Virus Database

Anticmos

Description Anticmos

It is a dangerous boot and MBR infector. On booting from infected floppy it infects the MBR of the hard drive, then it hooks INT 13h and infects the boot sector of the floppy disks. While infecting a disk the virus does not save the original sector. Sometimes it erases the CMOS memory.
"Anticmos.Lixi" contains the string:
I am Li Xibin!

The virus infection routine is a little bit buggy: while infecting boot sectors on floppy drives it overwrites a part of boot sector system data (miscellaneous fields: volume label, serial number, file system ID, and some other fields that are useful on hard drive boot sector only). These data are overwritten by virus installation routine.
While disinfecting affected floppy disks many anti-virus programs leave this part of virus code as-is, and these "virus traces" can be detected by other anti-virus programs (for example, AVP detects them as an unknown variant of "Anticmos" virus). The AVP anti-virus disinfection routine cleans the virus correctly: it removes not only the rest of virus code, but this installation routine too, and floppy disks disinfected by AVP do not cause any alarms.

Check other viruses! Be aware! Use Antiviral Software

DeadBoot.446

Description DeadBoot.446

This is a very dangerous memory resident encrypted multipartite virus. It infects the MBR of the hard drive and overwrites boot sector on floppy disks as well as headers of EXE files that are copied to floppy disks. The virus encrypts the directories sectors on the hard drive, as a result after disinfection they stay not accessible. To detect its TSR copy the virus uses INT 13h call with AX=DEADh.

DeadHead.992

Description DeadHead.992

It is a dangerous nonmemory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the beginning of the file. The virus has bugs and often halts the system instead of infection. Depending on its data the virus corrupts the boot sector of the C: drive and displays the message:
[XtZ] by dEAdhEAd (StupidVir).

In case of error while infecting a file the virus displays the message and returns to DOS:
Incorrect D0S version

Home