Immune.536
Description Immune.536
It is a dangerous memory resident parasitic virus. It hooks INT 15h, 19h, 21h and writes itself to the end of COM files that are executed. The virus has a bug, and halts the system rather than infecting the files. By hooking INT 15h,19h the virus tries to disable switching to the protected mode. The virus contains the text strings:
UNIX
Immune v2.0
Check other viruses! Be aware! Use Antiviral Software
Bucharest
Description Bucharest
It is not a dangerous memory resident boot virus. It hooks INT 12h, 13h and writes itself to the MBR of the hard drive and to boot sector of floppy disks. Depending on the system date and time it decrypts and displays the message:
ENJOY THIS BUG! RP VirusLab Bucharest
Budo.890
Description Budo.890
These are memory resident dangerous overwriting viruses. On execution they type one of the messages:
"Budo.890": Run time error
Bad command or file name
"Budo.1000": Incorrect DOS version
Then "Budo.890" hooks INT 8 (timer) and INT 9 (keyboard). It waits several minutes and then searches for the .COM- and .EXE-file of the current directory and overwrites them.
"Budo.1000" hooks INT 21h and on execution of any file it searches and overwrites .COM- and .EXE-files of current directory.
These viruses contain the internal text strings "*.COM *.EXE" and:
"Budo.890": BUDO V1.2 TH-HV FINLAND
FLOW LIKE A RIVER - STRIKE LIKE A THUNDER
"Budo.1000": BUDO V1.0 April/92.
T-H & HV Finland.
Flow like a river - strike like a thunder.
|