Virus Database

Glew.4283

Description Glew.4283

This is a very dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed, opened or closed. The virus does not infect several anti-virus programs (TBAV, FVIRU, F-PROT, AVP, e.t.c.) and COMMAND.COM according to the string:
TB FV F- VS AV VIR HIE OOLK UARD SCAN CLEA MMAN
The virus intercepts KEY and SIG files opening, looks for some program in the memory (anti-virus?) and patches its code.
On January 3, 9 and on July 19 the virus erases the hard drive sectors and displays the message:
A la Memoria de Cevallitos
-= RATA de GLEW virus =-

Check other viruses! Be aware! Use Antiviral Software

Psr.1000

Description Psr.1000

It is not a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or searched. The virus places a transition command (code E8 xxxx - CallVirus) directly into the host file entry point and does not modify the file header:
File: Infected file:
+--------------+ +--------------+
|Header | |Header |
|--------------| |--------------|
|Program code |<-entry point |Program code |>--+<-entry point
| | | | |
+--------------+ |--------------| |
|Virus body |<--+
+--------------+

The virus contains the text string:
[PSR.OMG.ROAKMNEEDS TBAYM ]

PSW-Worm

Description PSW-Worm
If you receive notification that a PSW-Worm has been detected, this means that the file that has been scanned is a stored password protected ZIP file (stored means that the file is effectively uncompressed) which contains a file with one of the extensions from the following list:
bat
cmd
com
exe
pif
scr
Such files are often detected in connection with several mail worms which have been spreading recently in password protected files. In such cases, the password will be shown in the message body. When scanning such messages, Kaspersky Anti-Virus searches for passwords and then scans the attached file using the password found.
If no password is included, or if the attached file is scanned separately from the message, then the message will be flagged as suspicious when scanned by Kaspersky Anti-Virus with the heuristic analyser enabled. The file will be flagged as being 'possibly infected by PSW-Worm', as such files are characteristics of a range of mail worms.

Home