AntiSkola.2111
Description AntiSkola.2111
It is a dangerous memory resident parasitic virus. It hooks INT 9, 21h and writes itself to the end of COM and EXE files that are executed. While infecting the COMMAND.COM file the virus patches its code at fixed offset and writes JMP-Virus instruction to there. That does work only for some COMMAND.COM version(s) and corrupts COMMAND.COM from other DOSes (including Win95).
On keystrokes (INT 9) depending on the system timer the virus changes the data in keyboard buffer. Depending on the system timer the virus stops executing the TURBO.EXE and TPX.EXE files. Also depending on the system time the virus decrypts and displays the message (see below), plays a tune and halts the computer:
Dobry den,predstavuje se Vam virus AntiSkola.Tento virus byl napsan
pro demonstraci idealniho preziti viru ve skolnim prostredi.Doufam,
ze se Vam bude libit.
Moje podekovani patri zejmena :
Firme Borland International Inc. za TurboAssembler a TurboDebugger
Skole za to,ze mi umoznila nerusene programovat
Firme Microsoft za "operacni system" MS-DOS,ktery byl koncipovan
primo pro viry.Na prikladu WINDOWS 95 je jasne videt,ze se stale
teto filozofie nevzavaji.Mozna by si meli neco precist o
protected modu a preemtivnim multitaskingu.
At zije SOSE v Brne na Obranske !!
Check other viruses! Be aware! Use Antiviral Software
Sysman.249
Description Sysman.249
It is a harmless nonmemory resident parasitic virus. It searches for SYS files (DOS device drivers), then writes itself to the end of the file. The virus does not manifests itself in any way. It contains the text strings:
*.SYS
[SYSMAN]
Copyright (C) 1998-99 Deadman
Syst.1695
Description Syst.1695
It is a harmless memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or opened. The virus does not manifest itself in any way.
|