ID.166
Description ID.166
These are memory resident parasitic viruses. They copy themselves into DOS data area at address 0060:0000, hooks INT 21h and write themselves to the end of COM-files that are executed.
"ID.166" also hits EXE-files, and corrupts them. These files halt the system when executed.
"ID.248" is a harmless virus. It does not manifest itself. It contains the text strings:
ID
Fuck you
Check other viruses! Be aware! Use Antiviral Software
Li.1178
Description Li.1178
These are not dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of COM files that are executed.
"Li.1178" checks input from DOS prompt and on entering "pajama" it displays: "Welcome Great One!". In some cases it sends Novell Netware packets.
"Li.1413" hooks also INT 09h and checks keyboard input. When the string "kkyyzz" is entered, the virus removes itself from memory. While executing of LI.EXE file the virus stores keyboard input and sends Novell Netware packet(?).
Lib.4000
Description Lib.4000
It is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are accessed. It contains encrypted text strings:
.EXE -V.EXE AIDSTEST TNTVIRUS SCAN DOCTOR DIAG TLINK
LIB TPU TPL ARJ $00 ZIP ARC LZH ICE
and does not infects the files with the names from the first string (starting from -V.EXE). It also checks the file extensions for names from second string, but do nothing with these files.
|