Virus Database

Alfa.3072

Description Alfa.3072

It is a dangerous(?) memory resident multipartite virus. While executing an infected file or loading from an infected floppy disk the virus infects the MBR of the hard drive. Then the virus hooks INT 13h, 21h and writes itself to the end of COM and EXE files that are executed. While accessing to floppy disks the virus infects the boot sector. Depending on its generation the virus may corrupt the CMOS.

Check other viruses! Be aware! Use Antiviral Software

Eddie family

Description Eddie family

This is the family of memory resident parasitic viruses. They hook INT 21h and write themselves to the end of the files. These viruses contain the strings:
"Eddie.651": Eddie lives
"Eddie.1797": McAfee and Associated (C)1992
Diana P.
This program was written in the city of Sofia
(C) 1988-89 Dark Avenger
"Eddie.1799": Francis livesallin Hong Kong!
Diana P.
This program was written in the city of Sofia
(C) 1988-89 Dark Avenger
"Eddie.1800": Eddie lives...somewhere in time
Diana P.
This program was written in the city of Sofia
(C) 1988-89 Dark Avenger
"Eddie.1800.b": Never buy Quest computers again!
This program is not dangerous stamp.
All new software seriosly danger
"Eddie.2000": ä¿á¡á Å.
(c) 1989 by Vesselin Bontchev
Zopy me - I want to trawel
"Eddie.2100": ä¿á¡á Å.
(c) 1989 by Vesselin Bontchev
Eddie lives
"Eddie.2000.b": 1994 Satan Virus[ Ver 3.09 ]
1994 by [Mad Satan] in TAIWAN.
"Eddie.2000.c": Only the Good die young...
(c) 1989 by Vesselin Bontchev.
"Eddie.2000.d": go, go with a smile (CK)
by McAfee Associates. (408-38

Eddie.651
This virus infects COM and EXE files that are executed. It sets the file's time stamp to 62 sec. The virus does not manifest itself in any way, it
The virus hooks the DOS functions FindFirst/Next FCB (DIR command) and "reduces" lengths of infected files. During "reducing" the file lengths the virus determines their state of health using the value of seconds in the date of the last modification (62 sec.) and does not check actual lengths of the files. If such value of seconds is found in a file of small length (less than 651 bytes), than the DIR command will show a strange length of the file - about 4 Gigabytes.
Eddie.1800
It is a dangerous memory resident virus. It hooks INT 13h, 21h, 27h and spreads quickly: it infects COM and EXE files that are loaded into memory for execution, created, renamed, opened and closed.
The virus takes some effective measures to stay undetected:
on running any program it marks the program segment as the last one, and becomes invisible for this program, after the program operation is finished, the virus marks the program segment as not the last one.
by the same way changes the interrupt vector 21h as a program is started - restores its initial value.
does not allow programs to change the interrupt vector 21h and in this way protects itself from memory-resident anti-viruses, installed after the virus has been activated.
attempts to bypass programs, watching for interrupt 13h, and to set this interrupt vector to its initial value.
This virus is very dangerous one, periodically it erases a sector with a random number. The virus analyses 2 bytes (8-th and 10-th) of the boot sector of the disk, from which the infected program has been started. This infector increments by 1 the value of the 10-th byte and saves it into the boot sector. If a new value of the 10-th byte is a multiple of 16, the virus erases on the disk a sector with a random number, which depends on the value of the 8-th byte.
Eddie.2000, Eddie.2100
These are very dangerous viruses. They hook INT 13h, 21h, 27h and quickly replicate themselves. They infect a file as it is loaded into memory for execution, created, renamed, closed, read or as its attributes are changed.
The viruses act in such a way, that the lengths of infected files increase exactly by 2000 (or 2100) bytes (to EXE files after paragraph alignment the necessary number of bytes is added). In infected files a new value of seconds in the date of the last modification is set - 62 seconds.
The "Eddie.2000" virus takes some effective measures to stay undetected, many of them are similar to those, taken by the "Eddie.1800" virus. The masking function is performed by the virus length: it is difficult enough to spot the length increase, multiple of 1000 bytes. Other protective function has as well been introduced: the virus hooks the Dos functions FindFirst and FindNext FCB and "reduces" lengths of infected files by 2000 bytes.
In addition "Eddie.2100" handles the DOS functions FindFirst/Next ASCII; the error because of which the DIR command reported that the file length was about 4 Gigabytes (see description of "Eddie.651") has been corrected. In incomprehension manner the "Eddie.2100" manipulates with hard disk sectors - possibly tries to activate or cure a boot virus unknown to me.
The "Eddie.2000" and "Eddie.2100" viruses are very dangerous - as the "Eddie.1800" virus they erase sectors with random numbers. The viruses directly address to the disk handling driver and bypass many memory resident antiviral monitors.
If the body of a program to be run has the string "Vesselin Bontchev" (author of known bulgarian antiviruses) the viruses begin to cycle and hang up the system.
Eddie.1028
It is a modification of "Eddie.1800": the text strings are overwrote by INT 1Ch handler. This handler contain the delay loop. The code of damage writing on disk are removed.
Eddie.1530
This is a dangerous virus. It resets computer and erases a part of CMOS.
Eddie.Father
It's a harmless virus. It contains the text:
In memory of my father.(C)Nduk '91

