as
qby the DOS
@by 672
|12's
!moved.
mby the
thing
.  At
be created
 in the
d SOME. (the
extension
 be blank).
of zero
thing
, it
pof 658
at the
"of the
a.  The
in the
thing v1.1"
 It is
if the
thing
PZPAPN
Sonik Youth
:  Sonik Youth
R:  854 - 866
5:   PNE -
30.00+,
2.58+,
\2.13+,
2.58+
 The Sonik Youth
.  Its
.  Sonik Youth is a
uof .
the Sonik Youth
wone .
in the
pof 854 to 866
).  160
to the
"of the
the remainder of the
#at the end of the
a.  The
>and
in the DOS
, but not to the
>and
.  The
in the
5in all Sonik Youth
 "My m
used to say"
 "You're the boy
can enjoy invisibility"
 "The pleasure is everlasting"
 "Sonik Youth
released 29
 The
in the
W\* \"
lhad the Sonik Youth
present for
 may
[the
deleting .
fthe
PZPAPN
Sorlec
:  Sorlec
 Sorlec 3
R:  597
5:   PRhAK -
, NAV 3.0+,
1.25+
 The Sorlec, or Sorlec 3,
.  Its
.  Sorlec is a
uof .
-and .
the Sorlec
X, the
 Sorlec
at the top of
$the
mby the
the Sorlec
, it
pof 597
 the
at the end of the
a.  The
 and
in the DOS
not be
.  The
can be
in the
5in all
 Sorlec
 "CLtV"
 "Sorlec 3 -
Detonaton!"
jfrequently
the Sorlec
of Sorlec are:
 Sorlec 4:
, Sorlec 4 is a later
of the Sorlec
is 10,240
), hooking
|21.  It
X, adding 553
)to the
.  The
>and
in the DOS
not be
.  The
in the
 "MSDOS.SYS"
 "Sorlec 4"
 Sorlec 5:
, Sorlec 5 is a non-
of the Sorlec
.  It
vall of
 the .
`in the
pof 535
 at the end of the
a.  The
>and
 the DOS
not be
.  The
in the
 "Sorlec 5 *.
 Sorlec 6:
, Sorlec 6 is a
of the Sorlec
.  It
vall of the .
 and .
`in the
pof 565
 at the end of the
a.  The
>and
 the DOS
not be
.  The
in the
 "..1... ... 1 *.
usually not function
ing in a
hang.
PZPAPN
Sorry
:  Sorry
V1.3, Perfume-2
R:  731
5:   PRhCK -
\, NAV,
:  NAV, or
 The Sorry
.  Its
comes
 German phrase in the
: "Tut mir Leid !".
 on the Perfume
fWest Germany, and
identify it as Perfume or 4711.
 The
the Sorry
 the
in high
both
Aby 1,024
mby the
 immediately
rby the
, thus insuring on later
immediately.
, it
wany .
X, increasing the
by 731
).  The
at the end of
 The Sorry
8the
 "G-VIRUS V1.3"
 "Bitte gebe den G-
5ein"
 "Tut mir Leid !"
 It is
what the Sorry
 See:   Perfume
PZPAPN
Soupy
00a    Q
0PTa
:  Soupy
i; TSR;
R:  1,072
5:   PRC -
3.96+,
 NAV 3.0+,
n1.04+,
6.64+,
1.25+
 The Soupy
, and is
.  Soupy is a
 of .
, but not
,.  In the case of advanced
ts, it may
za portion of
 order to facilitate the
mechanism in the
the Soupy
X, the
 Soupy
wone .
in the
E, as well as up
>a counter
in the
the Soupy
pof 1,072
at the end
 of the
a.  The
>and
in the DOS
not be
 The Soupy
the counter
in the
 has r
Qed 11, indicating the 11th generation of the
Qed.  At
, the
za portion of
of 736
), hooking
|08.
portion of the
zed, it
Mthe
one at a
every three minutes:
 "Unsuspecting
, 12 o'clock!"
 "Get ready... 'cause... THERE'S A VIRUS IN YOUR SOUP!"
fthe guys
brought you Lythyum, Radyum, and
 VioLite comes:"
 "The Soupy
, (k)
VG Enterprises,
 216/513/602/904/703"
 "By The Attitude Adjuster & AccuPunk!"
 "Hurry! Hire an Anti-
Professional!
pWallet Space!"
 "...hmmm, ya' know, I think I''ll halt now..."
the last
L, the
 halted or hung.  The
in the
 Soupy
5, as are the
 "[Soupy] The Attitude Adjuster & AccuPunk,
 VG 08/23/92 to 12/02/92"
 "Bad
of Soupy are:
 Soupy-Death:
on the Soupy
adds 1,001
)to the .
 Like Soupy, it
zs a 720
*portion of its
an 11th generation
thas
X.  In the case of Soupy-Death, the
hooks
|9.
, Soupy-Death waits for the
 to press CTRL-ALT-DEL, and
clear the
in color.  The
in the Soupy-Death
 "Your PC has lapsed into a higher state of
#..."
 "D E A T H!!"
 "Please, feel
eto cold
 "as nothing has
!damaged,"
 "it was
a near death"
 "Your PC should meditate more often,"
 "cuz
all the evil
 "flowing around neurospace"
 "we wouldn't want
 "to
 a real"
 "D E A T H"
 "[Death]   The Attitude Adjuster, VG,  12/02/92"
 "Bad
PZPAPN
:  Sov
 Leningrad, Sov-545, Sov-602
R:  See
5:   PNCK -
\, NAV,
 The Sov
is actually two
.  Both
es are
us of .
,.  Since
characteristics are
Cjointly
 as Sov,
differences noted under
a Sov
X, the Sov
 one .
in the
E.  If
E, it may
r.  Sov
depends on
 of the
es is present (see
$).  The
 at the end of the
be no
3to the
>and
in the DOS
 It is
if the Sov
es do
es are:
 Sov-545: One of the two Sov
adds 545 to 599
)to the
v.  The
din the
 "PATH="
could be a crash, crash, crash"
 Sov-602: One of the two Sov
adds 602 to 616
)to the
v.  The
din the
 "PATH="
 See:   Leningrad II
PZPAPN
Spanish
:  Spanish
i; TSR; slow
loads;
 cascading letters graphic effect
 Spain
R:  2,930
5:   PRsAK -
, NAV,
 The Spanish
Gin Spain in
.  Spanish
 is a
generic
is very
 to the Traceback II
 The
Spanish is
X, Spanish
as a low
TSR of
 7,632
{1C, 20, 21, and 27
mby the
X, the
wthe
Y, along
in the
E.  Spanish
by 2,930
).  The
at the end of the
be no
 in the
>and
in the DOS
 A symptom of a Spanish
loads
 longer
.  The slowdown
 is due to the
searching the
Efor a candi
Spanish is
for one hour, it
 cascading
effect
to the Traceback II
.  The
4on the
fall to the bottom of the
, until
encounter an
character.  Unlike Traceback
 II, the
is not restored by the
, and the
 end up
#hung.
 See:   Traceback II
PZPAPN
Spanish
Fools
:  Spanish
Fools
?28th
i; TSR;
j; copy,
B, and
6s may fail
 Spain
R:  1,417
5:   PRsE -
\, NAV,
n1.04+,
8/93+,
1.25+
 The Spanish
Fools, or
?28th,
, in the Zaragoza area of Spain.  It is reported to be
 widespread in
area.  Spanish
Fools is a
uof .
bSpanish
Fools
X, the
as a low
TSR of 1,808
{21 and 28
mby the
Spanish
Fools has
for several
 minutes, it
start
 by 1,417 to 1,431
).  The
at the end of
be no
3in the
in the
 Spanish
Fools
if it
 the
?28th of any year.  Upon
sporatically interfer
DOS internal
6s, such as COPY, RENAME, and DELETE.
6s may not
 function
involve .
, either not
 executing the
6, or hanging the
PZPAPN
Spanz
:  Spanz
=may dis
R:  639
5:   PNCK -
 NAV 3.0+,
8/93+,
 The Spanz
.  It
ated in
V.  Spanz is a
uof .
Spanz is
X, Spanz
search
 the
Eto locate the
, it
by 639
), the
at the end of the
a.  If the
in the
Ewas
12:00a, it
 now
blank
a DIR
6is issued.
can be identified by the
s near the end of all
 "INFECTED!  * SPANZ *"
 Spanz
Nnot do
PZPAPN
Sparse
:  Sparse
 Sparse-B
 TSR; .
i; gradual
R:  3,840
5:   PRsCK -
, NAV,
 The Sparse
.  Sparse is a
uof .
 The
Sparse is
X, the
as a low
 TSR of 3,872
{21, D1 and D3
 the
Sparse is
, it
by 3,840
at the
"of the
a.  The
>and
in the
to the
>and
Sparse
lthe ASCII
4"UK"
 as the second and third
)of the execu
9the
SHELLC, and
9the
of the
ed in the
becoming
.  (If the
 "sparse.com",
"sparse.com"
din all later
as long as the
Sparse
slowly
lless and less
.  The loss of
Zof an
in an
64K block of
.  If the
Ys 10
, in effect
be no
of Sparse are:
 Sparse-B:
gequivalent to the
Sparse
differ.
PZPAPN
Spring
:  Spring
 Spring-640
R:  640 - 655
5:   PRhAK -
30.00+,
1.25+
 The Spring, or Spring-640,
.  Its
.  Spring is a
uof .
-and .
bSpring-640
at the top of
', not moving
|12's
 and
, as
qby the DOS
@by 768
 Spring in
the Spring
, it
pof 640 to 655
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 in all Spring
 "699F"
 It is
what Spring
of Spring are:
 Spring-768:
, Spring-768
s to be
 a later
of the Spring
.  Its
, and
usage, is the same as for the
.  Spring-768
-and .
for any reason.
by 768 - 783
 the end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
 in all Spring-768
 "Spring"
PZPAPN
Spyer
:  Spyer
 Faust, Spyer-B, Spyer-C
 TSR; .
 Taiwan
R:  1,181
5:   PRsA -
, NAV,
 The Spyer
in Taiwan.
is a
uof .
-and .
`.  It
Nnot
 The
the Spyer
 the Spyer
as a 1,760
 low
TSR.
{21 and 22
mby the
, the
attempt to
 the next
X.  If the
is already
the Spyer
, the
 hung.  If the
was not already
r, Spyer
wit and
 hang the
always
by 1,181
Spyer
 between 1,181 and 1,195
).  In both cases, the
at the end of the
 always
lthe
chex character sequence at the end of
a: "CBDFD9DE848484".
 The Spyer
, in its present form, is not expected to ever be a
 serious problem.  Since it always
jthe
the next
becoming
, it is simply
 too obvious
thing is wrong.
of Spyer are:
 Spyer-B:
to the
Spyer,
fthe NCSA
collection
.  Its
source is
.  Spyer-B is
to Spyer,
the exception
hooks
|21.
hang the
X, but
usually
not.
 the same hex character sequence at the end of the
detect
 Spyer
miss
 Spyer-C: Very
to the
Spyer,
noteable differences.  It was
 the NCSA
collection
 and its
or source is
PZPAPN
Squawk
:  Squawk
G:  March,
R:  852
5:   PRtAK -
n, NAV 3.0+,
 The Squawk
in March,
.  Its
.  Squawk is a
uof .
-and .
bSquawk
X, the Squawk
at the top of
$the
', moving
|12's
, as measured
 by the DOS
@by 4,096
mby the
Squawk is
, it
-and .
pof 852
at the end of the
a.  The
>and
in the DOS
not be
 One
can be
din all
 Squawk
 "Nguyen Van Cuong - Siagon IBM comppany."
 It is
what Squawk
PZPAPN
Squeaker
:  Squeaker
.Exe
Bd if
R:  1,091
5:   PRhAK -
, NAV,
 The Squeaker
 Squeaker is a
uof .
-and .
 The
Squeaker is
X, the
at the top of
$the
, as
qby the DOS
@by 1,136
|12's
 moved.
{1C and 21
mby the
Squeaker is
, it
-and .
X.  If
X, it
Squeaker
pof 1,091
at the end of the
a.  The
in the DOS
to the
>and
 A symptom of a Squeaker
, if the
.Exe,
Bd.  The
ed to the DOS prompt.
 It is
if Squeaker
8any
damage potential.
PZPAPN
Squisher
:  Squisher
Hunter
R:  340
5:   ORfCK -
, NAV 3.0+,
 The Squisher or
Hunter
.  It
fthe
.  Squisher is a
 Unlike many
 Squisher
function
uses
techniques to avoid detection,
to the ZeroHunt
bSquisher
X, the
 Squisher
in a hole in
 low
, hooking
|21.
, as
qby the DOS
not be
the Squisher
, it
at least 340
)of hex '00'
 are
lthe
inserted
 where the hex '00'
4were
.  In the
 case of a
more
)of hex '00'
 it may
rmultiple
p, and the
>and
in the
 DOS
not be
.  No
 are
in the
 Squisher
Nn't
to do
PZPAPN
:  Staf
 Staff
may fail to
R:  2,083
5:   PNCK -
, NAV,
 The Staf
.  Its
 but
breports of it were out of
u.  It
the Staf
X, the
Mthe
Demo Ver.: 1.1 - Handle
care!
 By STAF (Tel.: [phone])
 Generation #n
 Press any key to
 The "n"
cthe pound sign
be replaced
 generation number of the
.  The "
 the
of the .
in the
has just
r.  If no
aexisted in the
X, the
s:" portion of the
be replaced
rall your
`in the
la nice day!"
Staf may
fail to
 "VIRUS ERROR #nn - Aborting process."
Staf
pof 2,083
at the
"of the
a. The
Nnot alter the
>and
in the
Eat the
 Staf
Nnot do
PZPAPN
Stahl
:  Stahl
 Stahlplatte
 Germany
R:  750
5:   PNCK -
, NAV,
1.53S+,
 The Stahl, or Stahlplatte,
.  It
fGermany.  Stahl is a
 of .
Stahl is
X, the
wone .
in the
E.  If the
encounters a very small .
it is searching
 for a
w, it
stop
the Stahl
pof 750
).  The
at the
 of the
.  The
>and
in the DOS
not be
.  Two
din all Stahl
 "STAHLPLA.TTE  Ich bin da!"
 "*.com"
 It is
what Stahl
PZPAPN
Stanco
:  Stanco
i; unusual
 Eastern
R:  7,529
5:   PNCK -
 NAV 3.0+,
 The Stanco
.  It is
fEastern
V.  Stanco is a
uof .
the Stanco
wone .
in the
pof 7,529
at the
"of the
.  The
>and
in the DOS
not be
.  The
9ed in the
5, but are not
as the
s in a PKLited form:
 "Insufficient DOS
... must be 3.2x or greater!"
 "Write Protect
KFull ..."
 "Abort"
the Stanco
may receive unusual
 such as the Write Protect
PZPAPN
StarDot 600
:  StarDot 600
:; spurious
 I/O ports
R:  604
5:   PNE -
/, NAV,
 The StarDot 600
.  Its
is a
uof .
StarDot 600 is
X, StarDot 600
wone .
in the
StarDot 600
by 604 to 616
at the end of the newly
a.  The
>and
in the
not be
 StarDot 600
write random data to the default
s, as well as send random data to the
 ports (37F to 3DF).
 See:   StarDot 789   StarDot 801
PZPAPN
StarDot 789
:  StarDot 789
R:  789 - 805
5:   PNAK -
, NAV,
 The StarDot 789
.  Its
.  StarDot 789 is a
 of .
-and .
StarDot 789 is
search the
Efor an
w.  If one is
d, it
r.  If an
ais not
d, the
search the
Efor an
w, and
 it if
 StarDot 789
pof 789
 to 805
at the end of the
be no
3in the
in the DOS
StarDot 789 may
 It is
what StarDot 789
 See:   StarDot 600   StarDot 801
PZPAPN
StarDot 801
:  StarDot 801
 Italian
R:  801
5:   PNAK -
, NAV,
 The StarDot 801
.  Its
it is very
to the Italian 803
, so it
 may
fItaly.  StarDot 801 is a
uof .
-and .
.  It
StarDot 801 is
X, the
look for an
in the
w. If an
Nnot exist in the
E, it
look for an
is selected, the
wit, adding the
5to the end of the
StarDot 801
by 804 to
 817
>and
in the
not be
 StarDot 801
^13th
is 1PM
 or later.  At
, it
write random data to all
Os on the
in reverse order (it starts at
OZ:).
jmay
 See:   StarDot 600
 StarDot 789
PZPAPN
Stasi
:  Stasi
 Stasi-1728
G:  March,
=seconds = 42;
R:  1,728 - 1,742
5:   PNE -
30.00+,
 The Stasi, or Stasi-1728,
in March,
.  Its
.  Stasi is a
uof .
.  It
ities to the Wit
the Stasi
X, the Stasi
wone .
in the
pof 1,728 to
 1,742
at the end of the
 The
>and
in the DOS
 not
to be
the seconds
!set to 42.
in the
5in Stasi
 The Stasi
Mthe
 "Stasi is watching you"
destructive
 See:   Wit
PZPAPN
Sterculius
:  Sterculius
 Sterculius.280, Sterculius I
^, 1994
R:  280
5:   PRaCK -
\2.10g+,
2.11a+,
V114+,
6.64+,
V113+,
6.64+,
1.25+
 The Sterculius
^, 1994.  Its
.  Sterculius is a
uof .
,.  A later
bSterculius
in low al
 hooking
|21.
qby the DOS
not be
the Sterculius
, it
pof 280
at the end
 of the
a.  The
>and
in the DOS
not be
.  One
in the
5in all
 "STERCULIUS"
of Sterculius are:
 Sterculius.440:
as Sterculius II,
pof 440
at the end of the
a.  The
in the DOS
to the
>and
.  The
can be
 the
5in all
 "STERCULIUS ]["
^, 1994.
PZPAPN
Sticky
:  Sticky
 Multi-2, Nu Way
G:  May,
R:  927 - 1,407
5:   PRtAKX -
W, Overlay, and
n, NAV 3.0+,
1.53S+,
 The Sticky, or Multi-2,
Gat several sites in the
and Canada in May,
.  Sticky is a
 multi-partite
vthe
) and all execu
bSticky
X, the Sticky
wthe
 writes a copy of its
5to Side 0, Cylinder 0,
2 and
 3, and
alters the
5.  The
 Sticky
Nnot
, and
 not
 Later,
fthe Sticky
K, the Sticky
 top of
$the
 12's
be moved.
qby the DOS
 3,072
mby Sticky in
the Sticky
, it
 execu
pof 927
).  .
by 1,133 to 1,407
).  In both
 cases, the
at the end of the
a.  The
>and
in the DOS
.  Sticky is an
, and no
in the
 It is
what Sticky
PZPAPN
StinkFoot
:  StinkFoot
 Stink
crashes on 8086/8088
machines
 Republic of South Africa
R:  1,254
5:   PNC -
, NAV,
 The StinkFoot
Gin the Republic of South Africa in
.  It is a
`, and
Nnot
StinkFoot is
X, the
 search the
Oand
Efor an
wwhose
is at least 1,000
).  If such
d, the
wit.
 StinkFoot
pof 1,254
).  259
 of the
at the
"of the
the remaining 995
#at the end of the
be no
3in the
>and
 in a DOS
 StinkFoot
Nnot do
.  It
 function
on XT (8088-
) machines.
of StinkFoot are:
 StinkFoot-1273:
s referred to as Stink 2, StinkFoot-1273
 is an
.  It adds 1,273
)to the .
v, splitting
 the
5between the
"and the end of
 the
: Republic of South Africa
 StinkFoot-2B: A minor
of the StinkFoot
adds 1,254
)to the
t.  It
, adding an
 1,273
)to the
 March,
PZPAPN
Stone`90
:  Stone`90
 Polish 961, Stone-90
 Poland
R:  961
5:   PNCK -
, NAV,
 The Stone`90
, or Polish 961, is a
uof .
,.  It was
, and is
fPoland.
the Stone`90
X, the
look for one .
on the
Oand in
 the
w.  If one is
d, the
rit. The newly
by 961
), and
lthe
at the end
 of the
 The
can be
 "Sorry, I`m INFECTED!"
 "I`m already NOT
 "(C) Stone`90"
 Stone`90
Nnot
to do
PZPAPN
&, Donald Duck, Hawaii, Marijuana, New Zealand,
 Rostov, San Diego, Sex Revolution, Smithsonian,
 Deunis,
-16,
-AT Love,
-Collor,
-Mexican,
Mutation
^, 1988
 BSC; TSR;
; RLL controller
 New Zealand
R:  N/A
5:   BRtX -
, NAV,
:  CleanUp, M
\, NAV
 The
breported in Wellington, New Zealand in
 early 1988.  The
r360KB 5-1/4"
I, doing no overt damage.  The
uis extinct, however, and all
 are capable of
sthe
) as well as may damage
Eor FAT
x.  Most
minor
 modifications, usually in what the
a computer
at the top of
. The
be moved, and ChkDsk
 indicate
the computer
as 2K less
zed.  If the
&was
J, the
attempt to
wthe
, if it
 was not
 During the
&process, the
 The
Lmore or less on a random basis.  The most
for the
 "Your computer is now
 "Your PC is now
, it
 are accessed on the
J, it
 moves the
0) to
11.  The
copies
into
0.  Since
11 is
 normally part of the
Jroot
Eon 360K 5.25"
I, any
Eentries
be lost.
s of DOS
11 as
 part of the
in the
K's FAT
#corrupted.
K, it copies the
to side 0, cyl 0,
7.  A copy
 of the
placed at side 0, cyl 0,
1, the
location of the
.  If the
Kwas formatted
software
starts the
, or
Eon side 0, cyl 0 right
 the
, the
Kmay be corrupted as well.
 In order to dis
, the
must be powered off and
, write-
 protected
J.  If
is not done, the
Ias soon as
are dis
are many
can dis
Iand
Ks.  To successfully use one of
, follow
 the instructions
 To remove
manually, the DOS SYS
6can be used on 5.25"
 360K
I.  On the
K, the
 must be copied back to side 0, cyl 0,
can be
 performed
Norton Utilities, or
editors.
 Deunis :
on the
, Deunis is a
fSpain in
.  The
in the
is now:
s abras
 tu Cpu!"
 "(c) IMAN4"
on the
, PS-
is a
 has
to avoid detection.  Unlike most
 members of the
], PS-
Nnot
, and
Nnot
Many
wthe
of both normal and
 high-density
I, as well as the
.  In the case of the
, the
is moved to cylinder 0,
 side 0,
17.  On low density
I, the
is moved to
11, while on
 high density
Iit can be
fNew Brunswick, Canada
}at a
 university.  As of May,
, no
products
 detect
can be just about in
 Rostov:
Nnot
.  It
8the
: "Non-
K" and
 "Replace and strike".
 Sex Revolution V1.1:
-B.
 the
 "EXPORT OF SEX REVOLUTION ver. 1.1"
 Sex Revolution V2.0:
to Sex Revolution V1.1, the
 has
 "EXPORT OF SEX REVOLUTION ver. 2.0"
-16: The
Nnot
as the
in the
 replaced
binary zeros.  On 5.25 inch 360K
 the
not be saved by the
.  On 5.25
 inch 1.2M
I, the
is saved at
17, part of the root
E.  The
 Side 0, Cyl 0,
 May,
in May,
 differs in
vthe
of the DOS
of the
.  It
to the
, moving the
on 360K 5.25"
11.  It
Nnot
9typical
, but
9the
" near the
"of the
 May,
-A: Same as
, but
Nnot
wthe
is the
and is now extinct.
 The
din the
 is: "Your computer is now
.  Legalize Marijuana".
 The "Legalize Marijuana" portion of the
is not
-AT Love:
to the PS-
 moves the
on 5.25 inch 360K
11, the last
of the root
E.  On 1.2M 5.25 inch
I, the
be moved to
17, in the middle of the
 root
E.  The
on the
!moved to Side 0, Cyl 0,
8the
may be
 Your PC is now St
NED in L
 May,
-B: Same as
 controllers may
[frequent
 typically
is: "Your computer is now
.  Legalise Marijuana". The "Legalise Marijuana"
 may
be in capital letters, or may be partially
.  It is not
-C: same as
, except
 removed.
-Collor:
to the
fBrazil's main distinction is
in the
 "Collor, um tiro basta!"
 "Call John"
:  Brazil
-D: same as
the exception
 can
whigh density 3.5" and 5.25"
now emits a "beep"
 through the
speaker
L: "Your PC is now
!" The
"LEGALISE
 MARIJUANA!" can
din the
emits a "beep"
 through the
speaker
L.  The
is: "Twoj PC jest teraz
 be!" The
"LEGALISE MARIJUANA?" can
 the
!modified to
 avoid detection by
utilities.  Since its
, most utilities can now detect
in the
 "Your PC is now
2" Or: "Donald Duck is
 a lie." The "
2" portion of the
may be
 corrupted as well.
-LM:
on the
Fly accessed
read and write intent, usually
ing in a
 hang.  The location of the
and the
to the
:  Canada
-Mexican:
Gin Mexico in May,
8the
 "NO VOTES FOR EL PRI".
:  Mexico, May
Mutation:
Mutation is a
 minor
of the
.  Its major destinction
Nnot
Iunless the
is accessed
write-intent.  It
 the same
as the
-NSD:
in the Eastern United
 States,
-NSD is a minor
of the
.  Its major difference is
to: "Non SYStEM dISc" and
 "LEGALISE MARIJUANA",
the second
 usually be corrupted to "LEGALISE4".
second
is corrupted, all later
 the corrupted
-NSD can
whigh
 density, 1.2M 5.25"
I, moving the
-NZ:
fNew Zealand in
has one slight difference.  It
 not always save the
vthe
K.  The
din the
is: "YOUR PC IS NOW STONED!".
 See:   Evil Empire   Horse
&  Swedish Disaster   NoInt
 WXYC
PZPAPN
Storm-1163
:  Storm-1163
 Storm
=seconds = 62; TSR
R:  1,163
5:   PRsCK -
3.96+,
30.00+, NAV 3.0+,
.2.0+
 The Storm-1163
.  Its
.  Storm-1163 is a
uof .
bStorm-1163
as a low
TSR of
 1,424
), hooking
the Storm-1163
, it
pof 1,163
at the end of the
a.  The
in the DOS
to be un
 however, the non-
Lseconds field
!set to 62.
 One
in the Storm-1163
 It is
what Storm-1163
PZPAPN
Storyteller
:  Storyteller
 TSR;
may run out of
R:  3,184 - 3,196
5:   PRsE -
V112+,
\2.13+,
V113+
 The Storyteller
.  Its
.  Storyteller is a
uof .
Nnot
wvery small
bStoryteller
X, the
 Storyteller
as a low
TSR of 3,568
{08, 16, 21, and FB
mby the
.  The
 copy of
 so in the case of advanced
ts, the
eventually
 run out of
the Storyteller
, it
pof 3,184 to 3,196
at the end of the
a.  The
>and
in the
 DOS
to the
>and
.  The
in the
5in all Storyteller
 "STORYTELLER"
, the Storyteller
Mthe
in a box on the
monitor:
 "Sitting on a grassy,beneath one of
 the window of the church,was a little
 girl.
her head bent back she was
 gazing up at the sky and singing,while
 one of her little hands was
 to the a
cloud
hovered like
 a golden feather
her head.So co-
 mpletely absorbed was she in watching
 the cloud to
song or
 incantation seemed addressed,
 did not observe me
I rose and went
 toward her.As I slowly approached the
 child,I could see by her forehead,
 the sunshine seemed like a globe of
 pearl,and especially by her complexion
she was un
7ly lovely.Her eyes
at one moment seemed blue_gray,
 at an
violet,were shaded by long
 black lashes,curving backword in a most
 peculiar way,and
matched in hue
 her eyebrows, and the trees
 tossed about her tender throat and were
 quivering in the sunlight.Gradully the
features,especially the sensitive
 full-lipped mouth,grew upon me as I st-
 ood silently gazing. Here seemed to me
 a more perfect beauty
had ever co-
 me to me in my loveliest dreams of bea-
 uty.Yet it was not her beauty so much
 as the look she gave me
facinsted
 me , melted me
in the
5, as are the
 "By   :
 Theodore Watts-Dunton"
 "Sir  .
 Press any key"
PZPAPN
Striker #1
:  Striker #1
 Striker, QD335
G:  March,
R:  461
5:   PNC -
, NAV,
:  CleanUp, or
 The Striker #1
}in the Eastern
 March,
is a
 of .
