HMA_Boot.b
Description HMA_Boot.b
This is a harmless memory resident multipartite virus. It copies TSR code to HMA memory and hooks INT 21h. It creates a file-dropper in root directory of C: drive and appends to the end of C:CONFIG.SYS file the instruction to load this file into the memory ("INSTALL="). The virus also infects boot sector of A: drive when a program that are executed on A: drive calls GetContryInfo DOS function (AH=38h). While loading from infected floppy disk the virus also hooks INT 1Ah.
It contains the text string:
C:CONFIG.SYS INSTALL=HMABOOT
Check other viruses! Be aware! Use Antiviral Software
Foo.956
Description Foo.956
It is not a dangerous nonmemory resident encrypted parasitic virus. It searches for COM files in current and in parent directories, then in C:WINDOWS directory and infects not more than three files found. While infecting the virus writes itself to the end of the file. The virus pays attention to the internal self-checking Windows32 ability and fix the necessary date ("ENUNS" field at the end of Windows COM files) while infecting them.
The virus uses anti-debugging tricks. On 29th of any month it displays the message and halts the computer:
--FOO VIRUS--
WE'RE ALL STARS NOW, IN THE DOPESHOW
MADE IN THE UK, WE EXIST..
Forever.912
Description Forever.912
It is not a dangerous memory resident parasitic virus. It traces and hooks INT 21h and writes itself to the end of EXE files that are executed. The virus contains the text string:
No WINDOWS, MS-DOS foreverall
|