Virus Database

GmSpirit.2655

Description GmSpirit.2655

It is not a dangerous memory resident polymorphic parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. The virus does not manifest itself in any way. The virus contains the text strings:
[GM.Spirit]
[v1.10]
[Author: Green Monster, Russia]
We live in XMSall

The virus uses many complex programming tricks:
- it stores its TSR copy in the XMS memory and leaves in DOS memory just a small routine that hooks file execution, then allocates a block of DOS memory, copies to there the main virus body from the XMS, and executes it;
- when other programs are executed, the virus is able to move this routine in DOS memory;
- to intercept file execution the virus scans DOS kernel and patches DOS handler code with JMP_Virus instruction;
e.t.c.

Check other viruses! Be aware! Use Antiviral Software

not-virus:Joke.Win32.JepRuss

Description not-virus:Joke.Win32.JepRuss
Jep/Russ is a joke program - it is not a virus or a Trojan program. It displays too scaring messages that can really frighten users. When this program launches it displays a standard message window with the text:
Please Wait. Initialisingall

In a moment it displays a dialog box with the following text:
Confirm Folder Delete
Are you sure you want to delete the folder [Windows] and all its contents ?
[Yes] [No]

The '[Windows]' reference designates the directory where Windows is installed. Regardless of a user's reaction, including sitting motionless afraid to touch any key, the program then displays the standard Explorer and 'File Deleting' windows and proceeds to emulate the file and folder deletion process. When the fake display indicates 'no files remaining', 'Jeb/Russ' displays the standard Windows shut-down menu with disabled (gray) [No] button and the following text:
Shut Down Windows
Windows has detected there is no system software on your computer

(*) Shut down the computer?
( ) Restart the computer?
( ) Close all programs and log on as a different user?

[Yes] [No] [Cancel]

The below message is then displayed:
Thank god this is only a game...

Note: The detection process for this joke program has been added to AVP database.

Not.574

Description Not.574

These are harmless memory resident parasitic viruses. They hook INT 21h and write themselves to the end of COM files that are executed. The viruses do not manifest themselves in any way.

Home