Virus Database

Email-Worm.Win32.NetSky.q

Description Email-Worm.Win32.NetSky.q
This worm spreads via the Internet as an attachment to infected messages. It is also able to propagate via P2P networks and accessible http and ftp directories. The worm's main component is a PE EXE file of approximately 29KB. The worm is packed using FSG; the unpacked file is approximately 40KB inall

Check other viruses! Be aware! Use Antiviral Software

Bog.233.a

Description Bog.233.a

It's a harmless not memory resident parasitic virus. It searches for Windows EXE-files and infects DOS-part of them. It does it by quite interesting method. It uses the fact, that a lot of Windows EXE-files have a DOS part of code. That code is executed if the Windows EXE is started under DOS. Usually these DOS parts of code have the same format in different Windows EXE-files. These parts contain the warning message like "This program requires Microsoft Windows." and several assembler instructions that display this message and return the control to DOS. Usually these instructions are:
MOV AH,9
INT 21h ; display the message
MOV AX,4C01h
INT 21h ; return to DOS

This virus reads the first 80h bytes of the DOS executable code (below the EXE header) and checks it for "WIN" or "Win" string. If that string is found, the virus starts to search for the assembler instructions listed above. If that code is present, the virus writes into the file 233 bytes of own code from last INT 21h instruction:
MOV AH,9
INT 21h ; display the message
MOV AX,4C01h
CALL $+3 ; virus code starts here

On execution from MS-Windows infected files works as usually, on execution from DOS it displays standard Windows' warning message and then the virus starts to work.
The also virus contains the internal text string:
BOG (C) '93 by GROG - Italy

Boing.349

Description Boing.349

It is a harmless nonmemory resident encrypted parasitic virus. It search for .COM files and writes itself to the end of the file. It contains the string:
[BOING]

Home