Virus Database

IntMaster Family

Description IntMaster Family

These are memory resident parasitic viruses. They hook INT 22h, return control to the host program and wait for termination call (INT 22h). Then they trace INT 21h and patches the DOS INT 21h handler with INT 79h call, hook INT 79h and stay memory resident.
The viruses infect OBJ files that are closed. They parse the OBJ records, create new record in OBJ file, write themselves to that record, then patch the main program's code in OBJ file with CALL_VIRUS instruction.
While linking an infected OBJ file the entry code of result executable file begins with CALL_VIRUS code. When such file is executed, the virus immediately receives the control.
"IntMaster.1340" is a harmless virus. It does not manifest itself in any way. It contains the text string:
(C) IntMaster, Kiev-1995all

"IntMaster.1878" is a very dangerous encrypted virus. It also infects the COM files (except C*.*) that are executed, the virus writes itself to the end of the files. When a W*.* file is executed, the virus depending on the system date erases that file, displays the message and halts the system:
This program wastes a lot of memory,
SYSTEM HALTED...

This virus also contains the string:
(C) Ace of Spades , Kiev-1995... Don't be a snub - enjoy yourself!

Check other viruses! Be aware! Use Antiviral Software

ProtoVirus Family

Description ProtoVirus Family

These are not dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of .COM files that are executed. The viruses contain the text string:
** ProtoVirus v1.0 by Chr'92 **

and check it while installing into the system memory. If that string is altered, the viruses halt the computer.

Prowler.1543

Description Prowler.1543

These are relatively harmless, memory resident encrypted multipartite viruses. They infect the MBR of the hard drive and write themselves to the end of COM (except COMMAND.COM) and EXE files that are executed, and the viruses hook INT 21h to do that. The MBR is infected when an infected file is executed. To install the TSR copy while loading from an infected MBR, the viruses also temporarily hook INT 1Ch (timer).
Upon loading from infected MBR on 13th of any month, the viruses manifest themselves as a sound and video effect and display the following message:
I am +he Midnigh+ Pr0wler, s0n 0f +he m00n
And I am the child 0f +he ?? genera+i0nall.

where ?? is virus generation.

Home