Virus Database

IRC-Worm.Mabra.a

Description IRC-Worm.Mabra.a

This is a silly IRC worm that spreads through IRC channels using mIRC client for spreading. The worm appears on a computer as the DOS EXE file with MABRA.EXE, CDMAN.EXE, or GLADYS.EXE filename (depending on the worm's version), and about 14K in file size. When this file is executed by a user, the worm copies itself into C:WINDOWS, C:WINDOWSSYSTEM or C:WINDOWSSYSTEM32 directory (depending on worm version), and overwrites the mIRC script file SCRIPT.INI in the C:MIRC directory. The new script sends the worm copy to any user that enters an infected channel.
Depending on the system time, the worm erases the C:WINDOWSWIN.COM file.

Check other viruses! Be aware! Use Antiviral Software

Baba.353

Description Baba.353

It's a harmless memory resident parasitic virus. It hooks INT 21h and writes itself at the end of COM-files (except COMMAND.COM) are executed. It contains the internal text string: "=>COMMAND.COM<=". It moves BABAh value in AX register on "Is my TSR here?" call.

Babe.1584

Description Babe.1584

It is not a dangerous memory resident parasitic virus. It hooks INT 16, 21h and writes itself to the end of COM and EXE files that are executed. By hooking INT 16 (keyboard) the virus exchanges the keys that are pressed: Home<->End, Up<->Down, PgUp<->PgDn, Left<->Right, Ins<->Del. The virus gets its name after its "Are you here?" call that is performed when the virus installs itself memory resident: INT 21h, BX/CX=B0B0h/BABEh. The memory resident virus copy returns BABEh/B0B0h in BX/CX registers.

Home