Virus Database

Fault.9209

Description Fault.9209

It is a dangerous memory resident parasitic virus. While executing an infected file the virus checks the processor number and mode, and returns to the host program if the processor is not i386 or better, or the system is not in the real mode. If the processor is in real mode, the virus copies itself to the XMS memory and to the block of conventional memory, switches the processor to protect mode, and stays memory resident. Staring from that moment the DOS is working in V86 mode.
The memory resident virus consists of two copies. The first TSR copy is placed in conventional memory, and installation procedure of that code looks as installation procedure of "Jerusalem" viruses. This copy does not hook any interrupt vectors, but is hot hidden in the system memory in any way - the corresponding block is visible by using any memory browser. The virus uses that copy to infect the files, and calls it from the second TSR copy.
The second virus TSR copy is placed in XMS memory. As a supervisor it hooks all interrupts calls, and on INT 21h calls FindFirst/Next FCB (AH=11h, 12h) calls the first virus TSR copy (DOS copy) to infect the EXE files that are accessed.
The virus has the bugs and halts the system in lot of cases. If a program is performing a function that is not i8086 specific, the virus displays one of the messages and halts the system:
General Protection Fault. Halting system!
Unimplemented Fault. Halting system!

Check other viruses! Be aware! Use Antiviral Software

MBRExe.a

Description MBRExe.a

This is a memory-resident harmless virus that writes itself into EXE-files and MBR-sector of HD. The MBR-sector of the hard disk get infection when an infected file is started. The original MBR-sector is saved on the hard disk at the location 0/0/9 (head/track/sector). EXE-files are infected by the standard manner when the computer boots from the infected disk. The virus doesn't manifest itself in any observable way, hooks INT 21h.

MbrKiller.713

Description MbrKiller.713

These are very dangerous memory resident parasitic viruses. They trace INT 13h, 21h, then hook INT 21h and write themselves to the end of COM files that are executed. The viruses have a bug and often halt the system while infecting a file. On 4883rd (1313h) infection the viruses erase the MBR of the hard drive. The viruses contain the text string:
MbR killer v0.01

Home