Striker #1 is
X, the
wone .
bthirteen
, and
the body of the
 appended to the end of the
show a
pof 461
)in the
 and
s are not
can be easily identified as the
 "Striker #1"
in the fourth through thirteenth
 all
s near the end of
 Striker #1
Nnot
to do
PZPAPN
Student-776
:  Student-776
=seconds = "62";
R:  776
5:   PRhAK -
n1.04+,
V112+,
2.58+,
6.64+,
1.22+,
V113+,
6.64+
 The Student-776
.  Its
.  Student-776 is a
uof .
-and .
bStudent-776
at the top of
 but
$the
', not moving
|12's
, as
qby the DOS
@by 1,024
mby the
, the
 Student-776
wthe
 the
the Student-776
, it
pof 776
at the end of the
a.  The
>and
in the
 DOS
to be
, but the
seconds field
!set to "62".  The
in the Student-776
 "(C) Student
 It is
what Student-776
PZPAPN
Stupid-1355
:  Stupid-1355
&failures
R:  1,355
5:   PNCK -
 NAV,
1.53S+,
 The Stupid-1355
.  Its
.  Stupid-1355 is a
 of .
Stupid-1355 is
X, the
wone .
in the
E, and
hang
.  If
,is in the
E, it may
r, the
fail to
the Stupid-1355
pof 1,355
 the end of the
be no
3to the
>and
in the DOS
.  One
can be
in the
 "*.BNL"
PZPAPN
Suicidal
:  Suicidal
G:  March,
R:  305
5:   PNCK -
3.96+,
 The Suicidal
in March,
.  Its
.  Suicidal is a
,.  It
Nn't
wpast the
 fifth .
ain a
the Suicidal
X, the
 Suicidal
wone .
in the
 305
at the end of the
 The
>and
in the DOS
 not be
 The
in the
5in all
 Suicidal
 "Suicidal! -/\-=> [Stingray/VIPER] <
 Suicidal
Nn't
to do
PZPAPN
Sunday
00/    L
    PT/
:  Sunday
, 1989
 TSR; execu
; FAT
 Washington (state),
R:  1,636
5:   PRsAT -
W. & .OV?
, NAV,
:  CleanUp,
, NAV, or
 The Sunday
Gby many
s in the Seattle,
 Washington area in
, 1989.
on any
 Sunday,
Ming the
 "Today is Sunday! Why do you work so
 All work and no play make you a dull boy!
 Come on! Let's go out and
fun!"
 The Sunday
s to
!derived
fthe
, the
in many respects.
 Damage to the
or FAT has
!reported
 number of
of Sunday are:
 Sunday-B:
to the Sunday
 activate on any day of the week due to an
Uin the
 day of the week checking routine.  The
in the
is never
L, and no damage is done to the
 Sunday-C:
to Sunday-B,
never
 It has, however,
!modified so
it differs
 both the Sunday and Sunday-B
es.
g, it
 is the same as Sunday-B.
 Sunday.Satan:
to the Sunday
's low
TSR is 1,936
, hooking
{08 and 21.  It
-and .
X.  .
by 1,636
at the
"of the
a.  .
by 1,636 to 1,650
at the end of the
a.  The
in the DOS
not be
 The
in the
 in all
 "-Satan-"
 "* Satan
*Carzy !! An
piece of Satan
 "Written by Mad Satan in TAIWAN .\
2.04 /"
 "= Mad Satan ="
:  Taiwan
1994.
 Sunday-UNAM:
to the Sunday
's low
TSR is 1,872
, hooking
{08 and 21.  It
-and .
X.  .
by 1,636
at the
"of the
a.  .
by 1,636 to 1,650
at the end of the
a.  The
in the DOS
not be
 On Sundays, it
Mthe
 accompanied
a strange sound on the
speaker:
 "El talento no impide tener manias,
 pero las hace mas no
 Saludos porros de la UNAM"
and sound are repeated every 12 seconds.  The
in the
, as is the
:  Mexico City, Mexico
 See:   Carfield
  Sunday-2
PZPAPN
Sunday-2
:  Sunday-2
 Datarape 2.2
 Canada
R:  2,877
5:   PRhAK -
, NAV,
.2.0+
 The Sunday-2
}in Canada in
.  Sunday-2
 is a
generic
u.  It
W, and overlay
on the
and Sunday
 The
Sunday-2 is
X, Sunday-2
at the top of
, but
 the
qby the DOS
Aby 5,888
{21, 22, and 27
mby Sunday-2.  At
 Sunday-2
Sunday-2 is
, it
W, and
 overlay
for any reason.
 Sunday-2
at the end of
`.  .
pof 2,877
).  .
pof 2,877 to 2,891
not see the
`in the DOS
Sunday-2 is
as the
adjusts
 the
it is
 Sunday-2
on Sundays
X.  The
L, and the
be hung:
 "It's Sunday. Why are you working?
 Take the day off compliments of RABID"
cannot be seen in
`as the
 The Sunday-2
5to perform a
 format on Sunday, however
5has several bugs and is not
 functional.
Sunday-2
notice
#detected by the DOS
 Sunday-2 is
as the
Eand
to match
checked by the DOS
of Sunday-2 are:
 Sunday-2B:
gequivalent to the
 is a minor
 See:   Basilisk
  Sunday
PZPAPN
Sundevil
:  Sundevil
i; beeping and
 Canada
R:  691
5:   PRfCK -
1.25+
 The Sundevil
.  Its
.  Sundevil is a
uof .
bSundevil
X, the Sundevil
at 9000:
 hooking
|21.
qby the DOS
not be
the Sundevil
, it
for any reason.
pof 691
at the end of the
a.  The
in the DOS
not be
.  The
in the Sundevil
 in all
is no America."
is no Democracy."
IBM, ITT, and AT&T."
is dedicated to all
!busted"
 "for computer hacking activities."
 "The SunDevil
by Crypt Keeper"
 "[Sundevil]"
 The
Lby the
on the
M, accompanied by beeping.
jmay
PZPAPN
Suriv 1.01
:  Suriv 1.01
1st, Israeli, Suriv01, Suriv A
 Extinct
, 1987
 TSR; .
lock on
 Israel
R:  897
5:   PRsC -
, NAV,
\, or
 The Suriv 1.01
is a
u.  It
 activate on
rby running an
aand
X. On
, it
Mthe
 "APRIL 1ST HA HA HA YOU HAVE A VIRUS".
 The
lock up, requiring it to be powered off and
back on.
 The
"sURIV 1.01" can be
din the
 See:   Suriv 4.02
PZPAPN
Suriv 2.01
:  Suriv 2.01
1st-B, Israeli, Suriv02, Suriv A
 Extinct
G:  1987
 TSR; .
lock on
 Israel
R:  1,488
5:   PRsE -
, NAV,
\, or
 The Suriv 2.01
is a
u.  It
 activate on
rby running an
Ming the same
as Suriv 1.01 and
 locking up the
.  The
cause a
lockup,
, 1 hour
 on any day on
default
>of 01-01-80 is used.
 The
wthe
of Suriv 2.01 are:
 Suriv 2.01B:
fFrance in
, 1994,
on the
Suriv 2.01
X, it
za 1,808
*TSR, hooking
|21.
pof 1,488
at the
"of the
.  The
>and
in the DOS
not be
.  The
can be
in the
5in all
 "sURIV 2.01M"
 "TMP$$TMP.
may be
 the
not be consistent in
 all
:  France
, 1994.
PZPAPN
Suriv 3.00
:  Suriv 3.00
 Israeli, Suriv03, Suriv B
 Extinct
G:  1988
 TSR; .
W, & .SYS
i; black window;
slowdown
 Israel
R:  1,813 (
`) & 1,808 (
5:   PRsA -
, NAV,
:  CleanUp,
\, or
 May be a
of the
.  The
"sUMsDos" has
1to "sURIV 3.00".  The Suriv 3.00
 Friday the 13th
is run or if it is
 already present in
, however
`are not
Bd due
 to a bug in the
on Friday the 13th,
 for 30 seconds, an area of the
is turned into a "black
 window" and a
wasting loop is
 overlay, . SYS, and
execu
Wand .
Nnot
 See:
PZPAPN
Suriv 4.02
:  Suriv 4.02
i; TSR;
to DOS prompt;
&failures;
 Ireland
R:  897
5:   PRsC -
, NAV,
 The Suriv 4.02
fIreland in
 Suriv 4.02 is a
uof .
`, but not
,.  It
 The
Suriv 4.02 is
X, the
as a low
 TSR.
Suriv 4.02 is
, it
X.  If
X, it
by 897
at the
"of the
 The
can be
din all
 "Suriv 4.02"
-MAND
 "$$TMP.
-APRIL 1ST"
 The
, "Suriv 4.02", is the
tmarker
 the
uses to determine if the
ais already
r.  It
in the fourth through thirteenth
Suriv 4.02
.  If
 the
Ythem, or
Ya non
, the
 to the DOS prompt.
in a
&failure.
 Suriv 4.02
1st, at
 the
"APRIL 1ST" followed by blanks
the next
goes
.  A
, requiring the
to re
&the
 See:   Suriv 1.01
PZPAPN
Surrender
:  Surrender
R:  513
5:   PRaAK -
, NAV,
 The Surrender
, and has an
.  Surrender is a
uof .
 and .
.  It
,if it is
 The
the Surrender
in the
 DOS buffers and graphics card
be no
qby the DOS
Fly by the
Surrender is
, it
-and .
pof 513
at the end of the
 be no
3to the
>and
in the DOS
 The
in the Surrender
 all
 "Jet"
 "Jews NEVER surrender!"
 Surrender
Nn't
to do
PZPAPN
Susan
:  Susan
Zfailure;
Bd; TSR;
=set to "62"
 Mexico
R:  571
5:   ORsE -
2.11+,
8/93S+, NAV 3.0+,
1.0A06+
 The Susan
fMexico in
.  Susan
 is a
uof .
on Sundays, and
in a very limited manner.
bSusan
X, the Susan
as a low
TSR of 832
mby Susan in
Susan is
, and the
issues a DOS DIR
6line arguments (ie. simply "DIR" at the DOS prompt)
 on any Sunday, the
wthe
 in the
E.  .
not be re
r, and
 the
Nnot spread past the
in any
 Susan
lthe
b571
 by the Susan
5.  The
>and
in the DOS
to be un
, but the seconds
 field
!set to "62".  The
in the
5in all Susan
 "Susan"
 "*.* *.
 "DIR"
 "Bad
fifteen
ts of the Susan
activate.  At
, the
start deleting
 all of the
`in the
PZPAPN
SVC 3.1
:  SVC 3.1
 SVC V3.1
G:  May,
R:  1,064
5:   PRhAK -
\, NAV,
 The SVC 3.1
Vin May,
.  It is
fthe
.  SVC 3.1 is a
 of .
-and .
 The
SVC 3.1 is
X, it
at the top of
 but
$the
, as measured by the DOS
 1,088
|12's
not be moved.
mby the
SVC 3.1 is
, it
-and .
X.  If
X, it
 1,064
at the end of the
a. The
>and
in the DOS
 not be
SVC 3.1
9the
 "(c)
by SVC,Vers. 3.1"
 SVC 3.1 is an earlier
of the
1689
.  Unlike
1689, it
Nnot hang the
the next
becoming
.  It
Nnot hide
 the
of SVC 3.1 are:
 SVC 3.1-CHR:
, SVC 3.1-CHR is a
 modified
of the SVC 3.1
 Like the
adds 1,064
 to the .
-and .
 are
X.  The
at the end of
`.  The
can be
 in the
5in SVC 3.1-CHR
 "(C)
by CHR,Sverdlovsk"
is not detected by all
can detect the
SVC 3.1
 See:   SVC 4.0   SVC 5.0   SVC 6.0   SVC-2936   SVC.3241
PZPAPN
SVC 4.0
:  SVC 4.0
1689, Off
, SVC V4.0, SVC 4.0-1740
R:  1,689
5:   PRA -
\, NAV,
 The SVC 4.0
.  It is
is not a very viable
 both .
-and .
SVC 4.0 is
in the in-
 interpreter.
, the
wthe next
-or .
hang
by 1,689
`larger
1,689
), the
hide the
pif the
is already in
smaller
1,689
indicate a
pin the DOS
.  In all
 cases, the
at the end of
hang
, it is not a very viable
, and should not be
 considered a threat in its
;state.
of SVC 4.0 are:
 SVC 4.0-1740: A 1,740
of SVC 4.0,
 the bug fixed in the
j.  It
Nnot
wvery small .
`.  The DOS
Ton all
.  The
 "(c)
by SVC,Vers. 4.0"
 See:   SVC 3.1   SVC 5.0   SVC 6.0   SVC-2936   SVC.3241
PZPAPN
SVC 5.0
:  SVC 5.0
3103, SVC V5.0
 Israel
R:  3,103
5:   PRhAK -
, NAV,
1.53S+,
 The SVC 5.0, or
3103,
}in Israel in
.  It is believed to
ated
in the
3103 is a
uof .
, as well as overlay
`.  It is a
 The
SVC 5.0 is
X, the
at the top of
$the
, as
qby the DOS
Aby 3,120
{01, 03, 08, and 21
mby the
, SVC 5.0
-and .
X.  SVC 5.0 is a
, and
, the
 of 3,103
not be
.  Likewise,
to view
SVC 5.0
in a "clean" copy of the
#made
.  In reality, the
by 3,103
at the end of the
a.  The
can be
in the
 "(c)
by SVC, Vers. 5.0"
 SVC 5.0
checks
 see if the
is "AIDSTEST.C".  If the
 has
add a copyright
 the
reads:
 "-*
-91 by SVC, Vers 6.0 *-
 SVC 5.0 may
cause
multiple
 open at the same
of SVC 5.0 are:
 SVC 5.0B:
gequivalent to the
SVC 5.0,
minor
 SVC 5.0C:
gequivalent to the
SVC 5.0,
minor
2.  It
 "(c)
by SVC,Vers. 5.0"
 SVC 5.0D:
on the SVC 5.0
are two major
 differences
b, the
hooks
{13 and 21, instead of 01, 03, 08, and 21.
 Second, it
Nn't
9the typical copyright notice
din the SVC 5.0
 See:   SVC 3.1
 SVC 4.0   SVC 6.0   SVC-2936   SVC.3241
PZPAPN
SVC 6.0
:  SVC 6.0
R:  4,644
5:   PRhAX -
n, NAV,
 The SVC 6.0
Gin the
.  It is
fthe
.  SVC 6.0 is a
-and .
.  It
Nnot
 The
SVC 6.0 is
X, the
at the top of
$the
, as measured by the DOS
 by 4,672
{08 and 21
mby the
 and
|12's
!moved.  The SVC 6.0
has actually al
68K of
uses the
 4,672
 If the
bSVC 6.0
fthe
K, the
rthe
by altering three
).  The
written
 to the
Kstarting at side 0, cylinder 0,
2.  The
three
)cause the
to be
fthe
SVC 6.0 is
, it
-and .
pof 4,644
be hidden by the
it is
 SVC 6.0
at the end of
be no
3in the
>and
in the DOS
 SVC 6.0 is a true
are read into
, it "dis
v" them, so a clean copy
be in
 As such, if SVC 6.0 is
utilities may not
 be able to detect the
in the
 Three
be able to be
 if the
is not
 "(c)
-91 by SVC, Vers. 6.0"
 "AIDSTEST.C"
 "SVC 6.0"
 It is
what SVC 6.0
of SVC 6.0 are:
 SVC 6.0-4677: A later
of SVC 6.0,
is 4,704
).  Like the SVC 6.0, it hooks
{08 and 21.
, SVC 6.0-4677
-and .
for any reason.
pof 4,677
at the end of the
a.  The
pis not
SVC 6.0-4677 is
.  The
>and
in the
 DOS
not be
.  The
in the SVC 6.0-4677
 "/* (c)
-91 by Moscow SVC, Vers. 6.0 */"
 "AIDSTEST.C"
 "SVC 6.0"
 Like SVC 6.0, SVC 6.0-4677 is a full
 SVC 6.01: A later
of SVC 6.0,
is 4,688
).  Like the SVC 6.0, it hooks
{08 and 21.
, SVC 6.01
-and .
for any reason.
pof 4,661
at the end of the
a.  The
pis not
SVC 6.01 is
 The
>and
in the DOS
not be
.  The
in the SVC 6.01
 "/* (c)
-91 by Moscow SVC, Vers. 6.0 */"
 "AIDSTEST.
 "Moscow SVC 6.01"
 Like SVC 6.0, SVC 6.01 is a full
 SVC 6.01-B:
to the SVC 6.01
is a minor
.  The
 "/* (c)
-91 by Moscow SVC, Vers. 6.0 */"
 "AIDSTEST.
 "Moscow SVC 6.01"
 See:   SVC 3.1
 SVC 4.0   SVC 5.0   SVC-2936   SVC.3241
PZPAPN
SVC-2936
:  SVC-2936
R:  2,936
5:   PRhA -
30.00+,
8/93s+, NAV 3.0+,
.2.0+
 The SVC-2936
.  Its
.  SVC-2936 is a
uof .
-and .
, but not
 The
SVC-2936 is
X, it
at the top of
 but
$the
, as measured by the DOS
 2,960
|12's
not be moved.
 01, 03, 08, 13, and 21
mby the
SVC-2936 is
, it
-and .
by 2,936
at the end of
 the
a. The
p, however,
not be
SVC-2936 is
as the
, or
Eand FAT entries, are read into
 The
>and
in the DOS
not be
SVC-2936
9the
at the very end of all
it can
 be seen in
is not
 "5Fr"
 It is
what SVC-2936
 See:   SVC 3.1   SVC 4.0   SVC 5.0   SVC 6.0   SVC.3241
PZPAPN
SVC.3241
:  SVC.3241
^, 1994
=seconds set to "58";
R:  3,241
5:   PRhA -
\2.10g+,
6.60+,
2.11a+,
V114+,
1.22+,
V113+
 The SVC.3241
^, 1994.  Its
.  SVC.3241 is a
uof .
-and .
, but not
,.  It is a
, hiding the
 well as dis
are read into
 The
SVC.3241 is
X, it
at the top of
 but
$the
, as measured by the DOS
 3,264
|12's
not be moved.
 01, 03, 08, 13, and 21
mby the
SVC.3241 is
, it
-and .
by 3,241
at the end of
 the
a. The
p, however,
not be
SVC.3241 is
as the
, or
Eand FAT entries, are read into
 The
>and
in the DOS
to be un
, but the seconds field
 set to "58".
 It is
what SVC.3241
 See:   SVC 3.1   SVC 4.0   SVC 5.0   SVC 6.0   SVC-2936
PZPAPN
Sverdlov
:  Sverdlov
 Hymn-2
R:  1,962
5:   PRhAK -
\, NAV,
 The Sverdlov
 believed to
ated in the
.  Sverdlov is a
uof .
-and .
`, and
 The
the Sverdlov
X, the
at the top
$the DOS
'.  4,080
!reserved, and the
is not
by the
.  The DOS
indicate
is 4,080
)less
expected.
if it
 was not already
Sverdlov is
, any .
-or .
aover 2K in
rif it is
for any
 reason.
pof 1,962
 1,962 to 1,977
.  In both cases, the
at the end of
 It is
if Sverdlov
of Sverdlov are:
 Sverdlov-B: Very
to the
Sverdlov
has one basic
3in behavior.  It
-and .
`over 3K in
before
wise, the
5is very
to avoid detection,
 and
may identify it as Hymn-2.
PZPAPN
:  SVir
 Endangered
 Poland
R:  512
5:   PNE -
, NAV,
/2.0+,
.2.0+
 The SVir
}in Poland early in
 The
}had a fatal flaw in its
prevented it
fexecuting.  In
, a sample was
 obtained
fFridrik Skulason
 second sample, identified as SVir-B, is a
`.  A third
the SVir-B
X, the
wone .
between 516 and 526
5appended to
 the end of the
a.  If the
could not find an .
w, it
leave the
O"spinning" as it
be in an
 endless loop looking for a
 Interestingly enough,
 the A:
=in the
1to the
>and
 SVir, at least in the three
Nnot do
 malicious, it simply
of SVir are:
 SVir-0: A
is very
to SVir-B.
 the
weither 1 or 2
`in the
in a
hang.
 SVir-A: The
fPoland in early
 not
 SVir-B: A
has the bug in
 SVir-A fixed so
PZPAPN
:  Swap
 Falling Letters
&, Israeli
, 1989
 Graphic
M; BSC (floppy
); TSR; bad cluster
 Israel
R:  N/A
5:   RsF -
Floppy
K, CleanUp,
\, or DOS SYS
 The Swap
, or Israeli
, was
breported in
 1989.
is a
vfloppies.  The floppy's
it is accessed.  One bad cluster
be written on
 track 39,
6 and 7
the head unspecified.  If track 39,
6 and 7, are not empty, the
, it uses 2K or RAM.  The
 actual
of the
5is 740
 The Swap
for 10
 minutes.  A cascading effect of letters and
4on the
monitor is
seen,
to the cascading effect of
 the Cascade and Traceback
 The
d the Swap
because the
}case
 had the
cphrase
)00B7-00E4 on track 39,
 "The Swapping-
. (C)
, 1989 by the CIA"
 However,
phrase is not
 freshly
rby the Swap
the Swap
can be easily identified by
 looking at the
editor, such as Norton
 Utilities.  The
normally
at the end of
 the
not be
, instead the start of the
5is present.  The remainder of the
 track 39,
6 and 7.
PZPAPN
Swedish Boys
:  Swedish Boys
 Data Molester, Headache, Swedish, Why Windows
 Sweden
R:  457, 459, or 538
)(depending on
present)
5:   PNCK -
, NAV,
8/93S+,
8/93+,
.2.0+
 Swedish Boys is a group of initially three
 Sweden in
es are all
us of .
,.  Depending
 on the
present,
may be destructive.
 The Swedish Boys
es are:
 Data Molester: The Data Molester
is a
uof .
wall .
in the
pof 538
 the
at the end of the
a.  The
>and
in the DOS
.  The
in the
, and are not
 ":+:+ The Data Molester
V1.00 +:+:"
 "The Vile One / The BetaBoys Development Corporation."
 Data Molester
the C:
 root
Eand
:  Sweden
 Headache: The Headache
is a
uof .
,.  It
wone .
in the
pof 459
at the end of the
a.  The
 and
to the
.  The
 can be
in the
5in all
 "-+( Severe Head-Ache
V2.oo )+-"
 "Created by The Vile One & MaZ"
 "Copyright (c)
The BetaBoys Development Corp"
 "-Sweden 04/19/92"
:  Sweden
 Swedish Boys.Headache.441: The Swedish Boys.Headache.441
uof .
,.  It
wone .
in the
pof 441
at the end of the
 The
>and
to the
>and
.  The
can be
in the
5in all
 "Severe Head-Ache
V2.oo )+-"
 "Created by The Vile One & MaZ"
 "Copyright (c)
The BetaBoys Development Corp"
 "-Sweden 04/19/92"
:  Sweden
, 1994.
 Why Windows: The Why Windows
is a
uof .
wone .
in the
 459
at the end of the
.  The
>and
in the DOS
to the
 and
.  The
can be
din the
5in all Why Windows
 "*.com"
 "C:\
6.Com C:\Autoexec.Bat C:\Config.Sys"
 "\windows\win.com"
 "Why Windows (c)
MaZ / BetaBoys B.B"
 Why Windows is a destructive
.  It
attempt to
Bthe
a\windows\win.com.
ly, on
^23rd of any year it
attempt to
 C:\Autoexec.Bat.  On
^24th of any year, it
 attempt to
BC:\Config.Sys.  Lastly, on
^25th
 of any year it
attempt to
the C:
Oroot
Eand
:  Sweden
PZPAPN
Swedish Disaster
:  Swedish Disaster
 BSC;
 Sweden
R:  N/A
5:   BRhX -
\, NAV,
 The Swedish Disaster was
s to be
fSweden.  It is a
 floppy
and the
Jwhose
the Swedish Disaster
, the
moved to side 0, cylinder 0,
6.  The
at the top of
 but
$the
 by 2,048
be 6,944
)less
 what is expected by the
|12's
 moved by the
Swedish Disaster is
, the
 all non-write protected
are accessed on the
.  On 360K 5.25"
I, the
!moved to
is normally a part of the root
means
if the
 entries in
be lost.
 The
can be
dat the end of the
I, as well as
in the
 "The Swedish Disaster"
the Swedish Disaster can be dis
 powering off the
and re
&ing
fa write-protected,
J.  The DOS SYS
6can
be used to
 replace the
I.  For
Ks, the
remove
remain in the
 See:
PZPAPN
Swiss 143
:  Swiss 143
 Switzerland
R:  143
5:   PNCK -
 NAV,
 The Swiss 143
, by Dany Schoch
 of Hagendern, Switzerland.
is a non-
uof .
Swiss 143 is
X, the
wall .
`in the
by 143
), the
 the end of the
.  The
>and
to the
>and
were
Nnot do
PZPAPN
Swiss Phoenix
:  Swiss Phoenix
 Switzerland
R:  927
5:   PRhAK -
3.96+,
8/93S+, NAV 3.0+,
1.53S+,
.2.0+
 The Swiss Phoenix
}in Switzerland in
is a
uof .
-and .
,.  It exhibits
 techniques.
 The Swiss Phoenix
fa low-level sub
, it
reside at the top of
 but
$the
, as
qby the DOS
 by 976
mby Swiss Phoenix in
the Swiss Phoenix
, it
-and .
, or copied,
usually
in sub
Fories.
the Swiss Phoenix
pof 927
at the end of the
a.  The
>and
in the DOS
not be
.  The
 the
, and is not
the Swiss Phoenix
the DOS
.  Not all
be flagged, but
those
were
 prior to the
becoming
 It is
what Swiss Phoenix may do
PZPAPN
Sylvia
:  Sylvia
 Holland Girl
?, 1989
i; TSR
R:  1,332
5:   PRsC -
, NAV,
\, or
 The Sylvia, or Holland Girl,
breported by Jan Terpstra
 of the
`, increasing
by 1,332
).  The
 apparently
damage, and
Nnot
 The
is due to the fact
and phone number of a girl
d Sylvia in Holland, along
 her address, requesting
post cards be sent to her.  The
 is believed to
!written by her ex-boyfriend.
of Sylvia are:
 Sylvia 2: The Sylvia 2, or Holland Girl 2,
is a modified
of the Sylvia
uof .
Zof an
in up to four
becoming
may be
in the C:
Oroot
E, or the
pof 1,332
at the
"of the
a.  The
can be
in the
5, along
Sylvia's last
 and full address
is not
#repeated here:
rby a HARMLESS
V2.1"
 "Send a FUNNY postcard to : Sylvia"
 "You might get an ANTIVIRUS
:  New Brunswick, Canada
PZPAPN
SysLock
00U    G
[PTU
:  SysLock
 3551, 3555
 Endangered
, 1988
i; data
R:  3,551
5:   PNA - Encrypting
, NAV,
\, or
 The SysLock
is a
encrypting
 both .
-and .
`, as well as damaging
data
Nnot
, but instead searches through the .
-and .
Fories on the
K, picking one execu
 random to
w.  The
lits
3,551
it may vary slightly
 depending on
 The SysLock
damage
`by searching for the word
 "Microsoft" in any combination of upper and lower case
 and
dreplace the word
"MACROSOFT".
 If the SysLock
finds
an en
ment variable "SYSLOCK"
 exists in the
and has
!set to "@" (hex 40), the
wany
or perform
replacements, but
instead pass control to its host immediately.
of SysLock are:
 Advent: Reported to be a SysLock
, the sample of
by the author
Nnot
.  All
 samples of
researchers
do not
.  Fridrik Skulason of Iceland has
it is on an
a, and
t to be extinct.
 Advent-B:
fthe NCSA is
, Advent-B
 is a bug fixed
of the Advent
.  Advent-B
 may
wone .
-or .
in the
, however,
wthe
bfew
`in the
 2,768 to 2,783
at the
 end of the
.  The
>and
 in the
not be
.  Like Advent,
 Advent-B
activate in
?, at
 randomly activate,
Ming four candles and playing
 "On Tannenbaum" on the
speaker.
 Cookie:
on the SysLock
, Cookie is a
 considerably shorter in
.  It is a
uof .
-and .
,.  It
vone .
