Virus Database

GraveLion.2250

Description GraveLion.2250

This is a relatively harmless memory resident multipartite polymorphic virus. When an infected file is executed, the virus infects the MBR of the hard drive and returns to the host program. While loading from an infected disk, the virus hooks INT 8 and INT 9, waits for DOS loading and hooks INT 13h and 21h, and writes itself to the end of COM and EXE files that are executed, opened or renamed.
The virus uses quite a complex stealth routine to hide infected MBR. First, the virus does not put its code to the MBR - it just writes its code to the disk starting from the second disk sector and modifies the address of the active boot sector in the disk Partition Table (see also "Starship" virus). While accessing the infected MBR by INT 13h calls, the virus redirects these calls to the original MBR that is saved in the 7th sector on the disk. When the files B*.EXE, F*.EXE, T*.EXE (direct disk access anti-viruses?) are executed, the virus temporarily disinfects the infected disk.
If an error occurs while loading from an infected disk, the virus displays the following:
Access to Hard Drive deniedall

The virus also contains the text:
[ü ¿ ûÑ"Ñ¡ ] v1.0 Copyright (c) 1995 Grave Lion

Check other viruses! Be aware! Use Antiviral Software

Lation.897

Description Lation.897

It is a dangerous nonmemory resident parasitic virus. It searches for .EXE files, then writes itself to the end of the file. The virus also searches for some non-EXE files and patches (corrupts?) them. The virus contains the text string:
fUCKUp(C++), by <mutilation.h> 1997

Laufwerk

Description Laufwerk

It is a harmless nonmemory resident companion virus. It searches for .EXE files of the subdirectory tree of a random selected disk, renames the file that is found to the random selected name, and writes itself instead of original file.
Being executed the virus searches for the files and infects them, then it executes the host file that was renamed. This virus contains the text strings:
.exe Laufwerk:
Runtime error at .
Portions Copyright (c) 1983,90 Borland

Home