Gobot family
Description Gobot family
These are very dangerous nonmemory resident encrypted overwriting viruses. They search for COM files in the current directory, then overwrite them, display the message and return to DOS:
Parameter value not in allowed range
If there are no COM files in current directory, the viruses display the standard Windows' error message:
WARNING!
The system is either busy or has become unstable. You can wait and
see if it becomes available again, or you can restart your computer.
* Press any key to return to Windows and wait.
* Press CTRL+ALT+DEL again to restart your computer. You will
lose unsaved information in any programs that are running.
Press any key to continue
The viruses also contain the strings:
GOBOT virus written 24th March 1997 in New Haven, CT
_________ _______ ___________ _______ __________
___________ ___________ _____________ ___________ ____________
___ ___ ___ _____ ____ ____ ___ ______ ____ _
____ ____ ____ ___________ ____ ____ ____
____ _________ ____ ________________ ____ ____
_____ _____ _____ ___ ____ _________ ___ ____
___________ ___________ ___________ ___________ ____
_________ _______ ___________ _______ _____
________ _____ ________ _______
__________ _________ __________ __________
___ ____ ___ _________ ________ ____
_______ ____ __________________________
_______ ____ ____ __________ __________
___ ______ ___ ___ ____ ___ ____
___________ _________ __________ __________
__________ ______ ________ ________
Check other viruses! Be aware! Use Antiviral Software
Hate.971
Description Hate.971
It is a harmless memory resident encrypted virus. It hooks INT 21h and writes itself to the end of .COM and .EXE files except COMMAND.COM that are executed. In May is erases CMOS, and fills the screen with the string:
Klaeren Hac, Hac!
and blinks with NumLock, CapsLock and ScrollLock indicators.
Hatev.524
Description Hatev.524
It is a harmless memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are executed. The virus does not manifest itself. It contains the text string:
THIS IS [HATE V1.0] VIRUS
|