-or .
 the
 of 2,232 to 2,251
at the
 end of the
a.  The
>and
in the DOS
Cookie may
X.  In
cases, the
 functioning
a number of
Zs.
!reported to
Mthe
"I want a
 COOKIE!",
the sample
Nn't exhibit
 behavior.
 Macho-A: same as the SysLock
, except
"Microsoft" is
 replaced
"MACHOSOFT".
PZPAPN
T-1000
:  T-1000
&failure;
R:  128
5:   ONCK -
8/93+,
.2.0+,
1.25+
 The T-1000
.  T-1000 is a
,.  It corrupts the
the T-1000
X, the
 T-1000
wall of the .
in the
E, and
Mthe
 "T-1000"
hang
the T-1000
lthe
)of the host
by the T-1000
unless
 were
smaller
), in
case
 128
.  The
>and
in the
 DOS
to the
>and
.  The
, along
, is
in the
 "*.Com"
PZPAPN
Tabulero
:  Tabulero
7- South America
i; TSR
 Venezuela
 Argentina
R:  2,048 - 2,062
5:   PRsE -
.2.0+
 The Tabulero
.  It is
 Venezuela,
it was
}in Argentina.  Tabulero is a
uof .
.  It is
on the
bTabulero
X, the Tabulero
as a low
 TSR of 2,048
).  It hooks
{09 and 21.
the Tabulero
, it
X.  Tabulero cannot recognize previous
ts on
`, so it
the Tabulero
pof 2,048 to 2,062
 of the
a, and 2,048
t.  The
at the end of the
a.  The
>and
 the DOS
not be
.  The
can be
din all Tabulero
 "pTpApBpUpLpEpRpOp pI.U.P.L.C.M Wilmer C  G"
 "exe"
 Tabulero may
Mthe
"TABULERO" on the
it has
period of
of Tabulero are:
 Tabulero-B: A later
of the Tabulero
, it
Nnot re
.  The
 "pTpApBpUpLpEpRpOp p"
 "ISRAEL"
 "ODALUBAT atse CP us, otreum ah LEMRAC"
 "--IUP LUIS CABALLERO MEJIAS--"
 Tabulero 2: An
of the Tabulero
Nnot re
`.  The
in the
5are:
 "ODALUBAT atse CP us, otreum ah LEMRAC"
 "--IUP LUIS CABALLERO MEJIAS--"
 "Wilmer 86-Phonix (R) Rescue anti
 "Copyright (C) Phonix Corp 1987-
 All right reserved."
 "Immunizing"
 "No path especifed or no
 "Example RESCUE A:"
 "pTpApBpUpLpEpRpOp p"
 "ISRAEL"
PZPAPN
:  Tack
G:  May,
R:  449 - 464
5:   PNCK -
, NAV 3.0+,
 The Tack, or 4-A,
in May,
.  Its
.  Tack is a
the Tack
X, the Tack
wone .
in the
 and
Mthe
- Hello, I am
pof 449 to 464
at the end of the
a.  The
>and
in the DOS
to the
>and
%the
, the
can be
in the
5in Tack
 "TACK"
the Tack
Lon the
monitor, and
of Tack are:
 Tack-411:
, Tack-411 is a 411
of the Tack
Ms the
 It adds 411 to 426
)to the .
 In addition to the
in its
 "*.com"
 Tack-477:
, Tack-477 is a 477
of the Tack
Ms the same
as the
, and adds
 477 to 492
)to the .
r.  In
 addition to the
in its
 "*.com"
PZPAPN
Tai-Pan
:  Tai-Pan
 Whisper
, 1994
R:  438
5:   PRhE -
6.64+,
V117+,
 AVTN/N 6.64+,
V117+
 The Tai-Pan or Whisper
, 1994.  Its
s it may be in the
 public domain in North America.  Tai-Pan is a
uof .
are smaller
bTai-Pan
X, the Tai-Pan
at the top of
 but
$the
', not moving
|12's
, as
qby the DOS
@by 512
mby the
 are
 438
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 in all
 "[Whisper presenterar Tai-Pan]"
 It is
what Tai-Pan may do
PZPAPN
Taiwan
:  Taiwan
 Taiwan 2, Taiwan-B, Doom I, Doom I-B
 Endangered
i; 8th day of any month corrupts
&, FAT,
 Taiwan
R:  743
5:   PNCK -
, NAV,
\, NAV, or
 The Taiwan
in Taiwan,
 R.O.C.
,, and
Nnot
into
the Taiwan
X, the
attempt to
wup to three .
`.  The
 default
Eis not
r, instead the
 start its search for candi
`in the C:
Oroot
, the
vthe
aby copying the
5to the
b743
 of the
a, the
b743
)of the
ais re
 to the end of the .
a.  A bug exists in
, if the
ais less
, the
always be 1,486
effect is due to the
not checking to see if it read less
)of the
abefore
 The Taiwan
is destructive.  On the 8th day of any month,
is run the
perform an absolute
 write for 160
starting at logical
0 on the C: and D:
Os.  In effect,
logical write
in the FATs and
 root
of Taiwan are:
 Doom I: The
of Taiwan
is between Taiwan-B and
 Taiwan, Doom I adds 752
3in the
>and
in the DOS
E.  Doom I
wfour .
`on the C:
X.  It
 reset the
Oand
`, so if the
was not
;ly using the C:
 as the
may notice the
3.  Due to
 a bug in the
Doom I
smaller
), the
 1,488
 Doom I-B: Doom I-B is a later
of the Taiwan
, and
ps the
`by 677
).  It
wthree .
on the C:
X.  The
 and
reset to the
Ethe
tprocess is complete.  Unlike
 Taiwan,
smaller
 Taiwan-B: Apparently an earlier
of the Taiwan
hang the
X, but
it has
ausing
 the selection mechanism
qfor the Taiwan
PZPAPN
Taiwan 3
:  Taiwan 3
 Anticad 2
 Taiwan
R:  2,900
5:   PRA -
\, NAV,
:  CleanUp, or
 The Taiwan 3
in Taiwan, R.O.C.  It
 was dubbed the Taiwan 3
by John McAfee because it is the
 third
fTaiwan, the
two are Taiwan and
KKiller.
is not related to either of
 The
the Taiwan 3
Xon a
, the
 in low
 3,152
).  The
hooks
becoming
, Taiwan 3
wany
X.  .
by 2,900
pby between 2,900 and 2,908
 Overlay
`may
ras well.
 It is
what the
criteria is for
 what it
%spreading.
 See:   Fu Manchu
PZPAPN
Taiwan 4
:  Taiwan 4
 2576, Anticad 5
 TSR; .
slowdown
and Thailand
 Taiwan
R:  2,576
5:   PRsA -
n, NAV,
1.53S+,
:  CleanUp, or
 The Taiwan 4, or 2576,
.  While
 one copy of
by a
of Excalibur! who
it had
fa download of AutoCad
BBS, a second copy was
to John McAfee
 Thailand on
the same
s to
ated in Taiwan, and is
on the Taiwan 3
.  It is a
uof .
-and .
`, but
the Taiwan 4
X, the
check to see if it is already
.  If the
isn't already in
, the
as a low
TSR of 2,832
 and 21
mby the
, the
start to slow down
 the
gradually.
30 minutes, it
 slowed the
down by
30 percent.
 Any .
-or .
Taiwan 4 active in
pd by 2,576
)for .
`, and 2,576 - 2,590
 for .
`.  The
at the
"of .
`, and the end of .
`.  The
din all
 "To Whom see
: Shit! As you can see
document,
 you may know what
is. But I must tell you:
 DO NOT TRY to WRITE ANY ANTI-PROGRAM to THIS VIRUS.
is a test-
, the real dangerous
 implement on
. I use MASM to generate varius
easily and you must use DEBUG against my
kly,
is foolish. Save your
until next month.
 OK? Your Sincerely, ABT Group., Oct 13th, 1989 at FCU."
can be
din all
 "ACAD.
PZPAPN
Tajfun
:  Tajfun
 Tajfun 1.0, Tajfun.250
, 1994
R:  250
5:   PNCK -
/2.1+,
\2.13+,
6.64+,
.2.0+,
1.25+,
6.64+
 The Tajfun, Tajfun 1.0, or Tajfun.250,
 1994.  Its
.  Tajfun is a
Nn't
to do
the Tajfun
wall of the .
in the
 250
at the end of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
5in all
 "*.com"
 "tajfun1.0"
PZPAPN
Talentless
:  Talentless
R:  1,077
5:   PNAK -
, NAV,
 The Talentless
.  Its
.  Talentless is a
-and .
u.  It
the Talentless
 the Talentless
wone .
-or .
 on the C:
O.  The
start looking for a
win the C:
Oroot
E, and
move down through
 the
Estructure.
the Talentless
pof 1,077
).  The
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
in all Talentless
 "Bad
 It is
if Talentless
PZPAPN
TalkingHeads
:  TalkingHeads
fail to function;
 README.
acreated
R:  519
5:   ONCK -
/, NAV 3.0+,
30.00+,
n1.04+,
6.64+,
1.25+
 The TalkingHeads
.  Its
.  TalkingHeads is a
uof .
,.  It
 permanently corrupts the .
the TalkingHeads
wtwo .
in the
, the
create a 519
 README.
-in the
E, as create a 519
ain the C:\DOS
Eif the
Nn't already exist.
the TalkingHeads
lthe
 519
)of the host
by the
be no
unless the
awas
 smaller
, in
case it
.  The
>and
in the DOS
not be
.  The
 can be
in the
5in all
 "C:\DOS\
 "README.
 The TalkingHeads
Mthe
Xon Fridays between 11:00 and 11:59:
ain't no disco..."
 The
Nn't always
behaviour.  The
in the
PZPAPN
Tamanna
:  Tamanna
^, 1994.
i; Read
Attribute set on
R:  1,857 - 1,872
5:   PRhAK -
\2.10g+,
6.60+,
2.11a+,
V114+,
V113+,
6.64+,
1.25+
 The Tamanna
^, 1994.  Its
.  Tamanna is a
-and .
bTamanna
X, the Tamanna
at the top of
$the
', hooking
{1C and 21.
|12's
not be moved.
, as
qby the DOS
@by 1,888
the Tamanna
, it
pof 1,857 to 1,872
at the end of the
a.  The
>and
in the
 DOS
not be
, but the read
 attribute
be set.  The
in the Tamanna
5in all
 "Tamanna"
 "Wish.."
 "Facts need no recognition"
 "A silent friend"
 "DHAKA"
 "Press T to reconcile
my Wish"
 "OK carry on >>"
ahas
!modified"
 "Rebuilding..."
 "Standby while re
&ing"
 It is
what Tamanna may do
PZPAPN
Tankard
:  Tankard
 Tankard V2.0
G:  March,
R:  493
5:   PRhCK -
3.96+, NAV 3.0+,
1.25+
 The Tankard, or Tankard V2.0,
in March,
 Its
.  Tankard is a
, fast
uof .
bTankard
X, the Tankard
at the top of
$the
', hooking
|12's
not be moved.
, as
qby the DOS
@by 1,024
the Tankard
, it
for any reason.
pof 493
at the end of the
a.  The
in the DOS
not be
.  The
in the Tankard
 in all
 "IBMBIO.
-IBMDOS.
 "Tankard vers.2.0"
 It is
what Tankard may do
of Tankard are:
 Tankard V3.01: A 556
of the Tankard
1,024
), hooking
|21.  It adds 556
)to the .
Zand open.  The
can be
in the Tankard V3.0
 "IBMBIO.
-IBMDOS.
 "Tankard vers. 3.01"
 March,
PZPAPN
Tao Cheng
:  Tao Cheng
j; video mode
&failure;
 garbage
4written to
 unexpected
R:  1,295
5:   PRtAK -
3.96+,
n1.03+,
30.00+, NAV 3.0+,
 The Tao Cheng
.  Its
.  Tao Cheng is a
uof .
-and .
bTao Cheng
X, the Tao Cheng
at the top of
$the
', moving
|12's
, as
qby the DOS
@by 3,072
mby the Tao Cheng
the Tao Cheng
, it
 and .
pof 1,295
at the end of the
a.  The
>and
 the DOS
not be
.  The
in the Tao Cheng
 "TheDraw
Save"
 "Unsupported Video Mode"
 "[Tao Cheng] Tommy Chong"
 The author of the "TheDraw"
had nothing to do
 creation of
.  The
btwo
are in the
due to use of TheDraw to create part of the
the Tao Cheng
[a number
.  Frequent
jmay be accompanied
 colored squares
9ing random
4on the
monitor.
 The
video mode may be switched.  Unexpected
 may
, as well as
&failures
© of
Tmay
 accompanied by a
-MAND cannot be loaded, and the
!halted.
PZPAPN
Tatou
:  Tatou
i; TSR;
seconds set to "62"
 Poland
R:  1,153
5:   PRsCK -
n, NAV 3.0+,
8/93+,
 The Tatou
fPoland in
.  Tatou
 is a
uof .
bTatou
X, the Tatou
as a low
TSR of
 1,424
).  It hooks interrup 21.
the Tatou
, it
pof 1,153
 at the end of the
a.  The
>and
in the DOS
to not be
's seconds field
!set to "62".  The
in all Tatou
 It is
what Tatou
PZPAPN
:  TB1
R:  124 - 448
5:   PNE -
 The TB1
.  Its
.  TB1 is a
uof .
the TB1
X, the TB1
wup to three .
in the
 124 to 448
at the end of the
a.  The
>and
in the DOS
not be
.  No
in the
 TB1
Nn't
to do
PZPAPN
TBug-634
:  TBug-634
 Andr-634
R:  634
5:   PRhAK -
n1.04+,
6.64+,
V109+,
1.25+,
6.64+
 The TBug-634
.  Its
.  TBug-634 is a
 of .
-and .
bTBug-634
at the top of
 the
', not moving
|12's
, as
qby the DOS
@by 640
mby TBug-634 in
the TBug-634
, it
pof 634
 the end of the
a.  The
>and
in the DOS
to the
 and
.  The
can be
dnear the end of all
 "TbUg"
 TBug-634 uses a mechanism
employed by the Vacsina
.  As a
employing
ning technologies may detect
of the Vacsina
PZPAPN
Tchantches
:  Tchantches
i; graphic
hang;
 Liege, Belgium
R:  3,303 - 3,318
5:   PRsAK -
30.00+, NAV 3.0+,
1.25+
 The Tchantches
.  It is
fLiege, Belgium, and is
on the Gotcha
 Tchantches is a
uof .
-and .
bTchantches
at the top of
 but
$the
', not moving
|12's
, as
qby the DOS
@by 3,648
mby Tchantches in
, the
 Tchantches
the Tchantches
, it
 and .
for any reason.
 Tchantches
 3,303 to 3,318
at the end of the
a.  The
>and
in the DOS
not be
.  The
 the Tchantches
5, thus not
 "TCHANTCHES d
mineur v1,10"
 "Portez secours
 votre disque dur"
 "Entr
e=Drapeau, Espace=Explorer"
 "(C)Copyright Setaicossa EefaCm '92"
 The Tchantches
1st of any year.  At
, the
 draw a box centered on the
M.  The
btwo lines
be at the top of the box, and the last two lines
at the bottom.  The
be hung.
 See:   Gotcha
PZPAPN
TechnoRat
:  TechnoRat
 Rat-615
G:  March,
=seconds set to "62"
R:  615
5:   PNCK -
 NAV 3.0+,
n1.05+,
 The TechnoRat, or Rat-615,
in March,
.  It
s to be
fthe
.  TechnoRat is a
uof .
the TechnoRat
wall of the .
in the
E, and the
pof 615
 the
at the end of the
a.  The
 and
in the DOS
to be
, however the seconds field
!set to "62".  The
in the TechnoRat
 in all
 "Techno-Rat I. Copyright by Lord Blaise, Odessa
 "*.* *.
-..\*.
 It is
what TechnoRat may do
PZPAPN
Telecom
:  Telecom
 Telefonica, Telecom
a, Spanish Telecom-2
Kformatted
 Spain
R:  3,700
5:   PRhC -
, NAV,
 The Telecom, Telefonica, or Telecom
breported
, in Spain.
several samples of Telecom
 were
in early
, the
breplicable sample arrived
sample is
fSpain.  Telecom is a
uof .
.  It
carries a
of the Anti-Tel
zon the
).  Telecom was written by
 the same individual as the Anti-Tel and Holocaust
es.  All of
es are
Telecom is
X, Telecom
at the top of
$the
|12's
not be
 moved.
, as measured by
 the DOS
@by 3,984
mby the Telecom
Telecom is
, it
 larger
1K in
by 3,700
 the
pcannot be seen in the
as the
hides it.  The
alters the
 in the
Eby adding 100 to the year,
 readily apparent.  The
>alteration is how Telecom determines
 if the
ais already
Telecom
, it
wthe
of the Anti-Tel
 accesses a
on the
K.  See the description
 for Anti-Tel for
xon the
 The
Nnot
9a complete copy
 of the Telecom
, so it by
cannot
 The
uportion of Telecom
Nnot
 mechanism per say, the
mechanism is in the
K, the
 See:   Anti-Tel   Holocaust
PZPAPN
:  Ten
 1554, 9800:
, V-Alert, 1559
H:
i, TSR, linkage
R:  1,554
5:   PRfAK -
\, NAV,
\, or
 The Ten
), or 1554,
was accidentally sent out over the
 VALERT-L network on
^13,
 subscribers.
, the
.  It
proceed to
`over 1000
and .
`over 1024
,, increasing
tby 1,554 to 1,569
 The Ten
?of any year.  Upon
, any
are written
be missing the
bten
).  At the end of
`, ten
)of miscellaneous
.  In effect, both
and data
be corrupted.
 If the Ten
Xon a
less
, the
hang the
of Ten
)are:
 1415: The 1415
on the Ten
.  It
elow
 hooking
{21 and 49.  The 1415
by 1,415 to 1,462
at the end of the
be no
3in the
>and
in the DOS
)-1514: The Ten
)-1514
on the Ten
.  It
, it
 and .
by 1,518 to
 1,569
at the end of the
may notice
`written to
Kmay be missing the
were in the
a, thus corrupting the
)-1514B:
gequivalent to the Ten
)-1514,
differs in a few
PZPAPN
Tequila
:  Tequila
modified;
 Switzerland
R:  2,468
5:   PRtEX -
, NAV,
1.25+
:  CleanUp,
\, or
 replace
 The Tequila
.  It is
fSwitzerland, and at the
of its
~was
V.  Tequila is a
) and .
uses a complex
 encryption method and garbling to avoid disassembly and detection by
 using a
or search
 The
Tequila is
Xon a
, the
check to see if it has already
.  If the
has not
r, Tequila
write an un
Scopy of
to the last six
of the
K, as well as
 modify the
wious.  Tequila
, and it
 Later,
is re
fthe
 Tequila
.  It
at the top
$the
|12's
be moved, preventing the
{13 and 21
mby the
, as
qby the DOS
be 3,072
)less
expected.
Tequila is
, it
 2,468
), but
not be able to be seen in the
 DOS
Eif the
.  The
at the end of
.  The
>and
in the
not be
 The
be able to be
don the last few
 of the
 "Welcome to T.TEQUILA's latest production.
 Contact T.TEQUILA/P.o.Box 543/6312 St'hausen
 Switzerland.
 Loving
t to L.I.N.D.A.
 BEER and TEQUILA forever !"
Tequila
notice
#detected
the DOS
.  If
the /F option,
:may
perform CRC checking may not be able to
 detect Tequila on
`, regardless of whether the
 Tequila
four months
the initial
 of the
K.  At
, and every month
 on the anniversary
>, the
Ma graphic and the
Y: mov ax, FE03 / int 21. Key to go on!"
 If the
Ys a
9ing
sequence of
 instructions, the
don the last
 the
PZPAPN
Terminator
:  Terminator
2; TSR; write protect
R:  526
5:   PRsCK -
, NAV,
 The Terminator
.  Its
.  Terminator is a
uof .
 The
the Terminator
X, the Terminator
 as a low
TSR of 1,104
{21, 22, and
the Terminator
, it
the Terminator
 of 526
at the end of the
 The
>and
in the DOS
to the
>and
the Terminator
may notice
 the
fa write-protected
J, a write-protect
PZPAPN
Terminator-2294
:  Terminator-2294
R:  2,294
5:   PRhAK -
\, NAV 3.0+,
8/93+,
1.25+
 The Terminator-2294
.  Its
.  Terminator-2294 is a
uof .
-and .
,.  It employs
techniques to avoid detection,
 and
Nnot
until the
ring
?31,
?31,
, and a
 Terminator-2294
X, the Terminator-2294
at the top of
$the
', hooking
{13, 21
 and 24.
, as
 the DOS
@by 2,448
, the Terminator-2294
,if it
 was not
the Terminator-2294
, it
-and .
pof 2,294
at the end of the
a.  The
not be
.  The
>and
in the DOS
not be
.  The
in the Terminator-2294
 "TERMINATOR"
 ".csc.eziarchomanxep"
the Terminator-2294
notice
Ton all
.  It is
what
effects the
 Terminator-2294 may
PZPAPN
Terminator-3549
:  Terminator-3549
`corrupted;
fail to
 function
; "Divide overflow"
 The
R:  3,549
5:   ONE -
 The Terminator-3549
.  It is
fThe
.  Terminator-3549 is a
.  It
 permanently damages the
the Terminator-3549
 the Terminator-3549
wone .
 the C:
O.  The
starting
in the
O's root
E, and
slowly work down the
 structure.
the Terminator-3549
b3,549
)of the host
by the
5.  Unless the .
awas
smaller
3,549
be no
smaller
 3,549
before
 3,549
t.  The
>and
in the DOS
to the
 and
.  The
in the
5in Terminator-3549
 "*.exe"
 "$456789:;<o>=>?u"
in the
Lon the
monitor:
 "Divide overflow"
PZPAPN
Tester
:  Tester
 TestVir, Test
B V1.4
R:  1,000
5:   PNCK -
\, NAV,
 The Tester, or TestVir,
.  Its
is a
uof .
`.  It
Tester is
X, the
Mthe
, requiring a response by the
is TESTVIRUS B V1.4 !
 1 =
E+ run orig. prog.
 5 = run
orig.
 9 = abort"
 If a "1" is entered by the
, the
 all of the .
in the
E, and
 the
Tester
, it
Mone of the
ctwo lines, indicating
it is
;ly processing.  The
bline is
 the
if it was
r, the second line
 it is
sthe
 "Already
 "INFECTED:
 Entering a "5"
in no
r, and the
X.  Finally, entering
 a "9"
in the
terminating and the
ed to a DOS prompt.
Tester
by 1,000
 the
at the
"of the
 The
>and
in the DOS
to the
>and
PZPAPN
Thimble
:  Thimble
i; TSR;
R:  1,024 - 2,046
5:   PRsCK -
, NAV,
 The Thimble
.  Its
~, is
.  Thimble is a
uof .
bThimble
X, the
 Thimble
as a low
TSR of 4,416
{21 and CC
 the
the Thimble
, it
X.  If
the Thimble
normally
by 1,024
).  The exception is
smaller
1,024
 2,048
.  The
at the
"of the
.  The
>and
in the DOS
to the
>and
 The
can be
din all Thimble
 "Greetings to Cracker Jack..."
 "Loving
ts to Shirley"
 "Marty McFly lives
where in
 "Kill Eddie. Kill Diana. Kill Fredo."
 It is
if Thimble
PZPAPN
Thirty Three
:  Thirty Three
R:  525
5:   PRtCK -
n1.04+,
\2.10+,
V112+,
6.60+,
2.58+,
2.58+,
V113+,
6.64+
 The Thirty Three
.  Its
.  Thirty Three is a
uof .
bThirty Three
at the top of
$the
', moving
|12's
, as
qby the DOS
@by 1,024
mby the
, the Thirty Three
pof 525
at the end
 of the
a.  The
>and
in the DOS
to the
>and
.  One
in the
 "33"
 It is
very near the end of all
PZPAPN
mark 1
H:
 Poland
R:  1,062 - 1,076
5:   PRhE -
3.96+, NAV 3.0+,
8/93+,
 The
mark
.  It is
fPoland.
mark is a
uof .
mark
X, the
mark
at the top of
 the
qby the DOS
@by 1,072
{1C and 21
mby the
mark
mark
, it
very small ones)
pof 1,062 to
 1,076
#at the end of the
a.  The
>and
in the DOS
.  No
in the
mark
 It is
what
mark
mark are:
mark 2: Probably an earlier
of the
mark
is 1,088
), hooking
{1C and 21.  It adds 1,083 to 1,097
 to the .
v.  Unlike
mark,
mark 2
 adding an
1,083 to 1,097
).  The
>and
in the DOS
 not be
:  Poland
PZPAPN
Timid
:  Timid
H:
Zfailure
 Oregon,
R:  306
5:   PNCK -
, NAV,
 The Timid
Gin the state of Oregon in the
.  Timid is a
uof .
,.  Timid
s to be an escaped research
, and has
din the
 public domain.  It was
by Wallace Hale of Canada.
Timid is
X, the Timid
 look for an
in the
w.  The
encountered
rby the
.  If no
exist in
 the
E, a
hang
 Timid
pof 306
).  The
at the end of the
 The
>and
in the DOS
to the
>and
.  Two
can be
din the
 "VI"
 The
, "VI",
in the fourth and
 fifth
`.  Together
a jump (E9h) instruction
at the
"of the
a, it forms the
 marker used by the
to determine if the
awas
rby Timid.
&the
in a
hang.
 yield unexpected
s, such as beeping, or a
of Timid are:
 Hehheh:
, Hehheh is a 320
 of the Timid
.  It
vone
ain the
`may be of any
odata
`, as
 the
uses a search argument of *.*.
pof 320
at the end of the
a.  The
 and
in the DOS
to the
>and
all of the
`in the
Zof the next
in the
#repeatedly
Lon the
monitor, accompanied by beeping:
 "*.* HEH!HEH!HEH!HEH!"
can be
in the
5in all
 Hehheh
 Timid-290:
, Timid-290 is a 290
of the Timid
Zof an
in the
searching the
Efor an
w.  Unlike
 the
, it
Nnot
Mthe newly
pof 290
 at the end of the
a.  The
>and
in the
 DOS
to the
>and
.  The
4"VI" can be
dstarting in the fourth
 all
.  The
 the
5is "*.
:  North America
 Timid-297:
, Timid-297 is a 297
of the Timid-371
Zof an
in the
searching the
Efor an
w.  If the
cannot find an
w, it
 hang the
pof 297
at the
 end of the
a.  The
>and
in the DOS
to the
>and
.  The
4"GR" can be
dstarting in the fourth
 all
.  The
 the
5is "*.
:  North America
 Timid-305:
, Timid-305 is one
*smaller
Timid
Zof an
in the
searching the
Efor an
w.  If the
, it
Mthe newly
.  No beeping
 Timid-371:
, Timid-371 is a 371
of the Timid-290
Zof an
in the
searching the
Efor an
w.  If the
cannot find an
w, it
of the
Kstarting at
 Side 0, Cylinder 0,
 any
to access the
in an "Invalid
Ospecification"
U.  Norton
KDoctor can be used
 to fix the
pof 371
 the end of the
a.  The
>and
in the DOS
to the
>and
.  The
4"VI" can be
dstarting in the fourth
 all
.  The
 the
5is "*.
:  North America
 Timid-382:
, Timid-382 is
on the
Timid
Zof an
in the
searching the
Efor an
w.  If the
, it
Mthe newly
.  No beeping
pof 382
at the
 end of the
a.  The
>and
in the DOS
to the
>and
.  The
"VI" can be
dstarting in the fourth
*of all
may corrupt the
&record (
 Timid-431:
, Timid-431 is
on the
Timid
Zof an
in the
searching the
Efor an
W, or .SYS
pof 431
at the end of the
a.  The
>and
not be
in the DOS
.  The
"GR" can be
dstarting in the fourth
 of all
s of
&failures and
failing to function
 Timid-526:
, Timid-526 is
on the
Timid
Zof an
in the
searching the
Efor an
wboth
and data
the exception
in the root
wthe hidden
`, both
and data,
pof 526
at the end of the
a.  The
 and
not be
in the DOS
.  The
"GR" can be
dstarting in the
 fourth
*of all
s of
&failures,
failing to
 function
, and data
non-execu
r.  If the
Nnot encounter
w, it may slowly alter the
Muntil it is left blank.  A
hang
 Timid-557:
, Timid-557 is
on the
Timid
Zof an
in the
searching the
Efor an
wboth
and data
the exception
in the root
wthe hidden
`, both
and data,
pof 557
at the end of the
a.  The
 and
not be
in the DOS
.  The
"GR" can be
dstarting in the
 fourth
*of all
s of
&failures,
failing to
 function
, and data
non-execu
r.  If the
Nnot encounter
w, it
slowly drop
 down the
Mif it is in
mode, and
 later move them back into place.
