Virus Database

HLLP.Deftones.8576

Description HLLP.Deftones.8576

It is not a dangerous nonmemory resident parasitic virus. While installing into the system the virus copies its file to the Windows system directory with the D3F70N3S.COM filename and registers it in the system registry to be run each time any another application starts. The virus does that by creating a new key in the HKEY_CLASSES_ROOT, the key name is exefileshellopencommand and it is associated with the virus copy (with the D3F70N3S.COM file that was created in the Windows system folder). The virus infects all files, which are executed through it. Before executing infected file the virus renames its extension to ".COM".

Check other viruses! Be aware! Use Antiviral Software

CyberTech Family

Description CyberTech Family

These are harmless nonmemory resident (CyberTech.647,914,1313 are memory resident ones) parasitic encrypted viruses. They search for COM files, then write themselves to the end of the file. If the file name is COMMAND.COM some of these viruses insert themselves to the file end without increasing the file length (see also "Lehigh" virus).
"CyberTech.222,647" are not encrypted ones.
"CyberTech.439,444,454" contain the text string: "CAVAGUCO4DVSTB" and do not infect the files with names which begins from two letters from that string (CA*.*, all , 4D*.*, VS*.*, TB*.*). These viruses also contain the text strings:
"CyberTech.439": [NoLimit] John Tardy / Trident
"CyberTech.444": John Tardy / TridenT
"CyberTech.454": [NoLimit2] John Tardy / Trident

"CyberTech.501" contains the text strings:
I scream, you scream, we both scream for an ice-cream!
[TridenT]
John Tardy

"CyberTech.552" contains the text strings:
Mourners of a dying world
Too late to reconcile
Into Everlasting Fire
Can't you see it's Satan's world
TRIDENT
John Tardy

"CyberTech.503" displays:
RTL4
Joop van den Ende Produkties BV
Marco Daas (Casting Assistent)
Postbus 397
1430 AJ AALSMEER
van Cleeffkade 15
1413 BA AALSMEER
The Netherlands
Wedden dat... je een virus hebt?

"CyberTech.647" contains the text strings:
[90210 BH]
John Tardy / Triden

"CyberTech.Caco.664,668" contain the text strings:
(C) 1992 John Tardy / Trident
Satan spawn, the Caco-Daemon - Mor(T)alities Death

In 1993 "CyberTech.1076,1078", or in 1994 "CyberTech.1066,1215,1228" removed themselves from the host file and displayed:
The previous year you have been infected by a virus
without knowing or removing it. To be gentle to you
I decided to remove myself from your system. I suggest
you better buy ViruScan of McAfee to ensure yourself
complete security of your precious data. Next time you
could be infected with a malevolent virus.
May I say goodbye to you for now....
CyberTech Virus - Strain A
(C) 1992 John Tardy of Trident

CyberTech.914,1313
These are memory resident viruses. They hook INT 21h and write themselves to the end of COM files that are accessed. "CyberTech.914" also hooks INT 1Ch and forces system timer to decrease its counter instead of increasing. These viruses contain the text strings:
"CyberTech.914": | Trapped in a spell of the Necromonicon |
"CyberTech.1313": [ "Thunderdome" virus by John Tardy / TridenT ]
Created in Holland, released near Bolzano/Italy.
This virus is made to test the spreading rate of viruses in Italy. It is not
ment to be destructive, however, some programs might not work anymore,
because of CRC-checking. I am sorry if I accidentally corrupted one of your
programs, but HEY! That is how life is, eh? Try to get our virus collection!
and try TPE, or DMU (another one, more compact and also very complex!).
Greetings go to all other virus writers!

CyberWarrior.818

Description CyberWarrior.818

It is a harmless nonmemory resident parasitic virus. It searches for COM files in current directory, then writes itself to the end of the file. After infecting it decrypts and displays the message:
**************************************************************
* Crate Date: 03.07.1999 Version: 1.20 *
* Last Modification Date: 06.07.1999 Name: Cyber Warrior *
* We are outta here! *
**************************************************************

Home