Virus Database

Emorph.1696

Description Emorph.1696

It's a not dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM-files that are executed. On infection of the third file it hooks INT 8, 10h, 13h also and manifests itself by different methods: launch a ball (see "Ping-Pong"-virus), changes the font table for several characters, displays the message:
[1993 por JMC Ver 1.1]

It contains the internal text string also:
E-Morph

Check other viruses! Be aware! Use Antiviral Software

Konrad.999

Description Konrad.999

This is a dangerous, non-memory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the end of the file. On November 9th, the virus hooks INT 13h, and sounds upon accessing to the hard drive. The virus does not leave an INT 13h handler as a memory resident program, and after host-program termination, the computer halts.
The virus contains the following texts:
ZuSe by DiGiTAL
by DiGiTAL [TECHNO]logies
+-------------------------+
|Name: KoNrAd ZuSe 1.0 |
|ORiGiN: Ost-Berlin (FRG) |
|Creator: -= DiGiTAL =- |
|Size: 999 bytes/501 bytes|
|last UpDate: 04-28-93 |
+-------------------------+
| not resident |
| infects COM-files only |
| uses SeLf-EnCrYpTiOn |
| RuN-TiMe oPeRaTiOon |
+-------------------------+
Grz2: ThE GuYz FrOm ThE FeZ, !TWIN, SyNeC, RoY, WaNgLeR 'n'
all -= (*) TELEKOMiKER (*) =- (kotz,brech,ätz,krepel,übergiball

Kontragapi

Description Kontragapi

It is a dangerous memory resident polymorphic parasitic virus. The virus does work only if system date's year is 1998, otherwise the virus does not install itself into the system memory. While installing the virus hooks INT 21h and writes itself to the end of COM files that are accessed. The virus corrupts several anti-virus programs: if filename begins with F-, TB, AV, VIR, SCAN, KILL (F-PROT, TBAV, AVP etc), the virus writes to the file header a small program that displays the message:
kontragapi

This is the "Entry Point Obscuring" virus, i.e. there is no JMP_Virus instruction at the file header. The virus uses one of standard tricks to write the JMP_Virus to the middle of the file: it reads file header, disassembles it at looks for suitable place for the JMP_Virus code.

Home