 Timid-LM:
, Timid-LM is a 305
of the Timid
.  It is
fCanada, written by
 Lucifer Messiah.  Timid-LM
vone .
ain the
by 305
at the end of the
a.  The
 and
in the DOS
to the
>and
9the
 "LM" starting in the fourth
*of the
a.  The
din the
5is "*.
:  Canada
 Timid-Orig: The
Timid
whose source
 published in "The Little Black Book of Computer
 by Mark Ludwig.
the Timid-
 Orig
X, the
search the
Efor an
w, and
wit.
it has
, it
Mthe
of the
 has just
Timid-Orig
pof 306
at the end of the
.  The
>and
in the DOS
to the
>and
.  The Timid-Orig
Nnot cause beeping
on the
speaker.
:  Arizona,
PZPAPN
Timor
:  Timor
H:
i; TSR;
R:  1,562 - 1,576
5:   PRsA -
/, NAV 3.0+,
8/93+,
.2.0+
 The Timor
.  Its
.  Timor is a
uof .
-and .
, and is
on the
bTimor
X, the Timor
as a low
TSR of
 2,816
).  It
hook
{21 and F8.
Timor is
, it
-and .
X.  .
pof 1,562
at the
"of the
a.  .
pof 1,562 - 1,576
 at the end of the
a.  Unlike
, Timor
lany
>and
in the DOS
 The
can be
din all Timor
 "Timor"
 Cruz, Dili"
 "LxTimor"
 "sso,
edom for East Timor !"
Nov 12, Lusit
ia Expres"
 Timor
12th of any year, at
 may
Mthe
: "St Cruz, Dili".
 See:
PZPAPN
Di-94,
Di-101,
Di-108,
Di-110, Di-94,
 Di-101, Di-108, Di-110
H:
&failure;
R:  94 - 110
)(see
5:   PNCK -
n, NAV,
3.96+,
 The
Di, or Di,
]of four
es was
.  Its
.  The
es in
]are non-
us of .
,.  Since
four
es exhibit
behavior,
 in general,
differences
$under
X, the
wall .
in the
E.  If
E, it
 well.
one of the
 the
at the
"of the
a.  The
p, and whether the
later be re
 depends on
is present.  In any case, the
lhad
>and
in the DOS
to the
>and
 One
can be
in the
 "*.com"
 The
es do not intentionally do
may fail to
 are
r.  The
fail to
&if the
 copy of
members of the
]are:
Di-94:
adds 94
)to the .
v.  It is unable to distinquish
 has
r, so it
add 94
Di-101: A 101
*member of the
vall .
`in the
 not always in a
manner.  In
cases, the
b101
out saving the
b101
fore,
the initial
tof a
, the
be either zero or 101
 Like
Di-94, it cannot recognize
`, and
later re
wthem, adding an
 zero or 101
Di-108:
Di-101,
is 108
in a
 manner, and
s by
b108
 Unlike
Di-101, it can recognize
`, and
Nnot re
wthem.
Di-110:
Di-108,
is 110
PZPAPN
 see
$under "
members"
H:
R:  133 - 198
)(see
5:   PRC -
\, NAV,
 The
es was
by the author in
fVesselin Bontchev of
(.  All the
es in
 grouping share the same characteristics,
 difference is the effective
of the
 five (5)
es included in the "
]" as of
-158,
-159,
-160,
-167, and
-198.  In
, five (5)
es in
]were
 Vesselin Bontchev:
-134,
-138,
-143,
-154, and
-156. In
, an eleventh member was
-133.  In March
, the twelveth member was
-143B.
 The
one of the
Xon a
, the
segment 60h.
area of
is normally
used by DOS
&ed,
it is never
 used or referenced.
mby the
, the
wany .
pof between 134 - 198
), depending on
is present on the
.  The
>and
in the
to the
>and
 The
Nnot do
 The
es in
]" are not related to the
 documented
members of the
]are:
-133:
-134,
's effective
 133
).  The bugs in
-134
!fixed,
is an excellent replicator.
it cannot be detected by
 utilities
were aware of
members of
-134:
's effective
is 134
is the
member of
is not a
 very viable
, it
usually hang the
-138: Same as
, effective
is 138
-143: Same as
, effective
is 143
-143B:
-143B was
in March,
, and is
-143.  It has
to avoid
 detection by
familiar
-143.
 March,
-154: Same as
, effective
is 154
-156: Same as
, effective
is 156
-158: Same as
, effective
is 158
-159: Same as
, effective
is 159
-160: Same as
, effective
is 160
-167: Same as
, effective
is 167
-198: Same as
, effective
is 198
].Fred:
].Fred was
, 1994.  It
 is a 255
*member of
group of
es.  It adds 255
)to the .
-and .
9the
at the end of
 the
 "Fred"
, 1994.
 See:   Dutch
  Micro 128   Mini-97
PZPAPN
 Danish
, 163
H:
 Denmark
R:  163
5:   PNCK -
\, NAV,
\, or
 The 163
, or
, was
}by Fridrik Skulason
 of Iceland in
is a
generic .
u, and it
 The
the 163
 the
attempt to
wthe
ain the
E.  On
&able
normally be
attempt to be
`are
 greater
by 163
), and
=stamps in the
1to the
always end
 hex
: '2A2E434F4D00'.
Nnothing but
, and is the
 smallest MS-DOS
as of its
 The
may or may not be related to the
 documented elsewhere in
of the
 191: A 191
of the
, the 191
wone .
ain the
pof 191
 at the end of the
a.  The
>and
in the DOS
not be
.  One
s in the
 The 191
Nnot
wvery small
`, and it
 usually not
wmore
four
`in the
E.  It
Nnothing
 Brenda: A 256
of the
, Brenda
 one .
ain the
 of 256
at the end of the
a.  The
>and
in the DOS
to the
Brenda has
bthree .
`in the
E, it
 the
instead of
 "(C) '92, Stingray/VIPER
 Luv, Brenda"
is not
`as it is
S.  One
in the Brenda
5: "*.
 May,
 Brenda-B:
to Brenda,
has one
 Danish
.476: A 476
of the
wone .
ain the
pof 476
at the end of the
a.  The
>and
 the DOS
not be
.  The
in the
 "EW_476 MM2 VIRUS\MYVIRII\TEMP ge by the BLACK WIND VIRUS..."
 "Copyright (C)
, Destructive Technologies, Unlimited."
, 1994.
 Kennedy: The Kennedy
is a 333
of the
.  It
vone .
X, adding 333
)to the end of the
has three
6 (Robert Kennedy's
 assassination in 1968),
18 (death of Joseph Kennedy
 in 1969), and
22 (John F. Kennedy's assassination in
 1963) of any year.  On
, the
 "Kennedy is deal - long live 'The Dead Kennedys'"
 Two
can be
in the
6.com"
 "The Dead Kennedys"
[cross-linking of
`, lost
 clusters, and
: Denmark
 Stigmata: Stigmata is a 1,000
of the
vone .
in the
if it encounters a very small .
the Stigmata
pof 1,000
 the end of the
a.  The
>and
in the DOS
not be
.  No
in the
-177: A 177
of the
, the
wone .
ain the
pof 177
at the end of the
a.  The
>and
 the DOS
1to the
>and
.  One
in the
-180: A 180
of the
, the
wone .
ain the
pof 180
at the end of the
a.  The
>and
 the DOS
not be
.  One
s in the
 The
-180
Nnot
wvery small
`, and it
usually not
wmore
four
`in the
E.  It
Nnothing
 See:
PZPAPN
:  Tiso
H:
 Italy
R:  846
5:   PRhCK -
30.00+,
2.11+,
 NAV 3.0A06+,
 The Tiso
, and is
 Italy.  Tiso is a
uof .
bTiso
X, the Tiso
wthe copy of
in the C:
Oroot
E.  It
Nnot
until later
fthe
Kand the
Tiso is
, it
at the
 top of
$the
', moving
|12's
qby the DOS
@by 1,024
{08 and 24
mby Tiso in
the Tiso
, it
pof 846
at the end of the
a.  The
>and
in the
 DOS
not be
.  No
in the
5in Tiso
 It is
what Tiso
of Tiso are:
 Tiso.1279:
in May, 1994, Tiso.1279 is a 1,279
of the Tiso
.  Unlike the
is multi-partite,
 the
), in addition to .
-and .
X, the
 the
.  The
 not
, however, until the
fthe
K.  The
is 2,048
)at the top of
, but
$the
|12's
be moved, and
 the
-and .
pof 1,279
at the end of the
a.  The
>and
in the DOS
.  No
in the
5.  It is
what
:  Italy  May, 1994.
PZPAPN
:  TMTM
 Two Minutes To Midnight
H:
 England
R:  441
5:   PNCK -
3.96+, NAV 3.0+,
8/93+,
.2.0+
 The TMTM, or Two Minutes To Midnight,
 Manchester, England in
.  TMTM is a
uof .
the TMTM
wone .
in the
hang may
pof 441
at the
 end of the
a.  The
in the DOS
to 11:58p, or two minutes to midnight.  One
in the
jfrequently
PZPAPN
Tobacco
:  Tobacco
H:
i; TSR
R:  2,900 - 2,914
5:   PRsAK -
, NAV,
1.53S+,
 The Tobacco
.  Its
.  Tobacco is a
uof .
-and .
on the Plastique
bTobacco
X, the Tobacco
as a low
 TSR of 3,152
).  It
hook
the Tobacco
, it
 and .
the exception of
pof 2,900
at the
"of the
a.  .
rby Tobacco
by 2,900 to
 2,914
at the end of the
lany
rby Tobacco.
 The
can be
din all Tobacco
 "Tobacco v2"
 "AntiDacha. 21193We don't want"
 "gypsies in our"
 "world. We don't"
 "want DACHAs."
2nd Tabacalera gana siempre. Tobacco Ver. 2.0"
 It is
what Tobacco
of Tobacco are:
 Tobacco-B:
to the
Tobacco
Nnot
,.  The
 the
 "Tobacco v2"
 "We don't want"
 "gypsies in our"
 "world. DHC 1997"
 "ENIGMA MCMXCV
I@TTF"
2nd Tabacalera gana siempre. Tobacco Ver. 2.0"
 See:   Plastique
PZPAPN
Today
:  Today
H:
Zfailure;
&failure;
R:  177
5:   ONCK -
2.58+,
n1.05+,
6.64+, NAV 3.0A06+,
2.58+,
1.25+,
6.64+
 The Today
.  Its
.  Today is a
,.  It permanently
 corrupts the
the Today
X, the Today
wone .
in the
 The Today
s the
b177
)of the host
a, so
 unless the
smaller
), the
not be
were
smaller
 177
rby Today.  The
>and
in the DOS
to the
>and
.  The
in the
5in all Today
-Today is Good Thursday, nothing can go wrong!"
PZPAPN
Todor
:  Todor
H:
R:  1,993
5:   PNEK -
n, NAV 3.0+,
30.00+,
 The Todor
.  It is
 Todor is a
uof .
`and
the Todor
wup to four .
in the
ly, it
,if it was
 not
the Todor
pof 1,993
at the end of the
a.  The
in the DOS
not be
 The
in the
 Todor
 "*.exe *.com"
-SPEC=(C)Todor"
 It is
what Todor
of Todor are:
 Todor-B:
gequivalent to the
8minor alterations.
}:  The
PZPAPN
Tokyo
:  Tokyo
H:
may not function
 Japan
R:  1,258 - 1,273
5:   PNE -
30.00+,
 NAV 3.0A06+,
 The Tokyo
Gin Japan in
.  Tokyo is
uof .
Tokyo is
X, the
 one .
ain the
by 1,258 to 1,273
at the end of the
Tokyo may
[frequent
are made to
hang
Nnot
, often the
las the
is expecting,
pauses
ring in output
 operations, such as to the
 It is
if Tokyo
PZPAPN
Tolbuhin
:  Tolbuhin
 Sk1, Tolbuhin-1147
H:
R:  1,147
5:   PRhC -
, NAV 3.0+,
1.53S+,
 The Tolbuhin, or Sk1,
.  Its
.  Tolbuhin is a
uof .
, but not
bTolbuhin
X, the
 Tolbuhin
at the top of
$the
, as
qby the DOS
@by 2,048
{20 and 21
 Tolbuhin.  The
wone .
in the
Tolbuhin is
, it
pof 1,147
 the end of the
a.  The
>and
in the DOS
to the
>and
.  The
can be
din all
the Tolbuhin
 "Created 21.I.
- PMG\OTME - Tolbuhin"
 "*.com"
-MAND"
jfrequently
.  It
destructive
of Tolbuhin are:
 Tolbuhin-626:
on the Tolbuhin
2,048
).  It hooks
 13, and 21.
pof 626
at the end of the
a.  The
 and
in the DOS
to the
>and
.  The
 can be
in the
 "*.com"
 "SK9"
 The
"SK"
dstarting in the
 fourth
*of all
 Tolbuhin-992:
on the Tolbuhin
2,048
).  It hooks
 13, 20, and 21.
pof 992
at the end of the
a.  The
 and
in the DOS
to the
>and
.  The
 can be
in the
 "Created 21.I.
- PMG\OTME - Tolbuhin"
 "*.com"
-MAND"
 Tolbuhin-1004:
on the Tolbuhin
2,048
).  It hooks
 13, 20, and 21.
pof 1,004
at the end of the
a.  The
 and
in the DOS
to the
>and
.  The
 can be
in the
 "*.com"
-MAND"
PZPAPN
Tomato
:  Tomato
H:
j; unusual
R:  2,156 - 2,171
5:   PRhAK -
2.58+,
6.64+,
2.58+,
1.25+,
6.64+
 The Tomato
.  Its
.  Tomato is a
uof .
-and .
 The
the Tomato
X, the Tomato
 at the top of
$the
, as
qby the
 DOS
@by 2,736
{09, 13, and 28
mby Tomato in
the Tomato
, it
-and .
X.  If
X, it may
the Tomato
 of 2,156 to 2,171
at the
 end of the
a.  The
>and
in the DOS
not be
 The
in the Tomato
 "TOMATO!!!"
 "Praise the tomato! God save the tomato"
 "Big tomato is watching you Big Tomato says:"
 "Fighting for peace"
 "is like fucking for virginity TOMATO says:"
 "the pope suffers
fAIDS Big Tomato says:"
 "NO MERCY
lyou ever danced
the devil"
 "under the red light of a big tomato ?"
 "pray for your
Ks . . . Call McAfee [phone]"
 "if you
[problems
fTomato
 "\VIRUS \DOS *.
,tomato.tmp"
the Tomato
jor unusual
 For example, the DOS
get the
 "Cannot
+a Network
it is
Xeven
 it is not on a networked
PZPAPN
:  Tony
H:
R:  200
5:   PNCK -
, NAV,
 The Tony
.  It comes to us
(.  Tony is a
uof .
the Tony
X, the
check the day of the
>.  Depending on the day of the
 month, the
determine
`in the
w.  The algorithm is if the day = "1",
`starting
"B" are
r.  On the 2nd,
`starting
"C" are
algorithm continues for the rest of the
 days of the month.  Tony
vall .
`in the
meet the selection criteria.
 Tony
pof 200
).  The
at the
"of the
be no
3in the
>and
 DOS
.  The
can be
in the
5in Tony
 "Tony+*.
 Tony
Nnot do
of Tony are:
 Tony-203:
to the Tony
adds 203
)to the .
v.  The
din the
s in
PZPAPN
Tony
:  Tony
R:  N/A
5:   BR -
n, NAV,
1.53S+,
1.25+
Kor DOS SYS
 The Tony
.  It is
(.  Tony
&is a
 The
fa Tony
J, Tony
copy the
 to the last
of the
O, and
wthe
.  The
not be
 The next
fthe
K, the
 Tony
it is
, it
wany non-write protected
 exposed to the
.  The
in the
Ks and
 "Tony"
 It is
if Tony
of Tony
&are:
 Tony
&Dropper: Tony
&Dropper is a small
 places a copy of the Tony
into a
.  The Dropper
 not
PZPAPN
Tormentor
:  Tormentor
H:
i; .PAS
 Sweden
R:  1,024
5:   PRhE -
, NAV,
 The Tormentor
fMikael Larssen of the
 Help Center, Sweden, in
.  Tormentor is a
uof .
 The
Tormentor is
X, the
 Tormentor
at the top of
$the
, as
qby the DOS
@by 1,056
mby the
|12's
!moved.
Tormentor is
, it
 over
3K in
pof 1,024
at the end of the
a. The
>and
in the DOS
.  The
ctwo
can be
din Tormentor
 "*.PAS"
 "TORMENTOR!"
 The Tormentor
B.PAS
 the
a Tormentor
jmay
of Tormentor are:
 Tormentor-1040:
, Tormentor-1040 is a
 1,040
of the Tormentor
.  Its
is 1,072
), and like the
it hooks
|21.
Tormentor-1040
pof 1,040
at the end of the
a.  No
 are
in the
:  Sweden
 Tormentor-1072:
on the Tormentor
 Tormentor-1072 is a 1,072
-and .
, but not
 Its
is 1,104
), and it hooks
|21.
it is
, it
-and .
larger
by 1,072
at the end of the
a.  The
>and
in the DOS
 reflect the
>and
.  The
 can be
din all
 "NUKE!"
 "TORMENTOR,soldier of -=DY=-"
ks DAv!] DEMORALIZED YOUTH!"
 Unlike Tormentor,
Nnot
 .PAS
jmay
:  Sweden
 Tormentor-1072B:
gequivalent to the Tormentor-1072
, the
 are:
 "NUKE!"
 "THOMASC. KILLER !!! -=SY=-"
ks DAv!] DEMORALIZED YOUTH!"
 Tormentor-1072C:
gequivalent to the Tormentor-1072
has a few
 differ.
 Tormentor-1072D:
gequivalent
 to the
Tormentor-1072,
minor
 Nuke:
on the Tormentor-1072
, Nuke
adds 1,072
)to the .
v.  The Nuke
`, not .
members of the
 Tormentor group do.  The
in the Nuke
 "NUKE!"
ks DAv!] DEMORALIZED YOUTH!"
 Nuke
on the second day of any month.  At
Kon the
fC: through Z:.
 Nuke Dropper: A small .
the Nuke
.  The
is not a natural
 and serves no purpose except to release or drop the Nuke
 Lixo Nuke:
to the Nuke
 reformat the
Kon the 31st of any month.
becoming
, it
are copied.  Both the source and target
pof 1,072
at the end of the
a.  The
can be
din the Lixo
 Nuke
 "NUKE!"
 "TORMENTOR,soldier of -=DY=-"
ks DAv!]"
 "DEMORALIZED YOUTH!"
:  Sweden
 Lixo Nuke Dropper: A small .
the Lixo Nuke
.  The
is not a
 natural
t, and serves no purpose except to release
 or drop the Lixo Nuke
:  Sweden
 See:   Murphy
PZPAPN
Tormentor-205
:  Tormentor-205
 Lession, Lession-1
H:
3; unexpected
executing
 Sweden
R:  205
5:   PNCK -
 NAV 3.0+,
8/93S+,
8/93+,
.2.0+
 The Tormentor-205
fSweden in
is a
uof .
,.  It is by the same author as
 The Tormentor and Tormentor-1072
the Tormentor-205
wall the .
in the
pof 205
at the end of
 the
a.  The
>and
in the DOS
to the
.  The
in the
5in all Tormentor-205
 "(c)
Tormentor ,Swedish
Laboratory"
 "/ Demoralized Youth /"
Tormentor-205 may receive unexpected
include "Exec failure" and "Too many
`open".
usually not run
of Tormentor-205 are:
 Tormentor-263: Tormentor-263 is a 263
of the
 Tormentor-205
. It
in the
pof 263
at the end of the
 The
>and
in the DOS
to the
>and
.  The
can be
din all
 "Modifications provided by ME, Inc."
 "I hope
works!"
 "(c)
Tormentor ,Swedish
Laboratory"
 "/ Demoralized Youth /"
:  Sweden
 Tormentor-358: Tormentor-358 or Lession-2B is a 358
of the Tormentor-205
vall .
in the
pof 358
at the end of the
.  The
>and
in the
 DOS
 to the
>and
.  The
can be
din all
 "(c)
Tormentor / Demoralized Youth"
 "Rather
bin hell,
second in heaven."
:  Sweden
 Tormentor-358 Dropper:
 is a small .
is a dropper for the
 Tormentor-358
:  Sweden
 Tormentor-360: Tormentor-360 or Lession-2 is a 360
 of the Tormentor-205
.  It
vall .
in the
pof 360
at the end of the
.  The
>and
in the
 DOS
 to the
>and
.  It
 the same
as Tormentor-358.
:  Sweden
 Tormentor-360 Dropper:
 is a small .
is a dropper for the
 Tormentor-360
:  Sweden
 See:   Tormentor
PZPAPN
Totoro
:  Totoro
H:   March,
2; TSR
 Taiwan
R:  1,540 - 1,554
5:   PRsA -
8/93S+,
30.00+, NAV 3.0+,
n1.05+,
8/93+,
.2.0+,
1.25+,
1.0A06+
 The Totoro
in March,
, and is
fTaiwan.  Totoro is a
uof .
, but not
,.  It is
on the
bTotoro
X, the Totoro
as a low
TSR of
 1,856
), hooking
the Totoro
, it
pof 1,540
 at the
"of the
pof 1,540 to 1,554
 at the end of the
a.  In both cases, the
>and
 in the DOS
to the
>and
.  The
in the Totoro
5in all
 "Totoro  Dragon"
 "Hello! I am TOTORO CAT"
 "Written by Y.T.J.C.T."
 "Don't Worry,be Happy"
 "YTIT"
 It is
what Totoro
of Totoro are:
 Totoro.B:
, 1994, Totoro.B's
 TSR is 1,872
), hooking
|21.  Like the
-and .
 are
pof 1,540
at the
"of the
a.  .
 1,540 to 1,554
at the end
 of the
a.  The
>and
in the DOS
to the
>and
.  The
in the
 "MMAND.
 "--- Satan
 "Welcome to the "CLUB""
 "Written  by Mad Satan"
 "Ver 1.06   in Taipei"
 "- Mad Satan -"
in the
#blanked, and
 the cursor moving across the bottom of the
.  Every
 in while, it
spike up to the top of the
to the bottom of the
, 1994.
PZPAPN
Toxic
:  Toxic
H:   March,
fail to function
 England
R:  171
5:   ONCK -
3.96+,
1.25+
 The Toxic
in March,
, and is
fEngland.  Toxic is a
are permanently corrupted, and
not function
the Toxic
X, the Toxic
wone .
in the
lthe
b171
)of the host
the Toxic
5.  The
in the DOS
not be
.  The
can be
in the
5in all
 Toxic
-[Toxic] By Toxic Crusader -=ARCV=-"
PZPAPN
:  TPE
 Girafe
H:
; graphic &
 The
R:  Generally Over 3,000
5:   PRhA -
6.64+
 The TPE, or Trident Polymorphic Engine, was
.  It is
fThe
.  TPE is not actually a
, but rather a polymorphic encryption engine
is used
 as part of the
entry.  The encryption
 produced by the encryption engine is extremely complex and in
 respects
to the  DAME  encryption engine.
engine can
be identified by the presence of the
 encryption engine
.  At the
of its submission, one
 Girafe, exists
uses TPE for its encryption.  Girafe uses
1.1 of the Trident Polymorphic Engine.  An
 1.2, has
, but not
encorporated
 it.  The entry
$is for the Girafe
, and future
 using
encryption engine
be listed
and researched.
 The
the Girafe
 the Girafe
at the top of
but blow the
', hooking
, as
qby the DOS
@by 8,960
|12's
!moved.
the Girafe
, it
pof 3,039 - 3,117
at the end of the
a.  The
>and
in the DOS
.  The
in the
5in Girafe
 "COSCCLVSNEHTTBVIFIGIRAFEMTBRIM"
 "[ MK / Trident ]3 RV"
 "Amsterdam = COFFEESHOP!"
 The Girafe
on Thursdays, at
Ma graphic cannabis (marijuana) leaf and the
 "legalize cannabis".
(es)
use the TPE engine are:
 Beethoven: The Beethoven
in March, 1994.  It
 is a
uof .
-and .
.  Its
at the top of
$the
'is 2,048
), hooking
{1C and 21.
, it
-and .
 are
Xor openned, as well as
1,718 - 1,745
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 Beethoven
5in all
 "Beethoven is here
. And now, enjoy the music..."
 The
in the
 all
 "EMS
Page Frame Mappable Pages"
 Beethoven may play music on the
speaker.
 March, 1994.
 Bosnia: The Bosnia
.  It is
uof .
-and .
.  Its
at the top of
$the
'is 9,216
), hooking
|21.
, it
-and .
, but not
3,146 - 3,245
at the end of the
 The
>and
in the DOS
not be
.  The
in the Bosnia
5in all
 "HELP BOSNIA, BEFORE IT'S TOO LATE!"
 "[ MK / TridenT ]"
 "[TPE 1.4]"
 Bosnia
Nn't
to do
 Civil War IV v1.1: A later
of the  Civil War
 Civil War IV v1.1 is a
 of .
,.  It
in the
pof 2,018 - 2,127
at the end of the
a.  The
in the DOS
not be
 The
in the Civil War
 IV v1.1
5in all
 "Civil War IV v1.1, (c) Jan '93 *.com"
 "For all i've seen has
1my mind
 But still the wars go on as the years go by
no love of God or human rights
 Cause all
dreams are swept aside
 By bloody hands of the hypnotized
 Who carry the cross of homicide
 And history bears the scars of our Civil Wars."
 "[ DH / TridenT ] [ MK / TridenT ]"
 "[TPE 1.3]"
:  The
 March,
 Civil War V v1.0: A later
of the Civil War IV v1.1
, Civil War V v1.0 is a
 of .
at the top of
, but
X, hooking
|21.
, as
qby the DOS
@by 8,192
, it
pof 2,068 - 2,161
at the end of the
a.  The
>and
in the DOS
not be
. The
in the
 Civil War V v1.0
5in all
 "Civil War IV v1.0, (c) Jan '92"
 "DH[ DH / TridenT ][ MK / TridenT ]"
 "[TPE 1.3"
:  The
 March,
 Coffeeshop 4:
, Coffeeshop 4 is a
uof .
uses the TPE engine
 for its encryption.  It is
on the Coffeeshop
were
<Mutating Engine.
at the top of
$the
qby the DOS
 8,960
), and
-and .
X, adding 3,043 - 3,139
.  The
at the end of
 The
in the
 is not
 "Amsterdam = COFFEESHOP! ="
:  Amsterdam, The
PZPAPN
TPWorm
:  TPWorm
H:
`created;
R:  12,969
5:   SNE - Spawning
V112+,
n1.05+,
V113+,
1.25+
 The TPWorm
.  Its
.  TPWorm is a
spawning
 or companion
the TPWorm
X, the
 TPWorm
wthree .
in the
Eby creating 12,969
the same base
companion .
lthe
>and
were created.  The
 the
 "Find me!"
 The TPWorm
Nnot always
.  It
Bthe companion .
, the companion
`created by
 12,969
are not hidden, and are
in the
.  The
 can be
in the TPWorm companion
 ".com .exe"
 "PATH  ; ; ; \ *.exe .com  rb  wb  .
 "Find me!"
 "Packed
ais corrupt"
 TPWorm
Nn't
to do
Mits
 and
PZPAPN
Traceback
00_    F
PT_
:  Traceback
 3066, TB
 Extinct
, 1988
i; TSR; graphic
M1 hour
R:  3,066
5:   PRsA -
, NAV,
, NAV, CleanUp, or
 The Traceback
vboth .
-and .
`, adding 3,066
)to the
of the
X, it
ly, if the
?5, 1988, it
attempt to
wone
-or .
ain the
E.  If an
Nn't exist in the
E, it
search the entire
K, starting at the root
E, looking for a candi
search process terminates if it encounters an
 before finding a candi
>non-
derives its
ftwo characteristics.
