Virus Database

Face.1281

Description Face.1281

It is a dangerous memory resident encrypted parasitic virus. It hooks INT 8, 21h and writes itself to the end of COM and EXE files that are executed or opened. INT 8 (timer) hook is used in virus encryption engine. The virus has a bug and in some cases infects data files that are opened, that can corrupt these files. The virus contains the text strings:
.EXE.COMCOMM
FACE! Virus v0.11 (c)1998. The FINAL Release at the FACE's Generation

Check other viruses! Be aware! Use Antiviral Software

IRC-Worm.Godog.a

Description IRC-Worm.Godog.a

This is a virus worm that spreads via IRC channels. It is a DOS program, and when run, it copies itself to the MIRC directory (if MIRC software is installed) with the "GhostDog.exe" name, and creates the SCRIPT.INI mIRC script file here. This script contains instructions that send a worm copy to users that enter the infected IRC channel. The script also hides messages if they contain the "virus" or "worm" words.
The main worm feature is the fact that it generates polymorphic instructions in the SCRIPT.INI file. These instructions are mixed in order; characters are randomly uppper and lower-cased; there are a random number of random comment-lines here, for example:
n0=$40Yw840RIGlx6Amlp7G0JaZ4QTs840N
n1=On 1^tExt^*WoRm*^*^{ /Ignore $nick | /closeMsg $NiCk }
n2=$HyX5NMq840KBAfrpTGfj7Z0DuT5J6m840GXWb1lQcbe7V0ZpT5F5j840CTRwihMYW
Despite the strange appearance, the script commands maintain their functionality.

IRC-Worm.Kazimas

Description IRC-Worm.Kazimas

This is an IRC virus-worm that spreads itself via mIRC channels. It appears as a MILBUG_A.EXE DOS EXE file about 10Kb in length. When it is executed, it copies itself to several disk directories under different names:
C:WINDOWSKAZIMAS.EXE
C:WINDOWSSYSTEMPSYS.EXE
C:ICQPATCH.EXE
C:MIRCNUKER.EXE
C:MIRCDOWNLOADMIRC60.EXE
C:MIRCLOGSLOGGING.EXE
C:MIRCSOUNDSPLAYER.EXE
C:GAMESSPIDER.EXE
C:WINDOWSFREEMEM.EXE

The worm then infects the installed mIRC client in the C:MIRC directory: it creates a new script file SCRPT.INI and overwrites the MIRC.INI configuration file. If the mIRC client is installed in any other path, the worm fails to infect it.
The worm modifies the MIRC.INI files that customize the mIRC client. There are several options set, for instance a user's identity is set to "kazimas", and the additional script file SCRPT.INI is included in auto-run scripts.
The SCRPT.INI file, that is dropped by the worm, contains several instructions that switch a user to the "Chat2K" channel, send messages to there, and the most important: send to the channel the worm copy (the C:WINDOWSKAZIMAS.EXE file).
The worm also overwrites the C:AUTOEXEC.BAT file with instructions that restore worm's copies (if they are erased) and execution:
@copy c:windowssystempsys.exe c:windowskazimas.exe >nul
@copy c:windowskazimas.exe c:kazimas.exe >nul
@c:kazimas.exe >nul
@cls

Home