Eddie.Jasper
It is a very dangerous encrypted virus. It hooks INT 08h, 21h, 27h. Depending on system date it deletes the files or displays the message:
If You Liked This Virus,Call Asaf, At +972-4-225288!

It also contains the text string:
Written By Jasper,and Dedicated to Freddie Mercury.

Eddie.Jericho
These viruses contain the text strings:
"Eddie.Jericho.a": JERICHO by Eurystheus<FoG>*Calgary
"Eddie.Jericho.b": JERICHO*Eurystheus*Calgary AB

"Eddie.Jericho.b" is a harmless variant of "Eddie" virus. It does not hook INT 27h, and does not corrupt the disk sectors. It has the error in infection routine and does not infect EXE files.
Eddie.Korea
That plagiarism from "Eddie.1800" contains the texts:
If you are a thieve man, virus lives...somewhere always!
You must become good man!
Kang Yong Il.
This program was adjustted in 'Commputer Home' of KOREA
(C) 1988-89 ,LSR+KYL".

Eddie.Major
This virus is variant of "Eddie.1800". It contains the strings:
Written In Turbo Assembler v2.84
(C) 1992 MajorBBS Patch v1.0
This Program Was Written To Patch The Backdoor Of MajorBBS
(C) 1992 by Leroy Janowa

Eddie.Oliver
This virus contains the text strings:
Bill the Cat Lives!
by Oliver Wendell Jones
Politically Incorrect Personal Computers Presents:
the OLIVER VIRUS! Nya Ha Ha! Men Rule! America Kicks Butt! Rap Sucks!
Eat Fatty Food! Dames Melt Like Jell-O for Naughty Men!
Ted Kennedy Sucks Barney Frank`s Fag Cock!
Berk B.
Banana 6000 P.I.P.C. (C) I spell -Lightening- wrong!

Eddie.Psko
This virus contains the text strings:
The Ps!ko Virus - Version 1.0
SiTT
The Ps!ko Virus - Written in the USA, (C)1991 by SiTT and The Violator

Eddie.Satan.1800
Variant of "Eddie.1800", it contains the texts:
* Satan Virus * Satan Ver 2.09
- Satan Virus - 1994 Written by Mad Satan in TAIWAN. =Ver 2.09=

Eddie.Shyster
Variant of "Eddie.1800", it contains the text: "Shyster".
Eddie.Sign
It is also plagiarism of "Eddie.1800" (practically the same). It contains the text:
#.I.R. *-*-*-* Sign of the time! &^%s%c%d

Eddie.Uriel
From January, 15th it formats disk sectors. It has the bugs which can halt the system. It contains the internal text strings:
Uriel 1.00·Eur<FoG>

Eddie.Alexander
It's not a dangerous virus. It hooks INT 08h, 21h, 27h vectors and infects COM and EXE files. Sometimes it decrypts and displays the message:
+--------------------------------------+
| Apa depistata in microprocesor ! |
| Functionarea poate fi compromisa ! |
| Se recomanda oprirea calculatorului |
| citeva ore pentru uscare ! |
| |
| Alexander - Constanta, Romania |
+--------------------------------------+

and then plays a tune.
Eddie.Apa
This virus is not a dangerous one. It hooks INT 8, 21h, 27h and writes itself to the end of COM and EXE files on their execution, opening, renaming or changing file attributes. The virus also tries to infect the COMMAND.COM files of the root directory of the current disk. The virus contains the internal text ":COMMAND.COM". Sometimes it decrypts and displays the message:
Apa depistata in microprocesor !
Functionarea poate fi compromisa !
Se recomanda oprirea calculatorului
citeva ore pentru uscare !
Hellhound - Constanta, Romania

Edolan.832

Description Edolan.832

It is a very dangerous memory resident parasitic virus. It writes itself to the end of .COM files except COMMAND.COM. Being executed the virus hooks INT 21h and intercepts the execution of the files (AH=4Bh). While executing a .COM file the virus infects that file, then searches for *.COM files in the current directory and infects them, next the virus searches for *.DBF files and scans them for the string EDOLAN. If that string is found, the virus erases the sectors of C: and D: drives. The virus has a bug, as a result the infected files of small length being executed halt the system. The virus contains the text strings:
COMMAND.COM
*.DBF
*.COM

Home