9the
Epath of the
acausing the
in the
5, thus is it possible to "trace
 back" the
tthrough a number of
`.  Second,
 succeeds in
a, the
attempt to access
 the on-
Kcopy of the
the copy of the
was loaded
it can up
>a counter in the
.  The
takes over
Uhandling while trying to
>the
, so if it can't
wit, the
be unaware
 The primary symptom of the Traceback
having
if the
?28, 1988, the
produce a
 cascading effect
to the Cascade (1701/1704)
.  The
 cascading
s one hour
 If a keystroke is entered
fthe
during
lockup
one minute, the
 restore
ing to
 positions.
cascade and restore
Mare repeated by the
at one hour intervals.
of Traceback are:
 Traceback-B:
to the Traceback
, the major differences
 are
Traceback-B
,and
 is no cascading
Meffect
for one hour.
9the
of the
became
, but instead
 the
of the
a.  A
 "MICRODIC MSG" can be
 Traceback-B.  If the
 whose copy of
Yany
in a
Uand the
#halted.
: Spain, March
 Traceback-B2:
to Traceback-B2,
has the
 cascading
Meffect
for one (1) hour.  The
 " XPO DAD
 " replaces the "MICRODIS MSG"
in Traceback-B.
: Spain, May
 See:   Spanish   Traceback 3029   Traceback II
PZPAPN
Traceback 3029
:  Traceback 3029
 Traceback-4
i; TSR; graphic
M1 hour
R:  3,029
5:   PRsAK -
, NAV,
 The Traceback 3029, or Traceback-4,
.  Its
.  Traceback 3029 is a
uof .
 and .
,.  It
 hour
becoming
bTraceback 3029
X, the
 Traceback 3029
wone .
in the
E.  If the
Xhappens to
 be a .
, the
 a low
TSR of 7,696
).  It
{1C, 20, 21, and 27.  If the
 not a .
, the
 until the
Ys an
Traceback 3029
, it
 and .
X.  In addition to
 the
, the
wone
-or .
.  Traceback 3029
pof 3,029
).  The
 at the end of the
a.  The
>and
 DOS
.  The
can be
in the
 "BASE"
 "SPC FIL"
 Traceback 3029
it has
for one
 hour.  At
, all the
4on the
 "cascade" into a pile at the bottom of the
 minute has elasped, the
be restored to its
 "pre-cascade"
 See:   Spanish   Traceback   Traceback II
PZPAPN
Traceback II
:  Traceback II
 2930
 Extinct
, 1988
i; TSR; graphic
M1 hour
R:  2,930
5:   PRA -
, NAV,
, NAV, or
 The Traceback II
is a
of the Traceback (3066)
 It is believed
Traceback II pre
>s the Traceback
 however the Traceback
}and reported
b.  As
the Traceback
, the Traceback II
 and
vboth .
 The comments
qfor the Traceback
generally apply to
 the Traceback II
the exception
pis 2,930
)instead of 3,066
of Traceback II are:
 Traceback II-B:
to Traceback II,
the cascading effect
s, the
not be restored, instead the
be hung requiring it to be powered off and
 See:   Spanish   Traceback   Traceback 3029
PZPAPN
Traveller
00-    R
!PT-
:  Traveller
 Bupt
R:  1,220 - 1,237
5:   PRhAK -
6.60+,
 NAV 3.0A06+,
6.64+,
1.0A06+
 The Traveller
.  It is reported
ated in the
.  Traveller is a
generic
uof .
-and .
 The
Traveller is
X, the
 Traveller
at the top of
$the
, as measured by the DOS
@by 1,840
 the
in high
, as well as
|24 in low
|12's
!moved.
Traveller is
, it
-and .
X.  It
wone
X, or
 a DOS DIR
6is issued.
Traveller
 of 1,220 to 1,237
at the end
 of the
be no
3to the
 and
in a DOS
 Traveller
9the
 "Traveller (C) BUPT
 "Don't  panic I'm harmless <<---
 "*.*
 It is
if Traveller
of Traveller are:
 Traveller-B:
as BUPT-B,
is 1,840
), hooking
|21.  It
-and .
 or one
a DOS DIR
6is performed.
 of 1,220
).  .
 1,223 to 1,238
).  In both cases, the
at the end of the
a.  The
in the DOS
not be
.  The
can be
 all Traveller-B
 "*.*
!--->> Traveller (C) BUPT
.4  Don't p
 Traveller-C:
is 2,032
), hooking
|21.  It
-and .
 or one
a DOS DIR
6is performed.
 of 1,261
).  .
 1,261 to 1,278
).  In both cases, the
at the end of the
a.  The
in the DOS
not be
.  The
can be
 all Traveller-C
 "*.*
!--->> Traveller  (C) BUPT IE
.4  Don't
 panic,I'm harmless
!<<---"
 Traveller-C2:
is a very minor
of Traveller-C, and is
 Traveller-C3:
is a very minor
of Traveller-C, and is
PZPAPN
Tremor
:  Tremor
7(particularly in Germany)
G:  March,
; minor shaking of
 Germany
R:  4,000
5:   PRhEK -
, NAV 3.0+,
3.96+,
30.00+,
6.64+
 The Tremor
in March,
, and is
fGermany.
 Tremor is a
,and .
 It is an "anti anti-
9ing
checks to avoid
 detection by
software.
bTremor
X, the Tremor
at the top of
$the
', hooking
{15 and 21.  If,
 however, upper
or extended
, the
zmost of its
instead,
a hook
 to it in
qby the DOS
@by 4,288
, the
wthe copy of
ed to by the
-SPEC variable.
, the Tremor
X, adding 4,000
)to the
 The
be hidden
Tremor is
 The
at the end of the
a.  The
>and
in the DOS
, but
actually
lhad 100
to the years field
 in the
is the
tmarker for the
 Tremor is an
, and no
 the
the Tremor
[a sluggish
response to
6s and
be detected by the
, but not
Tremor is not in
Tremor
 has
!present on the
for over three months, a slight
 shaking effect of the contents of the
Mmay
 accompanied by a
hang.  The
 clear the
Mand
Mthe
on the
monitor:
 "-=> T.R.E.M.O.R was done by NEUROBASHER
 / May-
'92, Germany <=-
 -MOMENT-OF-TERROR-IS-THE-BEGINNING-OF-LIFE-"
a few seconds, the
to "normal".
 The Tremor
is a full
, dis
are read into
.  As a
 are
Xto check
achecksums/CRCs, or for the presence of
 the
bverifying it isn't in
 not find the
`.  It
checks for the presence of
monitoring
ly, Tremor
 is polymorphic, and an algorithmic approach must be used for
 detection.
PZPAPN
Trident
005    O
PT5
:  Trident
 See
-and/or .
 possible
 The
R:  Depends on
Present
5:   PNRAK-
n1.04+,
2.58+,
6.64+
 The Trident entry represents a group of
were written
 by members of the Trident
writing group in The
es are .
-and/or .
us, and may or may
 not be
.  At least one of the
es in
group,
 Trident 90210, is a
 The
are members of the Trident
]are:
 Trident 90210:
, Trident 90210 is
as the 90210 BH
.  It is a
uof .
,.  Trident
 90210
at the top of
$the
', hooking
 and 21.
, as
 by the DOS
@by 896
, it
 647
be hidden
 the
.  The
at the end
 of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[90210 BH]"
 "John Tardy / TridenT"
 The DOS
indicate
 all
:  The
 Trident-444:
, and
as the
 Servant
, Trident-444 is a
uof .
,.  It
vone .
in the
X.  It
Nnot
on the A:
 Trident-444
pof 444
 the
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "CAVAGUCO4DVSTB"
 "*.CoM"
 "John Tardy / TridenT"
not function
:  The
 Trident-611:
, Trident-611 is
as the Bugfix 1.1
.  It is a
uof .
,.  Trident-611
at the top of
 but
$the
', hooking
{1C and 21.
, as
qby the
 DOS
@by 624
, it
pof 611
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "[TridenT]"
 "{V1.1 Bugfix}"
 "OROiOgOhOaOrOdO OZOwOiOeOnOeOnObOeOrOgO OmOaOdOeO OtOhOeO
 ODOUOTOCOHO-O5O5O5O OVOiOrOuOsO!O!O!O"
 It is
what Trident-611
:  The
 See:   Darkray   Flue
PZPAPN
Trigger
:  Trigger
i; possible beeping
speaker;
R:  2,520 - 2,696
5:   PRtAK -
2.58+,
6.64+,
2.58+,
6.64+
 The Trigger
, and is
 Phalcon/Skism
writting group in the
.  Trigger
 is a
uof .
-and .
,.  It is more or less a proto
uses the
 Dark Angel Multiple Encryptor engine for its encryption, thus
 making it a polymorphic
.  It is the
to use
 engine.
bTrigger
X, the Trigger
at the top of
$the
', moving
|12's
, as
qby the DOS
@by 6,144
mby the
, as well as
 21.  The hooking of
|21 is accomplished using a tunnelling
 technique, so
mapping utilities
not map it to the
the Trigger
, it
accompanied by
 beeping on the
speaker.
pof 2,520 to 2,696
at the end of the
.  The
>and
in the
 DOS
not be
.  The
in the Trigger
 "Trigger by Dark Angel of Phalcon/Skism"
 "Utilising Dark Angel's Multiple Encryptor (DAME)"
 Trigger
Nn't
to do
PZPAPN
:  Troi
G:  March,
; output
 not be written to
input
4may not
 Michigan,
R:  322
5:   PRaCK -
, NAV 3.0+,
.2.0+
 The Troi
}in the state of Michigan in the United
 States in March,
is a
 of .
 The
the Troi
, hooking
Fly in the
be no
qby the DOS
the Troi
, it
X.  If
the Troi
pof 322
at the end of the
a.  The
>and
 the DOS
not to the
>.  The
s in the Troi
 "The Troi
the Troi
may notice
d on the
may not
on the
M, or
output
should be written to
 not actually be written to the
of Troi are:
 Troi-2: Simultaneously
}in Finland and Australia in
 May,
of Troi
May 19,
.  It
 are
X, adding 512
)to the end of the
a.  The
>and
not be
 the DOS
.  One
 the
 ">>>-Troi Two -->"
 The
remap the
it is
 May,
 Troi-2B:
gequivalent to Troi-2, Troi-2B is a very
 minor
 Troi-2C:
gequivalent to Troi-2, Troi-2C is a very
 minor
PZPAPN
TSoft
:  TSoft
 TSoft-547, TurboSoft, TurboSoft-547
seconds set to "62";
 Poland
R:  547
5:   PNCK -
, NAV 3.0+,
 The TSoft, or TurboSoft,
.  It
fPoland.  TSoft is a
uof .
,.  It is
 the
the TSoft
X, the TSoft
wone .
in the
pof 547
at the end of the
a.  The
>and
in the DOS
 not be
the seconds field in the
!set to "62".  The
can be
 the
5in all TSoft
 "TurboSoftware"
 TSoft
a portion of the
of TSoft are:
 TSoft-598: A 598
of the TSoft
vone .
in the
pof 598
).  The
 seconds field in the
in the DOS
be set to "62".  The
can be
in the
5in all TSoft-598
 "\dos"
 "T.Software -Death 1.0"
 TSoft-598
a portion of the
:  Poland
 See:
PZPAPN
Tu-482
:  Tu-482
R:  482
5:   PRhCK -
3.96+, NAV 3.0+,
6.64+,
1.25+
 The Tu-482
, and is
fthe
.  Tu-482 is a
uof .
larger
bTu-482
X, the Tu-482
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 512
|12's
!moved.
the Tu-482
, it
larger
8K in
pof 482
 the
at the end of the
a.  The
 and
in the DOS
not be
.  No
in the
5in Tu-482
 It is
if Tu-482
PZPAPN
:  Tula
 Tula-419
R:  419
5:   PRtCK -
, NAV 3.0+,
.2.0+
 The Tula, or Tula-419,
.  It is
fthe
.  Tula is a
,.  It
Nnot
 all
 The
the Tula
 Tula
at the top of
 but
$the
|12's
 moved.
, as
qby the
 DOS
@by 1,024
 21 and 22
mby Tula in
the Tula
, it
 larger
pof 419
at the
"of the
.  The
>and
in the DOS
to the
>and
 One
in the Tula
 "Tula
.Sat"
of Tula are:
 Tula-417:
as the F-Word or F-You
 is an earlier
of the Tula
 Its
is 1,024
), hooking
 08 and 21.
, Tula-417
by 417
 the
at the end of the
a.  The
>and
in the DOS
to the
.  The
 can be
din all
 "Fuck You!"
Tula-417 may
[difficulties
 executing .
, such as EDLIN.
require
6line input.
 Tula-593: The Tule-593
is a 593
of the Tula
.  Its
is 1,024
 hooking
{08 and 21.
, Tula-593
-and .
 by 593
at the end of the
a.  The
>and
in the DOS
not be
.  One
can be
 at the end of
Tula-593:
 "TR"
Tula-593 may
[difficulties
 executing .
, such as EDLIN.
require
6line input.
 Tula-635: The Tule-635
is a 635
of the Tula
.  Its
is 1,024
 hooking
{08 and 21.
, Tula-635
-and .
 by 635
at the end of the
a.  The
>and
in the DOS
not be
.  No
in the
Tula-635 may
[difficulties executing
, such as EDLIN.
require
6line
 input.
 Tula-1480: The Tule-1480
is a 1,480
of the Tula
.  Its
is 2,048
 hooking
{03 and 21.
, Tula-1480
-and .
for any reason.
by 1,480
by 1,480 to 1,494
 In either case, the
at the end of the
a.  The
>and
in the DOS
not be
.  No
in the
PZPAPN
Tumen
:  Tumen
 Tumen V.5
G:  May,
; music and graphics;
R:  1,663
5:   PRhCK -
, NAV,
.2.0+
 The Tumen, or Tumen V.5,
Vin May,
ated in the
.  It is a
uof .
bTumen
X, the
at the top of
 but
$the
, as measured by the DOS
 by 4,096
{09 and 21
mby the
Tumen is
, it
X.  If
X, it
 of 1,663
at the end of the
a.  The
>and
in the
to the
>and
 The
in the Tumen
 "Full moon tonight... The
of Wolfbacks... U...U...U...
demonstration
, but you hear
howl."
 "(C) Copyright MMA Company
 All rights reserved.
Tumen
-v0.5
was created in Tumen by group of
 three Wolfbacks at
 General
`affecting effects by Max
 Main consultant -- Tall Lazy Micle
 General  Music_&_Video  harmless  effects by Alex
 BACKWOLFS OF THE WORLD, UNITE!!"
 The
bset of
s near the
"of the
the remaining
at the end of the
 Tumen
should produce graphic and musical
 effects upon
event
ring.
of Tumen are:
 Tumen V1.2:
, Tumen V1.2 is a later
of the Tumen
pof 1,255
at the end of the
a.  The
>and
in the DOS
to the
>and
 Tumen V1.3:
, Tumen V1.3 is a later
of the Tumen
pof 1,242
at the end of the
a.  The
>and
in the DOS
to the
>and
 The
can be
in the
5in all Tumen V1.3
 "Tumen.,v1.3"
 Tumen V2.0:
in May,
, Tumen V2.0 is a later
of both Tumen and Tumen V1.2.  In addition
 to the behavior of the
modify the C:
is present.
 It adds 1,092
)to the .
 The
can be
din all
 "Be carefull... Hackers
tonight...
present was created in Tumen in
 v 2.0. (c) Max Soft corporation
 Hackers of the work, Unite!"
Tumen V2.0 may
 May,
PZPAPN
Turbo
:  Turbo
 Turbo 448, @
, Turbo @, Polish-2, Nagytud
anot
utilities
 Hungary
R:  448
5:   PRCK -
, NAV,
 The Turbo, or Turbo 448,
Gin Hungary in
is a
 The
the Turbo
X, the
at the end
 of the
6Interpreter in
mby the
 The Turbo
is unusual in
Nnot
X.  Instead, it
 are
reason
Z.  For example,
 if the
-is copied to B.
 both
rby the
by 448
at the end of the
a.  The
in the
to the
>and
awas
r.  The
can be
dat the end of all
 "Udv minden nagytudasunak! Turbo @"
interesting behavior of
products
are unaware of the
 Turbo 448's presence in
not function
 the third
ais read, the
may fail due to a "
to open the fourth
of Turbo are:
 Turbo Kukac:
Gin Hungary in
is a
uof .
,.  It
cthe
6interpreter and any
loaded TSRs, decreasing
by 1,040
 and 21 are
mby the
.  Turbo Kukac
for a reason
by 512
at the
 end of the
a.  The
in the DOS
.  The
can be
 in all
 "Turbo Kukac 9.9"
:  Hungary
PZPAPN
Turn.557
:  Turn.557
, 1994
R:  557
5:   PRhCK -
/2.1+,
\2.13+,
6.64+,
.2.0+,
1.25+,
6.64+
 The Turn.557
, 1994.  Its
.  Turn.557 is a
 The
the Turn.557
X, the
at the top of
$the
', hooking
, as
qby the
 DOS
@by 1,632
, the Turn.557
pof 557
 at the
"of the
a.  The
>and
in the
 DOS
to the
>and
.  No
in the
PZPAPN
Tver-308
:  Tver-308
R:  308
5:   PRaCK -
3.96+,
1.25+
 The Tver-308
.  Its
.  Tver-308 is a
uof .
bTver-308
X, the Tver-308
in a "hole" in al
, hooking
|21.
, as
qby the DOS
not be
the Tver-308
, it
pof 308
 end of the
a.  The
>and
in the DOS
to the
 and
.  The
in the
5in all Tver-308
 "G.J.V. Tver
PZPAPN
Twin Peaks
:  Twin Peaks
&failures;
 Australia
R:  1,310
5:   ONCK -
6.64+,
Bhidden
 The Twin Peaks
fAustralia in
 Twin Peaks is a
the Twin Peaks
wone .
on the C:
O.  The
Mthe
, and
to the DOS prompt:
 "Welcome to Twin Peaks..
 Your PC now has the Twin Peaks
the Twin Peaks
lthe
 1,310
be no
3to the
>and
in the DOS
.  The
`, as are
 the
 "*.com*"
?com\"
?exe
?com"
 See:  VirDem
PZPAPN
Twin-351
:  Twin-351
-351, Twin
`created
& hidden attributes; TSR
R:  351
5:   SRsA - Spawning
, NAV,
Bhidden
 The Twin-351
.  Twin-351
 is a
spawning
.  It
 creating a corresponding .
Yin place
 of the .
 The
Twin-351 is
X, Twin-351
as a low
TSR of
 656
mby the
, Twin-351
X.  Instead of altering the .
a, Twin-351 creates a
 351
corresponds to the
of the .
a.  For example, if the
YABC.
W, Twin-351
create ABC.
5.  The 351
`created by the
 the hidden and
attributes set so
`are not
in the
 As a
of the hidden .
a, the Twin-351 .
 If Twin-351 is already
, it
 corresponding .
a.  If Twin-351 wasn't already
 Twin-351
hide the hidden
`if the
Twin-351 in
PZPAPN
Twister
:  Twister
 Twister.451
, 1994
R:  451
5:   PRhCK -
/2.1+,
\2.13+,
6.64+,
V117+,
.2.0+,
1.25+,
6.64+,
V117+
Bhidden
 The Twister or Twister.451
, 1994.  Its
.  Twister is a
uof .
bTwister
at the top of
 the
', not moving
|12's
 and
, as
qby the DOS
@by 1,408
 the
, Twister
pof 451
at the
"of the
a.  The
in the
 "Twister (c)
 The Twister
is unable to determine
it has
a, as a
be re
rby the
, adding an
5can be
dat both the
"and the end
 of the
of Twister are:
 Twister.863:
, 1994, Twister.863 is an 863
of the Twister
.  Its
is 2,208
), hooking
|21.
X.  Like the
, it cannot
 recognize prior
ts of
`, so it
Twister.863
pof 863
)for
tpresent on a
a.  The
at the
"of the
a, as well as
 the end of the
ain the case of re
`.  The
>and
in the DOS
to the
>and
.  The
can be
in the
 "Twister (c)
 Unlike the
of the
 prevent the
fviewing the
, 1994.
 Twister.1015:
, 1994, Twister.1015 is an 1,015
of the Twister
.  Its
is 2,528
), hooking
{21 and
 24.
X.  Like the
, it cannot recognize prior
ts of
`, so it
Twister.1015
pof 1,015
)for
tpresent on a
a.  The
at the
"of the
a, as well as the end of the
ain the case of
`.  The
>and
in the DOS
to the
>and
 The
can be
in the
 "Twister (c)
 "C:\
of the
adds the ability to
 copy of
in the C:
Oroot
X.  Twister and
 Twister.863 did not
ability.
, 1994.
 Twister.1767:
, 1994, Twister.1767 is
 Twister.1015.  Its
is 4,032
), hooking
{08, 09, 10, 1C, and 21.
X.  Like the
, it cannot recognize
 prior
ts of
`, so it
 Twister.1767
pof 1,767
)for
tpresent on a
a.  The
at the
"of the
a, as well as the end
 of the
ain the case of re
`.  The
>and
in the DOS
to the
>and
.  The
can be
in the
 "Twister"
 "C:\
 "We are demons to
, angels to
 "So Far... So Good... So What?"
 "Children of the Damned"
heals all wounds"
 it may starting scrolling the
fleft to right,
 typing out
on the
M.  Like Twister.1015,
vthe copy of
in the C:
Oroot
, 1994.
PZPAPN
Typo
:  Typo
 Mistake
, 1989
 BSC;
-TOM; garbled printout
 Israel
R:  N/A
5:   BRt -
, NAV,
\, NAV, CleanUp, or DOS SYS
 The Typo
}in Israel by Y. Radai in
, 1989.
is a
 taking up 2K at the upper end of
it has
 The major symptom
be noticed on
 Typo
certain
4in printouts are always
 replaced
phonetically
4.  Since the
substitutes Hebrew letters for
Hebrew letters, the
was most likely written by
one in Israel.  Digits in
 numbers may
be transposed or replaced
numbers.  The
 substitutions impact printouts
, the
Mand data in
`are not affected.
 The Typo
structurally to the Ping Pong
 and may be a
of Ping Pong.  It can be removed
 by using M
K, CleanUp, DOS SYS
6, or just about any Ping
 Pong dis
PZPAPN
Typo
:  Typo
 Fumble, 867,
, 712, Typo-712
 Extinct
, 1989
-TOM; garbled printout (see
 England
R:  867
5:   PRtC -
, NAV,
\, or
 The Typo
to the Typo
garble data
is sent to the parallel port
it has
 activated.  Unlike the
, the .
vgeneric
breported by Joe Hirst of Brighton,
 UK, in
, 1989.
 The Typo
`on even-numbered days.
of Typo
-are:
 Typo-712: Typo-712 is a 712
of the Typo
vall .
`in the
X, adding its
5to the end of the
a.  Its
 portion is 224
and hooks
|16.  It
 may intermittently interfer
input.
 Typo-867B: Typo-867B is a minor
of the
Typo
.  It
vall .
`in the
X.  It
 a 480
*TSR
hooks
|16.
pof 867
at the end of the
 May,
PZPAPN
:  Tyst
`truncated to 3,424
>set to 4-04-92;
R:  3,424
5:   ONAK -
V112+,
 The Tyst
.  Its
.  Tyst is a
W, and .SYS
the Tyst
X, the Tyst
copy the
s of the
 the C:\DOS
Eto the
E.  The
 the
9the
 but instead of pure copy of the Tyst
of 3,424
).  The
>in the DOS
Eof 4-04-92.  The
be set to the
 zero
-SPEC, may
be created in the
 The Tyst
Ms the
ever an
 "Tyst f
r fan.. Jag spr
nger!"
%the
, the
can be
 the
5in all Tyst
 "C:\DOS\*.*"
-SPEC"
 "/C copy"
 "NUL"
 "RoTh"
PZPAPN
UFA-1201
:  UFA-1201
R:  1,201
5:   PNCK -
 NAV 3.0+,
 The UFA-1201
, and is
fthe
.  UFA-1201 is a
the UFA-1201
X, the
 UFA-1201
wtwo .
in the
 1,201
at the end of the
 The
>and
in the DOS
 not be
.  The
in the
 UFA-1201
 "*.com"
 It is
what UFA-1201 may do
PZPAPN
:  Ugur
 Mumcu
 Turkey
R:  1,297 - 1,313
5:   PRhAK -
30.00+,
n1.04+,
6.64+,
1.25+
 The Ugur
}in Turkey in
.  Ugur is a
uof .
-and .
,.  It "commemorates" turkish journalist Ugur Mumcu whom
 passed away in early
bUgur
X, the Ugur
at the top of
$the
', hooking
|21.
 and
, as
qby the DOS
not be
|12's
not be moved.
the Ugur
, it
for any reason.  .
the Ugur
pof 1,297
).  .
by 1,301 to 1,313
).  In both cases, the
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the
5in all Ugur
 "UGUR MUMCU
LMEDi.."
turkish phrase translates roughly to:
 "Ugur Mumcu has not died"
PZPAPN
Ultimation
:  Ultimation
G:  March,
2; hidden
 starting
"_" created;
R:  23,802
5:   ONE -
n1.04+,
V112+,
V113+,
6.64+,
1.25+
 The Ultimation
in March,
.  Ultimation is
`.  Unlike most
one saves a copy of
 the
the Ultimation
X, the
 Ultimation
wone .
in the
E.  The
bmakes a copy of the
bcharacter of the base
1to "_", and
 sets the hidden attribute.  The
s the
 23,802
)of the host
5.  .
 larger
23,802
p, while
 those
smaller
23,802
 23,802
.  The
>and
in the DOS
value.  The
 can be
in the
5in Ultimation
 "PATH *.
 "I'm bored."
 "Screw you."
 "Life is a drag."
 "kufc fof."
 "Ouch! Don't hit me so
 "Floppy
OA: is flooded. Please insert J cloth."
 "Murderer."
 "You
rby ULTIMATION corp."
 "Go
Fly to jail. Do not pass go. Do not collect $200."
 "Ah ha! Caught you."
 "Copy protection
U23. Please re-
, one of the
may be
Las a
, possibly accompanied by
hang,
 To dis
tof the Ultimation
, and
remove the hidden attribute
 the .
acopies
start
the "_" character.  The
need to be re
d so
bcharacter of the
is restored to its
value.
PZPAPN
Under 7
:  Under 7
 Paradise
R:  320
5:   PRaCK -
30.00+,
n1.04+,
6.64+,
1.25+
 The Under 7
.  Under 7 is a
uof .
bUnder 7
in low
, hooking
|21.  It
access the
 and a
hang may
the Under 7
, it
pof 320
at the end
 of the
a.  The
>and
in the DOS
to the
>and
.  One
can be
dat the end of
 the
5in all Under 7
PZPAPN
UnExe
:  UnExe
R:  425
5:   PNCK -
 NAV 3.0+,
30.00+,
n1.04+,
6.64+
 The UnExe
.  UnExe is a non-
uof .
,.  It
the UnExe
X, the
 UnExe
wone .
in the
E.  If
E, it may
 of 425
at the end of the
 The
>and
in the DOS
to the
>and
.  The
in the UnExe
5in all UnExe
 "Viru"
 "1 /M"
 The UnExe
Bone .
in the
PZPAPN
:  Unk
G:  March,
=s corrupted
R:  1,015
5:   PRhAK -
, NAV,
 The Unk
.  Its
~are
.  Unk is a
-and .
bUnk
X, the Unk
at the top of
 but
$the
, as
qby the DOS
@by 3,008
the Unk
, it
for any reason.
 The
hides the
`, so
 it is not noticeable to the
the Unk
pof 1,015
at the
 end of the
, adding an
1,015
 The
>and
in the DOS
Emay
 to be corrupted.  One
can be
in the
5in Unk
 "(c)
Szegedi & Farmosi Kiss."
 It is
what Unk
PZPAPN
Urfydus
:  Urfydus
G:  May,
i; TSR
 Italy
R:  2,638 - 2,653
5:   PRsAK -
, NAV 3.0+,
 The Urfydus
}in Italy in May,
 is a
uof .
-and .
,, but not very small .
-and .
.  Its
 is italian, and translates to "Nasty" in english.
 The
Urfydus is
as a low
 TSR of 3,152
), hooking
{21, CC, and F8.
Urfydus is
, it
-and .
