Virus Database

GDIKill.1288

Description GDIKill.1288

This text was written by Alexey Podrezov, F-Secure Corp.
Being run it first goes to C:WINDOWS folder. Then it checks current date and if the month is not March it passes control to original WIN.COM code. If the date is 14th of March, the virus just deletes GDI.EXE, outputs a message and passes control to original WIN.COM code.
If the virus starts from a dropper (it checks 1 byte flag for that), it looks for WIN.COM file and infects it. The virus author planned that his virus would infect other COM files in case WIN.COM is already infected, but there's a bug in virus code and this doesn't happen. Also there's a routine in virus code that goes to FONTS folder and deletes all files there. But this routine is never activated.

Check other viruses! Be aware! Use Antiviral Software

Mity.1982

Description Mity.1982

It is not a dangerous memory resident multipartite virus. When an infected file is executed, the virus writes its code to the last sectors of C: drive and modifies the disk partition table in such way, that active boot sector address points to the virus code (see "Starship" virus). The virus then returns to the host program.
While booting from infected disk the virus hooks INT 13h, waits for DOS loading process, hooks INT 21h and then infects COM and EXE files that are executed. The virus writes itself to the beginning of COM file and to the middle of EXE files.
Depending on its counters the virus displays the text:
XXXX XXXX XXXXXXXX XXXXXXXXXX XXX XXX
XXXXXX XXXXXX XXXXXXXX XXXXXXXXXX XXXXX XXXXX
XXXXXXXXXXXXXXX XXXX XXXX XXXXXXXXX
XXXX XXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXXX
XXXX XXXX XXXX XXXX XXXXX

Mix.2280

Description Mix.2280

This is a dangerous encrypted memory-resident parasitic virus. It hooks INT 8, 9, 14h, 17h, 21h and writes itself to the end of COM files that are loaded into the memory.
The virus contains the text:
Strike the pauseVogue, you got to Let your body move with the music
I can leave you , say goodbye , i can love u if i try all...
Left to my own devices i probely could.
The virus manifests itself by changing some characters as they are sent to COM or LPT ports. It changes background color when Ctrl-Alt-Del are pressed, causes "characters falling", or launches a ball, bouncing around the screen frame. An infected file contains the text "Mix1" or "Mix2" at its end.

Home