Virus Database

Haifa.2352

Description Haifa.2352

These are very dangerous memory resident parasitic polymorphic viruses. They copy themselves to the system memory at address 9000:0000 or 8AA0:0000 and do not fix MCB list, that might halt PC. Then they hook INT 21h and write themselves to the end of .COM and .EXE files. Sometimes they print the screen (by INT 5 call), or halt the computer.
On May, 7th they display the message:
KIRYAT MOZKIN!!!
LOCAL PROCESS INDUS¿Uvs¿UurrrS DONE BY:
SIBEL ,TEACHES
HOW TO MANAGE SHEEP?
Thanks for using Turbo Anti Virus.
PLEASE JMP FE00:0

This virus writes to BAK files:
What is backup for anyway???
BackUp is usually unneccessary!
End..

and to DOC and TXT files:
What's 455260 MI COUNTACH 5000 CC???
Instead of reading this junk, think about it!

It also contains the texts:
DES of USA Y
COMSPEC=
the Great

They write to the .ASM and .PAS files a small source code:
.model small
.code
s: mov ax,310h
xor cx,cx
mov dx,80h
int 13h
end s

It also displays:
OOPS! Hope I didn't ruin anything!!!
Well, nobody reads those stupied DOCS anyway!
COMSPEC=HAIFA VIRUS V1.01
WRITTEN BY Y.S.
GUEST STARS: T.S. & I.F.
MADE IN ISRAEL
I AM TIRED. PLEASE WAKE ME UP ON TUE 12.4.3456
PRESS RESET TO CONTINUEall

and contains the text:
CONST VIRUS='HAIFA';

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Gurre

Description Macro.Word.Gurre

This macro virus contains three macros: AutoOpen, AutoClose, Form. On opening an infected document the virus affects the global macros area, documents get infection on saving. Starting from 21st of any month it formats the C: drive. The virus contains comments in Russian.

Macro.Word.Hades

Description Macro.Word.Hades

It is an encrypted macro virus. It contains only one macro AutoOpen and replicates on opening documents. It contains the text string "Hades".
On September 30 starting from 7:00 it sets a password for documents that contains random characters and the string " Hades". On December 5 it erases all files on the hard drive and pastes 9666 random symbols into the current document.

Home