X.  If the
fa write protected
J, the
attempt
wthe
ing in the
hanging while it
to write to the write protected
Urfydus
 of 2,638 to 2,653
).  The
at the end
 of the
a.  The
>and
in the DOS
.  The
can be
in the
5in all
 "C:\SYSTEM\
,MMAND.
 It is
what Urfydus
PZPAPN
Uruguay
:  Uruguay
 Uruguay 3
j; music;
 Uruguay
R:  2,552 - 2,637
5:   PRhA -
 The Uruguay, or Uruguay 3,
 and is
fUruguay.  Uruguay 3 is a
-and .
, but not
,.  Uruguay 3 and the
 later
s of
are polymorphic, using a complex
 encryption mechanism to complicate
ability to be detected by
products employing
ning technology.  An algorithmic
 approach is required to detect
the Uruguay 3
X, the
 Uruguay 3
at the top of
$the
, as
qby the DOS
@by 5,120
|mapping
 indicate
many
use both
|13 and 21 via a tunnelling technique.
the Uruguay 3
, it
 and .
pof 2,552 - 2,637
at the end of the
a.  The
>and
 in the DOS
not be
.  The
in the
Uruguay 3
notice slow response to
6.  The
s be
 accompanied by tones on the
speaker.
 "'Uruguay-#3'
med in Montevideo (URUGUAY) by F3161. 06/92
is a research
- DO NOT DISTRIBUTE"
is not
`as it is
of Uruguay are:
 Uruguay 4:
on the Uruguay 3
 Uruguay 4's
is 5,456
).  It adds
 2,718 to 2,859
)to the .
-and .
Zand
aopen for read-
.  The
Lby the
accompanied by a tune on
 the
speaker is:
 "'Uruguay-#4'
med in Montevideo (URUGUAY) by F3161. 07/92
is a research
- DO NOT DISTRIBUTE"
:  Uruguay
 Uruguay 5:
on the Uruguay 4
, Uruguay 5's
is 8,352
of Uruguay
at all, but stays
 the
presses CTL-ALT-DEL:
 "'Uruguay-#5'
med in Montevideo (URUGUAY) by F3161. 08/92
is a research
- DO NOT DISTRIBUTE"
 As Uruguay 5
Nnot
, it is
included
 here for
xal purposes, and is not used for
product testing.
:  Uruguay
 Uruguay 6:
on the Uruguay 5
 Uruguay 6's
is 9,504
).  It adds
 4,879
)to the .
-and .
Zand
aopen for read-
.  The
pis hidden
Uruguay 6 is
.  The
 DOS
detect
 all
Uruguay 6 is in
.  The
Lby the
accompanied by a tune on
 the
speaker is:
 "'Uruguay-#6'
med in Montevideo (URUGUAY) by F3161. 11/92
is a research
- DO NOT DISTRIBUTE"
:  Uruguay
PZPAPN
Uruk-hai
:  Uruk-hai
R:  394
5:   PRxCK -
3.96+,
.2.0+,
1.25+
 The Uruk-hai
, and is
.  Uruk-hai is a
uof .
-progams,
bUruk-hai
in a "hole" in low al
, hooking
|21.
, as
qby the DOS
not be
the Uruk-hai
, it
X.  If
X, it
the Uruk-hai
pof 394
at the end of the
a.  The
>and
in the
 DOS
to the
>and
.  The
can be
in the
5in all Uruk-hai
 "V 1.0 Igor,
The Uruk-hai are upon you!"
of Uruk-hai are:
 Uruk-hai 300: A 300
of the Uruk-hai
resides in a "hole"
 in al
, hooking
|21.  It
X, adding
 300
.  The
 the end of the
a.  The
>and
 the DOS
 to the
>and
.  The
can be
in the
5in all Uruk-hai 300
 "Igor
v.2.0 The Uruk-hai and winged Nazgul
 strikes again!"
 Uruk-hai 361: A 361
of the Uruk-hai
 at the top of
$the
', moving
|12's
 and
, as
qby the DOS
@by 1,024
mby the
.  It
X, adding
 361
.  The
 the end of the
a.  The
>and
 the DOS
 to the
>and
.  The
can be
in the
5in all Uruk-hai 361
 "Igor
v.3.0 It was last assault of the Uruk-hai...
 We shall meet in Valhalla!"
PZPAPN
 damage;
j; long
load
R:  576
5:   PNE -
, NAV 3.0+,
 The
in the
.  It is
generic
uof .
X, it
search the
Efor the
a.  If it finds one, it
attempt to
wit.
a, it
hang the
 leaving the
Olight on, however most of the
 successful.
by 576 to 586
at the end of the
may go to
 its
to find
!removed, and the
) has
 damaged, thus rendering the
Kinaccessible.
damage can
 be repaired  using Norton
KDoctor, or M
the /P option.
[longer
normal load
X.  The longer
normal load
is due to the
searching for a
w, and
sthe candi
aif one was
PZPAPN
 V-311,
-311, Com2Con
d to
-MAND.CON
R:  311
5:   PNCK -
/, NAV,
 The
311, or V-311,
.  It
ated in the
is a
311 is
X, the
 check the
to see if the seconds value is equal to one
 of 16 values.  If it was equal to one of those 16 values,
be re
d to
-MAND.CON.  Whether or not the
, the
in the
by 311
), the
at the end of the
a.  The
in the
be modified to be 11:19:32,
 the
tmarker for
.  The
>in the
Eis not
alter the
aattributes for the
ain the
E.  In particular, bits 8 through 15
be reset,
 may produce unexpected
s in en
ments
make use of
bits.
PZPAPN
-492, RC492, 492
R:  495 - 508
5:   PRfCK -
\, NAV,
 The
and is
is a
u, it
492 is
X, the
in high
 but
$the
is not reserved by
 the
mby the
.  At the
 of going
, the
check to determine if
,on the C:
r, if it isn't,
492 is
, it
wany .
,on the A:
Ois the
way to
,on A:.
 495 to 508
).  The
at the end of
>and
 the
1to the
>and
Nnot
to do
PZPAPN
 Leapfrog, V516, 516
R:  516
5:   PRCK -
\, NAV,
 The
.  It is
is a
uof .
,.  It
 The
X, the
in a "hole
" between MSDOS and the DOS Stacks.
area
 labeled DOS Data.
mby the
be no
, it
had an
 greater
pd by 516
), the
at the end
 of the
Nnot
to do
.  The
sample was not a natural
, so
may be a research
PZPAPN
-600, V600, 600
R:  600
5:   PRhCK -
\, NAV,
 The
, and is
is a
uof .
600 is
X, the
at the top of
$the
'.  The DOS
indicate
 are 2,048
)less
expected.
Nnot move the
600 uses
{21 and 24.
600 is
, it
of at least
 600
by 600
), and
 the
at the
"of the
 It is
PZPAPN
-707, V707
R:  707
5:   PRtCK -
, NAV,
 The
.  It is
is a
uof .
at the top
$the
'.  It
move the
cannot be
707 makes use of
|21,
 map to the
in high
be 720
)less
expected.
707 is
, any .
rby the
pof 707
), the
at the
 end of the
a.  If
X, it
 It is
PZPAPN
-711, 699, V711-2
R:  704 - 719
5:   PRhC -
\, NAV,
 The
, and comes
 the
is a
uof .
Nnot
711 is
X, the
at the top of
$the
is reserved.
 The
hooks
{08, 13, and 21.  The DOS
indicate
is 704
)less
what the
expects.  The
is not
711 is
, any .
had an
of at least 1600
rby the
 by 704 to 719
), and the
at the end of
 the
711 may notice occasional
 It is
 occasionally hang the
PZPAPN
-948, V948, 948
R:  948
5:   PRhA -
\, NAV,
 The
, and
 in the
is a
uof .
`, and
948 is
at the top of
$the
'.  The
not be
in use by the
 reserved.
{1C and 21
mby the
948 is
, and .
-or .
for any reason
rby the
the exception of
by between 950 to 963
).  In the case of
,, the
a portion of the stack space
in the
a, so the
3.  In
 all cases, the
>and
s in the
Eare not
lthe
at the end
 of the
 It is
PZPAPN
 1014
R:  1,014 - 1,028
5:   PRhA -
3.96+,
n1.05+,
.2.0+,
2.58+
 The
1014, or 1014,
.  It is
fthe
1014 is a
 of .
-and .
,.  It
smaller
 The
1014
at the top
$the
, as
qby the DOS
@by 1,040
{10, 21, and 60
1014.
, the
1014
-and .
pof 1,014 to 1,028
 at the end of the
a.  The
>and
in the DOS
not be
.  No
in the
 The
1014
alter .
smaller
, adding 2 to 30
)to the
`are not
r, and
continue to function
PZPAPN
 RCE-1049, 1049
 and
R:  1,049
5:   PRhA -
, NAV,
 The
1049
.  It
 in the
is a
uof .
`, and
Nnot
1049 is
X, the
at the top of
$the
be 1,056
and is reserved.  The
is not
 moved.
mby the
1049 is
, the
X.  The
, however,
wvery small .
 by 1,051 to 1,064
), the
at the end of
 the
1049 is unusual in
5to support a
5via a special
|21 call
 the
5may
!used by
 the author
developing the
to stop it
1049
 occasionally
actually be
1049
Nnot do
 See:   Alfa
PZPAPN
 V2144, 2144,
2144-B
R:  2,144
5:   PRhAK -
\, NAV,
 The
2144
, and is
 the
is a
uof .
2144
X, the
at the top
$the
'.  The DOS
indicate
values
show 4,608
)less
expected.
Nnot move the
.  The
Fly alters the
|page in
Ythe
2144 is
, and
greater in
 reason
rby the
by 2,144
).  .
by 2,144 to 2,159
).  In both cases, the
at the end of
>and
in the
 and
Nnot hide the
 It is
2144
2144 are:
2144-B:
in March,
gequivalent to the
.  The
' encryption has
!slightly modified.
PZPAPN
:  V-1n
 V-10, V-11
G:  May,
R:  113 or 624
5:   ONCK -
 The V-1n group of
es was
in May,
 group's
.  The
es in
entry are earlier
s of the
Cin the  V-3n  entry.  Unlike the
Cin the V-3n entry, the
Chere
 are
es.  The earliest of the
es, V-10,
entry,
member of the group
$.  Both of the
es in
entry
the V-10
wthe third .
in the
b624
)of the
.  The
ed to the DOS prompt.
%having the
b624
)of the host
5of the V-10
>and
in the DOS
 to the
>and
.  If the host
smaller
), it
 628
larger
p.  The
can be
in V-10
 "V -
 V-10
Nn't do
, destroying the host
Member(s) of the V-1n group of
es are:
 V-11: A later
of the V-10
s the
b113
)of the .
v.  The
in the
 "V -
1.1".
 May,
 See:   V-3n
PZPAPN
:  V-3n
 V-30, V-31, V-32
i; seconds in
set to 00
R:  268
5:   PNCK -
.2.0+
 The V-3n
es was
.  The earliest of the
es, V-30,
entry,
]members
$under
.  All of the
es in
]are
us of .
V-30 is
X, the V-30
wone
in the
E.  If
,resides in
E, it
 may
V-30
 268
).  The
at the end of the
 The seconds in the
in the DOS
 be set to "00",
is the marker the
uses to determine
 if the
ais already
r.  The
din all V-30
 "*.com V -
 V-30
Nn't do
Members of the V-3n
es are:
 V-31:
to the V-30
adds 266
 to the .
v.  The
is now:
 "*.com V -
3.1".
 V-32:
to the V-30
adds 274
 to the .
v.  The
is now:
 "*.com V -
3.2".
 See:   V-1n
PZPAPN
V270x
:  V270x
 268-Plus
G:  May,
R:  268 - 272
5:   PNC -
 NAV,
 The V270x
Vin May,
.  V270x is
uof .
`.  It
V270x is
X, the
wup to five .
in the
E.  The
by 268
).  The
 second
pby 269
).  The third
 through fifth
by 270, 271,
 and 272
), respectively.  In all cases, the
at the
.  The
 and
in the
not be
 V270x
s to not do
PZPAPN
:  V351
 V-351
fail to function
R:  351
5:   PRhCK -
 The V351, or V-351,
.  Its
.  V351 is a
uof .
bV351
X, the V351
at the top of
$the
', hooking
|21 at
 address 7D00.
|12's
!moved.
the V351
, it
pof 351
at the end
 of the
a.  The
>and
in the DOS
not be
.  One
in the
5in V351
the V351
fail to
 function
PZPAPN
:  V388
 V-388
R:  388 - 403
5:   PRhCK -
3.96+, NAV 3.0+,
1.25+
 The V388, or V-388,
, and is
fthe
.  V388 is a
uof .
,.  It is not likely to
 a serious threat
 in its present form.
bV388
X, the V388
at the top of
$the
', hooking
|21.
, as
qby the DOS
@by 102,400
|12's
!moved.
the V388
, it
pof 394 to 403
at the end
 of the
a.  The
>and
in the DOS
not be
.  No
in the
5in V388
the V388
[frequent
PZPAPN
:  V483
R:  483
5:   PRAK -
 The V483
.  Its
.  V483 is a
uof .
-and .
V483 is
becoming
wthe next .
-or .
X, it
r.  At
, the
 hung
has completed
sthe
V483
 483
).  The
at the end of the
.  The
>and
in the DOS
to the
>and
.  V483
hex "FF"
4, thus permanently corrupting them.
usually not
PZPAPN
:  V651
 Eddie 3,
 Sofia,
R:  651
5:   PRtA -
, NAV,
:  CleanUp, or
 The V651, or Eddie 3,
}in Sofia,
by Vesselin Bontchev.  V651 is believed to
 written by the same author as
<, V1024, and V2000.
is a generic
ufor .
-and .
 The
V651 is
X, the
.  Using the DOS
, as well as
@by 688
 Later, as
of 651
)or greater are
rby the
by 651
not be seen by performing a
 present in
. The
Kspace
 adjusted by the
Kspace
 due to the
's activities cannot be seen.  Powering off the
&ing
clean
J, followed by
 issuing a
in the correct
Las well as the actual
space
 on the
`can be easily identified as the
"Eddie
 Lives."
s near the end of the
be 651
)longer
expected
is not
 present in
 A side effect of the V651
lost clusters may
if the
6is used.  While
 not
for all
`, the number of
Treported by
be much higher statistically
V651 is present.
 Unlike
<and V2000,
Nnot
 any
aopen.  It
 See:   Alfa
<  V1024   V2000
PZPAPN
:  V800
 Live
Death
G:  May,
R:  800
5:   PRC -
\, NAV,
:  CleanUp,
\, or
 The V800, or Live
Death,
 Vesselin Bontchev in May,
.  The V800 is a self-encrypting
u, and it
Nnot
t to
!written by the same person as
 the
since many of the same techniques are used.
 The
of the Live
Death
 the
8the "Live
Death"
it cannot
 be seen in
`as the
 The
is run on a
, the V800
.  In the process of
zing
, it
by 16K, using 8,192
)for
in the top of
.  It
hook
, every
ais attempted to be
 the
check to see if it is a candi
>for
 Whether the
rdepends on the
of the .
it is attempted to be
X.  In no event is a .
asmaller
1024
r, but not all .
`over
 1024
)are
reither.
 The V800
 increasing by 800
t.  It
Nnot, however,
`more
eight
of V800 are:
 V800M: Very
to V800, the major difference is
V800M
`on both
aopen and
 putting
into the "
category.
 the
8,192
 not
lthe "Live
Death"
in it.
PZPAPN
:  V801
 V791, V-801, 805
G:  March,
R:  791
5:   PNAK -
, NAV,
:  CleanUp, or
 The V801
in March,
fthe
is a
uof .
.  It
V801 is
X, the
 search the
Efor an
.  If
 one is
d, it
wthe
.  If an
is not
d, the
search for an
in the
E, and
V801
by 791 to 808
).  .
lthe
".  .
lthe
at the end of
 the
a. The
>and
in the
not be
may cause a
hang
 attempted to be
 V801
Nn't
to do
PZPAPN
:  V82
aalternation;
R:  2,000
5:   PRhAK -
\2.13+,
 The V82
.  The
 submitter
awas
(.  V82 is a
uof .
-and .
, and
 internally
, but not actually
9a replicating copy
 of the
 The
V82 is
X, the V82
at the top of
$the
, as
qby the DOS
@by 8,192
|12's
 moved.
mby the
.  It
za 48
*portion in low
, V82
either
wor alter .
-and .
 In the case of .
over 2,000
at the end of the
rmany
s as the
Nnot recognize the already
it is later
Xby the
by 2,000
tof the
on the
a.  V82
wor alter .
`smaller
2,000
rby the
 fairly large, and
usually not
lany
 the
part of the host
.  In most .
`, however, the
not actually
wthe
abut
a portion of the
9ing 00h
4, thus
 altering it.
5may actually be a trojan if it is
 by the host
 It is
what V82
 See:   Phoenix   Phoenix 2000
PZPAPN
V1024
:  V1024
<III,
, Diamond, 1024
G:  May,
 TSR;
R:  1,024
5:   PRA -
, NAV,
 The V1024, or
<III,
by Daniel Kalchev.  V1024 is a
generic
uof .
-and .
`.  It is believed to
 written by the same person
wrote
<and V2000.
may actually be an earlier
of the
 it has many of the same characteristics,
Nnot
 all
for any reason.
 The
V1024 is
X, the
.  At
, it checks to
 see if several
{are
#monitored,
 1 and 3.  If
{1 and 3 are monitored, V1024 allow the
to run, but any subsequent
 hang the
and V1024
V1024 is
by 1,072
 The
lremapped several
{by altering
 location in the
|map page in
now be controlled by V1024.
V1024
, the
is greater in
1,024
).  Both
-and .
`are
,is not
by 1,024
if the
is present in
and a
 DIR
is done.
 V1024
`can be identified by a
s very close to the end of
`.  The
 is: '7106286813'.
 V1024
Nnot
9any
of V1024 are:
 Diamond:
to V1024, Diamond's main difference is
at the top of
$the
, and
, as measured by the DOS ChkDsk
Aby 1,072
{08 and
mby the
 Diamond-B:
to Diamond,
!slightly
to avoid detection by
 See:   Alfa
<  Diamond   V651   V2000   Ah   Damage
PZPAPN
V2000
:  V2000
<II,
, Travel
, Eddie 2000,
 Apocalypse II
G:  1989
 TSR; .
W, .OV?
i(see
); crashes;
 cross-linked
R:  2,000
5:   PRA -
, NAV,
:  NAV, or
 The V2000, or
<II,
is a
generic
u.  The
}samples of
(, where it was
}by Daniel Kalchev and
 Niki Spahiev.
 V2000
W, and Overlay
`, as well as
X, the
, and
 it has not already
an execu
for any reason, it is
rif it hasn't
not be shown if the V2000
 present in
a DIR
6is issued.  Issuing a
in cross-linking of
 since the
xmay not
to match the entries
 in the
(FAT).
the V2000
[unexpected
crashes,
ing in lost data.
&able due to the modification of
,or the
 hidden
 One of the
ctwo
in the
`, thus accounting for the
of Travel
 used in
 "Zopy me - I want to travel"
 "Copy me - I want to travel"
are reports
the V2000
looks for and
jthe
written by Vesselin Bontchev are
 attempted to be
would explain the presence of the
ccopyright notice
in the
 "(c) 1989 by Vesselin Bontchev"
of V2000 are:
 V2000-B: (Die Young)
to the V2000
, the main
 difference is
"Zopy me - I want to
 travel" is now "
the Good die young..." or "Mnly the
 Good die young..." and the encryption used by the
 different.
is actually the
 predating V2000.
 Apocalypse II: Apocalypse II was
Vin May,
.  It is
to V2000 and V2000-B, the
 major
it no longer crashes
 the
, and the
"Zopy me - I want
 to travel" is now "Apocalypse II begin!!".
modifies the
, but not
wious copy of the
 See:
<  V651   V1024
PZPAPN
V2100
:  V2100
 2100,
R:  2,100
5:   PRtA -
, NAV,
:  NAV, or
 The V2100, or 2100,
}in Sofia,
 Vesselin Bontchev in
.  It is a
generic
 of .
W, and overlay
`.  It
s to
released into the public
 domain on an
was uploaded to a
 BBS in
V.  While not all copies of U
are carriers of
was one
exists
has the
 embedded in its
5.  The
cannot be detected on
 Trojan
using search algorithms for
.  V2100 is
 believed to
!written by the author of
 The
V2100 is
X, the
top of
 the
'.  The top of
ed by
 be lower
expected by 4,288
).  Likewise,
@by 4,288
).  At
same
, V2100
be hidden
 by the
, it
wany .
 or overlay
of at least 2100
for any reason.  The simple act of copying an
 execu
in both the source and target
 becoming
be 2,100
)longer,
hide the
 isn't noticeable
Fories are listed.  In
cases,
to be 2,100
)smaller
expected
 if the
is present in
the V2100
notice
ring, along
cross-linking of
`.  Due to
`may
 corrupted.
Tare truly
exist whether or not the
 present in
 A side note on the V2100
: if the
the Anthrax
, V2100's introduction
 in the Anthrax
again
#present in the
effect
s because Anthrax stores
 a copy of
on the last
of the
V2100
, it searches the last 16 cylinders of the
 for a copy of Anthrax.  If V2100 finds the hidden copy of Anthrax, it
 copies it into the
.  On the next
fthe
K, Anthrax
again be active on
 the
PZPAPN
:  V2P2
 Chameleon
 Research
 Minnesota,
R:  1,426 - 2,157
5:   PNCK -
, NAV,
1.25+
 The V2P2
is a research
written by Mark Washburn and
 distributed to
authors in
, according to its author, has not
!released.
is a
generic
uof .
the V2P2
X, it
wthe
ait finds in the
 is not
.  The
adds its
5to the end
 of the
a, and the
pbetween
 1,426 and 2,157
 Like the 1260
uses a complex encryption method.
 In fact, the encryption used
the 1260
is one of several
 possible encryptions
V2P2 may produce.  As a
ning software
often identify the 1260
in a
#both 1260 and V2P2.
identification is entirely valid as
 1260 is a special case of V2P2.
 See:   1260   Casper   V2P6
PZPAPN
:  V2P6
 Research
 Minnesota,
R:  1,946 - 2,111
5:   PNCK -
, NAV,
1.25+
:  NAV, or
 The V2P6
is a research
written by Mark Washburn and
 distributed to
authors in
, according to its author, has not
!released.
is a
generic
uof .
 the 1260 and V2P2
the V2P6
X, it
wthe
ait finds in the
 is not
.  The
adds its
5to the end
 of the
a, and the
pbetween
 1,946 and 2,111
 Like the 1260 and
es by Mark Washburn,
uses a
 complex encryption method.  The encryption method used by V2P6 is
 more complex
used in V2P2, but less complex
 used in the last
], V2P6Z.  Like V2P2, an
 algorithmic approach must be used to identify
of V2P6 are:
 V2P6-B:
to V2P6 in behavior,
by 1,990 to 2,261
 V2P6Z:
to V2P6 in behavior,
is the last
]to be
by researchers.  It
 employs a more complex encryption algorithm requiring an
 algorithmic search to identify
`.  V2P6Z adds
 2,076 to 2,364
)to the .
 See:   1260   Adolph   Casper   V2P2
PZPAPN
Vacsina
:  Vacsina
, 1989
 TSR; .
W, .BIN, & .SYS
i; "beeps"
R:  1,206
5:   PRsA -
, NAV,
:  CleanUp,
\, or
 The Vacsina
1200
and can be
are at least 48
of the Vacsina
as the TP
not all of them
}.  Later
s of
are included in
under the
"Yankee Doodle".
 Generally, the Vacsina
vboth .
-and .
`, as
 well as .SYS and .BIN
bconvert it into .
-format by changing the MZ or
 ZM identifier in the
btwo
)of the
ato a JMP
 instruction and
adding a small piece of relocator
5, so
the .
acan be
it were
 One sign of a Vacsina
rmay "beep"
=in the
1to the
were
of Vacsina are:
 TP04VIR:
`, changing them internally into .
may beep
X, and may
 be identified by searching for the
"VACSINA"
 along
the second
fthe end of the
9ing a 04h.
of Vacsina is a poor
 replicator, and while it
always convert a
 to .
aformat, adding 132
), it
Nnot always
 TP05VIR:
to TP04VIR, except
the second to the last
*in the
ais now a 05h.
jmay
 TP06VIR:
to TP05VIR, except the second to the last
 the
ais now a 06h.
 TP16VIR:
to TP06VIR, the second to the last
*in the
ais now 10h.
 TP23VIR:
to TP16VIR, the second to the last
*in the
ais now 17h.  The
"VACSINA" no longer
s in the
 TP24VIR:
to TP23VIR, the second to the last
*in the
ais now 18h.
 TP25VIR:
to TP24VIR, the second to the last
*in the
ais now 19h.
 See:   Penza   Yankee Doodle
PZPAPN
Varicell
:  Varicell
 Varisela
R:  1,482
5:   PRhAK -
30.00+,
V112+,
2.58+,
6.60+,
n1.05+, NAV 3.0A06+,
2.58+,
.2.0+,
V113+,
6.64+,
1.0A06+
 The Varicell, or Varisela,
 Its
.  Varicell is a
uof .
-and .
 It is a fast
u, and
bVaricell
X, the Varicell
at the top of
$the
', not moving
|12's
, as
qby the
 DOS
@by 1,536
 13, 1C, 21, and 22 are
mby Varicell in
the Varicell
, it
, or copied.
pof 1,482
be hidden by the
it is
.  The
>and
in the DOS
not be
.  No
in the
 Varicell
 It is
what Varicell
PZPAPN
:  VCL
5Zero
H:   May,
R:  576
5:   PNCK -
3.96+,
, NAV 3.0+,
6.60+,
n1.05+,
1.25+, NAV 1.0A06+
 The
5Zero, or the
VCL created,
 May,
.  It
ated in the
or Canada.
5Zero
 is a
uof .
,.  The
es listed
$under
were
 created by a
of Nowhere Man's V.C.L., a
whose
 purpose is to simplify the task of writing
5Zero
X, the
5Zero
search the
Eto locate an
w.  If it finds an
, it
wit, and the host
 continue
Z.  If the
5Zero
Nnot find an
, it
Mthe
 "** CODE ZERO **"
5Zero
pof 576
).  The
at the end of the
a.  The
>and
in the DOS
.  Four
 can be
din the
 "*.* *.
 "** CODE ZERO **"
5Zero
Nowhere Man/[NukE]"
es created
VCL are:
 Angel: Angel is a VCL generated
^, 1994.
 It is a
uof .
,.  Angel
vone .
in the
pof 1,681
 at the end of the
a.  The
>and
in the DOS
not be
.  The
in the Angel
 "*.* *.
 "CHKLIST.MS"
 "Your computer was
ANGEL"
 "Don't be afraid it's harmless!"
 "Today is 21st of
^, my birthday!"
 "Be young, be crazy, be nice, be ANGEL!"
 "HI! Don't forget: ANGEL is watching you!"
(FAT)
:may
Ks.
all of the .
r, the
Mthe
 "HI! Don't forget: ANGEL is watching you!"
^21st of any year, the
in graphic
 "Your computer was
ANGEL
 Don't be afraid it's harmless!
 Today is 21st of
^, my birthday!
 Be young, be crazy, be nice, be ANGEL!"
^, 1994.
 Arwen3: Arwen3 is a VCL generated
.  It
vone .
ain the
pof 722
at the end of the
 The
>and
in the DOS
not be
.  The
in the Arwen3
 "Arwen3 is a fat sow"
 "[VCL]"
 B-52: B-52 is a VCL generated
 generated by the
generation
.  B-52 is
uof .
,.  It
vtwo .
pof 3,808
at the end of the
a.  The
 and
in the DOS
not be
.  Many
can be
in the
5in all
 ".. *.* *.
 "c:\dos\*.com"
 "AT&FL0M0DT911"
 "[MPC] Call 911"
 "*.exe *.com .. *.exe"
 "Abort, Retry, Ignore, Fail?"
 "Fail on INT 24"
 "I'm hungry! Insert PIZZA & BEER in to
OA: and"
 "Strike any key
ready..."
 "Impotence
Ureading
's dick"
too big to fit in
 "Cannot load
-MAND,
halted"
 "I'm sorry, Dave
. but I'm afraid I can't do
 "[vcl]
 March,
 Beva 32: Beva 32 is a VCL generated
.  It
vone .
ain the
E, or one
Eup in the
Estructure,
pof 562
 the
at the end of the
a.  The
>and
in the DOS
.  The Beva 32
on the 22nd day of
 any month, at
attempt to
 "Whats wrong
my computer, you ask?
