Virus Database

Ginger Family

Description Ginger Family

These are harmless memory resident stealth multipartite viruses. While executing an infected file the viruses infect the MBR sector of the hard drive. While infecting the viruses correct only the physical address of the Active Boot Sector (from which DOS is loaded), the viruses set this address to 0/0/2 (cylinder/head/sector) and write their code and data to that and followed sectors. As a result the viruses correct only three bytes in the MBR. While loading from an infected sector the viruses hook INT 13h, 21h and write themselves to the end of COM and EXE files that are accessed. The viruses contain the text strings, several of them are in use when the viruses infect the files:
"Ginger.2774,2782":
You can't catch the Gingerbread Man!!
Bad Seed - Made in OZ
COMSPEC= COMMAND.COM
CHKDSK MEM
10/23/92

"Ginger.Orsam.2624":
Orsam - Made in OZ
You can't catch the Gingerbread Man!!
COMMAND

Check other viruses! Be aware! Use Antiviral Software

Babe.1584

Description Babe.1584

It is not a dangerous memory resident parasitic virus. It hooks INT 16, 21h and writes itself to the end of COM and EXE files that are executed. By hooking INT 16 (keyboard) the virus exchanges the keys that are pressed: Home<->End, Up<->Down, PgUp<->PgDn, Left<->Right, Ins<->Del. The virus gets its name after its "Are you here?" call that is performed when the virus installs itself memory resident: INT 21h, BX/CX=B0B0h/BABEh. The memory resident virus copy returns BABEh/B0B0h in BX/CX registers.

Babec.a

Description Babec.a

This is a relatively harmless memory resident boot virus. It hooks INT 16h and 21h, and writes itself to the BOOT sectors of floppy disks and to the MBR sector of the hard drive. Upon loading from a BOOT sector, the virus writes itself to the MBR sector. It writes itself to the BOOT sectors upon setting up a default disk by a DOS function. The virus does not manifest itself in any way.

Home