 Well I do believe it has
la nice day!"
 The
in the
, as are the
 "[VCL/BEv]"
 ".. *.
:  Oregon,
 Beva 33: Beva 33 is a VCL generated
.  It
vone .
ain the
E, or one
Eup in the
Estructure,
pof 519
 the
at the end of the
a.  The
>and
in the DOS
.  The Beva 33
1st of
 any year, at
attempt to
 "Happy New Years, Eat my viril
kware!"
 The
in the
, as are the
 "[VCL/BEv]"
 ".. *.
 "-=BEv#A33=-"
:  Oregon,
 Beva 96: Beva 96 is a VCL generated
.  It
vone .
ain the
E, or one
Eup in the
Estructure,
pof 516
 the
at the end of the
a.  The
>and
in the DOS
.  The Beva 96
4th of any
 year, at
attempt to
Mthe
 "Happy 4th! Hope you enjoy your messed up computer!"
 "-=BEv#A96=-"
 The
in the
, as are the
 "[VCL/BEv]"
 ".. *.
:  Oregon,
: Big
is a VCL generated
 March,
.  It
vseveral .
`in the
pof 676
at the end of the
 The
>and
in the DOS
not be
.  The
in the
 ".. *.* *.
 "[VCL] VIRUSES!!  HACKERS!!"
 "Who ya gonna call???Not McAfee Associates!!!
Suck BIGTIME!!!   [DJ]"
jmay frequently
 are
 March,
 CD Player: CD Player is a VCL generated
.  It
vall of the .
-and .
 in the
X.  A sound
to the sound made by a "scratch"
 on a record is emitted on the
speaker, and the
 is re
&ed.
lthe
)of the host
by the CD Player
5.  The
>and
in the DOS
not be
 Chicken Pox: Chicken Pox is a VCL generated
.  It
vthree .
 the
E, or along the
path,
by 604
 at the end of the
a.  The
>and
in the
 DOS
not be
jfrequently
 as well as write protect
fwrite-protected
5Zero-652: A 652
of the
5Zero
.  It was created by Nowhere Man by
 recompiling the
5Zero
1.0.
vone .
pof 652
at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
and are not
d samples:
 "*.* *.
 "** CODE ZERO **"
 "[VCL] [
5Zero] Nowhere Man, [NuKE] '92"
all of the .
in the
Zof the next
in a
Mof the
 "** CODE ZERO"
rby the
5Zero-652
becoming locked out
 Cops-1: Cops-1 is a VCL generated
.  It
vfour .
`in the
 higher level
pof 1,083
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
Sthe Cops-1
 ".. *.
 "Your Computer has
!one of the many"
 "to be tortured by the CoPs-1
, one"
 "of the many to come. Made by CoPs in
 "I guess today really isn't a lucky"
 "day for you, because you
 "hit
the CoPs-1
 "It has
!a year since
 "released, and the CoPs-1
is still going"
 "strong.
Was Made By CoPs"
 "in
.Your Computer Has
!Honored"
 "By
#Able To Witness TheWrath of The"
 "Infamous CoPs-1
. Made By CoPs in
 Rapid beeping and a
hang may
ever an
 Crasher: Crasher is a VCL generated
vfive .
`in the
;or a higher level
pof 594
at the end of the
 The
>and
in the DOS
not be
.  The
in the Crasher
 ".. *.* *.
 "CRASHER"
 Dial: Dial is a VCL generated
 March,
.  It
vfour .
`in the
pof 599
at the end of the
 The
>and
in the DOS
not be
.  The
in the
5in all
 ".. *.* *.
 "AT&FM0L0DT9008201110"
 (Note:
 "[VCL]"
 The
starting
"AT" is a
to dial the included phone number on Hayes compatible
 modems.  Area
5900 phone numbers typically carry a
 per minute connection fee, and the owner of the
phone
 number
Nn't
la connection to
:  North America  March,
 Diarrhea: Diarrhea is a VCL generated
.  It
vone .
ain the
E, or along the
path,
by 931
at the end of the
 Diarrhea
on Fridays
Zof an
s in the
Mof the
 "EAT MY DIARRHEA!" in graphic
4made of ASCII line
$in normal
4: "--GG Allin & The Texas Nazi".  If ANSI.SYS is
 loaded, the
be in red,
the second line
#in yellow.
 Diarrhea6: Diarrhea6 is a later
of Diarrhea.  It adds
 1,221
)to the .
v.  Like the
on Fridays.  In the case of Diarrhea6, it
trojanize an .
in the
b596
the trojanized .
X, it
Mthe
fthe Diarrhea
a flashing
 border has
to the
be bright blue
 if ANSI.SYS is loaded.
 Diarrhea6 Trojan: The trojan dropped by the Diarrhea6
 Fridays
a Diarrhea6
trojanized by the
lthe
a small
to produce the
for the
 Diogenes: Diogenes is
on the Diarrhea
, and has
!specifically
5d to avoid detection by
utilities
can detect
VCL generated
es.  It adds 846
)to the .
 Diogenes
on the 31st of any month, at
b718
of the C:
 "DIOGENES 2.0 has visited you
fine product of the Lehigh Valley."
 "Watch (out) for future 'upgrades'."
 "The world's deceit has raped my soul.  We melt the plastic
 people down,
we melt
plastic town
are not
in the
 DM 92 Bios: DM 92 Bios is a VCL generated
.  DM 92 Bios
vtwo
 in the
preference to .
lthe
b457
by the
 permanently corrupting them.  The
in the
 ".. *.* *.
 "DM-92 BIOS
 Dome: Dome is a VCL generated
 Canada in
.  It
s the
b546
 of .
, as well as
,.  It
 "*.* *.
 "Divide overflow"
-[VCL] DOME"
:  Canada
 Dome2: A
of Dome,
generated by VCL.
s two .
-or .
X.  It may
the hidden
`and .BAT
`, and alter the
 Unlike Dome,
s the entire host
 are
:  Canada
 Dome3: An
Dome
one creates 433
 companion .
`for the .
in the
E.  The companion .
`are hidden,
 and
9the
 "Divide overflow"
 "*.* [VCL] DOME3"
 "*.* *.
:  Canada
 Dome4: An
minor
of the Dome
one has
 one
differs.  In addition to
the host
, it
 corrupt .
.  Executing one of the corrupted .
give unpredic
 unexpected
 Donatello: Donatello is a 827
created
VCL 1.0.
vthree .
it is
pof 827
at the end of the
 The
>and
in the DOS
not be
.  The
 are
in the
5, and as such are not
 "Cowabunga, dudes!  It's Donatello!"
 "(Hey, John, can I be on Nightline too?)"
 "[VCL] [Donatello] Nowhere Man, [NuKE] '92"
 "Hey, Donatello, be like Mike!"
jmay
 and the
btwo
Las a
, a "Divide overflow"
X, and no
 E-Coli:
, E-Coli is a 706
*companion
 or spawning
wone .
ain the
Eby creating a 706
*hidden .
 same base
.  The hidden .
 Read-
and Hidden attributes set, and the
>and
.  The
in the E-Coli
 "[VCL]
is for corporate"
 "America for poisoning the peopl"
 ".. *.* *.
d samples
`unless the
aattributes are reset by the
 Earth Day: Earth Day is a 797
created
VCL 1.0.
vone .
pof 797
 at the end of the
a.  The
>and
 in the DOS
not be
 The
in the
 and are not
d samples:
 "*.* *.
 "Happy Earth Day!!!"
 "In the spirit of Earth Day,
VIRUS has recycled
 your
 "[VCL] [
5Zero] Nowhere Man, [NuKE] '92"
rby the Earth Day
becoming locked out
X.  "Divide overflow"
 frequently
X.  The
Mthe
 and
 Earthquake:
, Earthquake is a 1,145
 companion or spawning
wone .
ain the
Eby creating a 1,145
*hidden .
 same base
.  The hidden .
 Read-
and Hidden attributes set, and the
.  The
in the Earthquake
 ".. *.* *.
 "* * * Earthquake Warning! * * *"
 "Head for the hills!"
 "Take cover!!!"
 "Whew!  We Made It!"
 "-=[VCL/BEv]=-"
frequently
]is a VCL generated
 March,
.  It
vtwo .
`in the
pof 663
at the end of the
 The
>and
in the DOS
not be
.  The
in the
5in all
 ".. *.* *.
failure of Traditional
]Values!  Oh no!"
 "[VCL]"
 The second
may be
Las a
 in flashing
 March,
 Garfield: Garfield is a VCL generated
.  It
vone .
ain the
pof 515
at the end of the
 The
>and
in the DOS
not be
.  The
in the
5in all
 ".. *.* *.
 "You got da Garfield
la nice MONDAY[HAL]"
 Handler: Handler is a VCL generated
.  It
vthree .
`in the
pof 420
at the end of the
 The
>and
in the DOS
not be
.  The
in the
5in all
 "[VCL] beep beepHandler is a fag!"
 Heevahava: Heevahava is a VCL generated
 in the
.  It
in the
Xby creating companion
 The companion
`created by the Heevahava
 be 514
)long and
lthe read
, and
 hidden attributes set.  The base
correspond
 to an .
in the
E, and the
be the
the companion
awas created.
 The
can be
din the Heevahava
 hidden companion
heeva-hava's get stuck
THE HEEVAHAVA
 "HEEVA[VCL]"
 "*.* *.
 Kinison: An 806
created
1.0.
vone .
pof 806
at the
 end of the
a.  The
>and
in the
 DOS
not be
.  The
in the
 are not
d samples:
 "*.* *.
 "DIE BITCH
 "[VCL]
*VIRUS* is dedicated to the
of Sam
 Kinsion, 1954-
[Kinison]"
 "Nowhere Man, [NuKE] '92"
rby the Kinison
becoming locked out
X.  "Divide overflow"
 frequently
 Kinison
on any Friday the 11th, at
Mits
and trash the
 Kinnison-734: Kinnison-734 is a
of the Kinison
is two
)longer,
 and
8the
 "*.* *.
 "DIE BITCH
 "[VCL] Dedicated to the
 "Sam Kinnison 1954-
 "[Kinnison Nowhere Man, [NuKE] '92"
:  Canada
 McYellow: McYellow is a VCL generated
in May,
.  It
vthree .
`or one .
 in the
X.  It
Ms the
in yellow
 blocked graphic
4on the
 " MCAFEE
 IS A FAG"
 On non-VGA
, the
Mmay just
!cleared.
lthe
b1,297
)of the host
by the
 The
>and
in the DOS
not be
.  The
in the
5in all
 May,
 Miles:
, Miles is a 480
*companion
 or spawning
wone .
ain the
Eby creating a 480
*hidden .
 same base
.  The hidden .
 Read-
and Hidden attributes set, and the
>and
.  The
in the Miles
 ".. *.* *.
 "... miles to go before I sleep."
 On the 3rd day of any month,
in the
Ming the second
as a
on the
d samples
`, or
Mthe
on the
 3rd, unless the
aattributes are reset by the
 Pearl Harbor: A 930
created
VCL.
vone .
asmaller
X.  Unlike
 Pearl Harbor is a spawning or companion
, so no
to the
.  Instead,
 a 930
ais created
the same base
as the .
r.  The 930
lattributes of read-
, and
 hidden, so it is not
in the DOS
.  The
>and
on the hidden .
be the
>and
 The
in the
 and are not
d samples:
?7th, 1941 -- A day
live in infamy..."
 "*** REMEMBER PEARL HARBOR ***"
 "C:\*.* [VCL]"
 "Dedicated to the memories of the brave American men and
 women who gave
lives at [Pearl Harbor]."
 "Nowhere Man, [NuKE] '92"
 Pearl Harbor
?7th, at
Mthe
X, as well as attempt to write to
 device PRN or LPT1:
?7th, 1941 -- A day
live in infamy..."
 "*** REMEMBER PEARL HARBOR ***"
5to corrupt
 the C:
Oroot
E, but it may not actually be
 Pro-Choice: Pro-Choice is a VCL generated
.  It
vfive .
`in the
pof 1,569
at the end of the
 The
>and
in the DOS
not be
.  The
in the
5in all
 ".. *.* *.
 "Hello, all fascist narrow-minded jerks!!
one's for you"
 "The p
ryour
 "HAHAHAHAHAHAHAHA!"
 "I hope
makes you think twice about restricting a
 person's
edom of"
 "choice and limiting his/her decision about aborting a
 baby. I
hope
demonstrates
fucking up
one's life in the
of an unborn"
 "child is OK. Not.
la wonderful day."
 "And may corrupted
ming reign!! Long live Jim Shorts"
 "[VCL] Pro-Choice
jmay
 as well as the second
may be
 as a
 Red Team: Red Team is a VCL generated
.  It
vfour .
`in the
pof 716
at the end of the
 The
>and
in the DOS
not be
.  The
in the
 ".. *.* *.
 "Now YOU are a part of the Red Team!"
 "by Dark in 93"
 Red Team
on Wednesdays,
 last two
as a
accompanied by a
 scraping sound and a
hang.
 VCL.551: VCL.551 is a VCL generated
, 1994.
 VCL.551
vtwo .
`in the
pof 551
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "*.*"
, 1994.
 VCL.587: VCL.587 is a VCL generated
, 1994.
 VCL.587
vthree .
`in the
Xby creating a 587
*companion
a.  The companion .
9the
lthe read
, and hidden attributes set
 and the
>and
 The
in the
 "*.*"
 "Well, nobody is going to give a damn
dyour dead,
 limp,body in the river next week
a knife through your
 heart.
just laugh and say..."
 "Good, I hated anyways."
 "[VCL]"
 "FAKE DARK AVENGER!!!(c) BeePoP / [PuKe] WaReZ
 The third, fourth, and fifth
may be
 as a
on the
monitor, accompanied by a
hang,
, 1994.
 VCL.Angel.436: VCL.Angel.436 is a VCL generated
, 1994.  It
vone .
ain the
pof 436
 at the end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "Angel X v.1.1"
 "(c)
Laboratorio Luz de Luna y Angel X"
 "Lima - Per"
 "MUERA FUJIMORI !!!"
 It may
Mthe second thru fifth lines of
, accompanied by a
hang,
:  Peru
, 1994.
 VCL.Blue Moon: VCL.Blue Moon is a VCL generated
, 1994.  It
vup to four .
`in the
pof 932
at the end of the
a.  The
in the DOS
not be
 The
in the
 "THe =BLue Moon=
Rise.."
 The
may be
, 1994.
 VCL.Elena: VCL.Elena is a VCL generated
 1994.  It
vone .
ain the
pof 730
at the
 end of the
a.  The
>and
in the DOS
not be
.  The
in the
 "Elena M."
 "Tnx2NMan.."
 "*.*"
 "Hey Jack! please contact me, I'm in your city! What?
is a simple
? Don't worry... it's
a demo!"
, 1994.
 VCL.Noble: VCL.Noble is a VCL generated
 1994.  VCL.Noble
vall of the .
in the
pof 531
at the
"of the
a.  The
>and
in the DOS
 not be
.  The
 the
5in all
 ".. *.* *.
 "NOBLE VIRUS
Happy B-Day!"
, 1994.
 VCL.Olympic: VCL.Olympic is a VCL generated
, 1994.  It
vup to five .
`in the
pof 1,440
at the end of the
a.  The
in the DOS
not be
.  The
9ed in the
5, however
 all are
the exception of the last
 "*.*"
 "Haakon And Kristin Blew It Up Again..."
!Fucking Around
The Olympic
 Computers, And Managed"
 "To
wA Lot Of Your Computers
A Little
 Destructive
 "Now, Antonio, You Can't Let Them Runaway
 Punish The Little Bastards!"
 "Olympic Aid(s) '94 (c) The Penetrator"
, 1994.
 VCL.Reptoid: VCL.Reptoid is a VCL generated
, 1994.  It
vup to two .
`in the
pof 2,536
at the end of the
a.  The
in the DOS
not be
.  The
in the
 ".. *.* *.
 "Live!
fZeta Reticuli..."
 "_Attack of the Reptoids_Starring Earl Gray as
 *The Lizard's Assistant*"
all of the .
`in the
Zof an
in the
Ming a rapid and short-viewed graphic of a reptoid,
 or sort of a face.  The
cleared and the
 proceeds to
, 1994.
 VCL-409: VCL-409 is a VCL generated
 1994.  VCL-409
vall of the .
W, .ZIP, .DAT, .SYS,
 and .OVL
in the
b409
by the
5, permanently
 corrupting them.  The
 the
5in all
 ".. *.
W*.ZIP *.DAT *.SYS *.OVL"
 "Tempest -
 Of Luxemburg Vaginal Discharged"
 VCL-409
Nnot
`smaller
:  Sweden
^, 1994.
 VCL-JP2:
, 1994, VCL-JP2 is a 1,919
 companion or spawning
wone .
ain the
Eby creating a 1,919
*hidden .
 same base
.  The hidden .
 Read-
and Hidden attributes set, and the
>and
.  The
in the VCL-JP2
 "[ MK / TridenT ]"
 "[TPE 1.3]"
 "[VCL]
 "dicat to ?he fuckn homo"
 "Spr"
 "gf ?ield's R.A.T."
 "LAMERS! Viru?"
 "by J.P."
 "Paul C"
 "ag Davi"
d samples
`unless the
aattributes are reset by the
, 1994.
 VCL-Windows: VCL-Windows is a VCL generated
.  It
vall .
-and .
 in the
lthe
)of the host
by the
, so for
larger
be no
smaller
 873
t.  The
>and
in the DOS
 not be
.  The VCL-Windows
Ms the
accompanied by a scraping sound
X, along
hang:
requires Microsoft Windows."
 The
in the
 are the
 "Hey Toto, I don't think were in
 "WINDOZE
any more!!"
 "[VCL] BenderHead '93Windows
 Voco: A 745
, Voco
vseveral .
`in the
be permanently
 corrupted as the
s the
b745
)of the
 host
.  The host
>and
in the DOS
not be
.  Voco
smaller
), so
.  The
in the
5in all Voco
 "PATH="
 "You Now
lThe VoCo BBS
Was Made By
 My M
The Car."
 "*.*"
is made for all the
s of Voco bbs. And for
 theentire country of volusia"
 "mayyou all fucking rot in hell:"
 VCL-YD2: An 821
created
1.0 of VCL.
vone .
pof 821
 at the end of the
a.  The
>and
 in the DOS
not be
 The
in the
 and are not
d samples:
 "PATH="
 "[VCL] [Yankee Doodle 2] Nowhere Man, [NuKE] '92"
[the song "Yankee Doodle"
 between 5:00PM and 7:00PM
 VCL-YD2B:
on the VCL-YD2
is one
 longer, adding 822
)to the end of the .
v.  It has
to avoid detection by
utilities.
 ZipLoc: A 710
*companion or spawning
, ZipLoc
 one .
in the
ever an
X.  The companion
be 710
, hidden, and read-
 attributes set.  The
>and
be the
>and
.  No
in the
5.  The ZipLoc
 search the
Estructure of the
Ofor .ZIP
`, and corrupt the .ZIP
`it encounters.
all of
 the .
rby the creation of the
 matching companion .
`, the
ZipLoc'd"
 See:   Nowhere Man
PZPAPN
VComm
:  VComm
 637,
?, 1989
i; TSR; write failures
 Poland
R:  637 - 1,149
5:   PRaE -
, NAV,
, or
 The VComm
is of Polish
 1989.  The
is a .
 run, the
attempt to
wone .
ain the
E.  It
wthe
of the
6interpreter.
VComm
a, it
bpads the
is a multiple of 512
it adds its 637
5to the end of the
a, so the
 between 637 and 1,149
).  The
>and
in the DOS
not be
 The
portion of the
intercepts any
Kwrites
are attempted, and
2them into
Kreads.
of VComm are:
 VComm.633: A 633
of the VComm
adds 633 to 1,145
)to the .
r.  The
at the end of the
 and the
>and
in the DOS
not be
.  One
in the
 "-DWD"
jmay
, 1994.
PZPAPN
:  VCS
Construction Set
G:  May,
; autoexec.bat & config.sys replaced
 Germany
R:  1,077
5:   PNCK -
, NAV,
 The VCS, or
Construction Set, was
in May,
.  It
fGermany.  VCS is a
creates
 of a 1,077
the VCS
X, it
prompt the
in German
 for the number of generations before the
activate, and
 for the
of a
includes the
for the
 The VCS
create a
d VIRUS.
be a live
generated to the
's specification.  The
input by the
 not
the VIRUS.
X, the VCS-generated 1,077
fone to three .
in the
E.  If
,exists in the
 it may
 by 1,077
at the end of the
be no
3in the
in the DOS
 VCS-generated
activate
the number of generations
was specified by the
.  At the
, the
replace AUTO
WC.BAT and CONFIG.SYS
in the C:
Oroot
E.  If
`did not
exist, it
create them.  The new AUTO
WC.BAT and CONFIG.SYS
 be 512
9the
 specified during the
' creation using VCS.
VCS generated
es are:
 DarkSide: DarkSide is a
,.  It
 of the .
in the
pof 1,077
at the end of the
a.  The
in the
 "Welcome to the DarkSide of the Realm!"
 "We all heed a certain call, our minds cannot control,"
 "drawn
fdeep
in our hearts and deep
in our"
 "souls."
 "c:\autoexec.bat"
 "c:\config.sys"
 Paranoimia: Paranoimia is a
 of .
,.  It
 or two .
in the
pof 1,077
at the end of the
a.  The
in the
 "You
ljust
the Paranoimia
 "If you
lgotten
the odds are
you pirated"
 "software you shouldn't
l..."
 "Might as well press <Ctrl>-<Alt>-<Del> now..."
 "c:\autoexec.bat c:\config.sys"
VCS generated
the AUTO
WC.BAT and CONFIG.SYS
 the C:
Oroot
 VCS-Post: A
uof .
,.  It
 several .
in the
pof 1,077
at the end of the
a.  It
 the C:
Oroot
E's AUTO
WC.BAT and
 CONFIG.SYS
ever an
 Deutsche Bundespost
 Telekom
Sin the AUTO
WC.BAT
 and CONFIG.SYS
`on the C:
:  Germany
 See:   Manta
PZPAPN
:  VFSI
 437, Happy Day
R:  437
5:   PNCK -
\, NAV,
 The VFSI
at VFSI (the Higher
 Institute of Financial Management)
in Svistov, a town on
 the Danube.  VFSI is a
the VFSI
X, it
wone
in the
 Candi
`to be
rare
baligned to be a multiple
 of 16, and
by between 437 and 452
at the end of
`can be easily identified as
always
 the
chex
: 3A483F244B6F636E706C74.
one out of five
Zs of an
 the
flash the
on the
 "HELLO!!! HAPPY DAY and SUCCESS
1.1 VFSI-Svistov"
Sin the
5, so it is not
PZPAPN
:  VHP
 VHP-348, VHP-353, VHP-367, VHP-435, VHP-757, VHP-776
 Research
R:  348 - 435
5:   PNC -
\, NAV,
\, or
 The VHP
is actually a small group or "
]" of
 was
(in early
;ly four
 identified
to the VHP
the VHP-435
#the one
the most potential for spreading.
 were
on the
.  The progression of the
shows
to be a slightly better replicator.
 The VHP
es are:
 VHP-348:
Nnot
due to bugs in the
5.  If it did
, it would
 The
's effective
is 348
 VHP-353: VHP-348 fixed so
 increasing its
by 353
).  It
Nnot
is still buggy, and it
 occasionally hang
to find a .
 VHP-367: VHP-353
by 367
).  Very
a.  VHP-353
Nnot always
X, it
 not
wany .
it has in effect
 immunized the
effect is
 probably a bug in
 VHP-435:
, 1989,
is 435
and is not destructive, all it
Nis spread.
 VHP-435
attempt to
wone
,and .
 are not
sall of the .
 on the
Oand
E, it
attempt to
OC:.   VHP-435 is the VHP-367
 modifications to make it less likely to be noticed.
 VHP-757:
, VHP-757 is a 757
of the VHP group of
.  It
vone .
, but not
by 757
at the
 end of the
d samples are typically
 not very
wious, and
 VHP-776:
, VHP-776 is a 776
of the VHP group.  It is
in behaviour to
 the VHP-757
wthe
 two .
`in a
 See:   Sicilian Mob
  VHP2
PZPAPN
:  VHP2
 623, VHP-623, VHP-2
 Research
G:  March,
i; re
&s or
R:  623
5:   PNC -
\, NAV,
\, or
 The VHP2
(in March,
on the
, and has many of the same
 characteristics of the VHP-435
of the VHP
.  It's major
 difference is
of effective
, and
1 of every 8
perform a warm
 VHP2 is 623
)long,
`but not
of VHP2 are:
 VHP-627:
to VHP-623, except
is 627
 See:   VHP
PZPAPN
Victor
:  Victor
G:  May,
i; data
alinkage
T; unexpected
R:  2,443 - 2,458
5:   PRAK -
\, NAV,
\, NAV, or
 The Victor
}in May,
.  It is believed
ated in the
due to
 the
 "Victor V1.0 The Incredible High Performance
 Enhanced
soon.
was imported
ks to Ivan."
 The
can be
dat the end of
`, but
Nnot
to ever be
 The
the Victor
X, the
, occupying
 3,072
)at the top of
 intercepted by the
becoming
, Victor
seek out and
 Victor is a very slow
 in every 10
by between 2,443 and
 2,458
).  The
is not hidden by the
 Occasionally in the process of
a, the
 hang the
in data
:. Overlay
`may
ing in
alinkage
 Victor
on Wednesdays, at
be 3,008
bVictor
Xon a Wednesday, the
wall .
 and .
larger
2,500
 immediately.
PZPAPN
 Austrian, Unesco, DOS-62, DOS-68, 1-in-8, 648
, 1988
 Austria
R:  648
5:   PNCK -
P, NAV 3.0+,
:  CleanUp,
, NAV, or
 The
, 1988, in Moscow at a
 UNESCO children's computer summer camp.  The
uof .
X, the
select a .
in the
!modified by the
.  Usually, the
aand set the seconds in the
 in the
Eto 62.
pof 648
at the
 end of the
 One out of every six
selects
not be
 actively
rby the
.  Instead, the
bfive
 the selected .
1to the hex character
"EAF0FF00F0", and the seconds field in the
 set to 62.
are later
X, a
&may
.  Since
corrupted
do not actually
9the
, and most
cannot
 detect them,
 continue to
[unexpected re
&s until all of the
 corrupted .
!replaced
clean copies.
hang upon
rby the
 The
was written by a high school student in
 Austria as an experiment.  Its large number of
, as well as
are in part
5, can be
 accounted for as its source
5has
!published many
 Due to the large number of
ts may not
 exhibit exactly the
 Cracky:
, Cracky is a 546
 the
on 8088
.  On 286 and higher
Zof an
in a
hang, or the
 "Cracky !"
Lin the upper left hand corner of
 the
and a
hang
the next
 or .BAT
X.  On XT
, Cracky
wone .
 of 546
at the end of the
a.  The seconds field in the
in the
 DOS
Eentry
!set to 22, the
tmarker.  The
Mof the
"Cracky !" may
on 286 and higher
, along
 hang.  The
can be
in the
5in all
 "Cracky !"
 "*.com"
 DOS 625: DOS 625 is a 625
of the
.  It
8the
-", "PATH=", and "om OM".
 It is
in behavior to the
Nnot do
 Dr Q:   Dr Q is a 1,161
of the
.  It
8the
"(C) DOCTOR QUMAK"
in the
5in all
 Dr Q-1028:   Dr Q-1028 is a 1,028
of the Dr Q
.  It
8the
 "(C) DOCTOR QUMAK"
in the
5in all
, as well as the
 "Hello world
 "Infecks"
 "stuff
should be here"
vone .
in the
by 1,028
)and
3in the
>and
in the DOS
Zof an
 in the
Mof the "Hello world
 Genny-648: Genny-648 is a 648
of the
 It either
vor trojanizes one .
pof 648
at the end of the
a.  Trojanized
&the
X, the
bfive
)having
 Like the
sets the seconds in
 the
stamp to 62 to indicate
 March,
 Kuzmitch: Kuzmitch is a 1,064
of the
wone .
ain the
E, but
 not
pof 1,064 -
 1,222
at the end of the
a.  It is
if it
 Maxwell-498:   Maxwell-498 is a 498
of the
.  It
vone .
ain the
X, but not
 The
can be
in the
 "MaxWell Defender: I don't kill MMM"
 "PATH=*.
, the
=seconds field
be set to "62" on all
 Maxwell-499:   Maxwell-499 is a 499
of the
.  It
vone .
ain the
X.  The
can be
in the
 "MaxWell-Defender: I
ln't
 "PATH=*.
, the
=seconds field
be set to "62" on all
 New Generation: New Generation is a 1,054
of the
.  It
wone .
ain the
pof 1,054
at the
 end of the
a.  On every 20th generation of the
, it
Mthe
on the
 monitor:
     New Generation
 by NET CRASHER,
 a PROUD member in Hyper.
s in a generation
is devided by 20. Please don't remove
 was created for research purposes
> Get a Life!"
 The
in the
5, as are
 the
ctwo
 "*.com PATH="
lthe seconds field in the
 in the DOS
Eset to 62.
: Israel
 Twer-1000: Twer-1000 is a 1,000
of the
wone .
ain the
pof 1,000
at the end of the
a.  The
in the DOS
to be
, but the seconds field has actually
 "60".  The
can be
in the
5in all Twer-1000
 "Twer
 "PATH="
822:
822 is
-B 645 in behavior.
,, increasing
by 822
Nnot perform either a warm re
V May,
-415:
-415 is a 415
of the
in the C:
Oroot
E.  It adds 415
)to the .
,.  It sets
 the seconds in the
in the DOS
 to 62 to indicate the
-618:
-618 is a 618
of the
.  It adds 618
)to the .
,.  It sets the seconds
 in the
in the DOS
Eto 62
 to indicate the
all the
in the
Zof an
hang.
-621:
-621 is
to the
.  It adds 621
)to the .
v.  Like
-618, it sets the seconds in the
 62 to indicate
-634 Re
-634 Re
&is a 634
 the
.  It
vone .
25% of the
X, a
instead of
r.  The alteration
in the
&ed the next
-645:
to the
-B 645
 adds 645
)to the .
v.  It
 not trojanize
to perform a warm re
8the
-", "PATH=", and
-648E:
on the
 adds 648
)to the .
v.  It
 alters
`, rather
sthem, by
bfive
hex 20
 The seconds field in the
be set to 62 on
 all trojanized and
.  It
-", "PATH=", and "
-656:
-656 is a 656
of the
X, it
ain the
E, as well as accessing
 the C:
O.  It
Nn't
on the C:
O, but may crosslink the C:
-712:
-712 is a 712
of the
occasionally trojanize a
instead of
sit.
trojanized
X, a warm
-716:
-716 is 716
of the
in "Divide overflow"
ring, or possible
-726:
-726 is a 726
of the
 Like
, it
vone .
ain the
50% of the
X, a warm re
ca long
Kaccess.  The
can be
 "(c) Copyright IBM Corp 1981, 1987 Licensed Material"
Property of IBM"
-726B:
-726,
has six
differ.
-827:
on the
adds 827
)to the .
v.  Like
vone .
X, locating the
at the end of the
.  The
can be
din the
 "Alan Solomon"
 "Doctor of what?"
 "Thinks he's a copper,"
 "A copper he's not."
 "HVPOW YXNHM SUWXM XXCPO MX"
 "PATH="
 The seconds field in the
>and
in the
 DOS
be set to "60" on all
, 1994.
-851:
on the
adds 851
)to the .
v.  Like
vone .
X, locating the
at the end of the
.  The
can be
din the
5: "PATH=", "
-", and
-".
jfrequently
-943:
on the
adds 943
)to the .
v.  Like
vone .
X, locating the
at the end of the
.  The
can be
din the
5: "PATH=", "
-", and
-".
jfrequently
X.  The
la NICE day...r is no longer operational due to an
 outbreak of".
 March,
 Vien6:
, except
the warm re
&has
 removed.  Effective
of the
is still 648
ron the
O, the
start
-Abacus:
on the
 adds 648
)to the .
v.  It
 alters
`, rather
sthem, by
bfive
hex 20
 The seconds field in the
be set to 62 on
 all trojanized and
.  It
-", "PATH=", "
-", and
 "Abacus Software!".
 Unexpected
&s may
trojanized
, except
instead of a warm re
 the
-B 645:
to the
 effective
is 645
).  It
Nnot perform
 either a warm re
.  It
N, however,
-Beta Boys:
fSweden in
adds 679
)to the .
,, and sets the seconds field
 in the
to 62.  The
can be
din all
 "-+[BetaBoys]+-"
 "PATH="
 Beta Boys
^of any year, overwritting the
 C:, D:, and E:.
:  Sweden
-Beta Boys 730:
fSweden in
adds 730
)to the .
,, and sets the seconds field
 in the
to 62.  The
can be
din all
 "BetaBoys Present:  Memo v2.0 /MaZ"
 "PATH="
:  Sweden
-CDM.A:
fPoland in
adds 642
)to the .
,, and sets the seconds field
 in the
to 58.  The
can be
din all
 "PATH="
 "COULD DO MORE
 "YOU COULD D"
-CDM.A
>is set to
1st thru May 5th of any year.  It
Nn't
:  Poland
-CDM.B:
on the
-CDM.A
is a minor
:  Poland
-CDM.C:
on the
-CDM.A
is a minor
:  Poland
-Feliz:
on the
adds 518
)to the .
v.  Like
, it
 one .
 locating the
at the end of the
.  The
can be
din the
 "(C)
Feliz Navidad!"
Feliz A
o Nuevo!"
-PATH="
 The seconds field in the
>and
in the DOS
be set to "60" on all
:  Spain
-Kaszana:
on the
adds 1,848
)to the .
v.  Like
, it
 one .
 locating the
at the end of the
.  The
are usually
in the
 an un
Scopy of the
 "PATH="
-WCLOCK.
 "REVEROF ANASZAK"
 The seconds field in the
>and
in the DOS
be set to "26" on all
-Nag:
-Nag is a 648
of the
.  Like the
 adds 648
)to the .
,.  It
sets the seconds field in the
to 62.  It
8the
 "PATH="
-New Years:
-New Years is a 697
of the
.  It
vone .
ain the
X.  The
can be
in the
 "The New-Years
 "PATH="
, the
=seconds field
be set to "62" on all
-Refresh:
-Refresh is a
 648
of the
.  Like the
 adds 648
)to the .
,.  It sets the seconds field in the
 32.  It
8the
 "PATH="
-Yam 92:
-Yam 92 adds 849
)to the .
 and sets the seconds field in the
to 56.  The
can be
din all
 'Matthew Stolarski - "A Loser in deep trouble
 "Matthew Stolarski is a born loser..."
 "Let's kill him
 "YAM '92.  Remember
 "PATH="
-Yam 92B:
-YAM 92B,
has four
differ.
 March,
 Wien:
in all details,
minor
 avoid detection.
: Poland
 See:   1260   Arf   Ghostballs   Grither   Lisbon   Mexican Mud
 Parasite   Rattle   Sicilian Mob   TSoft   VHP   VHP2
  W13   Incom   Viperize
PZPAPN
Vinchuca
:  Vinchuca
, 1994
i; TSR
 Argentina
R:  925
5:   PRsC -
 The Vinchuca
, 1994, and is
 Argentina.  It is a
uof .
 but not
bVinchuca
as a low
 of 1,232
mby the
the Vinchuca
, it
pof 925
 at the
"of the
a.  The
>and
in the
 DOS
not be
.  The
in the Vinchuca
 "Saludos para SaTaNiC BRaiN y Patoruzu"
ViNCHuCa V1.0
 "Creado por MURDOCK."
 "Buenos Aires,Argentina"
 "Su PC tiene Mal de Chagas
.jajaja..."
PZPAPN
Vindicator
:  Vindicator
jon 386
R:  734
5:   PRhCK -
n, NAV,
1.53S+,
 The Vindicator
.  Its
.  Vindicator is a
uof .
 The
the Vindicator
X, Vindicator
at the
 top of
$the
, as
qby the DOS
@by 1,536
{1C and
mby Vindicator in
.  The
if it was not
the Vindicator
, it
pof 734
at the
"of the
.  The
in the DOS
not be
 The
can be
in the
 all Vindicator
 It is
what Vindicator
PZPAPN
Strain B
 Endangered
OB:; formats
 Canada
R:  1,055
5:   PNCK -
, NAV,
:  CleanUp, or
 The
by an anonymous
of Homebase BBS.  While
}in the United
 States,
fCanada.
X, what
 happens depends on what the
>is set to.  If the
 prior to
, the
wone .
in the
E, adding 1,055
)to the
.  If the
, the
 not
wany
`, but
format the
btrack of the
of an
tof the
include unexpected
to access
OB:.  If
is no
 or the
OB: is write-protected, a
 The
s in the
 "TransMogrified (TM)
 RABID N'tnl Development Corp
 Copyright (c)
RABID!
>: 08/15/90
Strain B -
 ! (Field Demo Test
 ! * NOT TO BE DISTRIBUTED * !"
 Baby: Baby is a 1,000
, its
.  Baby
vone .
ain the
pof 1,000
at the end of the
a.  The
in the DOS
to be
, however the seconds field
!set to
 "60".  The
in the
5in all Baby
 "by by baby"
 "PATH="
 It is
what Baby may do
on the
is 716
.  The major
4, and
?4.  On
reformat track 0 of all
 The
 "*.com" "
B2 is a 1,000
, and
related to the Arf
s to
!written by the same group.
 activate on
31 and
the year
or later.  At
, it
wipe out the
b700h
 random
8the
-" "Arf Arf! Got you!" "
-" "-- RABID
 '90" "down or DIE!" "--- RABID '90"
vone or two .
X, along
 the
: "Arf Arf Got you! -- RABID '90"
B2-969:
B2-969 is a 969
of the
.  It
: "*.
-" and
B2 (C) '90 RABID Nat'nl Development Corp."
B3 is a 843
.  Like
 the
s, it
X.  Unlike the
s, it
affect the C:
 immediately in
circumstances.  Damage caused by
B3 can be fixed
Norton
KDoctor.
B3 should activate on
?25, at
attempt to format the
B3 are: "
 Strain B3 - RABID Nat'nl Development Corp. " "*.
BT: Very
to the
.  It
 includes the same
-C is a 821
.  Like
 the
s, it
pof 821
at the end of the
a.  The seconds field
 of the
in the DOS
 set to "56".  The
in the
5, un
Strain C -
 (C)
RABID Int'nl Development Corp."
strikes again..."
 "PATH=*.
thru
of any
 year, at
Zof an
in the
of the
"of the
K, and the
strikes again...".
:  Canada
 See:   Arf
B4   Violite
PZPAPN
 Christmas
Strain B4
ion 8088
 80286 & 80386
 Canada
R:  5,302
5:   PNCK -
\, NAV,
 The
in the United
 States.  It is
fCanada.
 released into the public domain on a Trojan
of DSZ
 (DSZ1203).  It is a
uof .
 What
Ndepends on what processor is in the personal
 computer it is
Xon.  On 80286 and
processors,
 the
activate immediately,
 portion of the
K.  It
attempt to
 Christmas greeting at
, but the greeting
 garbled if ANSI.SYS is not loaded.  Damage caused by
B4 at
can be repaired using Norton
KDoctor.
 On an 8088
do nothing but
X, the
 one
in the
pof 5,302
 The
>and
in the
not be
.  The
at the end of the
 The
in the
it is never
Strain B4 - Written by RABID Nat'nl Development Corp.
 RABID would like to take
opportunity to extend it's sincerest
 holiday wishes to all Pir8 lamers around the world! If you are
 reading
you are lame!!!
 Anyway, to John McAffe!
la Merry Christmas and a
filled
 new year. Go ahead! Make our day!
 Remember! In the festive season, Say No to drugs!!!
suck shit!
 (Bah! We make a
large, might as well
thing positive!)"
B4 are:
B4-1: Very
to the
track 1 of the
it has completed two
ts on a 386-
machine.  It
 same
as the
, and
differs by a few
B4-B:
is the same as
B4-1, it differs
 by two
).  Its behavior is identical to
 B4-1.
 See:
PZPAPN
Violetta
:  Violetta
7- Germany
i; TSR
 Germany
R:  3,840 - 7,678
5:   PRsC -
/, NAV,
 The Violetta
Gin Germany in
.  It
 was reported to be widespread in Germany at the
of its
~.  Violetta is a
uof .
 but
Nnot
 The
Violetta is
X, the
 Violetta
as a low
TSR of 8,256
{21, CC, CE, F1, F7, and F8
the Violetta
, it
 Violetta
normally
 3,840
).  However, if the
 was less
3,840
), the
 be 7,680
).  In either case the
at the
"of the
be no
3to the
>and
in the DOS
 The
in the
 Violetta
 "VIOLETTA"
4.00"
 It is
if Violetta
of Violetta are:
 Violetta-1024: Violetta-1024 is a smaller
of the
 Violetta
.  Its
TSR is 4,432
, and hooks
|21.  Violetta-
 1024
pof 1,024
 at the
"of the
a.  .
 were
smaller
1,024
 2,048
 Violetta-1024.  The
>and
in the
 DOS
 the
>and
.  The
can be
in the
5in Violetta-1024
 "Greetings to Cracker Jack..."
 "Loving
ts to Shirley..."
 "Marty McFly lives
where in
 "Kill Eddie. Kill Diana. Kill Fredo."
PZPAPN
Violite
:  Violite
=seconds = 56;
 North America
R:  988
5:   PNCK -
, NAV 3.0+,
1.53S+,
8/93+,
2.58+,
.2.0+
 The Violite
, and is
fNorth
 America, probably the
.  Violite is
on the
, and like
, is a
uof .
the Violite
X, the
 Violite
wone .
in the
wvery small .
.  If
 a sui
cannot be
din the
E, the
search the
path for a sui
 candi
the Violite
pof 988
at the end of the
a.  The
>and
in the DOS
not to be
the seconds field of the
!set to "56".  The
can be
in the
5in all Violite
 "Vio-Lite, TAA, Virulent Graffiti, (k)
 "PATH=*.
 The Violite
maintains a counter
in its
 is intended to be the generation number of the particular
 of the
counter r
Qes a value of 10, the
 may
Mthe
as a
 See:
PZPAPN
Viper
:  Viper
 Viper Dropper
fail to
 Australia
R:  840
5:   ONAK -
, NAV,
 The Viper
was submitten in
.  It is
fAustralia.  Viper is a
 of .
-and .
.  It
Viper is
X, the Viper
wup to four
in the
E.  .
be selected
b, and
lthe
b840
the Viper
.  Unless the
_pre-
was less
be no
3to the
in the DOS
were
less
 840
now be 840
`as Viper is
all of the .
-and .
in the
Viper, the
Zof the next
in the
L, and
 the
ed to the DOS prompt:
 "-/\-] S.C.P. [-/\-
 Welcome, you
ljust joined the SCP Wasted
 Victims club!, yep
s right.. your've got
 the ViPER-I
!  and Lord Venom wont even
 charge you for it!. NO CRIPPLE WAREZ HERE!!!
 Copyright by Lord Venom & S.C.P. Australia
of Viper are:
 Viper Dropper: The
sample of the Viper
copy is completely un
 Wiggers:
on the Viper
, Wiggers is
 a 666
vfour .
Wor .
lthe
b666
by the
 Wiggers
5.  The Wiggers
Mone of
 the
 usually
ring
hang:
 "We
lNoticed
Wiggers Seem To
lTake Over The High
 School Scene.  If You See One, Please Hit Him
Your Car!"
too big to fit in
 The
fthe
, along
, is
in the
PZPAPN
Viperize
:  Viperize
R:  934
5:   PNCK -
, NAV,
1.53S+,
.2.0+
 The Viperize
.  Its
.  Viperize is a
,.  It is
on the
Viperize is
X, the Viperize
wone .
in the
 934
at the end of the
 The seconds in the
stamp in the
!set to 62.  The
can be
 the Viperize
 "PATH="
 Viperize
on a random basis, at
Mthe
 "THE VIPERIZE VIRUS STRAIN A
 (c)
, STINGRAY / VIPER
 WITH AFFECTION TO BRENDA M.G.
 ONE OF THESE DAYS, YOU'LL BE MINE!
 AND -YOU- WILL FRY. FUCK YOU MCAFEEE."
 The
corrupt the
and hang the
of Viperize are:
 Viperize-B:
to the
has two
 See:   Generic
PZPAPN
VirDem
:  VirDem
 VirDem 2
 Endangered
G:  1986-1987
 Germany
R:  1,236
5:   PNC -
/, NAV,
\, or
 The VirDem
was written in 1986-1987 by Ralf Burger of
 Germany. The
distributed in
Vas a
 demonstration
, to assist computer
s in understanding
 how a computer
operates.
 The VirDem
is not
, and
`on the A:
O.  It
always skip the
 the root
E, so normally it
,.  It
`past the second sub
Eon the
were
less
1,500
be 2,616
t.  .
 greater
1,500
 1,236
X, VirDem
wthe next
 candi
9the
 followed by the
sthe .
 the
play a "game"
you, starting
 " VirDem Ver.: 1.06 (Generation #) aktive.
 Copyright by R.Burger 1986,1987
 Phone.: D -
is a demo
 computer
es. Please put in a
 number now.
 If you're right, you'll be
 able to continue.
 The number is between
 0 and #
 (Note: I
lremoved the phone number here, but it
s where
x is
.  Where # is, the
's generation number
, you must guess the correct number and enter it.  If
 you put in the wrong number, you get the
and your
is not run:
 " Sorry, you're wrong
 More luck at next try
 If you guess the correct number, you receive the
 and your
 " Famous. You're right.
 You'll be able to continue.  "
 Finally,
all the candi
`on the A:
r, the
 " All your
 struck by VIRDEM.
-now."
 VIRDEM.
-was the
distribution
9ing the
 and had a VIRDEM.DOC
aincluded
it.  VirDem is not
 widespread, and is not destructive.
of VirDem are:
 VirDem 2:
to the
, the major
 difference is
!translated
 to German.
 VirDem-833:
on the VirDem
, VirDem-833
vone .
ain the
pof 833
at the
"of the
a.  The
 and
in the DOS
not be
.  The
in the
 VirDem-833
 "\ * *.
 "\ IRUS S"
 VirDem-833
 on any Monday starting in
.  At
, a "bug"
traverse the top of the
fleft to
 right, and the
 be corrupted by the
 See:   Burger   Twin Peaks   VirDem-792   VirDem-1542   Wonderful
PZPAPN
VirDem-792
:  VirDem-792
R:  792 - 1,526
5:   PNCK -
n, NAV,
 The VirDem-792
.  Its
~are
.  VirDem-792 is a non-
uof .
,.  It is
on the VirDem and Burger
VirDem-792 is
X, the VirDem-792
search the
Oand
Eto locate the
a.  If
E, it may
r.  If an
d, the VirDem-792
wit, and
 the
 VirDem-792
pof 792
)if the
_pre-
was at least 736
`whose pre-
was less
to 1,528
tof the
 VirDem-792
.  The
at the
 the
a, and the
>and
in the DOS
 The
can be
in the
 VirDem-792
 "*.com *"
?exe"
?com"
 "Generation"
cthe word "Generation", a number can be seen.
number
 is the generation number of the
a.  It is
 incremented by one and stored in the newly
`.  The
 Generation number
Nn't
to ever be reset, so it should be
 possible to trace to
extent the order of
 See:   Burger   VirDem   VirDem-1542   Wonderful
PZPAPN
VirDem-1542
:  VirDem-1542
j; access to unexpected
R:  1,542 - 3,028
5:   PNCK -
, NAV,
 The VirDem-1542
.  VirDem-1542
 is a
uof .
`.  It
 not
,in the C:
Oroot
E.  VirDem-1542
on the VirDem
VirDem-1542 is
X, the
access the C:
O, searching the
Estructure to
 locate an
,in the C:
Oroot
E, to
r.  If an
, the
wit.
by 1,542
), however if
was less
3,028
 3,028
 VirDem-1542
access the
 look for a
VirDem-1542 may
 executing
symptom is
if an
rcopy of the DOS
Ureading FAT 88
 Probable non-DOS
 Continue (Y/N)?"
 See:   Burger   VirDem   VirDem-792   Wonderful
PZPAPN
 Research
?, 1989
i; TSR
 District of Columbia,
R:  857
5:   PRC -
 NAV 3.0+,
\, or
 The
distributed in
?, 1989 by
 Patrick Toulme as an "educational tool",
source
for sale.  In
, the author contacted the
 sites where he had uploaded the
requesting
remove
, his having decided a live
was not a
 "good idea" for an educational tool
#contacted by
 several
authorities.
 The
cdescription was
by Patrick Toulme in
for inclusion in
educational, research
was written by Patrick Toulme to
 aid developers in understanding
    and in creating
-resistant software.
is a simple
Oand advises the
aon a
 floppy
Kis to be
r.  Of course, no damage
 the
and all
`advise the
of the
 upon
Z.  The safeguards provided by the author prevent
 accidental
tand the disassembly of the
5is extremely
 difficult.  Upon request
fthe
community,
-90 is
 now
to approved anti-
researchers."
 See:
PZPAPN
 Research
 TSR; BSC; .
i(floppy
 District of Columbia,
R:  2,560
5:   PRAFK -
\, NAV,
n1.05+,
1.25+
 The
-101 is the "big br
" of
-90,
written by
 Patrick Toulme as an "educational tool" in
, and employs an encryption scheme to avoid
 detection on
`.  It
,, and all
 execu
it has
rall the
`on a
J, it
wthe
.  It
vfloppy
Iin its
 The
cdescription was
by Patrick Toulme for
 inclusion in
-101 is a sophisticated, continually encrypting, research
written by Patrick Toulme, author of
-90.
vboth
-and
`and
evade most anti-
 software and
continually encrypt
to prevent
 non-algorithmic search
is not
to the
 general public and is presently used by government agencies and
 corporate security departments to test anti-
software and
kware devices."
 See:
PZPAPN
Vivaldi
:  Vivaldi
i; TSR
R:  4,102 - 4,112
5:   PRsE -
, NAV,
/2.0+,
 The Vivaldi
.  Its
~, are
.  Vivaldi is a
uof .
 The
the Vivaldi
X, the Vivaldi
 a low
TSR of 4,160
{21 and CC
mby Vivaldi in
the Vivaldi
, it
pof 4,102 to 4,112
at the end of the
a.  The
>and
in the
 DOS
not be
.  One
 can be
din the
5in Vivaldi
 "VIVALDI"
 It is
what Vivaldi
PZPAPN
:  VMem
G:  May,
i; VMEM.SYS hidden
acreated; CONFIG.SYS
 Israel
R:  3,291
5:   PRsAK -
2.58+,
6.60+,
n1.05+,
2.58+,
6.64+
 The VMem
}in Israel in May,
.  VMem is a
employs
technology to avoid
 detection by
utilities.
bVMem
X, the VMem
create a hidden
a, VMEM.SYS, in the
 root
hidden
be 3,275
 and
lits
>and
set to either all blanks or the
>and
, the VMem
>the CONFIG.SYS
ain the root
Eto add the
cline:
 "device=\vmem.sys"
 If CONFIG.SYS
Nnot exist in the
O's root
 the
create one
9ing the
line.
has completed
process, the
run.  The
is not yet
 The next
&s the
 had the VMEM.SYS
created and its CONFIG.SYS
 the VMem
as a device
, as
qby the DOS
3,696
mby VMem in
the VMem
, it
pof 3,291
at the end of the
a.  The
>in the
 DOS
lhad its day set to "00".  The VMem
hides the
pand the
3in the
>'s day
it is
.  The
 can be
din VMem
 "DOS50VMS" or "DOS33VMS"
 "LLP"
 The
in the VMem
 are not
 "TERMINATOR"
-SPEC"
 "VMEM"
the VMem
crashes
.  The DOS
not indicate
PZPAPN
Voice-1495
:  Voice-1495
i; TSR;
R:  1,495
5:   PRsA -
, NAV 3.0+,
V112+,
n1.05+,
.2.0+,
V113+
 The Voice-1495
.  Its
.  Voice-1495 is a
uof .
-and .
, but not
bVoice-1495
as a low
mby the
.  The
be accessed at
, and the
 may notice a scraping sound coming
fthe
the Voice-1495
, it
 and .
in the C:
Oroot
 1,495
at the end of the
is unable to determine
it has
a, so it
tadds an
1,495
)to the
a.  The
>and
in the DOS
to the
>and
the last
tof the
.  The
can be
in the
5in all Voice-1495
 "VOICE V1.01"
 The
in the
5, and
 is thus not
 "C:\*.
-C:\*.
jfrequently
PZPAPN
Voodoo
:  Voodoo
, 1994
may not function
R:  4,745
5:   PNA -
\2.10g+,
6.60+,
n1.04+, NAV 3.0A02+,
2.11a+,
2.58+,
V114+,
V113+,
2.58+
 The Voodoo
, 1994.  Its
.  Voodoo is a
uof .
-and .
, but not
a Voodoo
 one .
-or .
in the
pof 4,745
at the
"of the
a.  The
>and
in the DOS
to the
>and
 The
in the Voodoo
 "*.com"
 "*.exe"
 "Do ya know it's Vesselin Bontchev's birthday 2day?"
 "He studies how 2 kill virii like
 "Yar probably happy
r people like him.. so.."
 "why not write him a birthday
 "the adress is :*[e-mail]..."
 "Just remember 2 say we put ya up 2 it... :-)"
 "Bontchev's Birthday (c) [VooDoo]"
 "temp.com"
PZPAPN
Voronezh
:  Voronezh
R:  1,600
5:   PRhA -
\, NAV,
 The Voronezh
.  It is
fthe
.  Voronezh is a
uof .
-and .
`, and
Nnot
 The
Voronezh is
at the top of
$the
'.  While the
reserves 3,744
, it
Nnot move the
mby the
reserve 24
on the
Madapter card.
Voronezh is
-and .
by 1,600
), the
at the end of
9the
 "Voronezh,
2.01".
 It is
of Voronezh are:
 Voronezh B:
to the Voronezh
, the
 major difference
Voronezh B is
Voronezh B
 any reason.  The
did not
 open.  The
qfor Voronezh is
 See:   Voronezh-370   Voronezh-Chemist
PZPAPN
Voronezh-370
:  Voronezh-370
 370-B
i; TSR;
R:  370
5:   PRsCK -
/, NAV,
 The Voronezh-370
 Its
.  Voronezh-370 is a
 of .
.  It
Nnot
 The
Voronezh-370 is
as a low
TSR of 1,712
).  It
Voronezh-370 is
, it
pof 370
at the
"of the
a.  The
>and
 in the DOS
to the
>and
 It is
if Voronezh-370
 See:   Voronezh   Voronezh-Chemist
PZPAPN
Voronezh-Chemist
:  Voronezh-Chemist
 Chemist, Video Mode, Voronezh-650
R:  650
5:   PRhCK -
, NAV,
 The Voronezh-Chemist, or Chemist,
.  Its
it is related to the Voronezh
 and Voronezh-370
es.  Voronezh-Chemist is a
uof .
 The
the Voronezh-Chemist
at the
 top of
$the
 and
@by 2,048
|12's
!moved.
{21 and
mby the
Voronezh-Chemist is
, it
pof 650
 the
"of the
a.  The
>and
 the DOS
 The
can be
in the
 all Voronezh-Chemist
 "Video mode 80x25 not supported"
 "16.01.91, v1.00"
 It is
if Voronezh-Chemist
of Voronezh-Chemist are:
 Voronezh-650:
to the Voronezh-Chemist
has three
 differ.
 See:   Voronezh   Voronezh-370
PZPAPN
:  Vote
R:  1,004
5:   PNCK -
/, NAV 3.0+,
8/93+,
.2.0+
 The Vote
.  It is
(.  Vote is a
uof .
the Vote
X, the Vote
wthe
in the
E.  If
Vote, the
wit.  The
run.
, .BAT
a, or DOS
6, a
hang
usually
the Vote
pof 1,004
)for
tof Vote
in the
 The Vote
at the end of the
a.  The
>and
in the DOS
not be
of Vote are:
 Vote-1000: A later
of the Vote
 not re
.  It
vone of the
bfour
`in the
pof 1,000
 the end of the
a.  The
>and
in the
 DOS
not be
.  Vote-1000
attempt to
 the
may be in cyrillic and is thus